Fix hanging when minimised on OSX

Publish nexusterminal to repo.dixon.cx and Homebrew; install instructions

.github/copilot-instructions.md

@@ -0,0 +1,86 @@
+# Copilot Instructions — Nexus Terminal
+
+Nexus Terminal is a native desktop client (SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub, local shell) written in Rust with an eframe/egui UI. All the code lives in the Cargo workspace under `rust/`.
+
+## Build & Test
+
+```bash
+cd rust
+cargo run --release                                     # the app (binary `nexus-terminal`)
+cargo test --workspace                                  # unit and integration tests
+cargo clippy --workspace --all-targets -- -D warnings   # must be clean
+cargo fmt --all --check                                 # must be clean
+
+# Single test
+cargo test -p nexus-core --lib storage::
+cargo test -p nexus-core --test ssh_integration
+```
+
+CI (`.github/workflows/ci.yml`) runs `cargo test --locked`, `cargo fmt --check` and `cargo clippy --all-targets -D warnings` on Linux, macOS and Windows. The toolchain is pinned in `rust/rust-toolchain.toml`. Platform prerequisites and release packaging are in `docs/build-and-release.md`.
+
+## Architecture
+
+The project is engine-first: a UI-free core crate, and the egui app is one client of it.
+
+```
+rust/
+├── core/   nexus-core: storage, secrets, models, protocol clients, session Manager, Service. No egui.
+│   ├── migrations/       numbered SQL migrations, embedded with include_str!
+│   └── tests/            sessions.rs, ssh_integration.rs, fixtures/
+└── app/    nexus: the egui shell (binary `nexus-terminal`)
+```
+
+**Core (`rust/core/src/`):**
+- `service.rs` — `Service`, the app-facing API: profiles, connect/reconnect, credentials, known hosts, preferences, snippets, import/export, SSH keys, SFTP, updates. File dialogs live in the UI; methods here take paths.
+- `sessions.rs` — `Manager`: concurrent sessions, auto-reconnect with backoff, login scripts, broadcast writes, recording hooks, secret resolution (saved / session-only / ask every time), host-key checks. It reports through one `Event` enum (`Data`, `State`, `Closed`, `RawData`, `Irc`, `Github*`, `Forward*`, `Recording*`, `SftpProgress`, `SecretPrompt`, `HostKeyVerify`, `Vnc*`).
+- `clients/` — one module per protocol (`ssh`, `sftp`, `telnet`, `raw`, `serial`, `local`, `irc`, `github`, `vnc`). Read the conventions at the top of `clients/mod.rs` before touching one: `connect()` blocks its (worker) thread and returns once usable; the client then owns its reader thread(s) and reports through `Callbacks` (data, fatal error, close exactly once); `write`/`resize`/`close` are callable from any thread and `close` is idempotent. russh-based clients use the shared tokio runtime from `clients::rt()`; the rest use plain threads.
+- `storage.rs` (SQLite via rusqlite, WAL), `secrets.rs` (keychain + vault), `config.rs` (data directories and Alchementary Link migration), `models.rs`, `validation.rs`, `exportimport.rs`, `recording.rs` (asciicast v2), `sshconfig.rs`, `updater.rs`, `ircformat.rs`, `terminalenv.rs`, `keyfiles.rs`.
+
+**App (`rust/app/src/`):**
+- `main.rs` parses flags, opens the `Service` and starts eframe. `app.rs` owns `App`: it installs an event sink that forwards `Event`s over a channel and calls `request_repaint`, drains them each frame (`on_event`), handles `Request`s, the keyboard shortcuts (`shortcuts()`), and lays out the frame.
+- `state.rs` — `Shared` (service handle, cached profiles and preferences, tabs, panes, toasts) and the `Request` queue features use to ask the main window to act.
+- `views.rs` — `View::{Terminal, Raw, Irc, Github, Vnc}`, one per pane.
+- `terminal.rs` (`TermView`: alacritty_terminal drawn with egui's painter), `tabs.rs` (tab strip, workspace, find bar, overlays), `splits.rs` (split tree), `sidebar.rs`, `chrome.rs` (title bar, status bar, command palette `Cmd` enum, prompts, dialogs, toasts).
+- Feature windows: `profile_editor.rs`, `quick_connect.rs`, `settings.rs` (including the Help topics), `ssh_keys.rs`, `transfer.rs` (import/export), `sftp.rs`, `forwards.rs`, `snippets.rs`, `triggers.rs`, `recordings.rs`.
+- Protocol views: `raw_view.rs`, `irc_view.rs`, `github_view.rs`, `vnc_view.rs`.
+
+**Flow:** UI → `Service` / `Manager` method (plain Rust call) → protocol client on a worker thread → `Callbacks` → `Manager` emits `Event` → app channel → `App::on_event` on the next frame. Credential and host-key questions are `Event::SecretPrompt` / `Event::HostKeyVerify` carrying an `mpsc::Sender` reply; the connecting thread blocks on the receiver, and dropping the sender (closing the prompt or the session) cancels it.
+
+## Conventions
+
+- **British English** in comments, docs and UI strings (colour, initialise, behaviour, favourite).
+- **Never block the UI thread.** Anything that touches the network, the keychain, `ssh-keygen` or slow disk work runs on a worker thread: `Shared::spawn` (errors become toasts), `settings::Job` (poll a result each frame), or a module's own inbox. Call `ctx.request_repaint()` when the work finishes. Quick SQLite calls through `Service` are fine inline.
+- **Colours come from `Tokens`** (`theme.rs`, `Tokens::get(ctx)`): `text`, `text_dim`, `text_faint`, `accent`, `success`, `warning`, `danger`, `field`, `card`, `dock`, … Don't hard-code colours; all three app themes (Pro, Midnight, Light) must work. Protocol colours and badges come from `views::protocol_color` / `protocol_badge`; terminal palettes from `terminal_themes.rs`.
+- **Icons are Phosphor** (`egui_phosphor::regular as icon`), usually as `format!("{}  Label", icon::X)`. Reuse the helpers in `widgets.rs` (`primary`, `button`, `icon_button`, `hint`, `empty`, `chip`, `section`, `kv`) and `chrome::modal` for modal dialogs.
+- **Shortcut labels** go through `state::keys("Mod+Shift+K")`, which renders ⌘ on macOS and Ctrl elsewhere. A new shortcut needs an entry in `App::shortcuts()`, the command palette (`chrome::commands`), the menu, the Help "Keyboard Shortcuts" topic and the README table.
+- **Formatting:** `rustfmt.toml` sets `max_width = 160` with `use_small_heuristics = "Max"`, so long single-line expressions are normal. Run `cargo fmt --all` rather than wrapping by hand.
+- Errors are `nexus_core::Result<T>` (`Box<dyn Error + Send + Sync>`); use `?` and `format!` messages that read well in a toast.
+- Protocol configs are `Option<…Config>` fields on `Profile` (`ssh`, `telnet`, `raw`, `github`, `vnc`, `irc`, `serial`), stored as JSON columns; `Profile::new(protocol)` fills the defaults, and the structs use `#[serde(default)]` so older rows still load.
+- A `ponytail:` comment marks a deliberate simplification and names its limit; keep them accurate when you change that code.
+
+**Adding a protocol** touches: `models.rs` (`Protocol`, config struct, defaults, labels), `validation.rs`, a new migration (CHECK constraint and config column) plus the column lists in `storage.rs`, a client in `clients/`, the `Manager` connect/close/write paths in `sessions.rs`, the profile editor section, Quick Connect if relevant, a view (or `TermView` for terminal protocols), `views::protocol_badge`/`protocol_color`, the palette, and a Help topic.
+
+## Data compatibility (hard rules)
+
+Existing users upgrade in place, and their data came from the Go app first. Nexus Terminal must keep reading it.
+
+- **Never change the database, vault, export or recording formats incompatibly.** The vault (`vault/vault.json`: Argon2id t=3, m=128 MiB, 4 lanes; AES-256-GCM per secret), the export envelope (`[version][32-byte salt][12-byte nonce][ciphertext]`, `.nexus`; `.link` must still import) and asciicast v2 recordings are fixed.
+- **Fixtures** generated by the old Go app live in `rust/core/tests/fixtures/` (`link.db`, `vault/`, `profiles.link`, `recordings/`). Tests in `storage.rs`, `secrets.rs`, `exportimport.rs` and `recording.rs` read them. Don't regenerate or edit them to make a test pass.
+- **Schema changes are new SQL files** in `rust/core/migrations/` (`008_….sql`, …), added to `MIGRATIONS` in `storage.rs`. Each ends with `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'));`. Never edit an applied migration. SQLite has no `ALTER COLUMN`; use the recreate-table pattern.
+- **Keychain** entries are stored under the service `NexusTerminal`; reads fall back to `AlchementaryLink` and copy forward. Don't change key names (`profile:<id>:<kind>`).
+- **Data directory** names (`NexusTerminal`, `nexus.db`, `vault/`, `recordings/`) and the first-run migration from `AlchementaryLink/` in `config.rs` are user-facing; keep them stable.
+
+## Testing tips
+
+- **Never point a test or manual run at your real data.** Use `--data-dir DIR` (a temporary directory) for manual runs; tests create their own directory under `std::env::temp_dir()`, as the existing ones do.
+- **App flags** (`rust/app/src/main.rs`):
+  - `--data-dir DIR` — use another data directory.
+  - `--screenshot out.png` — render, save a PNG and exit (works under `xvfb-run`); combine with `--size WxH` and `--theme pro|midnight|light`.
+  - `--open WINDOW` — open a window at startup: `editor[:protocol|id]`, `quick`, `settings[:terminal|security|knownhosts|help|about]`, `keys`, `snippets`, `triggers`, `recordings`, `palette`, `export`, `import`.
+  - `--connect NAME` — connect a saved profile by display name or id.
+  - `--run-local CMD` — open a local terminal and type `CMD` into it once connected.
+
+  For example: `cargo run -- --data-dir /tmp/nx --open settings:help --screenshot /tmp/help.png`.
+- **SSH integration tests** (`core/tests/ssh_integration.rs`) start a throwaway `sshd` as the current user on a random port and skip themselves when OpenSSH isn't installed. They **must never open an interactive login shell** — the user's shell profile can auto-attach tmux/byobu to a real session. Set the profile's startup command to `/bin/sh -i`, as the existing `profile()` helper does.
+- `core/tests/sessions.rs` drives the `Manager` end to end against local TCP listeners; follow its `manager()` and `wait()` helpers for event-driven tests.
+- UI logic that can be tested without a window (parsers, fuzzy matching, split trees, snippet variables, trigger matching) has `#[cfg(test)]` unit tests next to it; add one with any non-trivial change.

.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: CI
+
+on:
+    push:
+        branches: ["**"]
+    pull_request:
+
+permissions:
+    contents: read
+
+jobs:
+    test:
+        name: Test (${{ matrix.os }})
+        runs-on: ${{ matrix.os }}
+        strategy:
+            fail-fast: false
+            matrix:
+                os: [ubuntu-22.04, macos-14, windows-latest]
+        defaults:
+            run:
+                shell: bash
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
+            - name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
+              if: runner.os == 'Linux'
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev openssh-server
+            - run: cargo test --locked --workspace
+            - run: cargo fmt --all --check
+            - run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+    audit:
+        name: Dependency audit
+        runs-on: ubuntu-22.04
+        defaults:
+            run:
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
+            - run: cargo install cargo-audit --version 0.22.2 --locked
+            # Ignored advisories and their reasons live in rust/.cargo/audit.toml. Yanked crates
+            # fail the build; the fuzz workspace has its own lockfile, so it's audited too.
+            - run: cargo audit --deny yanked
+            - run: cargo audit --deny yanked --file fuzz/Cargo.lock

.github/workflows/fuzz.yml

@@ -0,0 +1,35 @@
+name: Fuzz
+
+on:
+    schedule:
+        - cron: "17 3 * * *"
+    workflow_dispatch:
+
+permissions:
+    contents: read
+
+jobs:
+    fuzz:
+        name: Fuzz (${{ matrix.target }})
+        runs-on: ubuntu-22.04
+        strategy:
+            fail-fast: false
+            matrix:
+                target: [telnet, irc, vnc, sshconfig, updater]
+        defaults:
+            run:
+                working-directory: rust/fuzz
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
+            - run: sudo apt-get update && sudo apt-get install -y libasound2-dev
+            - run: rustup toolchain install nightly --profile minimal
+            - run: cargo +nightly install cargo-fuzz --locked
+            - run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=120 -rss_limit_mb=2048 -timeout=10
+            - name: Upload crashing inputs
+              if: failure()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: fuzz-${{ matrix.target }}
+                  path: rust/fuzz/artifacts

.github/workflows/release-builds.yml

@@ -0,0 +1,87 @@
+name: Release Builds
+
+on:
+    push:
+        tags:
+            - "v*"
+    workflow_dispatch:
+
+# Building and testing runs every dependency's build scripts and tests, so those jobs only get a
+# read token. Publishing is a separate job that never runs project or dependency code.
+permissions:
+    contents: read
+
+jobs:
+    build:
+        name: Build ${{ matrix.platform }}
+        runs-on: ${{ matrix.runner }}
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - { platform: darwin/amd64, runner: macos-15-intel }
+                    - { platform: darwin/arm64, runner: macos-14 }
+                    - { platform: linux/amd64, runner: ubuntu-22.04 }
+                    - { platform: linux/arm64, runner: ubuntu-22.04-arm }
+                    - { platform: windows/amd64, runner: windows-latest }
+                    - { platform: windows/arm64, runner: windows-11-arm }
+        defaults:
+            run:
+                shell: bash
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Rust toolchain (pinned by rust-toolchain.toml)
+              run: rustup show active-toolchain || rustup toolchain install
+
+            - name: Linux build dependencies
+              if: runner.os == 'Linux'
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip
+
+            - name: Test
+              run: cargo test --locked --workspace
+
+            - name: Build and package
+              env:
+                  NEXUS_RELEASE_TARGETS: ${{ matrix.platform }}
+                  NEXUS_RELEASE_ROOT: ${{ github.workspace }}/build/releases
+              run: ./release.sh
+
+            - name: Upload artefacts
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: nexus-terminal-${{ matrix.runner }}
+                  path: |
+                      build/releases/*/NexusTerminal-*.zip
+                      build/releases/manifest-*.json
+                      build/releases/version-*.txt
+
+    publish:
+        name: Attach to GitHub Release
+        needs: build
+        if: startsWith(github.ref, 'refs/tags/')
+        runs-on: ubuntu-22.04
+        permissions:
+            contents: write
+        steps:
+            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+              with:
+                  path: artefacts
+            - name: Checksums
+              run: |
+                  find artefacts -name 'NexusTerminal-*.zip' | while read -r f; do
+                      (cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
+                  done > SHA256SUMS
+                  cat SHA256SUMS
+            - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+              with:
+                  files: |
+                      artefacts/*/*/NexusTerminal-*.zip
+                      artefacts/*/NexusTerminal-*.zip
+                      SHA256SUMS

.gitignore

@@ -3,31 +3,8 @@
 # ==========================================================================
 
 # ── Build output ──────────────────────────────────────────────────────────
-build/bin/
-build/darwin/
-build/windows/
-build/linux/
-dist/
-
-# ── Go ────────────────────────────────────────────────────────────────────
-vendor/
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-*.test
-*.out
-__debug_bin*
-coverage.out
-coverage.html
-
-# ── Frontend ──────────────────────────────────────────────────────────────
-frontend/node_modules/
-frontend/src/js/lib/
-
-# ── Wails auto-generated bindings (recreated on every build) ──────────────
-frontend/wailsjs/
+rust/target/
+build/releases/
 
 # ── IDE / editor ──────────────────────────────────────────────────────────
 .idea/
@@ -35,20 +12,12 @@ frontend/wailsjs/
 *.swp
 *.swo
 *~
-*.sublime-project
-*.sublime-workspace
-.project
-.classpath
-.settings/
 
 # ── OS metadata ───────────────────────────────────────────────────────────
 .DS_Store
-.DS_Store?
 ._*
 Thumbs.db
-ehthumbs.db
 Desktop.ini
-$RECYCLE.BIN/
 
 # ── Application data (never commit user data or secrets) ──────────────────
 *.db
@@ -57,4 +26,12 @@ $RECYCLE.BIN/
 vault.json
 *.pem
 *.key
-!build/appicon.png
+
+# Compatibility fixtures generated from the last Go build are deliberate test data.
+!rust/core/tests/fixtures/**
+
+# Agent worktrees
+.claude/worktrees/
+
+# User guide LaTeX output
+docs/guide/build/

20260602-1221-securityAudit.md

@@ -0,0 +1,787 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This audit reviewed Nexus Terminal, a Wails desktop SSH/Telnet/RAW/VNC/SFTP client with a Go backend and JavaScript frontend. Fix mode was requested, so confirmed issues were patched, regression-tested, and prepared for commit.
+
+The highest-risk issues were SSH trust failures: regular SSH sessions were not wired to the existing known-host verification flow, jump-host SSH connections ignored host keys, and VNC SSH tunnels also ignored host keys. These could allow machine-in-the-middle attacks against SSH credentials and terminal/VNC traffic. This run wired all SSH paths to known-host verification and prompt handling.
+
+Other fixed issues include a local noVNC WebSocket proxy access-control weakness, SSH key-name path traversal in public-key reads, unsafe update-result DOM rendering, inline secret leakage in non-secret profile exports, and current vulnerable dependency versions in `golang.org/x/crypto` and `esbuild`.
+
+Residual risk remains in user-selected insecure modes such as direct unencrypted VNC, user-configured `HostKeyInsecure`, and large local file transfer workflows that still process complete files in memory.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go backend packages under `internal/`: API bindings, sessions, SSH, VNC, SFTP, storage, secrets, updater, raw/telnet clients, recording, validation, known hosts, config, app startup.
+- Frontend JavaScript under `frontend/src/js`: settings/update UI, host-key event handling, terminal and SFTP/VNC/GitHub surfaces, common DOM helpers.
+- Dependency manifests and lockfiles: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
+- Build and release scripts: `Makefile`, `build.sh`, `release.sh`, Wails config.
+- Tests under `internal/**/*_test.go`.
+
+Not in scope:
+
+- Live network penetration testing of remote hosts.
+- Reverse engineering packaged binaries.
+- Manual verification of Wails runtime origin values in a built app.
+
+## 3. Methodology
+
+- Static source review of trust boundaries, file operations, SSH/VNC flows, Wails API bindings, frontend DOM sinks, update checks, storage, crypto, and secret handling.
+- Dependency review with `govulncheck` and `npm audit`.
+- Configuration review of Wails, build scripts, update manifests, and release paths.
+- Threat modelling of desktop renderer compromise, local web-origin attacks, remote SSH/VNC attackers, and malicious update metadata.
+- Denial-of-service review of network timeouts, WebSocket proxy behavior, transfer paths, and file ingestion.
+- Regression tests added for fixed Go issues.
+
+## 4. Risk Rating Method
+
+Severity considered exploitability, attacker position, affected security property, and impact:
+
+- Critical: practical remote compromise or credential disclosure without meaningful preconditions.
+- High: credential/session compromise or machine-in-the-middle exposure on primary connection paths.
+- Medium: meaningful local, renderer, or network-assisted exploit with constraints.
+- Low: hardening issue, local DoS, or user-assisted exposure.
+- Informational: checked area or non-security note.
+
+Confidence reflects direct code evidence and verification coverage.
+
+## 5. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---:|---:|---|---|---|
+| SEC-001 | High | High | SSH sessions and jump hosts bypassed known-host verification | SSH sessions | Fixed |
+| SEC-002 | High | High | VNC SSH tunnels accepted any SSH host key | VNC over SSH | Fixed |
+| SEC-003 | Medium | High | Local noVNC WebSocket proxy used a guessable root endpoint | VNC WebSocket proxy | Fixed |
+| SEC-004 | Medium | High | SSH public-key read accepted traversal key names | SSH key API | Fixed |
+| SEC-005 | Medium | High | Update metadata rendered through dynamic HTML and inline handler | Settings/update UI | Fixed |
+| SEC-006 | Medium | High | Non-secret profile export leaked inline SSH secrets | Profile export | Fixed |
+| SEC-007 | High | High | `golang.org/x/crypto` vulnerable in reachable SSH code | Go dependencies | Fixed |
+| SEC-008 | Medium | High | `esbuild` dev dependency matched current npm advisory | Frontend dependency | Fixed |
+| SEC-009 | Low | Medium | Large local file upload paths remain memory-heavy | File transfer UX | Open |
+| SEC-010 | Low | Medium | Direct VNC remains unencrypted by protocol choice | VNC direct mode | Open |
+
+## 6. Detailed Findings
+
+### Finding ID: SEC-001
+
+#### Title
+
+SSH sessions and jump hosts bypassed known-host verification
+
+#### Severity
+
+High
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sessions/manager.go`, SSH connection setup, now fixed at lines 657 and 1450-1502.
+- `internal/sshclient/sshclient.go`, jump-host config, now fixed at lines 599 and 646-652.
+- `frontend/src/js/app.js`, host-key response correlation, now fixed at lines 334-342.
+
+#### Description
+
+The project already contained known-host storage, a host-key verifier, and frontend prompt UI, but the main SSH session manager previously called the SSH client's default `Connect` path. That default path used `ssh.InsecureIgnoreHostKey()`. Jump hosts also built their own `ssh.ClientConfig` with `ssh.InsecureIgnoreHostKey()`.
+
+#### Evidence
+
+The fix now calls `ConnectWithHostKeyCallback(...)` for regular SSH sessions and propagates the final host-key callback into jump-host configs. A request ID is included in host-key prompt responses to prevent cross-session prompt confusion.
+
+#### Attack Scenario
+
+An attacker on the network path presents a fake SSH server or jump host. Without host-key verification, Nexus Terminal would accept the attacker's key, allowing credential capture, terminal tampering, or traffic interception.
+
+#### Impact
+
+Possible SSH credential theft, terminal command tampering, and loss of server authenticity.
+
+#### Recommendation
+
+Always use the known-host verifier for every SSH hop. Unknown host keys should follow the configured profile policy: strict, ask, accept-new, or explicit insecure.
+
+#### Safer Example
+
+Implemented: `Manager.hostKeyCallback` builds `sshclient.NewHostKeyVerifier(...)`, emits a prompt when needed, and `connectSSH` calls `ConnectWithHostKeyCallback(...)`.
+
+#### Suggested Tests
+
+Added regression coverage:
+
+- `TestHostKeyCallbackAcceptNewStoresHost`
+- `TestHostKeyCallbackStrictRejectsUnknownHost`
+- `TestJumpHostClientConfigUsesFinalHostKeyCallback`
+
+#### References
+
+- CWE-295: Improper Certificate Validation, analogous host-key trust failure.
+- OWASP ASVS 9.1.2: server certificate validation principles.
+
+#### Assumptions / Limitations
+
+Profiles may still explicitly choose `HostKeyInsecure`; that is a user-selected insecure mode and remains visible as residual risk.
+
+### Finding ID: SEC-002
+
+#### Title
+
+VNC SSH tunnels accepted any SSH host key
+
+#### Severity
+
+High
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/vncclient/vncclient.go`, VNC SSH config, now fixed at lines 49 and 89-95.
+- `internal/sessions/manager.go`, VNC SSH callback wiring, now fixed at line 1016.
+
+#### Description
+
+VNC SSH tunnels established SSH connections with `ssh.InsecureIgnoreHostKey()`, allowing a network attacker to impersonate the SSH tunnel endpoint.
+
+#### Evidence
+
+The VNC client now requires `SSHHostKeyCallback` for tunneled SSH. The session manager supplies the same known-host/prompt path used by SSH sessions.
+
+#### Attack Scenario
+
+An attacker controlling DNS, Wi-Fi, or a gateway presents a fake SSH tunnel host for VNC traffic. The prior client accepted the key and tunneled VNC traffic through the attacker.
+
+#### Impact
+
+Possible VNC credential exposure, remote desktop traffic interception, and remote interaction tampering.
+
+#### Recommendation
+
+Require known-host verification for VNC SSH tunnels and reject tunnel setup if no callback is configured.
+
+#### Safer Example
+
+Implemented: `vncclient.Connect` returns an error if `cfg.SSHHostKeyCallback` is nil, and uses the provided callback in `ssh.ClientConfig`.
+
+#### Suggested Tests
+
+Covered indirectly by session host-key callback tests and VNC package tests.
+
+#### References
+
+- CWE-295.
+- OWASP ASVS 9.1.2.
+
+#### Assumptions / Limitations
+
+VNC tunnel host-key policy defaults to ask mode because VNC profiles do not currently expose a separate host-key policy field.
+
+### Finding ID: SEC-003
+
+#### Title
+
+Local noVNC WebSocket proxy used a guessable root endpoint
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/vncclient/vncclient.go`, WebSocket proxy setup, now fixed at lines 171-183 and 255-260.
+
+#### Description
+
+The local VNC WebSocket proxy listened on `127.0.0.1` with a random port, but accepted upgrades on `/` and allowed any Origin. A malicious local web page could scan localhost ports and attempt to connect to an active proxy.
+
+#### Evidence
+
+The proxy now generates a 128-bit random token and exposes only `ws://127.0.0.1:<port>/<token>` to the Wails frontend.
+
+#### Attack Scenario
+
+A user visits a malicious web page while a VNC session is active. The page scans localhost WebSocket ports and connects to the proxy endpoint, potentially reading or injecting VNC traffic.
+
+#### Impact
+
+Possible local cross-origin access to VNC session traffic if the port is discovered.
+
+#### Recommendation
+
+Require an unguessable per-session URL token and continue binding only to loopback.
+
+#### Safer Example
+
+Implemented: `newProxyToken()` uses `crypto/rand` and the proxy route is registered only at the token path.
+
+#### Suggested Tests
+
+Added `TestNewProxyTokenIsRandomHex`.
+
+#### References
+
+- CWE-346: Origin Validation Error.
+- OWASP ASVS 14.4.3: cross-origin resource restrictions.
+
+#### Assumptions / Limitations
+
+`CheckOrigin` still returns true because Wails/noVNC origin behavior needs built-app verification. The unguessable path materially reduces exposure.
+
+### Finding ID: SEC-004
+
+#### Title
+
+SSH public-key read accepted traversal key names
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`, SSH key API, now fixed at lines 1653-1708.
+
+#### Description
+
+`GetSSHPublicKey(name)` previously built `~/.ssh/<name>.pub` directly from a renderer-provided name. Unlike key generation, it did not restrict names to simple key basenames. Names such as `../somefile` could read `~/.ssh/../somefile.pub`.
+
+#### Evidence
+
+The fix centralizes key name validation through `sshKeyPairPaths(...)`, allowing only alphanumeric characters, hyphens, and underscores.
+
+#### Attack Scenario
+
+If renderer-side JavaScript is compromised or a malicious plugin/flow can invoke the Wails API, it can request public-key contents outside the intended `.ssh` key namespace if the target path ends in `.pub`.
+
+#### Impact
+
+Local file disclosure for matching `.pub` paths under paths reachable through traversal.
+
+#### Recommendation
+
+Treat key names as basenames, not paths. Apply the same validation to generate, read, and delete operations.
+
+#### Safer Example
+
+Implemented: `GetSSHPublicKey`, `GenerateSSHKey`, and `DeleteSSHKey` now all use `sshKeyPairPaths`.
+
+#### Suggested Tests
+
+Added:
+
+- `TestSSHKeyPairPathsAcceptsSafeName`
+- `TestSSHKeyPairPathsRejectsTraversal`
+- `TestSSHKeyPairPathsRejectsNestedPath`
+
+#### References
+
+- CWE-22: Path Traversal.
+
+#### Assumptions / Limitations
+
+The API still intentionally lists and reads legitimate SSH public keys in `~/.ssh`.
+
+### Finding ID: SEC-005
+
+#### Title
+
+Update metadata rendered through dynamic HTML and inline handler
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `frontend/src/js/settings.js`, update-check UI, now fixed at lines 940-958.
+
+#### Description
+
+Update metadata from GitHub or a configured update manifest was inserted into `innerHTML`, including an inline `onclick` that interpolated `info.releaseURL`. A malicious or compromised update metadata source could inject script into the Wails renderer.
+
+#### Evidence
+
+The fix constructs DOM nodes, sets text via `textContent`, and attaches a click listener with `addEventListener`.
+
+#### Attack Scenario
+
+An attacker controlling a self-hosted update manifest returns a release URL containing a quote and JavaScript payload. The prior inline handler interpolation could execute renderer JavaScript.
+
+#### Impact
+
+Renderer code execution. In a Wails app, renderer execution can call exposed backend APIs, increasing impact.
+
+#### Recommendation
+
+Never render remote metadata through string-built HTML. Use `textContent` and event listeners.
+
+#### Safer Example
+
+Implemented in `settings.js` with `createElement`, `document.createTextNode`, and `addEventListener`.
+
+#### Suggested Tests
+
+No frontend unit harness exists. Verified with `npm run build`.
+
+#### References
+
+- CWE-79: Cross-Site Scripting.
+- OWASP ASVS 5.3: output encoding.
+
+#### Assumptions / Limitations
+
+Other static modal templates still use `innerHTML`; reviewed high-risk dynamic remote metadata paths first.
+
+### Finding ID: SEC-006
+
+#### Title
+
+Non-secret profile export leaked inline SSH secrets
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`, Wails export wrapper, now fixed at lines 683-684.
+- `internal/storage/store.go`, storage export, now fixed at lines 356-358 and 726-738.
+
+#### Description
+
+The plain profile export path accepted `includeSecrets=false` but profiles can still contain inline `ssh.proxyPassword` and `ssh.totpSecret` fields. Those fields could be serialized despite a non-secret export request.
+
+#### Evidence
+
+The fix redacts `ProxyPassword` and `TOTPSecret` for non-secret exports in both API and storage layers.
+
+#### Attack Scenario
+
+A user creates a plain profile export believing secrets are excluded. The exported JSON contains proxy credentials or TOTP secrets that are then shared, backed up, or stored insecurely.
+
+#### Impact
+
+Credential leakage and potential 2FA bypass for affected profiles.
+
+#### Recommendation
+
+Redact inline secret fields whenever `includeSecrets=false`. Prefer encrypted export for any export that intentionally includes secrets.
+
+#### Safer Example
+
+Implemented `redactProfileSecrets(...)` in storage and API packages.
+
+#### Suggested Tests
+
+Added:
+
+- `TestExportProfilesRedactsInlineSSHSecrets`
+- `TestRedactProfileSecretsClearsInlineSSHSecrets`
+
+#### References
+
+- CWE-200: Exposure of Sensitive Information.
+- OWASP ASVS 8.3: sensitive data protection.
+
+#### Assumptions / Limitations
+
+The encrypted export path intentionally includes selected profile data and is password-protected.
+
+### Finding ID: SEC-007
+
+#### Title
+
+`golang.org/x/crypto` vulnerable in reachable SSH code
+
+#### Severity
+
+High
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `go.mod`, `golang.org/x/crypto`, now fixed at line 14.
+- `go.mod`, indirect `golang.org/x/sys`, now updated at line 45.
+- Reachable SSH code in `internal/sshclient`, `internal/vncclient`, `internal/sftpclient`.
+
+#### Description
+
+`govulncheck` reported seven reachable vulnerabilities in `golang.org/x/crypto@v0.51.0`, including SSH DoS/panic issues, FIDO/U2F security-key interaction bypass risk, and SSH agent forwarding constraint handling issues.
+
+#### Evidence
+
+`govulncheck` identified GO-2026-5033, GO-2026-5020, GO-2026-5019, GO-2026-5018, GO-2026-5017, GO-2026-5013, and GO-2026-5006 as reachable before the update. The dependency is now `v0.52.0`, and rerun output reports: "No vulnerabilities found. Your code is affected by 0 vulnerabilities."
+
+#### Attack Scenario
+
+A malicious or compromised SSH server, SSH agent, key material, or protocol peer triggers vulnerable SSH library behavior during connection, channel use, key parsing, or agent forwarding.
+
+#### Impact
+
+Possible client panic, denial of service, weakened security-key interaction, or agent forwarding constraint mishandling depending on the CVE path.
+
+#### Recommendation
+
+Keep `golang.org/x/crypto` at or above `v0.52.0` and run `govulncheck` in CI.
+
+#### Safer Example
+
+Implemented: `go get golang.org/x/crypto@v0.52.0`.
+
+#### Suggested Tests
+
+Ran `govulncheck` and `go test ./...`.
+
+#### References
+
+- https://pkg.go.dev/vuln/GO-2026-5033
+- https://pkg.go.dev/vuln/GO-2026-5020
+- https://pkg.go.dev/vuln/GO-2026-5019
+- https://pkg.go.dev/vuln/GO-2026-5018
+- https://pkg.go.dev/vuln/GO-2026-5017
+- https://pkg.go.dev/vuln/GO-2026-5013
+- https://pkg.go.dev/vuln/GO-2026-5006
+
+#### Assumptions / Limitations
+
+`govulncheck` also noted vulnerabilities in required modules that are not called by this code.
+
+### Finding ID: SEC-008
+
+#### Title
+
+`esbuild` dev dependency matched current npm advisory
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `frontend/package.json`, `esbuild`, now fixed at line 22.
+- `frontend/package-lock.json`.
+
+#### Description
+
+`npm audit` reported GHSA-67mh-4wv8-2f99 for `esbuild <=0.24.2`: any website could send requests to the dev server and read responses under affected versions.
+
+#### Evidence
+
+The frontend previously resolved `esbuild@0.24.2`. It now uses `^0.28.0`, and `npm audit --json` reports zero vulnerabilities.
+
+#### Attack Scenario
+
+During local development, a malicious website could interact with the esbuild dev server and read responses if a developer runs an affected dev server.
+
+#### Impact
+
+Possible local development data exposure.
+
+#### Recommendation
+
+Use a fixed esbuild release and keep npm audit in CI.
+
+#### Safer Example
+
+Implemented: `npm install esbuild@0.28.0`.
+
+#### Suggested Tests
+
+Ran `npm audit --json` and `npm run build`.
+
+#### References
+
+- https://github.com/advisories/GHSA-67mh-4wv8-2f99
+
+#### Assumptions / Limitations
+
+This is a devDependency, so production exploitability is lower than runtime dependencies.
+
+### Finding ID: SEC-009
+
+#### Title
+
+Large local file upload paths remain memory-heavy
+
+#### Severity
+
+Low
+
+#### Confidence
+
+Medium
+
+#### Affected Files / Components
+
+- `frontend/src/js/terminal.js`, dropped-file paste/upload flows.
+- `internal/api/api.go`, `SFTPUploadData`.
+
+#### Description
+
+Some upload paths read whole files into memory and send base64 payloads to Go before uploading. This can be expensive for very large local files.
+
+#### Evidence
+
+`SFTPUploadData` decodes the entire base64 payload before calling session upload. The frontend drag/drop paste path also reads file contents into strings.
+
+#### Attack Scenario
+
+A local user or compromised renderer submits very large files, causing high memory use and potential application unresponsiveness.
+
+#### Impact
+
+Local denial of service.
+
+#### Recommendation
+
+Add size limits for paste-as-text, prefer path-based streaming upload for large files, and surface user-facing warnings for files above a threshold.
+
+#### Safer Example
+
+Use file path streaming upload where possible and reject in-memory uploads above a configured maximum.
+
+#### Suggested Tests
+
+Add boundary tests for maximum accepted in-memory upload size and UI tests for large-file warnings.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption.
+
+#### Assumptions / Limitations
+
+This is primarily local/user-assisted. It was left open to avoid changing UX and transfer semantics during the security fix pass.
+
+### Finding ID: SEC-010
+
+#### Title
+
+Direct VNC remains unencrypted by protocol choice
+
+#### Severity
+
+Low
+
+#### Confidence
+
+Medium
+
+#### Affected Files / Components
+
+- `internal/vncclient/vncclient.go`, direct TCP VNC mode.
+- VNC profile settings.
+
+#### Description
+
+Direct VNC connections use raw TCP to the VNC server. VNC is commonly unencrypted unless tunneled or separately protected.
+
+#### Evidence
+
+The direct branch calls `net.DialTimeout` to the VNC endpoint. SSH tunnel mode is available and now host-key verified.
+
+#### Attack Scenario
+
+On an untrusted network, direct VNC traffic may expose screen contents or credentials depending on server configuration.
+
+#### Impact
+
+Sensitive remote desktop data exposure.
+
+#### Recommendation
+
+Warn users before direct VNC connections and prefer SSH tunnel mode by default.
+
+#### Safer Example
+
+Default new VNC profiles to SSH tunnel where feasible, or show an explicit "unencrypted direct VNC" warning.
+
+#### Suggested Tests
+
+Add UI tests that direct VNC profiles show a warning before connection.
+
+#### References
+
+- OWASP ASVS 9.1: communications security.
+
+#### Assumptions / Limitations
+
+Some VNC servers may provide their own encryption; this audit did not test remote server configurations.
+
+## 7. Denial-of-Service Review
+
+Fixed:
+
+- Updated `golang.org/x/crypto` to resolve reachable SSH panic/deadlock/DoS vulnerabilities.
+- Added random-token access control to the local VNC WebSocket proxy, reducing local cross-origin abuse.
+
+Reviewed and not changed:
+
+- HTTP clients for GitHub and update checks use finite timeouts.
+- SSH/Telnet/RAW connection setup uses timeouts.
+- VNC WebSocket bridge is intentionally long-lived and uses no read/write timeout.
+- Large in-memory file upload/paste paths remain a local DoS risk; see SEC-009.
+
+## 8. Dependency and Supply-Chain Review
+
+Checks run:
+
+- `govulncheck`: fixed reachable `golang.org/x/crypto` vulnerabilities by updating to `v0.52.0`; rerun found zero reachable vulnerabilities.
+- `npm audit --json`: fixed `esbuild` advisory by updating to `0.28.0`; rerun found zero vulnerabilities.
+- `npm run build`: passed after dependency update.
+
+Notes:
+
+- `xterm` packages are deprecated upstream in favor of `@xterm/*`, but no current audit advisory was reported in this run.
+- `go.mod` still has transitive modules with vulnerabilities that `govulncheck` reports as not called by this code.
+
+## 9. Secrets and Sensitive Data Review
+
+Fixed:
+
+- Non-secret profile export now redacts inline `ProxyPassword` and `TOTPSecret`.
+- SSH host-key verification now protects credential submission from basic MITM paths.
+
+Reviewed:
+
+- Vault uses Argon2id and AES-256-GCM with random salts/nonces.
+- Vault file is written with `0600` permissions and store directories with `0700`.
+- OS keychain is preferred where available.
+
+Residual:
+
+- Secret values still exist in process memory while sessions need them.
+- Proxy password is still present in profile model state when entered inline.
+
+## 10. Authentication and Authorisation Review
+
+Fixed:
+
+- SSH, jump host, and VNC-over-SSH authentication now has host authenticity checks before credential use.
+- SSH host-key prompt responses are request-correlated.
+
+Reviewed:
+
+- SSH/TOTP flows use profile-specific secret callbacks.
+- Agent forwarding is explicit profile configuration.
+- Known-host policies include strict, ask, accept-new, and insecure.
+
+Residual:
+
+- `HostKeyInsecure` remains available for user-selected insecure connections.
+
+## 11. Input Validation and Output Encoding Review
+
+Fixed:
+
+- SSH key names now reject traversal and nested path separators.
+- Update metadata is rendered with DOM APIs instead of string-built HTML.
+- Non-secret export redacts inline secret fields.
+
+Reviewed:
+
+- SQL operations use parameterized queries.
+- Profile validation checks host, port, username, protocol-specific fields, and port-forwarding basics.
+- Frontend frequently uses `textContent` or `escapeHtml`; remaining `innerHTML` static templates should still be reviewed during future frontend hardening.
+
+## 12. Infrastructure and Deployment Review
+
+Reviewed:
+
+- Wails app binds Go services directly to the renderer. This makes frontend XSS more impactful than in a browser-only app.
+- Build scripts use `set -euo pipefail`.
+- Update checking is opt-in and does not auto-install binaries.
+
+Residual:
+
+- No CI configuration was present in the reviewed file list, so dependency scanning is not currently enforced by repository automation.
+
+## 13. Logging, Monitoring, and Error Handling Review
+
+Reviewed:
+
+- Audit logger records profile create/update/delete, connection events, secret access, import/export.
+- Errors are generally returned to the frontend with enough context for troubleshooting.
+
+Residual:
+
+- Some error messages include file paths, which is acceptable for a local desktop tool but should be considered if telemetry is later added.
+
+## 14. Test Coverage and Security Regression Gaps
+
+Added tests:
+
+- API SSH key path validation and export redaction.
+- Session host-key callback storage and strict rejection behavior.
+- Jump-host host-key callback propagation.
+- Storage export redaction.
+- VNC proxy token generation.
+
+Remaining gaps:
+
+- No frontend unit test harness for DOM injection regressions.
+- No integration test for full Wails host-key prompt round trip.
+- No VNC WebSocket integration test verifying token-only connection behavior.
+- No large-file upload boundary tests.
+
+## 15. Prioritised Remediation Plan
+
+Immediate:
+
+- Keep the fixes in this audit and ensure they are merged.
+- Add dependency scanning to CI: `govulncheck ./...` and `npm audit --audit-level=moderate`.
+
+Short-term:
+
+- Add a frontend test harness for update UI and other dynamic DOM surfaces.
+- Add direct VNC warning UX and default to SSH tunnel where possible.
+- Add explicit in-memory upload size limits.
+
+Medium-term:
+
+- Expose host-key policy for VNC SSH tunnels instead of always using ask mode.
+- Review all Wails-exposed methods under a compromised-renderer threat model.
+- Migrate deprecated `xterm` packages to maintained `@xterm/*` packages.
+
+Long-term:
+
+- Consider capability gating or confirmation for high-risk renderer-callable APIs such as file deletion, SSH key deletion, local shell selection, and profile import/export.
+- Add signed update metadata if self-hosted update manifests become a production channel.
+
+## 16. False Positives / Needs Manual Verification
+
+- Wails/noVNC Origin behavior in a packaged app should be manually verified. Tokenized VNC WebSocket paths are in place, but Origin policy may still be tightened later.
+- Direct VNC encryption depends on remote VNC server configuration and network placement.
+- `HostKeyInsecure` is intentionally user-configurable; confirm UI wording makes the risk clear.
+- Large-file memory usage thresholds need product decisions before enforcement.
+
+## 17. Final Notes
+
+Fix mode completed with code changes, tests, and dependency updates. The strongest residual concern is the general Wails threat model: a frontend XSS can call powerful local backend APIs. This audit fixed the confirmed dynamic update UI injection path and several backend trust-boundary issues, but future work should continue reducing string-built HTML and adding capability checks around sensitive local operations.

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

Makefile

@@ -1,62 +0,0 @@
-.PHONY: all build dev clean test test-cover lint install deps frontend-deps run package help
-
-# Resolve the Wails binary. Prefer wails on PATH; fall back to GOPATH/bin.
-WAILS := $(or $(shell which wails 2>/dev/null),$(shell go env GOPATH)/bin/wails)
-
-# Default target
-all: build
-
-# Install all dependencies
-deps: frontend-deps
-	go mod download
-
-# Install frontend dependencies
-frontend-deps:
-	cd frontend && npm install
-
-# Development mode with hot reload
-dev: deps
-	$(WAILS) dev
-
-# Production build
-build: deps
-	$(WAILS) build
-
-# Run tests
-test:
-	go test ./... -v -count=1
-
-# Run tests with coverage
-test-cover:
-	go test ./... -v -count=1 -coverprofile=coverage.out
-	go tool cover -html=coverage.out -o coverage.html
-
-# Clean build artefacts
-clean:
-	rm -rf build/bin
-	rm -rf frontend/node_modules
-	rm -rf frontend/src/js/lib
-	rm -rf frontend/src/css/lib
-	go clean -testcache
-
-# Lint (requires golangci-lint)
-lint:
-	golangci-lint run ./...
-
-# Package for distribution
-package: build
-	@echo "Binary built at build/bin/"
-
-# Help
-help:
-	@echo "Nexus Terminal — Build Targets"
-	@echo ""
-	@echo "  make deps          — Install all dependencies"
-	@echo "  make dev           — Run in development mode with hot reload"
-	@echo "  make build         — Production build"
-	@echo "  make test          — Run tests"
-	@echo "  make test-cover    — Run tests with coverage report"
-	@echo "  make clean         — Clean build artefacts"
-	@echo "  make lint          — Run linter (requires golangci-lint)"
-	@echo "  make package       — Build and package for distribution"
-	@echo "  make help          — Show this help"

README.md

@@ -1,399 +1,121 @@
 # Nexus Terminal
 
-**A premium desktop SSH, Telnet, and RAW TCP client** built with [Wails v2](https://wails.io/) (Go backend, web frontend).
+**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
 
-Nexus Terminal provides a modern, tabbed interface for managing remote connections over SSH, Telnet, and raw TCP — with encrypted credential storage, host key verification, audit logging, and a dark Material-inspired design.
+Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence. It is a single Rust application with no webview, so it starts quickly and stays responsive under heavy terminal output.
 
----
+## Highlights
 
-## Features
+- SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminal sessions in one app
+- Tabbed sessions with split panes, pinning and drag-to-reorder
+- SFTP browser with drag-and-drop uploads and a permission-aware directory picker
+- SSH jump hosts, SOCKS5/HTTP proxies, local and remote port forwards, agent forwarding and TOTP auto-fill
+- Serial consoles with full line settings (baud, data bits, parity, stop bits, flow control)
+- Native VNC and RDP viewers; RDP with NLA, certificate pinning, and SOCKS5/HTTP proxy or SSH tunnel routes
+- Disconnected overlay with one-click reconnect, and auto-reconnect with backoff
+- Broadcast input, snippets, trigger rules and terminal search
+- Session recording (asciicast v2) and playback
+- Secure credential storage with the OS keychain first and an encrypted vault fallback
 
-### Implemented
+## Install
 
-- ✅ **SSH connections** — password, public key, and keyboard-interactive authentication
-- ✅ **Telnet** — option negotiation, character encoding, local echo, configurable line modes
-- ✅ **RAW TCP** — binary-safe text, hex, and split views with payload presets
-- ✅ **Saved connection profiles** — tags, folders, environments, favourites
-- ✅ **Encrypted secret storage** — AES-256-GCM with Argon2id key derivation
-- ✅ **OS keychain integration** — macOS Keychain, Linux Secret Service, Windows Credential Manager
-- ✅ **Known hosts verification** — configurable policies (strict / ask / accept-new / insecure)
-- ✅ **Tabbed multi-session management** — rename, reorder, pin, context menu
-- ✅ **xterm.js terminal** — search, web links, fit-to-container
-- ✅ **Profile import/export** — JSON format, secrets excluded by default
-- ✅ **Command palette** — quick access via Ctrl+K / Cmd+K
-- ✅ **Dark charcoal Material-inspired UI**
-- ✅ **Audit logging** — timestamped records of connections and actions
-- ✅ **Input validation** — comprehensive profile and protocol validation
+**macOS** (Homebrew):
 
-### In Progress
+```sh
+brew install --cask andydixon/tap/nexusterminal
+```
 
-- 🔨 **Jump host / bastion support** — architecture in place, single-hop implemented
-- 🔨 **Session transcript export** — partial implementation
+**Debian, Ubuntu** (22.04 and later):
 
-### Planned
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+curl -fsSL https://repo.dixon.cx/dixon.gpg | sudo tee /etc/apt/keyrings/dixon.gpg >/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/dixon.gpg] https://repo.dixon.cx/apt stable main" |
+    sudo tee /etc/apt/sources.list.d/dixon.list
+sudo apt update && sudo apt install nexusterminal
+```
 
-- 📋 Port forwarding (extension point architected)
-- 📋 SFTP file transfer (extension point architected)
-- 📋 Split panes
-- 📋 Theme customisation
-- 📋 OpenSSH config import (partial parser exists)
-- 📋 Encrypted profile export
+**Fedora, RHEL, openSUSE:**
 
----
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/dixon.repo https://repo.dixon.cx/rpm/dixon.repo
+sudo dnf install nexusterminal        # or: sudo zypper install nexusterminal
+```
 
-## Screenshots
+**Arch Linux:**
 
-> _Screenshots will be added once the UI is feature-complete._
+```sh
+curl -fsSL https://repo.dixon.cx/dixon.asc | sudo pacman-key --add -
+sudo pacman-key --lsign-key C22FF7330668417C62C7A304CBC7951D7F2234D1
+printf '\n[dixon]\nServer = https://repo.dixon.cx/arch/$arch\n' | sudo tee -a /etc/pacman.conf
+sudo pacman -Sy nexusterminal
+```
 
----
+**Windows**, or any platform by hand: download a zip from
+[GitHub Releases](https://github.com/andydixon/nexus/releases) and check it against `SHA256SUMS`.
+Builds aren't code-signed yet, so macOS and Windows ask you to confirm the first launch.
 
-## Prerequisites
+## Quick start
 
-| Tool       | Version | Install                                                           |
-|------------|---------|-------------------------------------------------------------------|
-| Go         | 1.21+   | [golang.org/dl](https://golang.org/dl/)                           |
-| Node.js    | 18+     | [nodejs.org](https://nodejs.org/)                                 |
-| Wails CLI  | v2      | `go install github.com/wailsapp/wails/v2/cmd/wails@latest`       |
+1. Launch Nexus Terminal.
+2. Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**) and create a connection profile.
+3. Click **Create & Connect** to save it and open a session in a new tab. Afterwards, click the profile in the sidebar to connect.
 
-> **Note:** On Linux you may also need GTK, WebKit, and related system libraries.
-> Run `wails doctor` to verify your environment.
+Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect, or click **Local Machine** in the sidebar for a local shell.
 
----
+If a session drops, use the **Reconnect** button in the disconnected overlay.
 
-## Quick Start
+## Documentation
+
+- Product overview: [docs/overview.md](docs/overview.md)
+- Quick start (shareable): [docs/quick-start.md](docs/quick-start.md)
+- User manual: [docs/user-manual.md](docs/user-manual.md)
+- Illustrated user guide (PDF): [docs/guide/nexus-guide.pdf](docs/guide/nexus-guide.pdf), built from LaTeX in [docs/guide](docs/guide) (`make` there; `tools/screenshots.sh` regenerates the screenshots)
+- Build and release: [docs/build-and-release.md](docs/build-and-release.md)
+
+## Keyboard shortcuts
+
+All shortcuts use **Cmd** on macOS and **Ctrl** on Windows/Linux.
+
+| macOS Shortcut    | Windows/Linux Shortcut | Action                           |
+| ----------------- | ---------------------- | -------------------------------- |
+| Cmd + K           | Ctrl + K               | Open command palette             |
+| Cmd + N           | Ctrl + N               | New connection                   |
+| Cmd + W           | Ctrl + W               | Close current tab                |
+| Cmd + Tab         | Ctrl + Tab             | Next tab                         |
+| Cmd + Shift + Tab | Ctrl + Shift + Tab     | Previous tab                     |
+| Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number          |
+| Cmd + ,           | Ctrl + ,               | Open settings                    |
+| Cmd + F           | Ctrl + F               | Find in terminal                 |
+| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane right (side by side)  |
+| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane down (top and bottom) |
+| Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording         |
+| Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode      |
+| Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library             |
+| Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect                    |
+| F11               | F11                    | Toggle fullscreen                |
+
+## Building from source
+
+Nexus Terminal is a Rust workspace in `rust/`. With [rustup](https://rustup.rs) installed:
 
 ```bash
-git clone https://github.com/your-org/nexus-terminal.git
-cd nexus-terminal
-make deps    # install Go modules and frontend npm packages
-make dev     # launch in development mode with hot reload
+cd rust
+cargo run --release
 ```
 
-Or using the shell script:
+See [docs/build-and-release.md](docs/build-and-release.md) for platform prerequisites, tests and release packaging.
 
-```bash
-./build.sh deps
-./build.sh dev
-```
+## License
 
----
+Copyright (C) 2026 Andy Dixon.
 
-## Build
+Nexus Terminal is free software: you can redistribute it and/or modify it under the terms of the
+[GNU Affero General Public License, version 3](LICENSE) as published by the Free Software
+Foundation. It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+license for details.
 
-| Command            | Description                              |
-|--------------------|------------------------------------------|
-| `make deps`        | Install all dependencies                 |
-| `make dev`         | Run in development mode with hot reload  |
-| `make build`       | Production build                         |
-| `make test`        | Run Go tests                             |
-| `make test-cover`  | Run tests with HTML coverage report      |
-| `make clean`       | Remove build artefacts and caches        |
-| `make lint`        | Run golangci-lint                        |
-| `make package`     | Build and package for distribution       |
-| `make help`        | Show all available targets               |
+Third-party crates (including the patched copies in `rust/vendor/`) keep their own licenses,
+which are listed in each crate.
 
-The production binary is written to `build/bin/NexusTerminal`.
-
----
-
-## Architecture Overview
-
-```
-copilot-ssh-client/
-├── cmd/
-│   └── app/
-│       └── main.go              # Application entry point (Wails bootstrap)
-├── frontend/
-│   ├── dist/
-│   │   └── index.html           # HTML entry point (embedded by Wails)
-│   ├── scripts/
-│   │   ├── build.js             # Frontend build & watch script
-│   │   └── copy-assets.js       # Copies xterm assets from node_modules
-│   ├── src/
-│   │   ├── assets/icons/        # Application icons
-│   │   ├── components/          # UI components (planned)
-│   │   ├── css/                 # Stylesheets
-│   │   │   └── lib/             # Vendored CSS (xterm.css — auto-copied)
-│   │   └── js/                  # JavaScript source
-│   │       └── lib/             # Vendored JS (xterm — auto-copied)
-│   └── package.json
-├── internal/
-│   ├── api/                     # Wails-bound API methods (planned)
-│   ├── app/
-│   │   └── app.go               # Application lifecycle management
-│   ├── audit/                   # Audit log service (planned)
-│   ├── config/
-│   │   └── config.go            # Platform-specific path resolution
-│   ├── knownhosts/              # Known hosts management (planned)
-│   ├── models/
-│   │   ├── models.go            # Core domain types (Profile, Session, etc.)
-│   │   └── defaults.go          # Default values and factory functions
-│   ├── preferences/             # Preferences service (planned)
-│   ├── rawclient/
-│   │   └── encoding.go          # Hex, escaped, and character encoding utilities
-│   ├── secrets/
-│   │   ├── keychain.go          # OS keychain integration
-│   │   ├── redact.go            # Secret redaction for logs and UI
-│   │   └── secrets.go           # AES-256-GCM encrypted vault
-│   ├── sessions/                # Session lifecycle management (planned)
-│   ├── sshclient/
-│   │   └── hostkey.go           # SSH host key verification with policies
-│   ├── storage/
-│   │   ├── migrations/
-│   │   │   ├── 001_initial.sql  # Initial database schema
-│   │   │   └── migrations.go    # Embedded migration files
-│   │   └── storage.go           # SQLite persistence layer
-│   ├── telnetclient/            # Telnet client (planned)
-│   └── validation/
-│       └── validation.go        # Profile and protocol validation
-├── build.sh                     # Shell build script for CI
-├── Makefile                     # Make-based build targets
-├── wails.json                   # Wails v2 project configuration
-├── go.mod                       # Go module definition
-└── README.md
-```
-
-### Key Packages
-
-| Package            | Purpose                                                                |
-|--------------------|------------------------------------------------------------------------|
-| `cmd/app`          | Wails application bootstrap — window size, title, lifecycle hooks      |
-| `internal/app`     | Wires together all subsystems; manages startup and shutdown            |
-| `internal/config`  | Resolves platform-specific data, database, and vault paths             |
-| `internal/models`  | Domain types shared across all packages — profiles, sessions, enums    |
-| `internal/storage` | SQLite repository with WAL mode, migrations, and import/export         |
-| `internal/secrets` | Encrypted vault (AES-256-GCM + Argon2id) and OS keychain abstraction  |
-| `internal/sshclient` | SSH host key verification with strict / ask / accept-new policies   |
-| `internal/rawclient` | Hex dump, escape parsing, and character encoding for raw TCP         |
-| `internal/validation` | Multi-field validation for profiles and protocol-specific configs  |
-
-### Frontend–Backend Interaction
-
-Wails v2 exposes Go methods to the frontend as JavaScript functions. The `App` struct (and future API types) are bound in `main.go`. Frontend calls arrive as synchronous RPC; asynchronous data (terminal output, session events) flows via the Wails event system.
-
-```
-┌─────────────┐   Wails bindings   ┌──────────────┐
-│  Frontend    │ ◄────────────────► │  Go backend   │
-│  (xterm.js)  │   Wails events     │  (App struct) │
-└─────────────┘                     └──────────────┘
-       │                                    │
-       │ xterm.js writes                    │ golang.org/x/crypto/ssh
-       │ to terminal                        │ net.Dial (telnet, raw)
-       ▼                                    ▼
-   Browser DOM                        Remote hosts
-```
-
----
-
-## Security
-
-### Secret Storage
-
-Nexus Terminal uses a two-tier approach to credential storage:
-
-1. **OS keychain (preferred)** — macOS Keychain, Linux Secret Service (via D-Bus), Windows Credential Manager. Probed at startup; used automatically when available.
-2. **Encrypted file vault (fallback)** — AES-256-GCM encrypted JSON file at `<data-dir>/vault`. Requires a master password to unlock.
-
-### Encryption Details
-
-| Parameter       | Value                             |
-|-----------------|-----------------------------------|
-| Cipher          | AES-256-GCM                       |
-| Key derivation  | Argon2id (time=3, mem=64 KB, threads=4) |
-| Key length      | 256 bits (32 bytes)               |
-| Salt            | 32 random bytes (per vault)       |
-| Nonce           | Random, prepended to ciphertext   |
-
-### Threat Model
-
-**Protects against:**
-- Secrets exposed via disk theft or backup exfiltration
-- Accidental secret leakage in logs, exports, or UI (redaction layer)
-- Credential access without the master password
-
-**Does NOT protect against:**
-- A compromised operating system or process with memory access
-- Memory forensics whilst the vault is unlocked
-- Keyloggers capturing the master password
-- Weak master passwords (no strength enforcement currently)
-
-### Secret Key Format
-
-Secrets are keyed by profile: `profile:<uuid>:password`, `profile:<uuid>:passphrase`. The `ListKeys()` method exposes keys but never values.
-
-### Export Handling
-
-Profile exports exclude secrets by default. The JSON export format contains connection metadata but no passwords or private key passphrases unless explicitly requested (future encrypted export).
-
----
-
-## Protocol Support
-
-| Feature                          | SSH | Telnet | RAW TCP |
-|----------------------------------|:---:|:------:|:-------:|
-| Password authentication          | ✅  | —      | —       |
-| Public key authentication        | ✅  | —      | —       |
-| Keyboard-interactive auth        | ✅  | —      | —       |
-| Host key verification            | ✅  | —      | —       |
-| Keepalive                        | ✅  | —      | —       |
-| Option negotiation               | —   | ✅     | —       |
-| Local echo                       | —   | ✅     | —       |
-| Character encoding (UTF-8, etc.) | —   | ✅     | ✅      |
-| Text view                        | ✅  | ✅     | ✅      |
-| Hex view                         | —   | —      | ✅      |
-| Split (text + hex) view          | —   | —      | ✅      |
-| Payload presets                  | —   | —      | ✅      |
-| Configurable line endings        | —   | ✅     | ✅      |
-| Auto-reconnect                   | —   | —      | ✅      |
-| Jump hosts / bastions            | 🔨  | —      | —       |
-| Port forwarding                  | 📋  | —      | —       |
-| SFTP                             | 📋  | —      | —       |
-
-**Legend:** ✅ implemented · 🔨 in progress · 📋 planned · — not applicable
-
----
-
-## Storage
-
-### Database
-
-Nexus Terminal stores profiles, known hosts, preferences, and audit entries in a SQLite database with WAL (Write-Ahead Logging) mode for concurrent read performance.
-
-| Platform | Default location                                       |
-|----------|--------------------------------------------------------|
-| macOS    | `~/Library/Application Support/NexusTerminal/nexus.db` |
-| Linux    | `~/.config/NexusTerminal/nexus.db`                     |
-| Windows  | `%APPDATA%\NexusTerminal\nexus.db`                     |
-
-### Schema Versioning
-
-Migrations are embedded at compile time via `embed.FS` and applied sequentially at startup. Each migration records its version in the `schema_version` table to prevent re-application.
-
-Current schema (v001):
-- `profiles` — connection profiles with JSON-encoded protocol configs
-- `known_hosts` — SSH host key fingerprints with trust state
-- `preferences` — key-value application preferences (JSON)
-- `audit_log` — timestamped action records
-- `schema_version` — applied migration tracking
-
----
-
-## Import / Export
-
-### JSON Export
-
-```bash
-# Via the application UI: Profiles → Export
-```
-
-The export format is a JSON array of profile objects. Each profile includes connection settings, terminal preferences, and protocol-specific configuration — but **not** secrets (passwords, passphrases) by default.
-
-### Import Strategies
-
-| Strategy    | Behaviour                                                     |
-|-------------|---------------------------------------------------------------|
-| `skip`      | Skip profiles whose ID already exists                         |
-| `overwrite` | Replace existing profiles with the imported version           |
-| `duplicate` | Import as a new profile with a fresh UUID                     |
-
-### Format
-
-```json
-{
-  "version": 1,
-  "exported_at": "2024-01-15T10:30:00Z",
-  "profiles": [
-    {
-      "id": "uuid",
-      "display_name": "Production Server",
-      "protocol": "ssh",
-      "host": "prod.example.com",
-      "port": 22,
-      "username": "deploy",
-      "tags": ["production", "web"],
-      "folder": "Servers",
-      "ssh_config": { "..." : "..." }
-    }
-  ]
-}
-```
-
----
-
-## Developer Notes
-
-### Adding a New Protocol
-
-1. Create a new package under `internal/` (e.g., `internal/mystclient/`).
-2. Define a protocol-specific config struct in `internal/models/models.go`.
-3. Add the protocol constant to the `Protocol` type.
-4. Update `internal/models/defaults.go` with default values and a factory case in `NewProfile()`.
-5. Add validation rules in `internal/validation/validation.go`.
-6. Wire the new client into `internal/app/app.go` and `internal/sessions/`.
-7. Update the database migration if new columns are required.
-
-### Adding Tests
-
-Tests live alongside the code they exercise:
-
-```bash
-go test ./internal/validation/ -v          # run validation tests
-go test ./internal/secrets/ -v             # run secrets tests
-go test ./... -v -count=1                  # run all tests
-go test ./... -coverprofile=coverage.out   # with coverage
-```
-
-Use `_test.go` files in the same package for white-box tests, or in a `_test` package for black-box tests. Table-driven tests are preferred.
-
-### Event System
-
-The Wails runtime provides an event bus for asynchronous communication:
-
-- **Backend → Frontend:** `runtime.EventsEmit(ctx, "event:name", payload)`
-- **Frontend → Backend:** `runtime.EventsOn("event:name", callback)`
-
-Key events:
-- `backend:ready` — emitted when the Go backend has finished initialisation
-- `session:data` — terminal output data for a specific session
-- `session:state` — session state changes (connecting, connected, disconnected, error)
-
----
-
-## Limitations and Future Work
-
-### Known Limitations
-
-- **Single-hop jump hosts only** — the jump host architecture supports chaining, but only one hop is currently implemented.
-- **No SFTP** — the extension point is designed but file transfer is not yet available.
-- **No port forwarding** — local/remote/dynamic forwarding is planned but not implemented.
-- **No split panes** — single terminal per tab; split view is planned.
-- **No theme customisation** — the dark charcoal theme is currently the only option.
-- **No master password strength enforcement** — the vault accepts any master password.
-- **Argon2id memory parameter is conservative** — 64 KB is low for production use; will be increased in a future release.
-- **No SSH agent forwarding** — authentication uses direct key/password only.
-- **Linux recursive file watch** — the development watch script may not detect all changes on Linux due to `fs.watch` limitations.
-
-### Planned Improvements
-
-- Increase Argon2id memory to 64 MB+ for stronger key derivation
-- SFTP file browser and transfer
-- Local, remote, and dynamic port forwarding
-- Multi-hop jump host chains
-- Split pane terminal layout
-- Custom themes and colour schemes
-- OpenSSH `~/.ssh/config` import
-- Session recording and playback
-- SSH agent forwarding
-- Encrypted profile export/import
-- Master password strength meter
-- Automatic update checking
-
----
-
-## Licence
-
-This project is licensed under the MIT Licence. See [LICENCE](LICENCE) for details.
-
----
-
-<sub>Built with ❤ using [Wails](https://wails.io/), [xterm.js](https://xtermjs.org/), and [Go](https://go.dev/).</sub>

audits/20260615-1934-functionalityNextSteps.md

@@ -0,0 +1,126 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix-mode audit improved immediate security and robustness around profile validation, imports, drag-drop upload, frontend encoding, dependencies, and release reproducibility.
+
+The most useful next work is to turn these fixes into durable product quality: add frontend interaction tests, make large file upload streaming and consistent, warn users about intentionally insecure protocol choices, and strengthen release provenance.
+
+## 2. Current Functional Risks
+
+Direct VNC can still be used without SSH tunnelling. That is valid for trusted networks, but the UI should make the risk visible when profiles are saved or connected.
+
+Drag-drop SFTP upload is now capped at 25 MiB because it still uses an in-memory browser-to-Go base64 path. Larger files should use the existing native SFTP upload flow or a future streaming drag-drop implementation.
+
+Profile import now rejects malformed or unsafe profiles before storage. That is safer, but older third-party exports with missing defaults may need a clearer import error UI or a migration/repair preview.
+
+RAW session history and recordings can still grow over long sessions. Users need limits, retention controls, and clear storage management.
+
+## 3. Code Quality Improvements
+
+Profile validation is now centralized enough for create/update/import, but profile normalization is still split between frontend defaults, Go defaults, and import-time cleanup. A schema-versioned import normalizer would make future protocol additions safer.
+
+Frontend still has many `innerHTML` templates. Some are static or escaped, but a small helper pattern for safe modal construction would reduce future XSS mistakes.
+
+Release scripts and CI now use pinned Wails and `npm ci`; follow-up work should avoid duplicate release logic between `build.sh`, `release.sh`, and GitHub Actions.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+Add Wails/browser interaction tests for:
+
+- Dropping a file with HTML metacharacters in its filename.
+- Dropping a file over 25 MiB.
+- Importing malformed and oversized profile bundles.
+- Saving GitHub profiles with HTTP and HTTPS API base URLs.
+- Creating direct VNC profiles and seeing a warning.
+
+Improve import UX by showing which profile entry failed validation without exposing secret values.
+
+## 5. Testing Roadmap
+
+Immediate tests to add:
+
+- Frontend DOM regression for file-drop title rendering.
+- API tests for successful valid GitHub Enterprise HTTPS profile creation.
+- Import tests for mixed valid/invalid profile arrays.
+
+Short-term tests:
+
+- End-to-end Wails smoke tests for create profile, connect prompt flow, import/export, SFTP upload, and VNC tunnel setup.
+- Load tests for large SFTP directories, RAW captures, and recordings.
+- CI security job with `npm audit`, govulncheck, and secret scanning.
+
+Longer-term tests:
+
+- Release workflow dry-run or artifact validation tests.
+- Migration tests for profile schema changes.
+
+## 6. Recommended New Functionality
+
+Add a direct-VNC safety warning and a per-profile “prefer SSH tunnel” nudge.
+
+Add streaming drag-drop SFTP upload for larger files, or route drag-drop files above 25 MiB into the native upload flow.
+
+Add import preview: list profile names, protocols, validation warnings, and duplicate handling before writing.
+
+Add recording retention settings: max recording size, max age, and one-click cleanup.
+
+Add security diagnostics in settings: dependency check status, known-host summary, direct insecure profile count, and last audit-log events.
+
+## 7. Next-Level Opportunities
+
+Release hardening:
+
+- Sign and notarize release artifacts where platform-appropriate.
+- Publish checksums and provenance.
+- Pin or cache dependency sources in CI.
+
+Observability:
+
+- Add structured non-sensitive debug logs for import rejection, update checks, VNC proxy lifecycle, and SFTP transfer failures.
+- Add audit entries for validation failures that indicate suspicious imports, without storing payload contents.
+
+Developer experience:
+
+- Consolidate release/build dependency resolution into one reusable script.
+- Add a frontend lint rule or custom check for unsafe `innerHTML` with dynamic values.
+
+Accessibility/product quality:
+
+- Ensure modal error states are keyboard reachable and announced.
+- Add clearer status messages for blocked uploads and import validation failures.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Add direct VNC warning copy and tests.
+- Add frontend file-drop XSS and oversize tests.
+- Add CI jobs for `go test ./...`, `npm run build`, `npm audit`, and govulncheck.
+
+Short-term:
+
+- Replace deprecated `xterm` packages with maintained `@xterm/*` packages.
+- Build import preview and validation repair UI.
+- Add recording and RAW capture storage limits.
+
+Medium-term:
+
+- Implement streaming drag-drop upload.
+- Add release signing, checksums, and provenance.
+- Add schema-versioned profile import/export.
+
+Long-term:
+
+- Build a security/settings dashboard for insecure profiles, known hosts, audit status, and update health.
+- Add comprehensive Wails end-to-end smoke coverage for core workflows.
+
+## 9. Caveats and Validation Needed
+
+The fixes were verified with automated local checks, but not with live Wails UI automation.
+
+The new import validation may reject malformed legacy profiles that were previously accepted. That is intentional for safety, but the UX should help users repair old data.
+
+The 25 MiB drag-drop upload cap is a guardrail, not a final large-file strategy. Streaming support would be the better long-term user experience.
+
+Direct VNC was left open because some users need it on trusted networks; the next step is product warning and safer defaults, not silent removal.

audits/20260615-1934-securityAudit.md

@@ -0,0 +1,752 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed Nexus Terminal, a Wails desktop client with a Go backend and JavaScript frontend for SSH, Telnet, RAW TCP, VNC, SFTP, GitHub, recordings, local shells, encrypted secrets, and profile import/export.
+
+The highest-risk issues fixed in this run were unsafe profile persistence/import validation, a local DOM XSS trigger in the file-drop modal, memory-exhaustion paths in import and drag-drop upload flows, vulnerable dependency versions, and release tooling that installed unpinned build dependencies. I also removed the stale insecure SSH connection helper so future code cannot silently bypass host-key verification.
+
+Post-fix verification passed: `go test ./...`, focused Go tests, `npm run build`, `npm audit --json`, `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`, `bash -n build.sh release.sh`, and `git diff --check`.
+
+Residual risk remains where users intentionally choose insecure protocols or workflows, especially direct VNC without SSH tunnelling. No high-confidence secrets or private keys were found in the repository search performed during this audit.
+
+## 2. Scope Reviewed
+
+Reviewed code and configuration:
+
+- Go backend under `internal/`: API bindings, sessions, SSH, VNC, SFTP, storage, secrets, export/import, validation, updater, recordings, local shell, GitHub client, raw and telnet clients.
+- Frontend JavaScript under `frontend/src/js`, especially file drop, terminal, settings, GitHub, profile, SFTP, VNC, notification, and import/export flows.
+- Dependency manifests and lockfiles: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
+- Build/release configuration: `build.sh`, `release.sh`, `.github/workflows/release-builds.yml`, `wails.json`.
+- Existing tests under `internal/**/*_test.go`.
+
+Not reviewed with live external testing:
+
+- Real SSH/VNC/GitHub endpoints.
+- Packaged binaries and platform installers.
+- Manual UI testing inside a running Wails app.
+
+## 3. Methodology
+
+I used a two-pass review:
+
+- Attack-surface mapping of Wails API methods, import/export paths, file handling, DOM sinks, dependency/build chain, protocol clients, local proxy behavior, and credential flows.
+- Defensive validation from source and tests, followed by smallest safe fixes with regression tests.
+
+Tools/checks used:
+
+- Static review with `rg`, direct source reads, and line evidence.
+- `go test ./...`.
+- Focused tests for API, storage, export/import, validation, SSH client, and sessions.
+- `npm audit --json`.
+- `npm run build`.
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`.
+- `bash -n build.sh release.sh`.
+- `git diff --check`.
+
+## 4. Risk Rating Method
+
+Severity considered attacker position, exploit preconditions, likely impact, and whether sensitive credentials or code execution could be affected.
+
+- Critical: practical remote compromise or credential disclosure with minimal preconditions.
+- High: credible dependency, credential, or supply-chain compromise.
+- Medium: user-assisted or renderer/local attack that can affect confidentiality, integrity, or availability.
+- Low: hardening, defense-in-depth, or intentionally insecure user-selected modes.
+- Informational: verified area, non-exploitable issue, or test gap.
+
+Confidence is High where source evidence and regression checks directly support the finding.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound Go API methods in `internal/api/api.go`.
+- Profile create/update/import/export and encrypted `.nexus` imports.
+- Drag-and-drop file upload/paste in `frontend/src/js/terminal.js`.
+- SSH, Telnet, RAW TCP, VNC, SFTP, GitHub API, and local shell sessions.
+- Local VNC WebSocket proxy on loopback.
+- Build/release automation and dependency installation.
+
+Trust boundaries:
+
+- Frontend renderer to Wails API.
+- User-selected/imported local files to backend parsers.
+- Saved/imported profiles to outbound network clients.
+- Remote hosts and GitHub/GitHub Enterprise APIs to frontend rendering.
+- Local filesystem/keychain/vault to application process.
+- CI/release environment to dependency registries and Go module proxy.
+
+Attacker starting positions considered:
+
+- Malicious imported profile bundle.
+- Crafted local file or filename dropped into the terminal.
+- Compromised renderer or malicious frontend input reaching Wails APIs.
+- Network attacker on SSH/VNC/GitHub paths.
+- Dependency registry or release-time supply-chain manipulation.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---:|---:|---|---|---|
+| SEC-20260615-001 | Medium | High | Profile persistence and imports accepted unsafe or malformed profiles | API, validation, import | Fixed |
+| SEC-20260615-002 | Medium | High | Import and drag-drop upload paths allowed memory exhaustion | Import/export, SFTP upload | Fixed |
+| SEC-20260615-003 | Medium | High | Dropped filenames were rendered through `innerHTML` | Frontend terminal file-drop modal | Fixed |
+| SEC-20260615-004 | Medium | High | Unused SSH helper still defaulted to insecure host-key verification | SSH client | Fixed |
+| SEC-20260615-005 | High | High | Dependency advisories affected `esbuild` and required `x/net` module versions | Dependencies | Fixed |
+| SEC-20260615-006 | Medium | High | Release automation installed unpinned build dependencies | CI/release supply chain | Fixed |
+| SEC-20260615-007 | Low | High | Direct VNC remains unencrypted when SSH tunnelling is disabled | VNC client | Open |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260615-001
+
+#### Title
+
+Profile persistence and imports accepted unsafe or malformed profiles
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`, `CreateProfile`, `UpdateProfile`, `ImportProfiles`, `ImportProfilesEncrypted`, lines 94-131, 715-728, 1176-1189, 1754-1791.
+- `internal/validation/validation.go`, profile, GitHub, and VNC validation, lines 51-140 and 325-410.
+- `internal/storage/store.go`, `ImportProfiles`, lines 365-380.
+
+#### Description
+
+The API comment said profile creation validates input, but the Wails API previously persisted profiles without calling the validation package. Plain JSON import also decoded into `[]*models.Profile` and dereferenced entries without rejecting `null`. A malicious or corrupt import could therefore crash the app or store profiles with unsafe GitHub API base URLs that would later receive a saved or prompted token.
+
+#### Evidence
+
+The fixed code now calls `validation.ValidateProfile` before create/update and validates every imported profile before writing. GitHub API base URLs must be HTTPS unless loopback, must be absolute, and must not include URL credentials. Import strategy and null entries are rejected before persistence.
+
+Regression tests were added in `internal/api/api_test.go` and `internal/storage/storage_test.go`.
+
+#### Attack Scenario
+
+A user imports a profile JSON containing a GitHub profile with `http://evil.example/api/v3` as the API base URL, or a `null` profile entry. Before the fix, malformed data could be saved or crash import handling. If the malicious GitHub profile were later used, the app could send a token to an attacker-controlled endpoint.
+
+#### Impact
+
+Possible token exposure through malicious profile configuration, app crash during import, and fragile persisted state.
+
+#### Recommendation
+
+Validate all Wails-bound persistence inputs and imported profiles before storage. Reject non-HTTPS remote GitHub API URLs and malformed entries.
+
+#### Safer Example
+
+Implemented:
+
+- `CreateProfile` and `UpdateProfile` call `validation.ValidateProfile`.
+- `ValidateGitHubConfig` rejects remote HTTP and URL credentials.
+- Import helpers reject oversized, null, or invalid entries before writes.
+
+#### Suggested Tests
+
+Implemented:
+
+- Unsafe GitHub base URL rejection.
+- Null import entry rejection.
+- Oversized JSON import rejection.
+- Storage-level null import entry rejection.
+- GitHub and VNC validation cases.
+
+#### References
+
+- CWE-20: Improper Input Validation.
+- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
+- OWASP API Security Top 10: API3 Broken Object Property Level Authorization / unsafe object properties.
+
+#### Assumptions / Limitations
+
+GitHub Enterprise over non-loopback HTTP is now rejected. If a legitimate deployment needs HTTP, it should be placed behind local loopback or HTTPS.
+
+### Finding ID: SEC-20260615-002
+
+#### Title
+
+Import and drag-drop upload paths allowed memory exhaustion
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`, plain import and SFTP drag-drop upload, lines 715-718 and 1336-1350.
+- `internal/exportimport/exportimport.go`, encrypted import file read, lines 37 and 131-144.
+- `frontend/src/js/terminal.js`, drag-drop file upload cap, lines 10 and 829-849.
+
+#### Description
+
+Several local file paths loaded attacker-controlled or user-selected content fully into memory without a size cap. Plain profile JSON import accepted arbitrary string size from the renderer. Encrypted `.nexus` import used `os.ReadFile` on the selected path. Drag-drop SFTP upload read each browser `File` into an `ArrayBuffer`, converted it to base64, and sent it to the backend, where it was decoded into another byte slice.
+
+#### Evidence
+
+The fixed code adds:
+
+- 5 MiB cap for plain profile JSON import.
+- 10 MiB cap for encrypted `.nexus` import files.
+- 25 MiB frontend and backend caps for inline drag-drop SFTP uploads.
+
+Regression tests cover oversized plain import, encrypted import, and backend upload payload rejection.
+
+#### Attack Scenario
+
+A user drops or imports a very large crafted file. Before the fix, the renderer and backend could allocate multiple full copies, causing high memory pressure or an app crash.
+
+#### Impact
+
+Local denial of service against the desktop application.
+
+#### Recommendation
+
+Keep bounded inline payload paths and prefer streaming APIs for larger transfers. The existing native SFTP upload path streams local files and should remain the recommended path for large uploads.
+
+#### Safer Example
+
+Implemented size checks before decode/read where practical:
+
+- `base64.StdEncoding.DecodedLen` guard before decoding drag-drop upload payloads.
+- `os.Stat` size check before encrypted import `os.ReadFile`.
+
+#### Suggested Tests
+
+Implemented:
+
+- `TestImportProfilesRejectsOversizedJSON`.
+- `TestDecryptRejectsOversizedFile`.
+- `TestSFTPUploadDataRejectsOversizedPayloadBeforeSessionLookup`.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption.
+- OWASP ASVS 12.4: file and resource limits.
+
+#### Assumptions / Limitations
+
+The caps are conservative application-level limits. Larger profile bundles or drag-drop uploads now require a streaming implementation or the existing native SFTP upload flow.
+
+### Finding ID: SEC-20260615-003
+
+#### Title
+
+Dropped filenames were rendered through `innerHTML`
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `frontend/src/js/terminal.js`, file-drop modal, lines 720-742.
+
+#### Description
+
+The file-drop modal interpolated the dropped filename into an `innerHTML` template. Local files can have names containing HTML metacharacters. In a Wails desktop app, DOM script execution is higher impact than a normal static page because the renderer can call privileged Wails APIs.
+
+#### Evidence
+
+The fixed modal escapes the file-drop title with `escapeHtml(title)` before injecting it into the template.
+
+#### Attack Scenario
+
+A user downloads or receives a file with a crafted name such as an HTML tag with an event handler, then drops it into a terminal. Before the fix, the modal could parse the filename as markup.
+
+#### Impact
+
+Potential renderer-side script execution and access to Wails-bound APIs from malicious DOM content.
+
+#### Recommendation
+
+Do not put user-controlled strings into `innerHTML`. Use `textContent` or escape before insertion.
+
+#### Safer Example
+
+Implemented `escapeHtml(title)` in the file-drop modal.
+
+#### Suggested Tests
+
+Add a frontend interaction test that drops a file named with `<img ...>`-style metacharacters and asserts the modal text is rendered literally. Manual Wails/browser verification was not run in this audit.
+
+#### References
+
+- CWE-79: Improper Neutralization of Input During Web Page Generation.
+- OWASP ASVS 5.3: output encoding.
+
+#### Assumptions / Limitations
+
+This fix covers the reviewed file-drop title sink. Other `innerHTML` templates were spot-checked; future work should add an automated DOM-sink lint or test pass.
+
+### Finding ID: SEC-20260615-004
+
+#### Title
+
+Unused SSH helper still defaulted to insecure host-key verification
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sshclient/sshclient.go`, `Connect`, lines 72-75.
+- `internal/sshclient/sshclient_test.go`, regression test, lines 12-19.
+
+#### Description
+
+Current production session code uses explicit host-key callbacks, and no remaining reviewed SSH/VNC path calls `ssh.InsecureIgnoreHostKey`. However, the internal `sshclient.Connect` helper still defaulted to an insecure host-key callback. That made future misuse easy.
+
+#### Evidence
+
+The helper now fails closed and instructs callers to use `ConnectWithHostKeyCallback`. `rg` found no remaining `InsecureIgnoreHostKey` references after the change.
+
+#### Attack Scenario
+
+A future feature calls the convenience method instead of `ConnectWithHostKeyCallback`. Before the fix, that new path would silently accept any SSH host key.
+
+#### Impact
+
+Potential SSH machine-in-the-middle exposure if the helper were reused.
+
+#### Recommendation
+
+Keep host-key policy explicit on every SSH path. Do not provide insecure convenience APIs in internal packages.
+
+#### Safer Example
+
+Implemented: `Connect` returns `sshclient: host key callback is required`.
+
+#### Suggested Tests
+
+Implemented `TestConnectRequiresHostKeyCallback`.
+
+#### References
+
+- CWE-295: Improper Certificate Validation, analogous to SSH host-key validation.
+- OWASP ASVS 9.1.2: server authenticity validation.
+
+#### Assumptions / Limitations
+
+This is a preventive fix. The reviewed production paths already used explicit callbacks.
+
+### Finding ID: SEC-20260615-005
+
+#### Title
+
+Dependency advisories affected `esbuild` and required `x/net` module versions
+
+#### Severity
+
+High
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `frontend/package.json`, `esbuild`, line 22.
+- `frontend/package-lock.json`, `esbuild` and platform packages.
+- `go.mod`, `golang.org/x/net`, line 15.
+- `go.sum`.
+
+#### Description
+
+`npm audit` reported `esbuild 0.28.0` affected by a high-severity advisory and a low-severity advisory. `govulncheck -show verbose` reported six vulnerabilities in required `golang.org/x/net v0.54.0` modules, though no reachable symbols were called by this code.
+
+#### Evidence
+
+The fixed versions are:
+
+- `esbuild` bumped to `^0.28.1`.
+- `golang.org/x/net` bumped to `v0.55.0`.
+
+Post-fix `npm audit --json` reports zero vulnerabilities and `govulncheck` reports `No vulnerabilities found.`
+
+#### Attack Scenario
+
+For `esbuild`, a compromised or manipulated package installation environment could exploit known build-tool weaknesses. For `x/net`, future code changes could start calling vulnerable symbols if the module stayed on an affected version.
+
+#### Impact
+
+Supply-chain compromise risk during build/development and latent dependency risk.
+
+#### Recommendation
+
+Keep audited dependency patch versions current and include `npm audit` and `govulncheck` in regular release checks.
+
+#### Safer Example
+
+Implemented package/module upgrades and lockfile updates.
+
+#### Suggested Tests
+
+Implemented verification:
+
+- `npm audit --json`.
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`.
+- `go test ./...`.
+- `npm run build`.
+
+#### References
+
+- CWE-494: Download of Code Without Integrity Check.
+- CWE-1104: Use of Unmaintained Third Party Components.
+- Go vulnerability database advisories for `golang.org/x/net`.
+- GitHub Advisory Database for `esbuild`.
+
+#### Assumptions / Limitations
+
+The `x/net` advisories were not reachable before the bump, according to govulncheck. The upgrade removes the latent module-level finding anyway.
+
+### Finding ID: SEC-20260615-006
+
+#### Title
+
+Release automation installed unpinned build dependencies
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `.github/workflows/release-builds.yml`, Wails and npm install steps, lines 66-70.
+- `release.sh`, Wails and npm install logic, lines 76-99.
+
+#### Description
+
+The release workflow installed the Wails CLI with `@latest` and used `npm install` rather than the lockfile-enforcing `npm ci`. Local release scripting also instructed or performed unpinned dependency installation in some paths.
+
+#### Evidence
+
+The fixed workflow installs the Wails CLI at the version resolved from `go.mod` and uses `npm ci`. `release.sh` now installs the pinned Wails CLI version from `go.mod` when needed and uses `npm ci` when `frontend/package-lock.json` exists.
+
+#### Attack Scenario
+
+A release build runs after a compromised or breaking upstream release, or after lockfile drift. Before the fix, release outputs could include unreviewed dependency changes.
+
+#### Impact
+
+Build reproducibility loss and supply-chain risk in release artifacts.
+
+#### Recommendation
+
+Use pinned module versions and lockfile-enforced installs in CI/release paths.
+
+#### Safer Example
+
+Implemented:
+
+- `go install ...@$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v2)`.
+- `npm ci` in CI and release script.
+
+#### Suggested Tests
+
+Implemented:
+
+- `bash -n build.sh release.sh`.
+- Frontend build after `npm ci`.
+
+#### References
+
+- SLSA build integrity principles.
+- CWE-494.
+
+#### Assumptions / Limitations
+
+The workflow still allows network dependency retrieval during CI. Stronger controls would include dependency caching, provenance, and artifact signing.
+
+### Finding ID: SEC-20260615-007
+
+#### Title
+
+Direct VNC remains unencrypted when SSH tunnelling is disabled
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sessions/manager.go`, direct VNC branch, lines 1012-1062.
+- `internal/vncclient/vncclient.go`, direct TCP dial, lines 139-144.
+
+#### Description
+
+When VNC SSH tunnelling is disabled, the client makes a direct TCP VNC connection. Classic VNC deployments often provide weak or no transport encryption.
+
+#### Evidence
+
+The VNC client intentionally supports both SSH-tunnelled and direct modes. The direct branch uses `net.DialTimeout` to the VNC address.
+
+#### Attack Scenario
+
+A user connects directly to VNC over an untrusted network. A network attacker observes or tampers with remote desktop traffic, depending on the VNC server's negotiated security type.
+
+#### Impact
+
+Potential confidentiality and integrity loss for remote desktop sessions.
+
+#### Recommendation
+
+Keep direct VNC available for trusted networks, but clearly warn users when SSH tunnelling is disabled and consider requiring explicit confirmation for saved direct-VNC profiles.
+
+#### Safer Example
+
+Prefer enabling `vnc.sshTunnel` and verifying the SSH host key for the tunnel host.
+
+#### Suggested Tests
+
+Add a UI test that direct VNC profiles show a warning, and an integration test that tunnelled VNC requires a host-key callback.
+
+#### References
+
+- OWASP ASVS 9.1: secure channel requirements.
+
+#### Assumptions / Limitations
+
+This was not changed in this run because direct VNC can be a deliberate user choice for isolated networks.
+
+## 8. Blackhat-Style Abuse Paths
+
+Path A: malicious profile import to token exfiltration, now blocked.
+
+1. Provide a profile bundle with a GitHub API base URL pointing to attacker infrastructure.
+2. User imports and connects.
+3. App prompts for or retrieves a token and sends it to the configured endpoint.
+4. Defensive breakpoints now added: profile validation, HTTPS requirement for remote GitHub APIs, import validation before storage.
+
+Path B: crafted dropped filename to renderer script execution, now blocked.
+
+1. User receives a file with HTML metacharacters in the filename.
+2. User drops it into a terminal.
+3. Filename is rendered in the file-drop modal.
+4. Defensive breakpoint now added: title is escaped before `innerHTML` insertion.
+
+Path C: oversized file to app memory exhaustion, now blocked for reviewed inline paths.
+
+1. User imports or drops an extremely large file.
+2. Renderer/backend allocate full file contents and base64 copies.
+3. App becomes slow or crashes.
+4. Defensive breakpoints now added: import and inline upload size caps.
+
+Path D: direct VNC over hostile network, still open by design.
+
+1. User disables SSH tunnel and connects to a VNC server over an untrusted network.
+2. Network attacker observes/tampers with VNC traffic if protocol security is weak.
+3. Defensive breakpoint: use SSH tunnel; future UI warning recommended.
+
+## 9. Denial-of-Service Review
+
+Fixed DoS controls:
+
+- Plain profile import now rejects payloads over 5 MiB.
+- Encrypted profile import now rejects files over 10 MiB before `os.ReadFile`.
+- Drag-drop SFTP upload now rejects files over 25 MiB in the frontend and backend before base64 decode.
+- Null profile entries no longer panic import paths.
+
+Checked and not found:
+
+- SQL queries use parameters for profile and audit operations reviewed.
+- GitHub repo fetch has timeouts and caps repository listing at 5000 repos.
+- SSH/Telnet/RAW connection setup uses dial timeouts.
+- VNC local proxy binds to loopback and uses a per-session token in the current code.
+
+Residual DoS risks:
+
+- RAW session history and terminal recordings can grow with long sessions.
+- SFTP directory listing still depends on remote server behavior and could return very large directories.
+- Direct VNC proxy bridges long-lived streams by design.
+
+## 10. Dependency and Supply-Chain Review
+
+Fixed:
+
+- `esbuild` upgraded to `^0.28.1`; `npm audit --json` now reports zero vulnerabilities.
+- `golang.org/x/net` upgraded to `v0.55.0`; govulncheck now reports no vulnerabilities.
+- Release workflow uses `npm ci` and pinned Wails CLI version.
+- `release.sh` uses `npm ci` when a lockfile exists and installs the Wails CLI at the version from `go.mod`.
+
+Checked:
+
+- `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
+- `.github/workflows/release-builds.yml`, `build.sh`, `release.sh`.
+
+Notes:
+
+- npm warns that `xterm` packages are deprecated in favor of the newer `@xterm/*` packages. That is not an active vulnerability from `npm audit`, but it is a maintenance risk.
+
+## 11. Secrets and Sensitive Data Review
+
+Checked:
+
+- Repository search for private key markers, common cloud tokens, GitHub token prefixes, and obvious password assignments.
+- Secret store uses AES-GCM with Argon2id-derived keys and writes vault data with `0600`.
+- Profile export redacts inline SSH proxy/TOTP secrets when non-secret export mode is used.
+
+No high-confidence committed secrets or private keys were found.
+
+Residual notes:
+
+- GitHub and remote connection tokens are still available to the running app process by design.
+- Audit logging should continue to avoid logging raw secrets; reviewed audit messages do not include secret values.
+
+## 12. Authentication and Authorisation Review
+
+This is a desktop app, so there are no multi-user server authz roles in the reviewed code.
+
+Checked/fixed:
+
+- SSH host-key bypass helper removed by making `sshclient.Connect` fail closed.
+- Current SSH and VNC tunnel paths use explicit host-key callbacks.
+- GitHub API base URL validation now reduces token leakage to remote HTTP endpoints.
+
+Residual:
+
+- Users can still choose insecure protocols/modes such as direct VNC or legacy Telnet/RAW TCP.
+
+## 13. Input Validation and Output Encoding Review
+
+Fixed:
+
+- API create/update now validates profiles before persistence.
+- Plain and encrypted import validate every profile before storage.
+- GitHub API URLs now require HTTPS except loopback and reject URL credentials.
+- VNC validation supports VNC-specific host fallback and validates tunnel fields.
+- File-drop filename is escaped before template insertion.
+
+Checked:
+
+- SSH key management already rejects path traversal key names with alphanumeric, hyphen, and underscore constraints.
+- SFTP dropped filenames use `filepath.Base` before remote path construction.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+Fixed:
+
+- File-drop modal filename sink now uses `escapeHtml`.
+- Drag-drop upload rejects files over 25 MiB before FileReader allocation.
+
+Checked:
+
+- Notifications render messages with `textContent`.
+- GitHub repository card fields reviewed use `textContent` or escaping for remote metadata.
+
+Not fully exercised:
+
+- No live Wails UI/browser automation was run in this audit. Add frontend interaction tests for file-drop, import/export, and update UI in future work.
+
+## 15. Infrastructure and Deployment Review
+
+Fixed:
+
+- GitHub Actions release workflow now uses pinned Wails CLI and `npm ci`.
+- Local `release.sh` now uses pinned Wails CLI and `npm ci`.
+
+Checked:
+
+- No Docker, Kubernetes, Terraform, or cloud deployment config was present in the reviewed file list.
+- Wails config was reviewed for frontend build/install commands.
+
+Residual:
+
+- Release artifacts are not signed/notarized in the reviewed workflow.
+- CI workflow has `contents: write`, required for release attachment, but should remain limited to release jobs.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+Checked:
+
+- Audit log records profile changes, import/export counts, connects/disconnects, and secret access without raw secret values.
+- Fixed import validation returns actionable errors rather than panics.
+- Frontend upload errors now surface a user-safe oversized-file message.
+
+Residual:
+
+- Some protocol errors are emitted directly to the UI. Continue avoiding credentials in error strings from remote services.
+- Consider adding structured debug logs for rejected imports without dumping payloads.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added/updated tests:
+
+- API rejects unsafe GitHub base URL.
+- API rejects null and oversized imports.
+- API rejects oversized inline SFTP upload before session lookup.
+- Export/import rejects oversized encrypted files.
+- Storage import rejects null profile entries and invalid strategy before looping.
+- Validation covers GitHub URL and VNC host/tunnel cases.
+- SSH client `Connect` requires explicit host-key callback.
+
+Remaining gaps:
+
+- Browser/Wails interaction tests for file-drop XSS and upload cap.
+- Load tests for very large SFTP directories, RAW history, and recordings.
+- End-to-end import/export tests through the actual Wails UI.
+- Release workflow provenance/signing tests.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Keep the fixed tests in CI.
+- Add `npm audit` and govulncheck to CI if not already present.
+- Warn users when saving or connecting direct VNC profiles without SSH tunnelling.
+
+Short-term:
+
+- Replace deprecated `xterm` packages with maintained `@xterm/*` packages.
+- Add frontend tests for DOM injection via filenames and imported profile metadata.
+- Add streaming drag-drop upload support or route large drops through the native file upload path.
+
+Medium-term:
+
+- Add release artifact signing/notarization and checksums with provenance.
+- Add application-level limits for RAW history, terminal recording size, SFTP listing size, and GitHub error body reads.
+
+Long-term:
+
+- Add a security-focused CI job: tests, `npm audit`, govulncheck, secret scanning, and static DOM-sink checks.
+- Introduce a profile schema version and migration/normalization layer for imports.
+
+## 19. False Positives / Needs Manual Verification
+
+- `govulncheck -show verbose` initially reported module-level `x/net` advisories that were not reachable. The module was still upgraded to remove latent risk.
+- Direct VNC is intentionally supported; risk depends on network trust and VNC server security type.
+- File-drop XSS was fixed by code inspection; manual Wails UI verification should still be added.
+- No live external service testing was performed.
+
+## 20. Final Notes
+
+The repo is in a materially better state after this run: profile data is validated before storage, local resource-consumption paths are bounded, the file-drop DOM sink is escaped, dependency scanners are clean, and release dependency installation is more reproducible.
+
+The main residual security posture issue is user-selected insecure connectivity: Telnet/RAW/direct VNC remain useful but should be presented with clear safety context.

audits/20260616-1111-functionalityNextSteps.md

@@ -0,0 +1,81 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix pass moves Nexus closer to predictable large-file behavior: file-backed Leviathan documents stay file-backed for save/export, recordings parse incrementally, and unavoidable in-memory parsers now advertise and enforce clear limits.
+
+The most useful next work is to surface these limits in the Leviathan UI and add user-facing guidance when an operation needs a smaller selection or a streaming implementation.
+
+## 2. Current Functional Risks
+
+Leviathan spectrogram conversion still uses bounded in-memory audio/image buffers because the current encoder/decoder APIs operate on byte slices. Very large images, MP3s, WAVs, or decoded MP3 output will now be rejected with an error rather than processed.
+
+PDF, certificate, and key scanners still operate on bounded whole-document buffers for structural parsing. The cap avoids memory denial of service, but users working with very large firmware or document corpora may need range-based scans in future.
+
+Recording playback is now line-streamed, but the returned API shape still collects parsed events before sending them to the frontend. Very long recordings are still protected by the playback cap; true progressive playback would require an API contract change.
+
+## 3. Code Quality Improvements Completed
+
+Chunk-first behavior:
+
+- Leviathan working-copy save now writes with `Document.ForEachChunk`.
+- Leviathan case export now streams `working.bin` into the zip file on disk.
+- Recording playback parses line-by-line instead of reading and splitting the whole file.
+
+Bounded read behavior:
+
+- Spectrogram image/audio inputs reject oversize data before decode.
+- Image decode checks dimensions before allocating decoded pixels.
+- HTTP response helpers cap JSON and error bodies.
+- SSH key, VNC key, vault, public-key, PDF, and BinSnoop file reads have explicit limits.
+
+Responsiveness:
+
+- Heavy Leviathan spectrogram/export operations no longer hold the engine lock while processing or showing native save dialogs.
+
+## 4. Frontend Interaction and Error Handling
+
+Recommended UI follow-up:
+
+- Show limit-aware messages for spectrogram tools, such as image max size, audio max size, and decoded image dimension limits.
+- For PDF/cert/key tools, show “scan a smaller file or selected range” guidance when caps are hit.
+- Add a small status line in Leviathan for whether an operation is streaming, bounded-buffer, or selection-based.
+- For recording playback, consider progressive playback loading so long recordings do not need all parsed events returned at once.
+
+## 5. Testing Roadmap
+
+Completed in this pass:
+
+- Oversized spectrogram image dimensions are rejected before full decode.
+- Leviathan bounded document reads reject oversize documents.
+- Patched working-file writes preserve changed bytes.
+- Oversized GitHub/update responses are rejected.
+- Oversized SSH public keys, vault files, PDFs, and BinSnoop files are rejected.
+
+Recommended next tests:
+
+- Wails UI tests for Leviathan oversized image/audio/PDF error messages.
+- A case-export test that opens a sparse file-backed document and verifies the zip is produced without materializing `working.bin`.
+- A recording playback test with malformed lines and a long valid event stream.
+- Browser interaction tests for the Leviathan tab while a long analysis is running.
+
+## 6. Recommended New Functionality
+
+Add range-based versions of whole-document Leviathan tools:
+
+- `keys.scanRange`
+- `certs.scanRange`
+- `pdf.quickScan` for headers/xref/trailer without full structural recovery
+- `spectrogram.renderRange` for selected audio windows
+
+Add streaming media support later:
+
+- Decode audio from file/range readers instead of complete byte slices.
+- Stream WAV output directly to disk for spectrogram generation.
+- Stream image insertion output to disk when carrier audio is large.
+
+## 7. Caveats
+
+The new caps trade permissiveness for stability. Files above the limits now fail fast instead of attempting best-effort processing.
+
+The frontend build and regression checks passed, but I did not run a packaged Wails app manually in this pass.

audits/20260616-1111-securityAudit.md

@@ -0,0 +1,135 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit focused on file-reading and response-reading paths that could allocate complete files or unbounded remote bodies in memory.
+
+The main risk fixed was local denial of service from large user-selected files, imported Leviathan artefacts, recordings, SSH key files, vault files, and remote update/GitHub API responses. Where the codebase already had a chunked document model, saves and exports now use it. Where a parser still requires a complete byte slice, the code now rejects oversized inputs before allocation.
+
+Verification passed with targeted package tests, `go test ./...`, frontend regression tests, frontend build, and `git diff --check`.
+
+## 2. Scope Reviewed
+
+Reviewed and changed:
+
+- Leviathan file-backed document save, case export, spectrogram image/audio conversion, PDF parsing, and BinSnoop file helpers.
+- Wails API helpers that read SSH public keys and Leviathan image/audio inputs.
+- SSH and VNC tunnel private-key loading.
+- GitHub client and update-checker HTTP response handling.
+- Recording playback parsing.
+- Encrypted secrets vault loading.
+
+Not live-tested:
+
+- A packaged Wails desktop binary.
+- Real remote SSH/VNC/GitHub endpoints.
+- Very large real-world media corpora beyond automated guard tests.
+
+## 3. Methodology
+
+I searched for `ReadFile`, `ReadAll`, and whole-document `Range(0, size)` patterns, then classified each as chunked, bounded, embedded/test-only, or unsafe. Fixes were kept to low-risk local changes:
+
+- Prefer `Document.ForEachChunk` for writing/exporting working file bytes.
+- Stream line-oriented recordings with `bufio.Scanner`.
+- Limit HTTP response reads with `io.LimitReader`.
+- Add `os.Stat` size checks before unavoidable bounded `os.ReadFile` calls.
+- Add parser-specific caps before whole-document reads.
+
+## 4. Findings Summary
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---:|---:|---|---|---|
+| SEC-20260616-001 | Medium | High | Leviathan save/export and spectrogram tools could materialize large files | Leviathan API, spectrogram | Fixed |
+| SEC-20260616-002 | Medium | High | Remote API/update responses were read without size limits | GitHub client, updater | Fixed |
+| SEC-20260616-003 | Medium | High | Local app data/key reads lacked size caps | SSH keys, VNC keys, vault, BinSnoop | Fixed |
+| SEC-20260616-004 | Low | High | Recording playback loaded the whole capped recording file | Recording playback | Fixed |
+| SEC-20260616-005 | Low | Medium | Some parsers still require complete bounded buffers | PDF, cert/key scanners, media decoders | Accepted with caps |
+
+## 5. Detailed Findings
+
+### SEC-20260616-001: Leviathan full-file allocation paths
+
+Leviathan save/export and spectrogram operations could duplicate entire working files in memory. Case export also built the zip archive in memory before writing it.
+
+Fixed in:
+
+- `internal/api/leviathan.go`
+- `internal/leviathan/spectrogram/spectrogram.go`
+- `internal/leviathan/pdf/pdf.go`
+
+Changes:
+
+- Working-copy save writes via `Document.ForEachChunk`.
+- Case export streams `working.bin` directly into `zip.Writer` backed by the destination file.
+- Spectrogram encode/view/insert rejects oversized image/audio documents before bounded decode.
+- Image decoding checks compressed byte size and decoded pixel dimensions before full image decode.
+- PDF parsing rejects files above 128 MiB before whole-document structural parsing.
+- Long-running spectrogram/export tools no longer hold the Leviathan engine lock while doing heavy work or native save dialogs.
+
+### SEC-20260616-002: Unbounded remote response reads
+
+GitHub and update-check response bodies could be read without an explicit maximum.
+
+Fixed in:
+
+- `internal/githubclient/githubclient.go`
+- `internal/updater/updater.go`
+
+Changes:
+
+- GitHub JSON responses are capped at 4 MiB.
+- GitHub error bodies are capped at 64 KiB.
+- Update release/manifest responses are capped at 1 MiB.
+- Repository archive downloads continue to stream to disk instead of memory.
+
+### SEC-20260616-003: Local key/vault/helper reads lacked caps
+
+Several local helper paths read files directly even though the expected files are small.
+
+Fixed in:
+
+- `internal/api/api.go`
+- `internal/sshclient/sshclient.go`
+- `internal/sessions/manager.go`
+- `internal/secrets/secrets.go`
+- `internal/leviathan/binsnoop/common.go`
+- `internal/leviathan/binsnoop/binsnoop.go`
+
+Changes:
+
+- SSH public keys are capped at 64 KiB.
+- SSH private keys for SSH and VNC tunnel auth are capped at 1 MiB.
+- Secret vault files are capped at 10 MiB.
+- BinSnoop direct file helpers are capped at 64 MiB; the UI path already uses a bounded buffer.
+
+### SEC-20260616-004: Recording playback whole-file read
+
+Recording playback had a 100 MiB file cap, but still read and split the full file in memory.
+
+Fixed in:
+
+- `internal/recording/recorder.go`
+
+Changes:
+
+- Playback now opens the recording and scans line-by-line.
+- Individual playback lines are capped at 8 MiB.
+- Existing malformed-event tolerance is preserved.
+
+## 6. Residual Risk
+
+Some operations still need bounded complete buffers because downstream parsers or decoders require byte slices: image/audio spectrogram conversion, PDF structural parsing, certificate/key scanning, and small SSH/vault/public-key parsing. These now fail before allocation when inputs exceed explicit caps.
+
+Truly streaming versions of every binary parser would be a larger Leviathan architecture project. The current fixes remove the unbounded allocation behavior while preserving tool behavior for normal files.
+
+## 7. Verification
+
+Passed:
+
+- `go test ./internal/api ./internal/leviathan/spectrogram ./internal/leviathan/pdf ./internal/leviathan/binsnoop ./internal/updater ./internal/githubclient ./internal/secrets ./internal/recording ./internal/sshclient ./internal/sessions -count=1`
+- `go test ./... -count=1`
+- `npm --prefix frontend test`
+- `npm --prefix frontend run build`
+- `git diff --check`
+
+New tests cover oversized GitHub/update bodies, oversized spectrogram images, bounded Leviathan document reads, chunked patched-file writes, oversized public keys, oversized vault files, oversized PDFs, and BinSnoop file caps.

audits/20260616-1702-functionalityNextSteps.md

@@ -0,0 +1,138 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix pass improved robustness around local proxying, file imports, remote downloads, SSH key management, and frontend rendering. The app now fails earlier and more predictably when inputs are malformed or too large.
+
+Highest-impact next steps:
+
+- Manually verify packaged VNC connections after the new Origin allowlist.
+- Add UI copy for newly enforced limits.
+- Add CI coverage for the security checks run in this pass.
+- Continue frontend cleanup around dynamic `innerHTML`.
+
+## 2. Current Functional Risks
+
+VNC runtime compatibility:
+
+- The backend now allows missing, `wails://`, and loopback HTTP(S) origins. This should work for Wails/noVNC, but packaged app validation is still needed.
+
+Large-file and large-download behavior:
+
+- GitHub archive downloads now stop at 2 GiB. Very large repositories will fail fast.
+- SSH config imports now reject files above 5 MiB or more than 5000 Host blocks.
+
+SSH key generation:
+
+- RSA key generation is limited to 2048, 3072, and 4096 bits and times out after 30 seconds.
+- Slow systems should be checked with RSA 4096 to ensure the timeout is not too tight.
+
+Frontend:
+
+- SSH key manager dynamic rendering is safer. Other static `innerHTML` templates remain and should be reviewed when they take dynamic data.
+
+## 3. Code Quality Improvements
+
+Completed:
+
+- Added focused helper functions for VNC Origin validation.
+- Centralized GitHub endpoint construction and owner/repo parsing.
+- Added reusable archive stream limiting.
+- Added backend SSH key generation option validation.
+- Added import bounds to the SSH config parser.
+- Replaced SSH key manager dynamic modal HTML with DOM construction.
+
+Recommended refactors:
+
+- Move file-size and stream-size caps into named settings or a shared limits package if more subsystems need them.
+- Add a small frontend helper for safe modal construction so feature code stops hand-rolling modal `innerHTML`.
+- Consider a common backend "safe basename" helper for local and remote file operations.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+Recommended:
+
+- Show a specific VNC connection error if the proxy rejects an unexpected Origin in packaged builds.
+- Show clear messages for SSH config files that exceed size or Host-block limits.
+- Show clear messages for GitHub archives above the cap.
+- Add a hostile-filename E2E test for the SSH key delete confirmation modal.
+- Continue converting dynamic modal content to DOM nodes or `textContent`.
+
+## 5. Testing Roadmap
+
+Added in this pass:
+
+- VNC Origin allowlist tests.
+- SFTP upload parent-directory rejection tests.
+- SSH config file and Host-block limit tests.
+- SSH key generation option validation tests.
+- GitHub path escaping and archive cap tests.
+- Frontend regression checks for SSH key manager text rendering.
+
+Next tests:
+
+- Packaged Wails VNC smoke test on macOS, Windows, and Linux.
+- Browser/E2E test for SSH key filenames containing `<`, `>`, quotes, and ampersands.
+- HTTP integration test for GitHub archive download caps and escaped branch refs.
+- UI tests for limit-aware error messages.
+- CI job that runs Go tests, frontend tests, frontend build, `npm audit --omit=dev`, `govulncheck`, and `git diff --check`.
+
+## 6. Recommended New Functionality
+
+Useful additions:
+
+- Preferences for maximum GitHub archive download size.
+- A pre-download confirmation for large GitHub archives when Content-Length is known.
+- Import preview for OpenSSH config showing Host count before persistence.
+- A diagnostics panel for VNC proxy status, including local URL redaction, Origin decisions, and connection state.
+- A unified "Limits" help page that lists SFTP upload caps, GitHub archive cap, SSH config import cap, and Leviathan file caps.
+
+## 7. Next-Level Opportunities
+
+Architecture:
+
+- Centralize resource limits and expose them to both Go and frontend UI copy.
+- Add a secure modal builder and migrate risky frontend dialogs gradually.
+- Add structured security regression tests for every Wails method that accepts file paths, filenames, URLs, or base64 payloads.
+
+Operations:
+
+- Generate checksums for release artifacts.
+- Generate an SBOM during release.
+- Publish a short security hardening checklist in `docs/build-and-release.md`.
+
+Developer experience:
+
+- Add a `make security-check` target that runs the same commands used in this audit.
+- Add pre-commit or CI checks for `gofmt`, `go test`, frontend regression tests, and `git diff --check`.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Manually test packaged VNC on all supported platforms.
+- Keep the security patch tests in CI before release.
+
+Short-term:
+
+- Add user-facing messages for the new SSH config, GitHub archive, and SSH keygen limits.
+- Add E2E coverage for hostile SSH key filenames.
+- Add an HTTP test around GitHub archive download behavior.
+
+Medium-term:
+
+- Centralize app resource limits and expose them to UI/help.
+- Migrate high-risk frontend dynamic HTML patterns to safe modal helpers.
+- Add release checksums and SBOM generation.
+
+Long-term:
+
+- Add progressive/streaming UX for large GitHub and SFTP transfers.
+- Build a cross-platform packaged-app smoke test suite for Wails integrations.
+
+## 9. Caveats and Validation Needed
+
+- VNC Origin compatibility must be validated in packaged builds, not only unit tests.
+- The 2 GiB GitHub archive cap may need product tuning for users with very large repositories.
+- RSA 4096 key generation timeout should be checked on lower-powered machines.
+- The frontend build passed, but this pass did not interactively click through the SSH key modal in a real browser/WebView.

audits/20260616-1702-securityAudit.md

@@ -0,0 +1,641 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed the Wails API surface, local proxy behavior, file import paths, SSH key management, GitHub integration, frontend DOM sinks, dependency manifests, tests, and release workflow.
+
+Six concrete issues were fixed:
+
+- The local VNC WebSocket proxy accepted any browser `Origin` and did not cap client-to-proxy WebSocket message size.
+- SFTP browser uploads accepted the special filename `..`, allowing a Wails caller to escape the selected remote directory when the name was joined.
+- SSH config import parsed line-by-line but had no total file or Host-block cap.
+- Backend SSH key generation trusted caller-supplied key type and RSA bit count and had no process timeout.
+- GitHub repo/ref values were interpolated into API paths without escaping, and archive downloads had no explicit stream cap.
+- SSH key manager UI interpolated backend errors and filesystem-derived key names into `innerHTML`.
+
+Verification passed with targeted Go tests, full Go tests, frontend regression checks, frontend build, `npm audit --omit=dev`, `govulncheck`, and `git diff --check`.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go backend packages under `internal/`: API bindings, VNC proxy, GitHub client, SSH config import, SSH key management, SFTP upload helpers, validation, sessions, storage, secrets, updater, recording, Leviathan parser bounds, and tests.
+- Browser-facing JavaScript under `frontend/src/js`, especially SSH key management, SFTP upload flows, VNC integration, and dynamic HTML usage.
+- Frontend package manifest, lockfile, build scripts, and regression script.
+- Go module dependencies and reachable vulnerability state.
+- GitHub Actions release workflow.
+
+Not fully live-tested:
+
+- A packaged Wails desktop binary.
+- Real noVNC connections inside the packaged WebView after the new Origin policy.
+- Real GitHub Enterprise archive downloads above normal repository sizes.
+
+## 3. Methodology
+
+The review used static analysis, targeted source searches, dependency/advisory tooling, and focused regression tests. I mapped attacker-controlled inputs from the renderer and local files into Go methods, network clients, local HTTP/WebSocket services, subprocesses, remote SFTP paths, and DOM sinks. I prioritized issues that could be fixed with small behavior-preserving changes and backed by tests.
+
+Commands run:
+
+- `go test ./internal/vncclient ./internal/api ./internal/sshconfig ./internal/githubclient -count=1`
+- `npm --prefix frontend test`
+- `git diff --check`
+- `go test ./... -count=1`
+- `npm --prefix frontend run build`
+- `npm --prefix frontend audit --omit=dev`
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`
+
+## 4. Risk Rating Method
+
+Severity reflects exploit prerequisite, affected trust boundary, likely impact, and availability/confidentiality/integrity outcome:
+
+- Critical: remote unauthenticated compromise or secret disclosure.
+- High: practical compromise of credentials, host access, or arbitrary code execution.
+- Medium: meaningful local, renderer, remote service, or connected-server abuse with realistic prerequisites.
+- Low: local robustness issues, bounded DoS, or defense-in-depth gaps.
+- Informational: observations and hardening opportunities.
+
+Confidence reflects direct code evidence and testability. Findings fixed here are High confidence because they map to concrete files and new regression tests.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound `api.Service` methods callable from the renderer.
+- Local VNC WebSocket proxy bound to `127.0.0.1` on a random port and random token path.
+- SSH, Telnet, RAW TCP, VNC, SFTP, GitHub, updater, and Leviathan binary-analysis workflows.
+- Profile import/export, encrypted `.nexus` import, OpenSSH config import, recording playback, SSH key generation/deletion, and drag/drop upload flows.
+
+Trust boundaries:
+
+- Renderer to Go backend.
+- Local browser/WebView to loopback VNC proxy.
+- Local filesystem files selected or scanned by the app.
+- Remote SSH/SFTP/VNC/GitHub/update endpoints.
+- OS keychain/encrypted vault to profile storage and session runtime.
+
+Attacker starting positions considered:
+
+- Malicious local webpage attempting loopback WebSocket access.
+- Malicious or compromised renderer script.
+- Malicious local filename or selected config/import file.
+- Malicious GitHub Enterprise/API endpoint or unusual repo/ref metadata.
+- Malicious connected SSH/SFTP/VNC host.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---|---|---|---|---|
+| SEC-20260616-1702-001 | Medium | High | VNC proxy allowed all origins and uncapped WebSocket frames | `internal/vncclient` | Fixed |
+| SEC-20260616-1702-002 | Medium | High | SFTP upload name `..` escaped selected remote directory | `internal/api` SFTP upload helpers | Fixed |
+| SEC-20260616-1702-003 | Low | High | SSH config import lacked total file and Host-block bounds | `internal/sshconfig` | Fixed |
+| SEC-20260616-1702-004 | Low | High | SSH key generation allowed expensive caller-controlled options without timeout | `internal/api` SSH key management | Fixed |
+| SEC-20260616-1702-005 | Medium | High | GitHub repo/ref path interpolation and uncapped archive stream | `internal/githubclient` | Fixed |
+| SEC-20260616-1702-006 | Medium | High | SSH key manager rendered key names/errors through dynamic `innerHTML` | `frontend/src/js/sshkeys.js` | Fixed |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260616-1702-001
+
+#### Title
+
+VNC proxy allowed all origins and uncapped WebSocket frames
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/vncclient/vncclient.go`
+- `internal/vncclient/vncclient_test.go`
+- Local noVNC WebSocket proxy
+
+#### Description
+
+The VNC proxy was bound to loopback and protected by a random token path, but its Gorilla WebSocket upgrader accepted every `Origin`. It also read WebSocket messages without an explicit message size limit. If a proxy URL token leaked through logs, UI state, injected renderer code, or another local channel, a non-local browser origin could attempt to drive the active VNC TCP connection or send oversized frames that force memory allocation.
+
+#### Evidence
+
+Before the fix, `websocket.Upgrader.CheckOrigin` returned `true` for every request, and the proxy called `ws.ReadMessage()` without `SetReadLimit`.
+
+#### Attack Scenario
+
+A malicious local webpage or injected renderer script obtains an active `ws://127.0.0.1:<port>/<token>` URL. Because all origins were accepted, it could connect from a non-app origin and send very large WebSocket messages or VNC protocol bytes into the bridged TCP connection.
+
+#### Impact
+
+Potential local cross-origin abuse of active VNC sessions if the token is exposed, and avoidable memory pressure from oversized client-to-proxy WebSocket frames.
+
+#### Recommendation
+
+Allow only Wails and loopback browser origins, keep accepting missing origins for non-browser clients, and cap inbound WebSocket message size.
+
+#### Safer Example
+
+Implemented `allowProxyOrigin`, `isLoopbackHost`, and `ws.SetReadLimit(maxWebSocketMessageBytes)`.
+
+#### Suggested Tests
+
+Added `TestAllowProxyOrigin` for missing, Wails, loopback, remote, lookalike, and malformed origins.
+
+#### References
+
+- CWE-346: Origin Validation Error
+- CWE-400: Uncontrolled Resource Consumption
+- OWASP ASVS 14.4: HTTP security configuration
+
+#### Assumptions / Limitations
+
+The packaged Wails WebView should be manually tested to confirm its runtime Origin is covered by the `wails://` allow rule.
+
+### Finding ID: SEC-20260616-1702-002
+
+#### Title
+
+SFTP upload name `..` escaped selected remote directory
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`
+- `internal/api/api_test.go`
+- `SFTPUploadData`
+- `SFTPUploadStart`
+
+#### Description
+
+`safeSFTPUploadName` normalized slash variants and used `path.Base`, but did not reject the special basename `..`. `path.Join(remoteDir, "..")` resolves to the parent directory, so a Wails caller could escape the selected upload directory.
+
+#### Evidence
+
+The previous rejection covered empty, `.`, `/`, and NUL, but not `..`. The upload methods then used `path.Join(remoteDir, safeName)`.
+
+#### Attack Scenario
+
+A malicious renderer call invokes chunked upload with `remoteDir="/home/user/upload"` and `fileName=".."`. The destination path resolves to `/home/user`, outside the selected directory.
+
+#### Impact
+
+Unexpected remote writes/truncation attempts outside the user's selected SFTP directory, depending on server permissions and target type.
+
+#### Recommendation
+
+Reject `..` after basename normalization.
+
+#### Safer Example
+
+Implemented `safeName == ".."` rejection.
+
+#### Suggested Tests
+
+Added `TestSafeSFTPUploadNameRejectsParentDirectory`.
+
+#### References
+
+- CWE-22: Path Traversal
+- OWASP ASVS 12.3: File path control
+
+#### Assumptions / Limitations
+
+The browser `File.name` API normally does not produce `..`, but Wails API methods are still a trust boundary and should validate independently.
+
+### Finding ID: SEC-20260616-1702-003
+
+#### Title
+
+SSH config import lacked total file and Host-block bounds
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sshconfig/sshconfig.go`
+- `internal/sshconfig/sshconfig_test.go`
+- `ImportSSHConfig`
+
+#### Description
+
+The OpenSSH config parser scanned files line-by-line, but it did not cap total file size or the number of accumulated Host blocks. A very large selected config could allocate a large slice of parsed blocks and profiles.
+
+#### Evidence
+
+`ParseFile` opened the file and appended Host blocks to an in-memory slice until EOF.
+
+#### Attack Scenario
+
+A user imports a hostile or accidentally huge SSH config containing thousands of Host blocks. The app spends unnecessary CPU and memory parsing and converting entries.
+
+#### Impact
+
+Local denial of service or UI unresponsiveness during import.
+
+#### Recommendation
+
+Reject oversized config files, set a scanner line cap, and reject excessive Host-block counts.
+
+#### Safer Example
+
+Implemented `maxConfigFileBytes`, `maxConfigLineBytes`, and `maxHostBlocks`.
+
+#### Suggested Tests
+
+Added oversized-file and excessive-Host-block tests.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+
+#### Assumptions / Limitations
+
+The selected caps are conservative for normal OpenSSH config files. Extremely large enterprise configs may need batch import support later.
+
+### Finding ID: SEC-20260616-1702-004
+
+#### Title
+
+SSH key generation allowed expensive caller-controlled options without timeout
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go`
+- `internal/api/api_test.go`
+- `GenerateSSHKey`
+
+#### Description
+
+The frontend exposes fixed key-type and bit-size choices, but the backend method accepted caller-supplied values directly and ran `ssh-keygen` without a context timeout. A malformed renderer call could request unsupported types or excessive RSA bit sizes, tying up the subprocess.
+
+#### Evidence
+
+`GenerateSSHKey` passed `keyType` to `ssh-keygen -t` and only checked `bits > 0` for RSA before adding `-b`.
+
+#### Attack Scenario
+
+A malicious renderer call requests a very large RSA key size. `ssh-keygen` consumes CPU for an extended period or fails slowly.
+
+#### Impact
+
+Local CPU denial of service and poor recovery if the subprocess hangs.
+
+#### Recommendation
+
+Validate allowed key types and RSA sizes server-side, and execute `ssh-keygen` with a timeout.
+
+#### Safer Example
+
+Implemented `validateSSHKeyGenerationOptions` and `exec.CommandContext` with a 30 second timeout.
+
+#### Suggested Tests
+
+Added validation tests for defaults, RSA defaults, oversized RSA sizes, and unsupported key types.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-20: Improper Input Validation
+
+#### Assumptions / Limitations
+
+The timeout is a safety net, not a substitute for platform-level process controls. Real key generation should still be manually tested on slower hardware.
+
+### Finding ID: SEC-20260616-1702-005
+
+#### Title
+
+GitHub repo/ref path interpolation and uncapped archive stream
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/githubclient/githubclient.go`
+- `internal/githubclient/githubclient_test.go`
+- `FetchLatestCommit`
+- `DownloadRepoArchive`
+
+#### Description
+
+Repository full names and refs were interpolated into REST API paths without escaping. The archive download also streamed response bodies to disk without an explicit maximum. A malformed renderer call, unusual branch name, or compromised GitHub Enterprise endpoint could create surprising request paths or consume disk.
+
+#### Evidence
+
+The client built paths with `fmt.Sprintf("%s/repos/%s/commits/%s", ...)` and copied archives with `io.Copy(file, resp.Body)`.
+
+#### Attack Scenario
+
+A renderer calls archive download with a malformed repo full name containing extra path segments, or a malicious GitHub Enterprise endpoint returns an unbounded archive response.
+
+#### Impact
+
+Potential confused API requests using the user's GitHub token and local disk exhaustion from unbounded archive streams.
+
+#### Recommendation
+
+Require `owner/repo` format, URL-escape each API path segment, and cap archive streams.
+
+#### Safer Example
+
+Implemented `splitRepoFullName`, `endpointURL`, `copyLimitedArchive`, and a 2 GiB archive cap.
+
+#### Suggested Tests
+
+Added tests for escaped refs, malformed repo names, archive limit rejection, and at-limit copies.
+
+#### References
+
+- CWE-20: Improper Input Validation
+- CWE-22: Path Traversal style path confusion
+- CWE-400: Uncontrolled Resource Consumption
+
+#### Assumptions / Limitations
+
+The 2 GiB archive cap may reject unusually large repositories. A future preferences setting could make this user-configurable.
+
+### Finding ID: SEC-20260616-1702-006
+
+#### Title
+
+SSH key manager rendered key names/errors through dynamic `innerHTML`
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `frontend/src/js/sshkeys.js`
+- `frontend/scripts/test-regressions.js`
+- SSH key manager modal
+
+#### Description
+
+The SSH key manager interpolated backend error text and confirmation title/message/button text into `innerHTML`. Key names are derived from local `~/.ssh/*.pub` filenames, so a malicious local filename could inject HTML into the delete confirmation modal.
+
+#### Evidence
+
+The previous code used `list.innerHTML = `<div ...>${err}</div>`` and built confirmation modal HTML with `${title}`, `${message}`, and `${confirmLabel}`.
+
+#### Attack Scenario
+
+A local attacker creates an SSH public key file with an HTML-like filename. When the user opens the key manager and deletes it, the filename is interpolated into modal HTML.
+
+#### Impact
+
+DOM XSS in the Wails renderer, with possible access to app UI actions exposed to the renderer.
+
+#### Recommendation
+
+Render dynamic strings with `textContent` or DOM node construction.
+
+#### Safer Example
+
+Implemented text-node rendering for key load errors and confirmation modal dynamic text.
+
+#### Suggested Tests
+
+Added frontend regression checks to prevent the vulnerable interpolation pattern from returning.
+
+#### References
+
+- CWE-79: Cross-Site Scripting
+- OWASP ASVS 5.3: Output encoding
+
+#### Assumptions / Limitations
+
+Other static-template `innerHTML` use remains in the frontend and should continue to be reviewed when it accepts dynamic values.
+
+## 8. Blackhat-Style Abuse Paths
+
+Path 1: Token leak to VNC abuse
+
+- Prerequisite: an active VNC proxy URL leaks to a non-app webpage or injected script.
+- Old path: any Origin could connect and send arbitrary WebSocket frames to the VNC TCP bridge.
+- Breakpoint added: Wails/loopback Origin allowlist plus message cap.
+
+Path 2: Renderer-to-remote path escape
+
+- Prerequisite: malicious renderer code or direct Wails call.
+- Old path: call SFTP upload with filename `..`, causing `path.Join(remoteDir, "..")`.
+- Breakpoint added: `..` is rejected after basename normalization.
+
+Path 3: Local filename to renderer script injection
+
+- Prerequisite: crafted key filename in `~/.ssh`.
+- Old path: key name appears in confirmation modal HTML.
+- Breakpoint added: key names and errors use `textContent`.
+
+Path 4: Malicious GitHub Enterprise response to disk pressure
+
+- Prerequisite: user connects to compromised or malicious API base URL allowed by profile validation.
+- Old path: archive stream was copied until EOF.
+- Breakpoint added: Content-Length precheck and streaming cap.
+
+## 9. Denial-of-Service Review
+
+Fixed resource-control issues:
+
+- VNC inbound WebSocket message cap.
+- SSH config file size, line size, and Host-block caps.
+- SSH key generation input validation and subprocess timeout.
+- GitHub archive stream cap.
+
+Previously fixed and rechecked from recent audit context:
+
+- GitHub/update JSON response caps.
+- Leviathan bounded reads and chunked save/export paths.
+- SFTP inline/chunk upload caps.
+- Secret vault and SSH key file read caps.
+
+Residual DoS considerations:
+
+- SFTP directory listings depend on remote server behavior and can still return large lists.
+- GitHub repository enrichment intentionally caps total repositories but still performs concurrent commit lookups.
+- Very large legitimate GitHub archives above 2 GiB now fail fast.
+
+## 10. Dependency and Supply-Chain Review
+
+Results:
+
+- `npm --prefix frontend audit --omit=dev`: 0 vulnerabilities.
+- `govulncheck ./...`: no vulnerabilities found.
+
+Reviewed manifests:
+
+- `go.mod`
+- `go.sum`
+- `frontend/package.json`
+- `frontend/package-lock.json`
+- `.github/workflows/release-builds.yml`
+
+No high-confidence dependency findings were found in this pass.
+
+## 11. Secrets and Sensitive Data Review
+
+Checked:
+
+- No obvious private keys, GitHub tokens, cloud keys, or hardcoded credentials were found in source outside documentation/examples.
+- Non-secret profile export redaction was already covered by tests.
+- Secret access logging records secret type, not value.
+- GitHub Authorization headers are set only in HTTP requests and not logged by this code.
+
+Residual:
+
+- Plain exports without secrets are safer, but encrypted export remains the recommended path for portable backups.
+- Local audit logs should continue to avoid host/user secrets in future features.
+
+## 12. Authentication and Authorisation Review
+
+This is a local desktop application, so there are no server-side user roles or tenant boundaries. Relevant controls reviewed:
+
+- SSH host-key callback requirement for VNC SSH tunnels.
+- Known-host storage and verification paths.
+- Secret retrieval via keychain/vault and prompt callbacks.
+- GitHub token validation before repo fetch.
+
+No missing multi-user authorization checks apply to the current architecture.
+
+## 13. Input Validation and Output Encoding Review
+
+Fixed:
+
+- SFTP upload basename `..`.
+- SSH key generation key type and RSA bit sizes.
+- GitHub repo full-name format and path segment escaping.
+- SSH key manager dynamic output encoding.
+
+Previously present controls:
+
+- Profile validation rejects invalid hosts, ports, secret modes, GitHub HTTP non-loopback base URLs, and malformed protocol configs.
+- Import profiles are size-capped and validated before persistence.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+Fixed:
+
+- SSH key manager load errors now render via `textContent`.
+- SSH key deletion confirmation modal dynamic strings now render via DOM nodes/text.
+- Regression script now checks these patterns.
+
+Checked:
+
+- Wails service bridge ordering remains covered by regression checks.
+- SFTP drag/drop upload still uses chunked methods.
+- Direct VNC warning flow remains covered by regression checks.
+
+Residual:
+
+- Frontend still contains many static `innerHTML` templates. Future reviews should focus on any template that accepts local filesystem, remote host, profile, update, or GitHub data.
+
+## 15. Infrastructure and Deployment Review
+
+Reviewed:
+
+- GitHub Actions release workflow.
+- Wails build config.
+- Frontend build scripts.
+
+No new high-confidence release workflow finding was fixed. The workflow uses pinned major versions for common actions and default GitHub token permissions scoped to release attachment needs.
+
+Residual:
+
+- Consider adding checksums/SBOM generation for release artifacts.
+- Consider a CI job for `go test ./...`, frontend regression tests, `npm audit --omit=dev`, and `govulncheck`.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+Fixed:
+
+- SSH key manager no longer injects raw error strings into HTML.
+- GitHub malformed repo names now fail before request construction.
+- SSH keygen timeout returns a specific timeout error.
+
+Checked:
+
+- Error messages added in this pass do not include tokens, passwords, or key material.
+- Existing audit logger records profile/session actions and secret access metadata.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added:
+
+- VNC Origin allowlist tests.
+- SFTP parent-directory upload name tests.
+- SSH key generation option validation tests.
+- SSH config oversized file and Host-block cap tests.
+- GitHub URL escaping, malformed full-name, and archive cap tests.
+- Frontend static regression checks for SSH key manager safe rendering.
+
+Remaining gaps:
+
+- No packaged Wails/noVNC integration test for Origin behavior.
+- No E2E browser test for SSH key modal rendering with hostile filenames.
+- No integration test for GitHub archive cap against an HTTP test server.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Manually test VNC connections in a packaged Wails app to verify the Origin allowlist.
+- Keep the new security tests in CI.
+
+Short-term:
+
+- Add an E2E test for SSH key manager hostile filenames.
+- Add an HTTP integration test for GitHub archive caps and escaped refs.
+- Surface user-friendly errors for new caps in the UI.
+
+Medium-term:
+
+- Add CI security checks for `govulncheck`, `npm audit --omit=dev`, and `git diff --check`.
+- Add release artifact checksums and an SBOM.
+
+Long-term:
+
+- Continue replacing dynamic frontend `innerHTML` where data provenance is mixed.
+- Add configurable large-download limits for GitHub archives and SFTP operations.
+
+## 19. False Positives / Needs Manual Verification
+
+- VNC Origin policy should be validated in macOS, Windows, and Linux packaged Wails builds.
+- The 2 GiB GitHub archive cap should be validated against expected user repository sizes.
+- The SSH keygen 30 second timeout should be checked on slow hardware, especially for RSA 4096.
+
+## 20. Final Notes
+
+This pass focused on concrete, testable hardening rather than broad speculative rewrites. The remaining risk is mostly runtime validation and UX around newly explicit limits. The repo still has an unrelated sidebar CSS spacing change in the working tree that was not part of this security audit.

audits/20260624-0945-functionalityNextSteps.md

@@ -0,0 +1,79 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix-mode pass improved VS Code extension robustness by hardening the local bridge and webview CSP handling. The highest-impact next step is runtime validation in a real VS Code host: the source-level tests pass, but the extension panels and long-lived bridge event stream deserve manual smoke coverage after the HTTP timeout and nonce changes.
+
+The codebase already has useful regression coverage for prior security fixes. The main opportunity now is to reduce duplicated webview HTML patterns and add integration tests around the VS Code bridge, because that surface currently depends heavily on static checks.
+
+## 2. Current Functional Risks
+
+- VS Code bridge `/events` uses a long-lived SSE stream. The new server has read/header/idle limits but intentionally no global write timeout, so a real VS Code smoke test should confirm events still flow correctly during SSH/SFTP/VNC/GitHub sessions.
+- VS Code webview HTML is duplicated across many panel classes. CSP, nonce generation, escaping, and message wiring are now correct in reviewed files, but duplication increases future regression risk.
+- The Node extension bridge client reads bridge responses without an explicit response-size cap or request timeout. The bridge is local and trusted, but a stuck bridge can still degrade the extension UX.
+- Frontend/webview coverage is mostly static regression assertions. It catches known bug patterns but does not prove that panels render and handlers fire inside VS Code.
+
+## 3. Code Quality Improvements
+
+- Centralise webview scaffolding in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`: CSP generation, nonce creation, common style policy, and HTML shell construction should live in one helper per extension or a shared local module.
+- Wrap bridge HTTP requests in a small client helper with timeout, response-size cap, JSON decode error handling, and consistent error messages.
+- Consider replacing large inline template-string webviews with smaller render helpers that build trusted static shell plus escaped dynamic content. The current approach is workable, but it makes security review repetitive.
+- Keep the bridge handler helpers small and testable. `newBridgeHTTPServer` and `decodeLimitedJSON` are a useful pattern for future endpoints.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+- Add manual smoke steps for Nexus Connections, terminal, RAW, GitHub, IRC, VNC, Profile Editor, Settings, SFTP, Leviathan Tools, Leviathan Hex, and Leviathan tool panels.
+- Add non-sensitive `console.error` or visible status handling for JSON parse failures in VS Code webview message handlers where currently errors may be silent.
+- Validate that reconnect, resize, SFTP directory actions, GitHub refresh/download, and Leviathan tool execution still fire their expected events after panel reloads.
+- Confirm no webview logs secrets, bearer tokens, passwords, passphrases, private key material, or raw sensitive bridge responses.
+
+## 5. Testing Roadmap
+
+- Unit tests: keep `cmd/vscode-bridge` tests for server settings and body caps; add request method/auth tests for all bridge routes.
+- Integration tests: add socket-level bridge tests for slow headers, oversized headers, and idle connection cleanup.
+- VS Code extension smoke tests: exercise webview creation, command registration, bridge startup, one RPC, and one event frame.
+- Frontend interaction tests: use a browser/DOM harness for key Wails UI flows where practical, especially SFTP upload, profile import, SSH key management, and Leviathan mode switching.
+- Abuse-case tests: retain oversized import/upload/config tests and add edge cases whenever new parsers or bridge endpoints are introduced.
+- Release smoke tests: package VSIX files and assert expected files, CSP strings, media resources, and bridge executable permissions.
+
+## 6. Recommended New Functionality
+
+- Add an in-extension bridge diagnostics command that shows bridge status, version, last RPC error, and whether the event stream is connected, without exposing the bearer token.
+- Add a developer-only test command for the VS Code extension that opens each webview and posts a benign fixture state. This would make manual and automated smoke testing faster.
+- Add a small security status page or command that reports vault state, known-host policy, update-check source, and active local bridge address without sensitive values.
+
+## 7. Next-Level Opportunities
+
+- Create a shared webview rendering module for both Nexus and Leviathan extension panels, with typed helpers for CSP, escaping, buttons, and event wiring.
+- Introduce structured bridge RPC method allow-list metadata rather than reflective method dispatch alone. Reflection is convenient, but a visible allow-list would make the trust boundary easier to review.
+- Add observability around bridge request counts, rejected oversized requests, active event clients, and session lifecycle errors.
+- Add accessibility checks for VS Code webview panels, especially keyboard focus, button labels, and status updates in terminal/disconnected flows.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Smoke-test the committed fix in a real VS Code host.
+- Confirm `/events` remains stable during session state changes.
+
+Short-term:
+
+- Add bridge client timeout and response-size caps in the Node extension code.
+- Add VS Code extension smoke tests for panel construction and bridge RPC.
+- Consolidate CSP nonce creation and webview HTML policy helpers.
+
+Medium-term:
+
+- Replace static-only regression assertions with executable DOM or VS Code integration tests for high-value panels.
+- Add bridge route coverage for auth failures, method errors, malformed JSON, and event subscription lifecycle.
+
+Long-term:
+
+- Build a release validation pipeline for desktop app, bridge binary, and VSIX packages.
+- Add structured diagnostics and observability for local bridge health and rejected requests.
+
+## 9. Caveats and Validation Needed
+
+- Source and automated tests passed, but VS Code runtime behaviour was not manually exercised in this pass.
+- The CSP nonce change should be behaviour-preserving, but every webview panel should still be opened once in VS Code.
+- The bridge timeout settings are conservative for local RPC; long-running operations should continue reporting progress through events rather than blocking a single HTTP request indefinitely.

audits/20260624-0945-securityAudit.md

@@ -0,0 +1,361 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed the Nexus desktop app, VS Code extensions, local bridge process, frontend regression harness, prior audit findings, dependency manifests, and build/test configuration. The codebase is in a materially better posture than the earlier June audits: major Wails, SFTP, VNC proxy, GitHub API, import-size, SSH key generation, and frontend DOM issues were already fixed and covered by tests.
+
+Two remaining issues were confirmed and fixed in commit `3a16a14`:
+
+- The VS Code bridge's localhost HTTP server had no explicit header/body read timeouts and decoded JSON request bodies without a hard cap.
+- VS Code webview CSP nonces were derived from `Date.now()`, which made a script allow-list nonce predictable rather than cryptographically random.
+
+Verification passed with targeted bridge tests, full Go tests, frontend regression checks, frontend build, `npm audit --omit=dev`, `govulncheck`, JavaScript syntax checks, and `git diff --check`.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go backend packages under `internal/` and the `cmd/vscode-bridge` localhost JSON-RPC/SSE bridge.
+- Browser-facing frontend JavaScript and regression checks under `frontend/`.
+- VS Code extension webviews in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`.
+- Dependency manifests: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`, VS Code extension package manifests.
+- Build, release, and CI files including shell scripts and `.github/workflows/release-builds.yml`.
+- Existing audit reports under `audits/` to avoid duplicate findings.
+
+Not fully live-tested:
+
+- Packaged VS Code extensions inside a real VS Code host after the CSP nonce change.
+- Long-lived bridge event streams under deliberate slow-client conditions.
+- Packaged Wails binaries on all target operating systems.
+
+## 3. Methodology
+
+I used static review, adversarial attack-surface mapping, dependency review, configuration review, DoS review, frontend/webview review, and targeted regression tests. I traced attacker-controlled inputs from webviews, the VS Code extension host, local HTTP requests, imported files, remote services, and session events into filesystem, process, network, DOM, and parser boundaries.
+
+Commands run:
+
+- `node --check vscode/nexus/extension.js`
+- `node --check vscode/leviathan/extension.js`
+- `node --check frontend/scripts/test-regressions.js`
+- `go test ./cmd/vscode-bridge -count=1`
+- `npm --prefix frontend test`
+- `git diff --check`
+- `go test ./... -count=1`
+- `npm --prefix frontend run build`
+- `npm --prefix frontend audit --omit=dev`
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`
+
+## 4. Risk Rating Method
+
+Severity reflects attacker position, exploit practicality, affected trust boundary, and confidentiality/integrity/availability impact. Confidence reflects direct source evidence and regression coverage.
+
+- Critical: unauthenticated remote compromise or credential disclosure.
+- High: practical credential theft, code execution, or privilege escalation.
+- Medium: meaningful local, renderer, or connected-service abuse with realistic prerequisites.
+- Low: defence-in-depth or bounded local robustness issue.
+- Informational: hardening or validation gaps without a direct exploit path.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound API methods callable from the renderer.
+- VS Code extension webviews and their `postMessage` handlers.
+- `cmd/vscode-bridge` localhost HTTP endpoints: `/health`, `/rpc`, `/events`, and `/runtime/event`.
+- SSH, SFTP, Telnet, RAW TCP, VNC, GitHub, IRC, local shell, updater, recording, export/import, and Leviathan binary-analysis workflows.
+
+Trust boundaries:
+
+- Renderer/webview to Go backend.
+- Local browser or extension host to localhost bridge.
+- Local selected files and profile imports to parsers.
+- Remote GitHub, SSH/SFTP/VNC/IRC/Telnet/RAW endpoints to client code.
+- OS keychain/vault to profile/session runtime.
+
+Attacker starting positions considered:
+
+- Local unprivileged process attempting bridge resource exhaustion.
+- Malicious or compromised extension webview state.
+- Hostile remote service data rendered into webviews.
+- Malicious selected local file or imported profile/export.
+- Compromised connected host attempting terminal/session abuse.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---|---|---|---|---|
+| SEC-20260624-0945-001 | Low | High | VS Code bridge accepted unbounded HTTP parser work | `cmd/vscode-bridge` | Fixed in `3a16a14` |
+| SEC-20260624-0945-002 | Low | High | VS Code webview CSP nonces used predictable timestamps | `vscode/nexus`, `vscode/leviathan` | Fixed in `3a16a14` |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260624-0945-001
+
+#### Title
+
+VS Code bridge accepted unbounded HTTP parser work
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `cmd/vscode-bridge/main.go:120`
+- `cmd/vscode-bridge/main.go:212`
+- `cmd/vscode-bridge/main.go:230`
+- `cmd/vscode-bridge/main.go:336`
+- `cmd/vscode-bridge/main.go:346`
+- `cmd/vscode-bridge/main_test.go:11`
+- `cmd/vscode-bridge/main_test.go:28`
+- `cmd/vscode-bridge/main_test.go:48`
+
+#### Description
+
+The bridge listens only on localhost and requires a random bearer token, but the HTTP server previously used default server timeouts and decoded JSON bodies directly from `r.Body`. A local process, or a compromised component with bridge token access, could keep connections open or send oversized JSON to force unnecessary parser work and memory use.
+
+#### Evidence
+
+Before the fix, `server := &http.Server{Handler: mux}` used default timeout values, and `/rpc` plus `/runtime/event` called `json.NewDecoder(r.Body).Decode(...)` without `http.MaxBytesReader`.
+
+The fix adds explicit bridge limits at `cmd/vscode-bridge/main.go:50`, uses `newBridgeHTTPServer` at `cmd/vscode-bridge/main.go:126`, and applies `decodeLimitedJSON` in both POST handlers at `cmd/vscode-bridge/main.go:218` and `cmd/vscode-bridge/main.go:236`.
+
+#### Attack Scenario
+
+A local unprivileged process repeatedly connects to the bridge and sends slow headers or a large authenticated JSON body. Without timeouts and body caps, the bridge can spend disproportionate time and memory on unauthorised or oversized traffic.
+
+#### Impact
+
+Local denial of service against the VS Code extension bridge, causing sluggishness, failed RPCs, or event-stream disruption.
+
+#### Recommendation
+
+Set bounded HTTP server timeouts and header limits. Cap JSON request bodies before decoding. Keep long-lived SSE compatibility by avoiding a global `WriteTimeout` that would break event streams.
+
+#### Safer Example
+
+Implemented:
+
+```go
+r.Body = http.MaxBytesReader(w, r.Body, bridgeMaxJSONBodyBytes)
+return json.NewDecoder(r.Body).Decode(dst)
+```
+
+#### Suggested Tests
+
+Added tests that assert bridge timeout/header settings and oversized `/rpc` plus `/runtime/event` bodies are rejected before reflective service dispatch.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- OWASP ASVS 12.1: File and resource handling
+- OWASP API Security Top 10 API4: Unrestricted Resource Consumption
+
+#### Assumptions / Limitations
+
+The practical attacker is local, because the bridge binds to `127.0.0.1`. The bearer token remains an important control, but it is not a substitute for parser and server resource limits.
+
+### Finding ID: SEC-20260624-0945-002
+
+#### Title
+
+VS Code webview CSP nonces used predictable timestamps
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `vscode/nexus/extension.js:5`
+- `vscode/nexus/extension.js:10`
+- `vscode/nexus/extension.js:219`
+- `vscode/nexus/extension.js:554`
+- `vscode/nexus/extension.js:895`
+- `vscode/nexus/extension.js:1061`
+- `vscode/nexus/extension.js:1162`
+- `vscode/nexus/extension.js:1260`
+- `vscode/nexus/extension.js:1375`
+- `vscode/nexus/extension.js:1618`
+- `vscode/nexus/extension.js:1832`
+- `vscode/leviathan/extension.js:5`
+- `vscode/leviathan/extension.js:10`
+- `vscode/leviathan/extension.js:189`
+- `vscode/leviathan/extension.js:497`
+- `vscode/leviathan/extension.js:773`
+- `frontend/scripts/test-regressions.js:222`
+
+#### Description
+
+The VS Code webviews use CSP script nonces, but each nonce was previously `String(Date.now())`. CSP nonces are intended to be high-entropy, per-render allow-list values. A timestamp nonce is guessable and weakens CSP if an HTML injection primitive is introduced elsewhere.
+
+#### Evidence
+
+All `const nonce = String(Date.now());` occurrences in the VS Code extension files were replaced with `createCSPNonce()`, backed by `crypto.randomBytes(16).toString('base64')`.
+
+#### Attack Scenario
+
+An attacker finds or later introduces a webview HTML injection path that can emit a `<script nonce="...">` tag. A predictable timestamp nonce materially reduces the barrier to bypassing CSP, especially when the webview creation time is observable or inferable.
+
+#### Impact
+
+Defence-in-depth weakness for webview script execution controls. A full exploit still requires an injection path, but predictable nonces undermine the CSP layer that should contain that class of defect.
+
+#### Recommendation
+
+Generate CSP nonces with cryptographically secure random bytes for every webview render, and keep regression coverage preventing timestamp nonce reintroduction.
+
+#### Safer Example
+
+Implemented:
+
+```js
+function createCSPNonce() {
+  return crypto.randomBytes(16).toString('base64');
+}
+```
+
+#### Suggested Tests
+
+Added regression assertions that both VS Code extension files use `crypto.randomBytes(16).toString('base64')` and that `const nonce = String(Date.now());` is absent under `vscode/`.
+
+#### References
+
+- CWE-345: Insufficient Verification of Data Authenticity
+- CWE-693: Protection Mechanism Failure
+- OWASP ASVS 14.4: Security headers
+
+#### Assumptions / Limitations
+
+I did not confirm a current exploitable webview injection path in these files during this pass. This fix preserves the CSP guarantee if a future DOM/HTML bug appears.
+
+## 8. Blackhat-Style Abuse Paths
+
+Path 1: Local bridge exhaustion.
+
+Prerequisite: local code execution on the same machine. The attacker opens many slow or oversized bridge requests. Before the fix, default server settings and uncapped JSON decoding provided weaker resistance. Defensive breakpoint: `ReadHeaderTimeout`, `ReadTimeout`, `IdleTimeout`, `MaxHeaderBytes`, and `http.MaxBytesReader`.
+
+Path 2: Future webview injection to script execution.
+
+Prerequisite: an HTML injection sink in a VS Code webview. Predictable CSP nonces made it easier to craft a nonce-bearing script. Defensive breakpoint: cryptographic per-render nonces and continued escaping/text-node rendering.
+
+## 9. Denial-of-Service Review
+
+Fixed:
+
+- Local bridge header/body parsing now has explicit limits.
+- Oversized bridge JSON bodies are rejected before reflective RPC dispatch.
+
+Previously fixed and still covered by tests:
+
+- VNC WebSocket frame read limits.
+- SFTP upload chunk and streaming size controls.
+- SSH config import file and Host-block caps.
+- GitHub archive stream cap.
+- Update response caps.
+- Leviathan and recording file-size limits in reviewed paths.
+
+Residual DoS considerations:
+
+- Long-lived `/events` streams intentionally remain open; they should be observed under slow-client conditions in VS Code.
+- Remote SFTP operations still rely on remote server responsiveness and transport-level behaviour.
+- Binary-analysis features should continue adding per-tool time and output caps as new parsers are added.
+
+## 10. Dependency and Supply-Chain Review
+
+`npm --prefix frontend audit --omit=dev` reported zero production vulnerabilities. `govulncheck` reported no reachable Go vulnerabilities. The release workflow uses pinned major versions of common GitHub Actions but still installs Wails dynamically from the module version; that is acceptable but should be monitored in release hardening.
+
+## 11. Secrets and Sensitive Data Review
+
+No new hard-coded credentials or private keys were found in the changed files. The bridge token remains generated with `crypto/rand` and is emitted to the extension process over stdout. Secret storage continues to use OS keychain and encrypted vault mechanisms reviewed in earlier audits.
+
+## 12. Authentication and Authorisation Review
+
+The bridge still requires `Authorization: Bearer <token>`. The fix does not change bridge authorisation semantics. No new auth bypass was identified in this pass. Host key handling, SFTP path validation, GitHub URL validation, and profile validation had existing regression coverage from prior fixes.
+
+## 13. Input Validation and Output Encoding Review
+
+Fixed:
+
+- Bridge JSON input is bounded to 1 MiB before decoding.
+
+Checked:
+
+- VS Code webviews continue escaping interpolated profile, repository, SFTP, and Leviathan state before `innerHTML` usage in reviewed areas.
+- Frontend regression tests include prior checks for SSH key manager error rendering and SFTP upload name handling.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+Fixed:
+
+- VS Code webview CSP nonces are now cryptographically random.
+
+Checked:
+
+- Existing frontend regression script still passes.
+- JavaScript syntax checks pass for both VS Code extension files and the regression script.
+
+Manual validation still needed:
+
+- Open the Nexus and Leviathan VS Code webviews in a real VS Code host and confirm all panels load under the stricter nonce generation.
+
+## 15. Infrastructure and Deployment Review
+
+The GitHub Actions release workflow was reviewed for obvious command injection or secret leakage. No new finding was fixed here. It still uses broad `contents: write` permissions for release attachment, which is appropriate for the release job but should remain isolated to tag/manual workflows.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+Bridge oversized-body failures return structured JSON errors through the existing RPC error path. No sensitive values are logged by the new code. The bridge still logs startup/server failures through `log`.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added:
+
+- Bridge server resource-limit tests.
+- Oversized `/rpc` body test.
+- Oversized `/runtime/event` body test.
+- Regression assertions preventing timestamp CSP nonces in VS Code webviews.
+
+Remaining gaps:
+
+- No automated VS Code host integration test exercises all webview panels.
+- No slowloris-style integration test measures bridge timeout behaviour over real sockets.
+- No e2e test validates the long-lived SSE event stream after server timeout changes.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Manually smoke-test the packaged VS Code extension panels and bridge event stream.
+
+Short-term:
+
+- Add a small VS Code extension integration smoke test for webview creation and bridge RPC.
+- Add a socket-level bridge test for slow headers and idle connections.
+
+Medium-term:
+
+- Centralise VS Code webview HTML helpers so CSP, escaping, and nonce generation are not duplicated.
+- Add response-size caps and request timeouts in the Node extension bridge client.
+
+Long-term:
+
+- Add release-time security checks for packaged VSIX contents, binary hashes, and expected CSP coverage.
+
+## 19. False Positives / Needs Manual Verification
+
+- The CSP nonce issue is a defence-in-depth finding, not evidence of a currently exploitable XSS.
+- Bridge DoS impact is local because the bridge binds to localhost.
+- VS Code runtime behaviour was not manually validated inside the actual editor during this audit.
+
+## 20. Final Notes
+
+The confirmed issues were fixed and committed in `3a16a14`. The residual risk is mainly operational validation: verify the VS Code extension panels in a real host and keep expanding integration coverage for bridge and webview behaviour.

audits/20260729-1237-functionalityNextSteps.md

@@ -0,0 +1,197 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix-mode pass makes long-running Nexus processes more predictable:
+reconnect prompts no longer accumulate runtime listeners, unfinished SFTP
+uploads are bounded and cancelled with their owning sessions, and application
+shutdown drains prompt, listener, session, and upload state. IPv6 literals now
+work in the reviewed VNC, IRC tunnel, and connection-test paths.
+
+The full backend, race, frontend, build, syntax, and dependency checks pass.
+The highest-value next step is a packaged long-duration soak test using real
+local and remote tabs. Unit tests prove the new ownership rules, but only a live
+test will show whether CPU, memory, goroutine, descriptor, and remote-session
+counts remain flat across thousands of open/close/reconnect cycles.
+
+## 2. Current Functional Risks
+
+- Application-level cleanup is now explicit, but remote libraries and OS
+  resources need live soak validation with real SSH, SFTP, VNC, IRC, Telnet,
+  RAW, and local shell sessions.
+- SFTP partial-file removal is best-effort. If a transport is already dead,
+  Nexus can close its local writer but may be unable to remove the remote
+  partial file.
+- External Leviathan extractors can run subprocesses without a shared timeout,
+  output-byte cap, or file-count cap. This path should remain unexposed until
+  those controls exist.
+- Parser test coverage varies by format. Complex hostile files may still find
+  correctness or performance edge cases not represented by current fixtures.
+- Several frontend areas still render trusted templates through `innerHTML`.
+  Existing dynamic values are escaped in reviewed paths, but DOM-based
+  construction would be less fragile for future edits.
+- Four Go module versions have advisories in code paths Nexus does not call.
+  They are not current reachable vulnerabilities, but routine dependency
+  refresh will reduce future uncertainty.
+- POSIX permission tests do not establish equivalent Windows ACL behaviour.
+
+## 3. Code Quality Improvements
+
+- Make ownership visible in types and naming. Sessions should own reconnect
+  contexts, uploads, protocol clients, terminal resources, and timers through a
+  single idempotent close path.
+- Introduce a small lifecycle registry for application-level Wails listeners.
+  The new stored unsubscribe functions are correct; a shared helper would make
+  future listeners harder to leak.
+- Replace `time.After` in long-lived or high-frequency paths with owned timers
+  when cancellation or reuse matters. The current reconnect prompt has bounded
+  frequency, but an owned timer makes resource lifetime more explicit.
+- Return structured cleanup results for unfinished uploads: local writer
+  closed, remote partial removed, or remote removal unavailable. This would
+  improve diagnostics without turning cleanup failure into a tab-close
+  blocker.
+- Centralise network endpoint formatting so every protocol consistently uses
+  `net.JoinHostPort` and one port-validation helper.
+- Keep frontend regression assertions aligned with tracked source. The audit
+  removed assertions for the intentionally deleted VS Code tree and replaced
+  the obsolete CGO flag check with the current pure-Go invariant.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+- When a tab closes during an upload, display a brief non-blocking message that
+  the upload was cancelled and whether a remote partial file may remain.
+- Make credential-prompt cancellation explicit in the UI so a reconnect
+  cancellation is distinguishable from a wrong password or timeout.
+- Add an unobtrusive diagnostics panel showing counts only: open tabs, active
+  protocol sessions, reconnect workers, pending prompts, streaming uploads,
+  goroutines, and recent cleanup failures.
+- Disable or debounce reconnect controls while a reconnect is already in
+  progress.
+- Prefer `textContent`, element creation, and event delegation for dynamic UI
+  state. Keep `innerHTML` for reviewed static templates only.
+- Ensure every async action rechecks that its tab/session still exists before
+  updating the DOM. This prevents late remote responses from reviving stale
+  state or producing confusing errors.
+- Never put passwords, vault contents, tokens, private keys, bridge tokens, or
+  terminal contents in diagnostics or frontend logs.
+
+## 5. Testing Roadmap
+
+Immediate automated coverage:
+
+- Add tests that call `Service.Shutdown` and `Manager.Shutdown` twice to enforce
+  idempotence.
+- Add a race test where an SFTP chunk write, session close, and shutdown overlap.
+- Add tests for a capacity race where two upload starts pass the pre-check and
+  only one may claim the final slot.
+- Add address-table tests for IPv4, DNS names, bare IPv6, and scoped IPv6
+  literals.
+
+Packaged soak coverage:
+
+- Start with zero tabs and record CPU, RSS, goroutines, descriptors, and
+  listener/upload counts.
+- Repeat local terminal open/write/close and SSH open/reconnect/close at least
+  1,000 times.
+- Repeat cancelled credential prompts and interrupted SFTP uploads.
+- Leave two idle tabs open for several hours and confirm resource counts and
+  CPU settle rather than grow.
+- Shut down and verify all subprocesses, sockets, PTYs, uploads, and runtime
+  listeners terminate.
+
+Protocol integration coverage:
+
+- Real SFTP server: finish, cancel, disconnect mid-chunk, reconnect, dead
+  transport, and remote partial-file cleanup.
+- Real IPv6 endpoints for VNC and SSH-tunnelled IRC/VNC.
+- Host-key accept/reject/cancel and secret prompt cancel/timeout.
+- Slow or malicious peers for protocol read limits and cancellation.
+
+Parser and frontend coverage:
+
+- Fuzz the PE, ELF, Mach-O, SquashFS, PDF, archive, and transform entry points.
+- Add DOM tests for tab close during asynchronous callbacks.
+- Keep `npm test`, frontend build, `go vet`, focused race tests,
+  `govulncheck`, and `npm audit` as release gates.
+
+## 6. Recommended New Functionality
+
+- Add a resource diagnostics view with current and peak counts for tabs,
+  sessions, reconnects, prompts, uploads, goroutines, file descriptors where
+  available, and local child processes.
+- Add an optional "delete partial remote upload on disconnect" status/history
+  entry, including a retry action after reconnect.
+- Add a developer soak command that scripts repeated open/reconnect/close
+  cycles against safe fixture servers and emits a machine-readable resource
+  summary.
+- Add an export-permission warning when the destination filesystem cannot
+  enforce private file access.
+- Add a dependency-health command for development builds that reports the Go
+  toolchain version and last audit result without contacting external services
+  during normal application use.
+
+## 7. Next-Level Opportunities
+
+- Build one lifecycle coordinator that owns application listeners, service
+  uploads, sessions, reconnect workers, protocol clients, timers, and local
+  subprocesses. A small dependency graph would make shutdown ordering
+  testable.
+- Add pprof-enabled development builds and automated before/after heap,
+  goroutine, mutex, and CPU profile comparisons during soak tests.
+- Introduce fault injection around remote writes, EOF, connection resets,
+  prompt cancellation, delayed events, and shutdown.
+- Wrap external analysis tools in a sandbox-oriented runner with a context
+  deadline, process-group kill, private working directory, output byte/file
+  limits, and a minimal environment.
+- Add signed, reproducible release metadata and verify the expected Go
+  toolchain, module graph, frontend lock file, and artefact hashes in CI.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Run a packaged local/remote tab soak test and capture resource graphs before
+  and after `b5c7528`.
+- Validate interrupted SFTP uploads against a real server.
+- Confirm shutdown leaves no Nexus child process, PTY, listener, or open
+  connection.
+
+Short-term:
+
+- Add shutdown-idempotence and overlapping upload/close race tests.
+- Add resource counters and a development diagnostics view.
+- Refresh modules with unreachable advisories under a dedicated compatibility
+  change.
+- Add live IPv6 integration tests.
+
+Medium-term:
+
+- Add parser fuzzing and external extractor limits.
+- Reduce dynamic HTML construction and add DOM lifecycle tests.
+- Add fault-injected protocol integration tests.
+
+Long-term:
+
+- Make packaged soak, vulnerability, dependency, race, and artefact checks part
+  of release qualification.
+- Track resource-count baselines so gradual lifecycle regressions fail before
+  release.
+
+## 9. Caveats and Validation Needed
+
+- Automated checks passed, but no packaged Wails application was opened during
+  this audit.
+- No real remote protocol server was used, so remote partial-file behaviour and
+  third-party client cleanup still need live confirmation.
+- The CPU symptom was not reproduced under a profiler in this pass. The
+  reconnect listener leak and upload leak were confirmed from source and fixed,
+  but they should not be claimed as the only possible causes of historical
+  high CPU without a profile from an affected long-running process.
+- Filesystem permission behaviour was validated on the current POSIX host, not
+  Windows ACLs or every network filesystem.
+- `clear` reduces the lifetime of mutable sensitive byte slices but does not
+  guarantee complete memory erasure in Go.
+- `govulncheck` reports no reachable vulnerability after the toolchain update;
+  its four module-only advisories still deserve normal upgrade testing.
+- The deleted VS Code extension sources were not audited as current code. Only
+  the still-tracked Go bridge was reviewed.

audits/20260729-1237-securityAudit.md

@@ -0,0 +1,858 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed the current Nexus desktop application, its local
+VS Code bridge process, browser-facing frontend, session and upload lifecycles,
+credential handling, network clients, encrypted storage and export, Leviathan
+file analysis, build/release configuration, dependencies, and earlier audit
+reports.
+
+No Critical or High severity vulnerability was confirmed. Four
+evidence-backed findings were fixed in commit `b5c7528`:
+
+- Auto-reconnect credential prompts registered a permanent Wails listener on
+  every prompt. Long-running processes with repeated reconnects accumulated
+  callbacks and unnecessary event-dispatch work.
+- Interrupted streaming SFTP uploads could retain open remote writers and
+  in-memory upload entries after their session closed. Concurrent unfinished
+  uploads were not bounded.
+- The accepted Go toolchain range included versions affected by a reachable
+  standard-library TLS privacy vulnerability.
+- Encrypted exports and Leviathan carve output did not consistently enforce
+  private local file permissions. Short-lived plaintext and derived key byte
+  slices were also retained until garbage collection.
+
+The same commit fixed malformed IPv6 host/port construction in VNC, IRC SSH
+tunnels, and the connection tester, and repaired stale frontend regression
+assertions left behind when the VS Code extension tree and CGO build were
+removed.
+
+All Go tests, focused race tests, Go vet, the complete frontend test suite,
+frontend production build, JavaScript and shell syntax checks, PHP syntax
+check, `npm audit`, and the reachable Go vulnerability scan pass. Live remote
+protocol testing and packaged desktop testing remain manual validation items.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go packages under `internal/`, including sessions, SSH, SFTP, VNC, IRC,
+  Telnet, RAW TCP, local shells, storage, vault/keychain integration,
+  recording, updater, GitHub client, import/export, and Leviathan.
+- The localhost service bridge in `cmd/vscode-bridge`.
+- Frontend source, lifecycle handling, DOM construction, timers, Wails event
+  subscriptions, build scripts, and regression harness under `frontend/`.
+- Network address construction, host-key verification, connection setup, and
+  session shutdown paths.
+- Dependency manifests and lock files.
+- Build, release, update, and CI configuration.
+- Earlier reports under `audits/`, to distinguish regressions from already
+  fixed findings.
+
+Not live-tested:
+
+- Packaged Wails applications on every supported operating system.
+- Real SSH, SFTP, VNC, IRC, Telnet, RAW, GitHub, or update endpoints.
+- Malicious network peers under sustained load.
+- External Leviathan extractor tools. Their extraction path is not currently
+  exposed by the active Wails document response.
+- A VS Code extension runtime, because the `vscode/` source tree was
+  intentionally removed in commit `4fc3b19`.
+
+## 3. Methodology
+
+The review combined:
+
+- Repository and Git-history inspection.
+- Trust-boundary and attacker-starting-position mapping.
+- Static review of authentication, authorisation, secrets, cryptography,
+  filesystem operations, command execution, parsers, network clients, event
+  listeners, goroutines, timers, and cleanup paths.
+- Adversarial resource-exhaustion review, with particular attention to a
+  process that has run for a long time while tabs and sessions are repeatedly
+  opened, reconnected, and closed.
+- Frontend sink/source review for unsafe HTML, event-listener accumulation,
+  timers, stale state, and privileged Wails calls.
+- Dependency and supply-chain scanning.
+- Focused regression tests followed by broad test, race, build, syntax, and
+  static-analysis checks.
+
+Principal validation commands:
+
+- `go test ./... -count=1`
+- `go test -race ./internal/sessions ./internal/api ./internal/exportimport ./internal/vncclient ./cmd/vscode-bridge -count=1`
+- `go vet ./...`
+- `go run golang.org/x/vuln/cmd/govulncheck@latest -show verbose ./...`
+- `go run github.com/securego/gosec/v2/cmd/gosec@latest ./...`
+- `npm test` in `frontend/`
+- `npm run build` in `frontend/`
+- `npm audit --json` in `frontend/`
+- `node --check` for changed JavaScript
+- `bash -n build.sh build-all.sh release.sh scripts/build-common.sh`
+- `php -l updates/index.php`
+- `git diff --check`
+
+## 4. Risk Rating Method
+
+Severity reflects attacker position, prerequisites, exploit repeatability,
+trust-boundary impact, and confidentiality, integrity, and availability
+consequences.
+
+- Critical: practical unauthenticated remote compromise or broad secret
+  disclosure.
+- High: practical code execution, credential theft, or privilege escalation.
+- Medium: meaningful local, renderer, connected-peer, or privacy impact with
+  realistic prerequisites.
+- Low: bounded local exposure, defence-in-depth weakness, or correctness issue
+  with a security consequence.
+- Informational: hardening or validation work without a confirmed exploit.
+
+Confidence reflects the strength of source evidence, reproduction, scanner
+evidence, and regression coverage. Severity is not increased merely because a
+scanner reports a possible pattern.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound service methods invoked by the desktop renderer.
+- Runtime events crossing between frontend JavaScript and Go.
+- The token-authenticated localhost bridge endpoints.
+- User-selected SSH, SFTP, VNC, IRC, Telnet, RAW TCP, GitHub, and update
+  endpoints.
+- Imported profiles, OpenSSH configuration, encrypted Nexus exports,
+  recordings, and files selected for Leviathan analysis.
+- Local shell commands and SSH key generation.
+
+Trust boundaries:
+
+- Renderer to privileged Go backend.
+- Local bridge client to localhost HTTP/RPC service.
+- OS keychain or encrypted vault to runtime session credentials.
+- Remote network data to protocol clients and frontend rendering.
+- User-selected or hostile files to parsers and external analysis tooling.
+- Release workflow and update manifest to installed application binaries.
+
+Attacker starting positions considered:
+
+- A malicious or compromised remote service.
+- A hostile local file or imported configuration.
+- A local unprivileged process targeting the localhost bridge or filesystem
+  artefacts.
+- A renderer injection or future renderer compromise invoking bound methods.
+- An observer of TLS traffic.
+- A legitimate local user accidentally creating unbounded resource state over
+  a long-running process.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---|---|---|---|---|
+| SEC-20260729-1237-001 | Medium | High | Reconnect credential prompts accumulated permanent runtime listeners | `internal/sessions` | Fixed in `b5c7528` |
+| SEC-20260729-1237-002 | Medium | High | Interrupted SFTP uploads retained resources without a concurrency bound | `internal/api` | Fixed in `b5c7528` |
+| SEC-20260729-1237-003 | Medium | High | Build accepted a Go toolchain with a reachable TLS privacy vulnerability | `go.mod`, build scripts | Fixed in `b5c7528` |
+| SEC-20260729-1237-004 | Low | High | Sensitive local artefacts did not consistently enforce private permissions | Export/import and Leviathan | Fixed in `b5c7528` |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260729-1237-001
+
+#### Title
+
+Reconnect credential prompts accumulated permanent runtime listeners
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sessions/manager.go:110`
+- `internal/sessions/manager.go:676`
+- `internal/sessions/manager.go:2577`
+- `internal/sessions/manager.go:2615`
+- `internal/sessions/manager.go:2654`
+- `internal/sessions/manager_test.go:383`
+- `cmd/vscode-bridge/main.go:187`
+- `internal/app/app.go:118`
+
+#### Description
+
+Every credential request created during automatic reconnect registered another
+`session:secret:response` Wails listener. The listener was never unregistered,
+including after a response, timeout, cancelled reconnect, session close, or
+application shutdown.
+
+The request ID check prevented one prompt from accepting another prompt's
+value, but all historical callbacks were still invoked for every future
+credential response. A process left open for a long time could therefore
+accumulate event callbacks in proportion to its reconnect history. A closed
+session could also leave a credential prompt waiting for its full timeout.
+
+#### Evidence
+
+Before the fix, `buildInteractiveSecretCallback` called
+`wailsRuntime.EventsOn` inside the callback created for each prompt and
+discarded the returned unsubscribe function.
+
+The fix registers one manager-level response router from `SetContext`, stores
+the unsubscribe function, routes responses through a request-ID map, honours
+frontend cancellation, and selects on the reconnect context. `Shutdown`
+unregisters both host-key and credential listeners and releases all waiters.
+Application and bridge shutdown now call the complete service and manager
+shutdown methods.
+
+#### Attack Scenario
+
+A remote SSH or IRC service repeatedly drops connections after authentication,
+or a user repeatedly opens and reconnects profiles that require an interactive
+secret. Historical event listeners accumulate. Later secret responses fan out
+to all callbacks, increasing CPU work and retained memory even though old tabs
+are closed.
+
+#### Impact
+
+Progressive memory and CPU consumption in a long-running process, sluggish
+credential prompts, delayed shutdown, and eventual application availability
+loss. The request-ID routing means no cross-session secret disclosure was
+confirmed.
+
+#### Recommendation
+
+Use one application-lifetime event listener per event type, route responses by
+opaque request ID, bind every waiter to a cancellation context, and explicitly
+unsubscribe and release waiters during shutdown.
+
+#### Safer Example
+
+Implemented in outline:
+
+```go
+cancel := wailsRuntime.EventsOn(ctx, "session:secret:response", m.handleSecretResponse)
+m.secretListenerCancel = cancel
+
+select {
+case response := <-ch:
+    return response.value, cancellationError(response)
+case <-ctx.Done():
+    return "", ctx.Err()
+}
+```
+
+#### Suggested Tests
+
+Added tests verify request-ID routing, reconnect-context cancellation, frontend
+cancellation, pending-map cleanup, and shutdown waiter release. The focused
+race suite passes.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-772: Missing Release of Resource after Effective Lifetime
+
+#### Assumptions / Limitations
+
+No packaged Wails runtime stress test was run. The defect and fix are directly
+visible in source, and the routing/cancellation logic is covered at Go level.
+
+### Finding ID: SEC-20260729-1237-002
+
+#### Title
+
+Interrupted SFTP uploads retained resources without a concurrency bound
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go:52`
+- `internal/api/api.go:117`
+- `internal/api/api.go:469`
+- `internal/api/api.go:475`
+- `internal/api/api.go:515`
+- `internal/api/api.go:1569`
+- `internal/api/api.go:2189`
+- `internal/api/api.go:2202`
+- `internal/api/api_test.go:145`
+
+#### Description
+
+Streaming SFTP upload state held an open remote writer in the service upload
+map. Finish and explicit cancel removed it, but disconnecting, reconnecting, or
+closing the owning session did not. Application shutdown also did not drain
+unfinished uploads. There was no limit on the number of simultaneously open
+streaming uploads.
+
+#### Evidence
+
+The earlier lifecycle paths called the session manager directly without
+visiting the upload map. `SFTPUploadStart` inserted every new writer without a
+capacity check.
+
+The fix:
+
+- Caps active streaming uploads at 16.
+- Checks capacity before opening a remote writer and atomically rechecks before
+  insertion.
+- Removes and closes uploads belonging to a session before disconnect or
+  reconnect.
+- Drains every upload during close-all and service shutdown.
+- Best-effort removes the partial remote file.
+- Releases secret-prompt waiters and the service's Wails listener during
+  shutdown as part of the same lifecycle hardening.
+
+#### Attack Scenario
+
+A compromised renderer, automation loop, or repeated user action starts
+uploads and closes the associated tabs or sessions without finishing them.
+Each iteration can retain a local map entry, SFTP request state, remote file
+handle, and partially written file. Repetition eventually exhausts descriptors,
+memory, or server-side resources.
+
+#### Impact
+
+Local and remote resource exhaustion, failed subsequent uploads, leaked partial
+files, and degraded session availability.
+
+#### Recommendation
+
+Make resource ownership explicit: uploads must be owned by a session and
+cancelled when that session ends. Bound concurrent work and keep a race-safe
+second capacity check after expensive setup.
+
+#### Safer Example
+
+Implemented:
+
+```go
+func (s *Service) DisconnectSession(sessionID string) error {
+    s.cancelSFTPUploads(sessionID)
+    return s.sessions.Disconnect(sessionID)
+}
+```
+
+#### Suggested Tests
+
+Added tests verify session-scoped cancellation, unrelated-upload preservation,
+the active-upload limit, writer closure, and shutdown cleanup. Full and race
+tests pass.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-404: Improper Resource Shutdown or Release
+- CWE-772: Missing Release of Resource after Effective Lifetime
+
+#### Assumptions / Limitations
+
+No real SFTP server was used to verify partial-file deletion after a transport
+failure. Removal is best-effort because the session may already be unavailable;
+local writer and map cleanup do not depend on remote deletion succeeding.
+
+### Finding ID: SEC-20260729-1237-003
+
+#### Title
+
+Build accepted a Go toolchain with a reachable TLS privacy vulnerability
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `go.mod:3`
+- `go.mod:5`
+- `build.sh:21`
+- `build-all.sh:20`
+
+#### Description
+
+The build accepted Go 1.25.0 and the local build used Go 1.26.4.
+`govulncheck` identified GO-2026-5856 / CVE-2026-42505 in a reachable
+`crypto/tls` path. Affected clients could expose TLS PSK identities in a
+plaintext ClientHello while Encrypted Client Hello was in use, allowing a
+passive observer to undermine ECH privacy.
+
+#### Evidence
+
+The pre-fix scan reported the standard-library vulnerability as reachable.
+The [official Go vulnerability record](https://pkg.go.dev/vuln/GO-2026-5856)
+states that Go 1.25 is fixed in 1.25.12 and Go 1.26 is fixed in 1.26.5.
+
+The fix raises the module minimum to Go 1.25.12, requests toolchain Go 1.26.5,
+and aligns both Unix build scripts with the new minimum. The post-fix verbose
+scan used the Go 1.26.5 standard library and reported zero symbol or package
+vulnerabilities affecting Nexus.
+
+#### Attack Scenario
+
+Where ECH and PSK resumption are used, a passive network observer records the
+client's plaintext ClientHello and correlates an exposed PSK identity with the
+protected destination.
+
+#### Impact
+
+Conditional network privacy disclosure. No private key or application
+credential extraction was demonstrated. Nexus does not explicitly configure
+ECH, so actual exposure depends on TLS configuration and runtime behaviour.
+
+#### Recommendation
+
+Enforce fixed toolchain floors in `go.mod`, local build scripts, and CI. Keep
+`govulncheck` in release validation so standard-library vulnerabilities cannot
+be missed by module-only scanners.
+
+#### Safer Example
+
+Implemented:
+
+```text
+go 1.25.12
+toolchain go1.26.5
+```
+
+#### Suggested Tests
+
+Run `go version` and verbose `govulncheck` in release CI, and fail if a
+reachable symbol-level vulnerability is reported.
+
+#### References
+
+- GO-2026-5856
+- CVE-2026-42505
+- CWE-200: Exposure of Sensitive Information
+
+#### Assumptions / Limitations
+
+The scanner established a reachable TLS symbol path, not that Nexus actively
+negotiated ECH with a vulnerable server during this audit. Severity therefore
+reflects conditional exploitability.
+
+### Finding ID: SEC-20260729-1237-004
+
+#### Title
+
+Sensitive local artefacts did not consistently enforce private permissions
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/exportimport/exportimport.go:68`
+- `internal/exportimport/exportimport.go:111`
+- `internal/exportimport/exportimport.go:116`
+- `internal/exportimport/exportimport.go:170`
+- `internal/exportimport/exportimport_test.go:108`
+- `internal/leviathan/binsnoop/binsnoop.go:137`
+- `internal/leviathan/binsnoop/binsnoop.go:141`
+- `internal/leviathan/binsnoop/extract.go:17`
+- `internal/leviathan/binsnoop/extract.go:20`
+- `internal/leviathan/binsnoop/common_test.go:25`
+
+#### Description
+
+Encrypted profile exports were created through `os.Create`, which normally
+uses mode `0666` filtered by the process umask. Overwriting an existing file
+also preserved its existing mode. Leviathan carved binary data and extraction
+directories used `0644` and `0755`. Carved content can include credentials,
+private keys, firmware configuration, or other forensic secrets.
+
+Export encryption keys, password byte slices, and decrypted plaintext byte
+slices also remained live until garbage collection after use.
+
+#### Evidence
+
+The fix opens exports with mode `0600` and explicitly applies `Chmod(0600)` so
+an existing permissive destination is tightened. Leviathan-owned carve files
+now use `0600`, and directories use `0700`. Export/import makes a best-effort
+`clear` of transient password, derived-key, and plaintext byte slices.
+
+#### Attack Scenario
+
+On a multi-user host, another local account reads a carved private key or
+configuration from a world-readable output file. For an export destination
+that already had permissive permissions, another account can copy the
+encrypted profile bundle for offline password guessing.
+
+#### Impact
+
+Local confidentiality exposure. The export remains protected by Argon2id and
+AES-GCM, which significantly reduces its immediate sensitivity; raw carve
+output has no equivalent encryption.
+
+#### Recommendation
+
+Create sensitive artefacts and parent directories with private modes, tighten
+existing destinations explicitly, and minimise the lifetime of mutable
+plaintext and key buffers. Document that Go strings and internal copies cannot
+be guaranteed to be erased.
+
+#### Safer Example
+
+Implemented:
+
+```go
+f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+if err == nil {
+    err = f.Chmod(0600)
+}
+```
+
+#### Suggested Tests
+
+POSIX-only regression tests verify `0600` export and carve files and a `0700`
+carve directory, including overwriting a pre-existing `0644` export.
+
+#### References
+
+- CWE-276: Incorrect Default Permissions
+- CWE-316: Cleartext Storage of Sensitive Information in Memory
+
+#### Assumptions / Limitations
+
+POSIX mode bits are not equivalent on Windows, so permission tests skip there.
+`clear` is best-effort in Go and cannot erase immutable password strings,
+copies held by libraries, or compiler-created copies. External extraction
+tools may choose their own modes for files they create beneath the private
+directory.
+
+## 8. Blackhat-Style Abuse Paths
+
+### Path 1: Reconnect churn to process exhaustion
+
+Prerequisite: a profile needs an interactive credential during automatic
+reconnect. A hostile endpoint repeatedly drops the connection. Before the fix,
+each prompt left another Wails listener behind. Defensive breakpoint:
+application-level listener routing, context cancellation, and shutdown
+unsubscribe.
+
+### Path 2: Renderer-driven SFTP handle exhaustion
+
+Prerequisite: renderer access to bound service methods. Start streaming uploads
+without finishing them, then close or reconnect sessions repeatedly. Before the
+fix, writers and upload entries survived. Defensive breakpoint: the 16-upload
+cap and session-owned cancellation.
+
+### Path 3: Passive observation of vulnerable TLS ECH
+
+Prerequisite: affected Go runtime, ECH/PSK behaviour, and network visibility.
+Observe plaintext ClientHello state and correlate exposed PSK identity.
+Defensive breakpoint: Go 1.25.12 or 1.26.5 and later.
+
+### Path 4: Local recovery of carved secrets
+
+Prerequisite: another local account can traverse the selected output location.
+Read a `0644` carved file containing a private key or configuration secret.
+Defensive breakpoint: `0700` directories and `0600` files.
+
+No practical chain to unauthenticated remote code execution was identified.
+
+## 9. Denial-of-Service Review
+
+Fixed in this audit:
+
+- Reconnect secret listeners no longer grow with historical prompt count.
+- Cancelled reconnect prompts stop immediately instead of waiting up to 60
+  seconds.
+- Session close/reconnect and application shutdown drain streaming uploads.
+- Concurrent streaming uploads are capped at 16.
+- Runtime listeners and prompt waiters are released at shutdown.
+- IPv6 literals are joined with ports correctly, preventing connection failure
+  and misleading repeated retry behaviour.
+
+Previously hardened and rechecked:
+
+- SFTP inline/chunk/total upload size caps.
+- VNC WebSocket frame limits.
+- GitHub archive and update-response size limits.
+- SSH configuration and public-key input caps.
+- Recording and Leviathan file-size limits in exposed paths.
+- Session timers, latency pings, frontend intervals, and closed-tab lifecycle
+  cleanup covered by the current regression tests.
+
+Residual considerations:
+
+- Network protocols ultimately depend on remote peer responsiveness.
+- External Leviathan tools lack a shared timeout/output-budget wrapper, but
+  that path is not currently exposed by the active UI API.
+- Hostile binary parsers deserve continued fuzzing even where current bounds
+  checks reject malformed offsets.
+
+## 10. Dependency and Supply-Chain Review
+
+`npm audit --json` reported zero vulnerabilities across 33 frontend
+dependencies.
+
+Post-fix `govulncheck -show verbose` reported:
+
+- Zero vulnerabilities in symbols Nexus calls.
+- Zero vulnerabilities in imported package call paths.
+- Four advisories in required module versions that Nexus does not appear to
+  call:
+  - GO-2026-5970 in `golang.org/x/text@v0.37.0`.
+  - GO-2026-5942 in `golang.org/x/net@v0.55.0`.
+  - GO-2026-5932 for the unmaintained `x/crypto/openpgp` package.
+  - GO-2026-5841 in `github.com/klauspost/compress/s2@v1.17.11`.
+
+Those versions should be refreshed through normal dependency maintenance, but
+they were not forcibly upgraded in this fix because the scanner found no
+Nexus call path and broad transitive churn would require separate compatibility
+testing.
+
+The release workflow uses common GitHub Actions by major version and a
+write-capable release job. Pinning actions to immutable commit SHAs would
+further reduce supply-chain drift. Release permissions should remain scoped to
+the release job and tag/manual triggers.
+
+## 11. Secrets and Sensitive Data Review
+
+No hard-coded production credential, private key, token, or certificate was
+found. Test secrets were confined to test fixtures.
+
+Reviewed controls:
+
+- OS keychain integration.
+- Argon2id-derived AES-GCM vault and export encryption.
+- SSH host-key verification and known-host handling.
+- Bridge bearer token generation and comparison.
+- Secret prompt routing and cancellation.
+- Sensitive file permissions.
+- Logging and frontend error paths for obvious secret disclosure.
+
+Fixed:
+
+- Best-effort clearing of mutable export/import plaintext, password bytes, and
+  derived keys.
+- Private export and carve modes.
+- Prompt waiters and listeners released during shutdown.
+
+Residual:
+
+- Go strings and library copies cannot be reliably zeroed.
+- Users may explicitly choose plaintext Telnet, RAW TCP, or non-TLS VNC.
+- A user can explicitly select insecure SSH host-key behaviour; that choice
+  remains a visible compatibility option and should not be the default.
+
+## 12. Authentication and Authorisation Review
+
+Nexus is a single-user desktop client rather than a multi-tenant server. Its
+primary authorisation boundary is the logged-in OS account plus the Wails
+renderer/backend boundary.
+
+Checked:
+
+- Local bridge endpoints retain bearer-token authentication.
+- SSH host-key callbacks are required in the reviewed direct and tunnel paths.
+- GitHub and remote-session credentials are retrieved from configured secret
+  stores or interactive prompts.
+- Sensitive service methods validate session identifiers through the manager
+  and validate paths, sizes, or option allow-lists where applicable.
+
+No new authentication bypass or cross-user authorisation defect was confirmed.
+A future renderer compromise would still have substantial privileges because
+Wails-bound methods are designed for the trusted desktop UI; maintaining output
+encoding and a narrow method surface therefore remains important.
+
+## 13. Input Validation and Output Encoding Review
+
+Reviewed:
+
+- Profile fields, ports, hostnames, paths, filenames, import strategies,
+  archive/update URLs, SSH key options, recording files, binary offsets, and
+  base64 upload chunks.
+- HTML construction and text insertion in frontend modules.
+- Local subprocess arguments for shell, `ssh-keygen`, and Leviathan extraction.
+
+Fixed:
+
+- `net.JoinHostPort` now constructs IPv4, hostname, and IPv6 endpoints in VNC,
+  IRC SSH tunnels, and the connection tester.
+- Existing SFTP validation is now combined with a concurrency limit and
+  lifecycle cleanup.
+
+Scanner findings for MD5/SHA-1 in Leviathan are intentional forensic hash
+identifiers, not password or signature protection. Representative integer
+conversion and slice warnings in hostile-file parsers were manually traced to
+existing bounds checks; no concrete out-of-bounds path was confirmed. Parser
+fuzzing remains preferable to broad speculative casting changes.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+The frontend contains numerous event listeners because each tab and modal owns
+interactive DOM. Reviewed tab/session paths attach handlers to ephemeral nodes
+that become collectable when their owning DOM is removed, while application
+listeners and intervals have explicit one-time or cleanup behaviour.
+
+Current regression coverage verifies session cleanup, active latency timer
+behaviour, closed-tab release, safe DOM patterns, upload constraints, build
+hardening, and other earlier fixes.
+
+The aggregate test harness still referenced VS Code files deleted in
+`4fc3b19` and a CGO flag removed by the same pure-Go migration. This caused
+`npm test` to fail before reaching its current assertions. The stale VS Code
+checks were removed, and the obsolete `-O2 -g0` assertion was replaced with a
+check that the current build retains `CGO_ENABLED=0`. Both frontend suites now
+pass.
+
+No confirmed exploitable current DOM injection was found. Some `innerHTML`
+usage remains and relies on escaping helpers or trusted static markup; future
+changes should prefer `textContent` and DOM construction for dynamic data.
+
+## 15. Infrastructure and Deployment Review
+
+Reviewed:
+
+- Shell, PowerShell, Makefile, and shared build helpers.
+- GitHub Actions release configuration.
+- Updater endpoint and PHP manifest delivery.
+- Cross-platform build flags and Go toolchain selection.
+
+Fixed:
+
+- Unix build scripts now reject Go versions older than 1.25.12.
+- `go.mod` requests Go 1.26.5 while keeping 1.25.12 as the minimum supported
+  language/toolchain floor.
+- Stale regression coverage now reflects the pure-Go build.
+
+The updater remains a high-value trust boundary. Production release validation
+should verify HTTPS, hashes/signatures where supported, expected artefact
+names, and least-privilege release credentials. No new command-injection or
+manifest-escaping defect was confirmed.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+The new cleanup paths do not log credentials or secret responses. Upload
+cleanup treats remote partial-file deletion as best-effort because the
+underlying session may already be broken.
+
+Useful future operational signals:
+
+- Active and rejected streaming-upload counts.
+- Reconnect attempt count and pending credential prompts.
+- Active runtime listener and session counts in a diagnostics view.
+- Resource snapshots during long-running open/close soak tests.
+
+These should expose counts and identifiers only, never passwords, tokens,
+private keys, terminal contents, or bridge bearer tokens.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added:
+
+- Credential response routing by request ID.
+- Reconnect cancellation releases its secret prompt immediately.
+- Frontend cancellation is honoured.
+- SFTP cleanup is scoped to the owning session.
+- Active streaming uploads are bounded.
+- Service shutdown releases uploads and prompt waiters.
+- Existing permissive export files are tightened to `0600`.
+- Leviathan carve directories/files use `0700`/`0600`.
+
+Passing:
+
+- Full Go test suite.
+- Focused Go race suite.
+- Go vet.
+- Complete frontend lifecycle and regression suite.
+- Frontend production build.
+- JavaScript, shell, and PHP syntax checks.
+- `npm audit`.
+- Reachable Go vulnerability scan.
+
+Remaining gaps:
+
+- No packaged Wails UI smoke or long-duration tab/reconnect soak test.
+- No real SFTP server test proves partial-file deletion after a broken
+  transport.
+- No live IPv6 protocol endpoint was used.
+- Hostile-file parser coverage is uneven; fuzzing should be expanded.
+- Windows ACL behaviour is not verified by POSIX permission tests.
+- External Leviathan extractors lack integration tests for time and output
+  limits.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Soak-test a packaged app while repeatedly opening, reconnecting, and closing
+  local and remote tabs. Monitor process CPU, memory, goroutines, file
+  descriptors, and listener/upload counts.
+- Exercise interrupted SFTP uploads against a real server and verify local
+  handle cleanup plus remote partial-file behaviour.
+
+Short-term:
+
+- Add a packaged Wails lifecycle smoke test.
+- Add fuzz targets for the highest-complexity Leviathan parsers.
+- Refresh the four module versions with unreachable advisories and run protocol
+  compatibility tests.
+- Add metrics or a diagnostics screen for active sessions, reconnects,
+  uploads, prompts, and event subscriptions.
+
+Medium-term:
+
+- Wrap every external Leviathan extractor with context timeout, process-group
+  termination, and output-size/file-count budgets before exposing extraction
+  through the UI.
+- Replace remaining dynamic `innerHTML` paths with text nodes or narrowly
+  reviewed rendering helpers.
+- Add real IPv6 SSH/VNC/IRC tunnel integration coverage.
+
+Long-term:
+
+- Add release CI gates for full tests, race-focused tests, `govulncheck`,
+  frontend audit/build, packaged smoke checks, and signed artefact validation.
+- Pin third-party GitHub Actions to reviewed immutable revisions.
+
+## 19. False Positives / Needs Manual Verification
+
+- Gosec MD5 and SHA-1 reports in Leviathan are forensic digest features, not
+  security authentication or password hashing.
+- Gosec subprocess reports include user-selected local shells, allow-listed SSH
+  key generation options, and an external extraction path not exposed by the
+  current document API. The extraction path still needs limits before future
+  exposure.
+- File-parser integer-conversion and slice warnings were reviewed
+  representatively; existing range checks rejected the paths inspected.
+  Fuzzing is required for stronger assurance.
+- The four remaining Go module advisories are present in required versions,
+  but `govulncheck` found no called symbol or imported vulnerable package path.
+- The fixed TLS issue had a reachable standard-library path, but actual ECH
+  exposure was not reproduced.
+- Sensitive-buffer clearing is best-effort and must not be described as
+  guaranteed memory erasure in Go.
+
+## 20. Final Notes
+
+The confirmed issues and their regression tests are committed in `b5c7528`.
+The most important improvement for the reported long-running-process behaviour
+is that credential event listeners, prompt waiters, and unfinished upload
+writers now have explicit owners and terminal cleanup paths.
+
+Closing a session now cancels its reconnect work and SFTP uploads; closing all
+sessions drains all uploads; application or bridge shutdown also unregisters
+runtime listeners and releases pending prompts. This materially improves
+cleanup, but live soak testing is still required before claiming that every OS,
+third-party library, and remote-peer resource remains flat indefinitely.

audits/20261012-0723-functionalityNextSteps.md

@@ -0,0 +1,139 @@
+# Functionality and Next Steps Report
+
+**Project:** Nexus Terminal — Rust port (`rust/` workspace)
+**Branch / base commit:** `rust-port` @ `8766846` (after this run: `aac986d`)
+**Date:** 2026-10-12 07:23 (local)
+**Companion:** `audits/20261012-0723-securityAudit.md` (SEC-20261012-NNN references below)
+
+## 1. Executive Summary
+
+The port is functionally complete relative to the Go/Wails app and is in good shape: the core crate is cleanly separated from the UI, every protocol client follows one lifecycle contract (blocking connect, own reader thread, `on_close` exactly once), the test suite (142 tests) exercises real sockets, a real `sshd`, PTYs and fake IRC/VNC/GitHub servers, and `clippy -D warnings` is clean.
+
+The highest-impact improvements now are reliability and user-experience rather than new protocols:
+
+1. **Credential UX** — a mistyped “saved” password is persisted before it is verified and then blocks every reconnect with no re-prompt (SEC-015); store failures are silent.
+2. **Resilience** — a panic on any worker thread poisons shared mutexes and takes the whole app down (`lock().unwrap()` everywhere); there is no panic hook, no crash message and no recovery of open sessions.
+3. **Product/privacy switches** — update checks, remote clipboard writes and multi-line paste all happen without a preference or notice.
+4. **Operability** — recording metadata, audit-log growth and the IRC state model scale poorly with long-running use.
+5. **Developer experience** — fuzz targets, a CI audit step and a documented `cargo clean` note after moving the checkout would have saved time in this run.
+
+## 2. Current Functional Risks
+
+| # | Risk | Where | Effect on users |
+|---|---|---|---|
+| F1 | Saved credential stored before auth succeeds; no path to replace it on failure other than editing the profile | `core/src/sessions.rs` `secret_fn` | Typo → every connect fails silently with the wrong saved password |
+| F2 | `Secrets::set` swallows errors (`let _ =`) | `core/src/secrets.rs` | “Save securely” silently doesn't save when the keychain refuses and the vault is locked |
+| F3 | Mutex poisoning: ~60 `lock().unwrap()` sites; any panic in a callback thread (e.g. a decoder bug) crashes the UI on the next lock | `sessions.rs`, `app.rs`, clients | One bad session kills all sessions, recordings stop mid-write |
+| F4 | No panic hook / crash dialog; `eframe` aborts silently | `app/src/main.rs` | Users see the window vanish with no explanation |
+| F5 | Quick Connect (SSH) allows an empty username; connection then fails at auth with an opaque server error | `app/src/quick_connect.rs`, `service.rs` `connect_quick` (unvalidated) | Confusing failure |
+| F6 | `import_ssh_config` writes profiles without `validate_profile` (e.g. empty `User`) | `core/src/service.rs` | Profiles that fail validation when later edited |
+| F7 | Unknown enum value in a stored JSON column (`hostKeyPolicy`, `lineEnding`, …) makes `parse_col` return `None`; the profile silently reverts that protocol's config to defaults | `core/src/storage.rs` `parse_col` | Lost settings after a downgrade/edit with a newer app |
+| F8 | Empty vault accepts any master password; a typo on first use creates entries under the wrong key (SEC-016) | `core/src/secrets.rs` | Unrecoverable secrets |
+| F9 | Recording listing reads every `.cast` fully (up to 250 MiB each) on the UI's worker thread (SEC-020) | `core/src/recording.rs` `read_meta` | Recordings window stalls with large files |
+| F10 | macOS `capture_cwd` runs `/usr/sbin/lsof` on every Enter in a local shell | `core/src/clients/local.rs` | Noticeable latency on macOS local tabs |
+| F11 | Keychain probe writes and deletes an item at every launch | `core/src/secrets.rs` `Keychain::available` | Keychain prompts/noise on macOS; D-Bus wake-ups on Linux |
+| F12 | Keychain legacy read-through copies `AlchementaryLink` items forward on every miss | `Keychain::get` | Repeated writes for keys that only exist in the legacy service |
+| F13 | GitHub refresh performs up to 5000 commit lookups every refresh interval with 5 threads | `core/src/clients/github.rs` | Token rate-limit exhaustion; 403s surface as “auth failed” |
+| F14 | IRC: channels/users tracked for any JOIN/NAMES seen, UI targets created for any sender (SEC-014) | `irc.rs`, `irc_view.rs` | Memory growth on busy networks |
+| F15 | `check_github` in `updater.rs` is unused (dead code) and hardcodes an owner/repo that may not exist | `core/src/updater.rs` | Misleading; GitHub fallback never runs |
+| F16 | Update check at every launch, no preference, docs say opt-in (SEC-013) | `app/src/app.rs` | Privacy expectation mismatch |
+| F17 | Audit log has no cap/rotation | `storage.rs` `add_audit` | DB grows indefinitely |
+| F18 | Stale `target/` after moving the checkout bakes old `CARGO_MANIFEST_DIR` into fixture tests (4 failures until `cargo clean`) | build hygiene | Confusing CI-vs-local mismatch |
+| F19 | `Secrets::delete_profile` relies on a static list of kinds (`PROFILE_SECRET_KINDS`); the profile editor and session manager still use string literals for kinds | `secrets.rs`, `profile_editor.rs`, `sessions.rs` | A new kind added in one place is missed by the purge |
+| F20 | Reconnect credential prompt timeout is 60 s vs 300 s on first connect | `sessions.rs` `schedule_reconnect` | Reconnects fail if the user is away briefly |
+
+## 3. Code Quality Improvements
+
+- **Secret kinds as a type**: replace the `&'static str` kinds (`"password"`, `"github-token"`, `"vnc-ssh-passphrase"`, …) scattered across `sessions.rs`, `profile_editor.rs` and `secrets.rs` with an enum (`SecretKind`) that has `as_str()` and `ALL`. Why: F19 and SEC-001 depend on the list staying complete. Safe step: enum + `From<&str>`; keep the string form for storage keys.
+- **Poison-tolerant locking**: introduce a small `fn lock<T>(m: &Mutex<T>) -> MutexGuard<T>` that recovers from poisoning (`unwrap_or_else(|e| e.into_inner())`, as `irc.rs`/`vnc.rs` already do) and use it in `sessions.rs`, `ssh.rs`, `app.rs`. Why: F3. Mechanical refactor; existing tests cover behaviour.
+- **Panic hook**: install `std::panic::set_hook` in `main.rs` that logs the payload (no locals) and posts a toast via `post_error`; keep worker panics from killing the UI. Why: F4.
+- **`parse_col` should not swallow errors**: log the parse error and keep the raw JSON (or surface a toast once) instead of returning `None`. Why: F7. Add `#[serde(other)]` variants to the enums so unknown values map to a named `Unknown` instead of failing the whole struct.
+- **`sessions.rs` (1 300 lines)**: split per-protocol connect functions (`connect_ssh/irc/vnc/github`) and the reconnect state machine into modules; the file is the hardest to test in isolation. Behaviour-preserving move; `tests/sessions.rs` guards it.
+- **Thread-per-event**: `on_close` spawns a thread per close and each connect spawns one; fine for a desktop app but makes ordering hard to reason about. Consider one `std::sync::mpsc` worker for lifecycle events.
+- **Duplicated defaults**: `Profile::new`, `Profile::normalize`, `profile_editor::prep` and `SshConfig::defaults` each know the default port/keepalive/retry values. Centralise in `models.rs` constants (already partly done) and have `prep` call `normalize`.
+- **`run_command("pwd")`** is the only use of exec for state; SFTP `realpath(".")` already gives the home — consider dropping the shell call to avoid shells that print banners.
+- **`Keychain::available` probe**: cache the result in preferences with a timestamp; re-probe weekly or on explicit request. Why: F11.
+- **Dead code**: `updater::check_github`, `Protocol::Local` branches in validation (`unsupported protocol`). Remove or wire up.
+- **`Store::migrate`**: wrap each migration in a transaction and record `schema_version` explicitly in code rather than relying on the SQL files to insert it (verify each file does).
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+The UI is native egui; the equivalent of “event firing / async failures / console diagnostics” was reviewed:
+
+- **Async failures surface**: every worker reports through `Job`, `Inbox`, `post_error` or `Shared::spawn`; the pattern is consistent. Gap: `Secrets::set` (F2) and `let _ = self.store.update_profile(&p)` in `connect_profile` discard errors — toast them.
+- **Modal keyboard handling**: `prompts()` and `dialogs()` read `Key::Enter`/`Escape` globally; with two modals stacked (a credential prompt while the Delete dialog is open) one key can act on both. Route keys only to the top-most modal (check `app.prompts.is_empty()` before dialogs read Enter).
+- **Credential prompt**: show which credential kind and profile; add “Save this credential” checkbox when the profile is in ask-every-time mode; after an auth failure with a saved secret, offer “Re-enter”.
+- **Host-key prompt**: offer “Copy fingerprint” and show the port; on key change, show both fingerprints side by side with a “Remove old key” action (today the user must go to Settings → Known Hosts).
+- **Clipboard from remote** (SEC-010): toast with the first line whenever OSC 52 or VNC sets the clipboard; preference to disable.
+- **Multi-line paste** (SEC-017): confirmation preview when the terminal is not in bracketed-paste mode.
+- **Transfers**: SFTP upload stops at the first failure and drops the rest of the queue (by design) — show which files were skipped.
+- **Console diagnostics**: adopt `tracing` with `RUST_LOG` support for connection lifecycle (host, protocol, state, error) — never credentials, never terminal data; today only `eprintln!` for CLI misuse exists.
+- **Crash fallback** (F4): panic hook + “Nexus Terminal hit an internal error; sessions were kept open where possible” dialog.
+- **Screenshot automation flags** (`--answer`): read from `NEXUS_ANSWERS` env/file instead of argv (SEC-018) and print a warning when used without `--screenshot`.
+
+## 5. Testing Roadmap
+
+- **Unit**: `secret_fn` ordering (store after success), `Vault` verifier (once added), `parse_col` unknown-enum behaviour, IRC state caps, `read_meta` tail parsing, `export_json` redaction of login-script sends.
+- **Integration**: extend `tests/ssh_integration.rs` with password + keyboard-interactive auth (sshd with `PasswordAuthentication yes` and a PAM-less test user is awkward; alternatively a russh server fixture), host-key change detection against the known-hosts table, remote forward teardown, SFTP rename/mkdir/remove.
+- **Abuse-case / fuzz**: `cargo-fuzz` targets for `vnc::read_update` (+ decoders), `telnet::Inner::process`, `irc::parse_line` + `ircformat::format_event`, `recording::Store::get`, `sshconfig::parse`, `updater::parse_manifest`. Run in CI nightly with a corpus from the existing fake-server tests.
+- **UI interaction**: the `--screenshot --do --answer` automation already drives the app headlessly; turn it into a smoke test matrix in CI (connect to the in-test sshd, open SFTP, run a palette command, assert the PNG is non-empty and the process exits 0).
+- **Regression**: keep the Go-fixture compatibility tests; add a fixture written by *this* version so future format changes are caught both ways.
+- **Load**: the ignored `perf::feed_throughput` test (50 MiB through the VT parser) should run in release mode in CI with a threshold; add a VNC decode benchmark on a synthetic 4K frame.
+- **Smoke**: `cargo audit` and `cargo deny check licenses advisories` jobs; `cargo test --locked` already runs on three OSes.
+
+## 6. Recommended New Functionality
+
+- **Preferences**: check-for-updates on/off (SEC-013), allow remote clipboard writes (SEC-010), confirm multi-line paste (SEC-017), confirm before `insecure` host-key policy connects.
+- **Credential management**: a Settings → Credentials page listing stored kinds per profile with “forget” buttons; master-password change (re-encrypt vault); export/import of the vault.
+- **Known hosts**: import from `~/.ssh/known_hosts` and export to it; SSH certificate CA trust (`@cert-authority`) since russh already parses certificates.
+- **Update integrity**: signed manifest (minisign/Ed25519), verified before display; optional in-app download with sha256 + signature check.
+- **IRC**: SASL PLAIN/EXTERNAL (modern networks reject NickServ IDENTIFY over plaintext), IRCv3 message tags for timestamps, per-network ISUPPORT line length.
+- **Serial**: session logging to file, hex view like RAW, break duration setting.
+- **SFTP**: recursive directory upload/download, drag-out to the desktop, resume on reconnect.
+- **Session**: “Send to all tabs in group”, per-session environment overrides for local shells, custom shell arguments.
+- **Operability**: audit-log viewer with cap/rotation; recordings metadata cache; “Diagnostics” page (keychain status, data dir, versions of russh/rustls, last update check).
+
+## 7. Next-Level Opportunities
+
+- **Observability**: `tracing` + optional file log with redaction; connection timing metrics in the status bar; opt-in crash reports (local file only).
+- **Resilience architecture**: supervisor-style session threads that catch panics per session (`std::panic::catch_unwind` around client callbacks) so one protocol bug cannot end the app.
+- **Security architecture**: move all secret-bearing fields out of `Profile` into the secret store behind a migration (keeps `.nexus` compatibility by exporting them inline only when “include secrets” is chosen); `Zeroizing`/`SecretString` throughout; Linux `PR_SET_DUMPABLE` while the vault is unlocked.
+- **Distribution**: signed, notarised builds; Flatpak/AppImage with sandboxing (`--filesystem=home:ro` + explicit `~/.ssh`), winget/Homebrew casks; SLSA provenance from the release workflow.
+- **Performance**: VNC — upload only dirty rows to the texture (`TextureHandle::set_partial`), decode JPEG on the I/O thread (already) but avoid the full `local.clone()` on resize; terminal — batch paint runs per style (already) and cache galleys per row.
+- **Accessibility**: egui `accesskit` is enabled; audit focus order in modals and provide screen-reader labels for icon-only buttons (`widgets::icon_button` has hover text only).
+- **Developer experience**: `justfile`/`make` targets for `test`, `clippy`, `audit`, `screenshot-smoke`; a `CONTRIBUTING.md` note about `cargo clean` after moving the checkout (F18); fuzz corpus checked in.
+
+## 8. Prioritised Action Plan
+
+**Immediate (this week)** — low risk, high value
+- Add the three preferences (update check, remote clipboard, paste confirmation) with safe defaults. Risk: trivial.
+- Toast on `Secrets::set` failure; store saved credentials after auth success (F1/F2). Risk: touches the auth path; covered by sshd tests — add a keyboard-interactive case.
+- Poison-tolerant lock helper + panic hook (F3/F4). Risk: mechanical.
+- Add `cargo audit` to CI with SEC-012 ignored and dated (outside `rust/`, owner's call).
+
+**Short term (next release)**
+- IRC state caps and joined-only tracking (F14).
+- `parse_col` error visibility and `Unknown` enum variants (F7).
+- Vault verifier entry (F8); keychain probe caching (F11).
+- Known-hosts import/export; host-key change dialog improvements.
+- Recording metadata from file tail (F9).
+
+**Medium term**
+- Secret-kind enum and credential management page (F19).
+- Fuzz targets + nightly job; screenshot smoke matrix.
+- Signed update manifest; release signing.
+- SASL for IRC; SFTP recursive transfers.
+
+**Long term**
+- Move profile-embedded secrets into the store with migration; `SecretString` everywhere.
+- Per-session panic isolation; `tracing`-based diagnostics.
+- Sandboxed distribution and provenance.
+
+## 9. Caveats and Validation Needed
+
+- Keychain behaviour (purge on delete, probe cost, legacy copy-forward) was verified by reading `keyring` usage, not by running against macOS Keychain, Windows Credential Manager or a live Secret Service; test on each OS before release.
+- The in-process key generator (`ssh::generate_key_pair`) was tested for Ed25519 and ECDSA; RSA generation runs the `rsa` crate's keygen (slow in debug builds — verify the UI stays responsive and that OpenSSH accepts the files on all three platforms).
+- `--data-dir` now creates directories 0700; if any user relies on sharing a portable data directory between accounts this changes behaviour.
+- The VNC size cap (64 Mpx) is above any real display; confirm with multi-monitor spanning setups (e.g. 3×4K = 37 Mpx) before lowering it.
+- Preference defaults for update checks and remote clipboard are product decisions; both have compatibility implications (vim/tmux yank over SSH relies on OSC 52).
+- UI event flows were validated by code review and the existing automation flags, not by an interactive run in this environment.

audits/20261012-2201-functionalityNextSteps.md

@@ -0,0 +1,136 @@
+# Functionality and Next Steps Report
+
+Nexus Terminal 3.0.1, reviewed alongside `20261012-2201-securityAudit.md`.
+
+## 1. Executive Summary
+
+The product is broad and mostly solid: nine protocols, sync, restore, shell integration, inline images, RDP devices and a 71-page guide. The highest-impact improvements now:
+
+- **Make the UI thread untouchable.** Several remote- or device-driven paths still do blocking or unbounded work on the UI thread:
+  - serial writes;
+  - inline image decode;
+  - find-bar recomputation;
+  - recording seek;
+  - the unbounded event queue.
+  Moving them to workers, or adding budgets, removes a whole class of "one bad peer freezes everything" reports.
+- **Finish the trust story for sync.** Timestamps are clipped and retargeted credentials are forgotten. What's still missing:
+  - a visible "what changed" summary;
+  - approval for security-relevant fields;
+  - eventually per-machine signatures.
+- **Credentials out of profile data.** Login-script passwords are the last secrets stored as profile data.
+- **Signed updates and releases**, as already planned by the owner.
+- **One fixed functional break:** link opening never worked, because eframe's `links` feature was missing. It is fixed now, but it shows the UI has no automated coverage for "does the click do something".
+
+## 2. Current Functional Risks
+
+| Risk | Where | Effect |
+|---|---|---|
+| Find bar recomputes matches over the whole scrollback (≤100k lines) on every output chunk while open | `app/src/terminal.rs` find (≈1035-1075) | A chatty session plus an open find bar pins the UI thread |
+| Recording seek re-feeds from byte 0 on every slider frame | `app/src/recordings.rs` `seek` | Dragging the slider on a big recording wedges the UI |
+| `.cast` ids: `trim_end_matches(".cast")` strips repeatedly and `trim()` changes names | `core/src/recording.rs` | `a.cast.cast` plays or deletes `a.cast`; names with leading spaces break |
+| A failed recording load closes the browser before the error toast | `app/src/recordings.rs` | The user loses their place |
+| `Dialog` is a single `Option`; terminal responses and menus overwrite an open dialog | `tabs.rs`, `app.rs` | A pending Delete confirmation can silently disappear |
+| A remote forward with `bind_port == 0` can't be stopped (cancel uses port 0) | `core/src/clients/ssh.rs` `shutdown_forward` | Forward stays listed and active on the server |
+| `sftp()` session cached forever; a dead subsystem breaks SFTP until reconnect | `core/src/clients/ssh.rs` | "SFTP stopped working" reports |
+| SFTP `list()` treats symlinks to directories as files | `core/src/clients/sftp.rs` | Can't navigate into linked directories |
+| No SFTP transfer cancellation | `core/src/clients/sftp.rs` | Large accidental downloads can't be stopped |
+| ssh-config import keeps only the first `ProxyJump` hop; `Host !foo` becomes a profile; `=` split on the first `=` anywhere | `core/src/sshconfig.rs` | Imported profiles connect differently from `ssh` |
+| Jump-host `auth_method`/`secret_mode` ignored (key/agent only) | `core/src/clients/ssh.rs` `via_jumps` | Password-only bastions can't be used |
+| IPv6 literals break KDC and gateway host:port parsing | `rdp.rs`, `ironrdp-mstsgu` | `[::1]:443` doesn't work |
+| RD Gateway consent message aborts the connection | vendored `ironrdp-mstsgu` | Enterprise gateways with a banner fail |
+| Kerberos hostname comes from `$HOSTNAME`, which is rarely exported | `rdp.rs` | Computer name is almost always "nexus" |
+| `is_newer` ignores pre-release suffixes | `core/src/updater.rs` | An `-rc` build isn't offered the final release |
+| Swallowed errors: tombstone write failure, vault delete failure, `triggers.json` read failure | `service.rs`, `secrets.rs`, `triggers.rs` | Silent data inconsistency |
+| `has_sync_password` was a keychain round trip per frame (now cached for 5 s) | `service.rs` | Fixed; included here because macOS keychain prompts were possible |
+
+## 3. Code Quality Improvements
+
+- **One GCM helper.** `secrets::seal/open` and `exportimport::seal/open` duplicate the AES-GCM wrapping with different layouts. Merge them into one helper that takes AAD; that also closes SEC-049 at the next format bump.
+- **Writer threads for every byte-stream client.** VNC already has a bounded queue. Telnet/RAW now have a write timeout, but writes still run on the caller's thread, and Serial and local PTY writes block under locks. One pattern for all of them removes a recurring bug class.
+- **Dead code:** `Store::import_profiles` (no callers), `TermResponse.title` / `TermEvent::Title` plumbing (never read), the stray doc comment in `updater.rs`, the stale `.gitignore` whitelist for `rust/core/tests/fixtures/**`, and "Alchementary Link" strings left in `migrations/001_initial.sql` and `updates/index.php`.
+- **`parse_col`** drops an unreadable config column, and the next save overwrites it with defaults. Keep the raw JSON and merge, so a config written by a newer build survives an older one.
+- **Dependency hygiene:** move nexus-core to `rand 0.9`, `argon2 0.6`, `aes-gcm 0.11` and `sha2 0.11` to match the rest of the graph, collapsing duplicate crypto crates.
+- **Vendored crates:** commit `.patch` files plus upstream tarball sha256, and add a CI check that the patches still apply cleanly to the pinned upstream versions.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+(The UI is native egui. These are its equivalents of the frontend event and error items.)
+
+- **Keep heavy work off the UI thread:**
+  - decode inline images on a worker;
+  - debounce find to ≤10 Hz, or restrict it to visible rows plus N;
+  - seek recordings on `drag_stopped`;
+  - write serial data on a writer thread.
+- **Bound the event queue:** a per-session byte budget, coalescing consecutive `Data` events.
+- **Dialogs:** make `Dialog` a small stack, or refuse to replace a confirmation dialog, so destructive confirmations can't vanish.
+- **A sync change summary:** after a pull, list the changed profiles and fields (host, user, key policy, scripts, forwards, shared folder), with approve/revert for the security-relevant ones.
+- **Explain withheld credentials:** IRC now does this for plaintext servers. Do the same for any future "held back for safety" behaviour, ideally with a one-click fix (enable TLS).
+- **Clipboard settings:** consider defaulting "Allow remote clipboard writes" to off, or prompting on multi-line writes. The toast is now honest about line counts.
+- **Debug logs:** before a user shares `RUST_LOG=debug` logs, the Diagnostics page should warn that debug output from the RDP libraries can contain authentication blobs and shared-folder data.
+
+## 5. Testing Roadmap
+
+- **Unit:**
+  - RDPDR read clamp;
+  - oversized RDP desktop;
+  - `.cast` id mapping;
+  - remote forward with port 0 stop;
+  - `parse_col` with an unknown future field;
+  - import strategies (skip/overwrite/duplicate, duplicate ids in one batch, size caps).
+- **Integration:**
+  - two-sshd jump chain proving a jump host can't open agent or forwarded-tcpip channels (SEC-008);
+  - a stalled SSH server proving every phase hits its timeout;
+  - a fake Telnet peer that floods and never reads, proving `close()` returns quickly.
+- **Migration fixtures:** real schema-1 and schema-7 databases opened by the current build, including one with Go-era `proxyPassword` keys.
+- **Fuzzing:**
+  - new targets for `.cast` parsing, `known_hosts::parse`, `exportimport::open` and the JSON profile importer;
+  - seed the VNC corpus with valid ZRLE/Tight zlib streams;
+  - keep `-timeout` (now 10 s) so slow-input bugs surface.
+- **UI smoke:**
+  - a headless run per protocol using the existing screenshot automation (`--connect`, `--do`, `--screenshot`) as a CI job, asserting no panic and a non-blank frame;
+  - "does this click do something" checks (link open, Copy, Paste) would have caught the missing `links` feature.
+- **Load:** stream 512 MiB through a RAW session with the UI paused and assert bounded RSS (SEC-044).
+
+## 6. Recommended New Functionality
+
+- **Secret placeholders in login scripts** (`{{password}}`, `{{totp}}`) resolved from the keychain or vault at run time. This removes plaintext secrets from profiles (SEC-020) and improves the feature.
+- **Sync change review and per-machine trust:** pair machines once by exchanging ed25519 public keys and sign sync records. Then the sync password is no longer the only key.
+- **Signed update checks:** a minisign signature over the manifest, with the public key embedded, and verification in the updater. Pairs with the signing work already planned.
+- **RDP NLA memory:** remember that a host did NLA and refuse a TLS-only downgrade later (SEC-019). Show "no NLA" visibly in the toolbar when it is in use.
+- **VNC "unauthenticated session" indicator**, shown when the server picks security type None.
+- **IRC TLS certificate pinning** for private-CA networks, so users aren't nudged to turn TLS off.
+- **SFTP:** transfer cancellation and following symlinked directories.
+- **Jump hosts with passwords:** honour the existing `auth_method` and `secret_mode` fields.
+
+## 7. Next-Level Opportunities
+
+- **Observability:** a "Copy debug bundle" action that redacts known-sensitive upstream log targets automatically, instead of relying on the user's `RUST_LOG` choice.
+- **Architecture:** a single I/O runtime per session (tokio already runs SSH) for Telnet, RAW, Serial and VNC. That gives consistent cancellation, timeouts and back-pressure, and removes several thread-per-connection blocking patterns.
+- **Release engineering:** build provenance attestations, signed tags, and reproducible-build notes. Releases are already split into build (read-only) and publish (write) jobs.
+- **Accessibility:** egui AccessKit is enabled. Audit screen-reader labels on the desktop viewers and terminal (password fields are already masked for AccessKit).
+- **Performance:** the OSC 8 underline painter issues up to cols/3 `hline` calls per cell per frame, and the RAW hex row cache is bounded by count, not bytes. Both are cheap wins.
+
+## 8. Prioritised Action Plan
+
+| When | Action | Why | Risk |
+|---|---|---|---|
+| Immediate | Fix the GitHub Actions billing block so CI and the v3.0.1 release builds run | No CI signal and no release artefacts right now | None |
+| Short term | Event budget, find debounce, recording seek on drag-stop, serial writer thread | Remove the remaining UI-freeze vectors | Low; contained changes |
+| Short term | Sync change summary plus approval for security-relevant fields | Closes SEC-021 | Medium; UX design needed |
+| Short term | RDP NLA memory (SEC-019) | Downgrade protection | Low; needs a small known-hosts field |
+| Medium | Login-script secret placeholders | Removes the last plaintext secrets | Medium; changes the script editor and migration |
+| Medium | Merge the GCM helpers with AAD, bump crypto crates, vendored patch checks | Hygiene and integrity | Low |
+| Medium | Fuzz targets and migration fixtures listed in §5 | Regression safety | None |
+| Long term | Signed manifests, binaries and tags; per-machine sync signatures | Supply-chain and sync trust | Medium; key management |
+
+## 9. Caveats and Validation Needed
+
+- **Not exercised against real systems:**
+  - Windows RDP with NLA and Display Control;
+  - RD Gateway;
+  - Kerberos;
+  - macOS/Windows keychains (after the `Zeroizing` API change);
+  - real plaintext IRC networks (behaviour changed: passwords are now held back there).
+- **Release ordering:** the release workflow now publishes only after every platform builds, so one failing platform blocks the release. Confirm that is the preferred trade-off over partial releases.
+- **Sync re-prompts:** forgetting credentials on retargeted sync/import means a host edit on one machine makes the others re-prompt once. That is intended, but users should be told (it's in the manual now).
+- **Profile ids:** ids are now limited to `[A-Za-z0-9._-]{1,64}`. Every id this app generates is a UUID, but hand-made JSON imports with unusual ids will be refused rather than rewritten. Rewriting them on import is a possible follow-up.

build.sh

@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-# build.sh — Build script for Nexus Terminal
-# Provides a reproducible build process for CI and local builds.
-# Usage: ./build.sh [dev|build|test|clean|deps]
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
-
-# Colours for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-log()  { echo -e "${GREEN}[nexus]${NC} $1"; }
-warn() { echo -e "${YELLOW}[nexus]${NC} $1"; }
-err()  { echo -e "${RED}[nexus]${NC} $1" >&2; }
-
-# Check prerequisites
-check_deps() {
-    command -v go >/dev/null 2>&1 || { err "Go is not installed"; exit 1; }
-    command -v node >/dev/null 2>&1 || { err "Node.js is not installed"; exit 1; }
-    command -v npm >/dev/null 2>&1 || { err "npm is not installed"; exit 1; }
-
-    if ! command -v wails >/dev/null 2>&1; then
-        if [ -f "$HOME/go/bin/wails" ]; then
-            export PATH="$PATH:$HOME/go/bin"
-        else
-            err "Wails is not installed. Run: go install github.com/wailsapp/wails/v2/cmd/wails@latest"
-            exit 1
-        fi
-    fi
-
-    log "All prerequisites found"
-    log "Go:    $(go version)"
-    log "Node:  $(node --version)"
-    log "Wails: $(wails version 2>/dev/null | head -1)"
-}
-
-# Install dependencies
-install_deps() {
-    log "Installing Go dependencies…"
-    go mod download
-
-    log "Installing frontend dependencies…"
-    cd frontend && npm install && cd ..
-
-    log "Dependencies installed"
-}
-
-# Development mode
-dev() {
-    check_deps
-    install_deps
-    log "Starting development mode…"
-    wails dev
-}
-
-# Production build
-build() {
-    check_deps
-    install_deps
-    log "Building production binary…"
-    wails build
-    log "Build complete: build/bin/"
-}
-
-# Run tests
-run_tests() {
-    log "Running tests…"
-    go test ./... -v -count=1
-}
-
-# Clean build artefacts
-clean() {
-    log "Cleaning build artefacts…"
-    rm -rf build/bin
-    rm -rf frontend/node_modules
-    rm -rf frontend/src/js/lib
-    rm -rf frontend/src/css/lib
-    go clean -testcache
-    log "Clean complete"
-}
-
-# Main
-case "${1:-build}" in
-    dev)     dev ;;
-    build)   build ;;
-    test)    run_tests ;;
-    clean)   clean ;;
-    deps)    check_deps && install_deps ;;
-    *)
-        echo "Usage: $0 [dev|build|test|clean|deps]"
-        exit 1
-        ;;
-esac

docs/build-and-release.md

@@ -0,0 +1,74 @@
+# Build and Release
+
+Nexus Terminal is a Rust workspace in `rust/`:
+
+```
+rust/
+├── core/   nexus-core: storage, secrets, protocol clients, session manager, Service. No GUI.
+└── app/    nexus: the egui desktop app (binary `nexus-terminal`)
+```
+
+The toolchain is pinned in `rust/rust-toolchain.toml`; `rustup` installs it on first build.
+
+## Prerequisites
+
+- **All platforms:** [rustup](https://rustup.rs).
+- **Linux:** the X11/Wayland/GL headers eframe links against, and GTK for native file dialogs:
+
+  ```bash
+  sudo apt-get install -y build-essential pkg-config libxkbcommon-dev libgl1-mesa-dev \
+    libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip
+  ```
+
+- **macOS:** Xcode command-line tools (`xcode-select --install`).
+- **Windows:** the MSVC build tools (Visual Studio Build Tools, "Desktop development with C++").
+
+There are no runtime C libraries to install: SQLite is compiled in and TLS uses rustls.
+
+## Build and run
+
+```bash
+cd rust
+cargo run --release                 # the app
+cargo test --workspace              # unit and integration tests
+cargo clippy --workspace -- -D warnings
+```
+
+Useful flags (also handy for testing): `nexus-terminal [--theme pro|midnight|light]
+[--data-dir DIR] [--screenshot out.png] [--size WxH] [--run-local CMD]`. `--data-dir` points at
+another data directory; `--screenshot` renders the window, saves a PNG and exits (works under
+`xvfb-run`); `--run-local` opens a local terminal and types `CMD` into it.
+
+The SSH integration tests start a throwaway `sshd` as the current user on a random port; they
+skip themselves when OpenSSH isn't installed.
+
+## Release packages
+
+```bash
+cd rust
+./release.sh                                            # this machine's platform
+NEXUS_RELEASE_TARGETS=linux/amd64,windows/amd64 ./release.sh
+```
+
+Artefacts land in `build/releases/<version>/` at the repo root:
+
+- `NexusTerminal-<os>-<arch>.zip` — on macOS a universal-capable `.app` bundle
+  (`rust/packaging/macos/build-app.sh`), on Windows the `.exe` (icon and version info embedded,
+  GUI subsystem), on Linux the binary plus `install.sh` and a `.desktop` entry
+  (`rust/packaging/linux/install.sh` installs into `~/.local`).
+- `manifest-<os>-<arch>.json` and `version-<os>-<arch>.txt` for the update server
+  (`updates/index.php`), in the same format as before.
+
+The version is `<latest tag>-<short commit>` unless `NEXUS_VERSION` is set. The update manifest
+URL is compiled in from `NEXUS_UPDATE_URL` (default in `release.sh`); `{platform}` and `{arch}` use
+the old Go names (`darwin`/`linux`/`windows`, `amd64`/`arm64`).
+
+Cross-building `windows/amd64` from Linux works with `x86_64-pc-windows-gnu` and mingw-w64.
+macOS bundles must be built on a Mac. CI (`.github/workflows/release-builds.yml`) builds every
+platform natively on GitHub runners and attaches the zips to tagged releases;
+`.github/workflows/ci.yml` runs tests and clippy on Linux, macOS and Windows.
+
+## Signing
+
+macOS bundles are ad-hoc signed. For distribution, sign with a Developer ID and notarize (see the
+comments in `build-app.sh`). Windows binaries are unsigned.

docs/guide/Makefile

@@ -0,0 +1,11 @@
+# Builds nexus-guide.pdf with LuaLaTeX (three passes: contents, page references, then page overlays settle).
+# Needs LuaLaTeX with luaotfload (Debian/Ubuntu: texlive-luatex texlive-latex-extra).
+# Screenshots: tools/screenshots.sh (needs xvfb-run, sshd, python3).
+OUT ?= build
+nexus-guide.pdf: nexus-guide.tex nexus-guide.sty chapters/*.tex img/*
+	mkdir -p $(OUT)
+	lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null || (grep -A8 '^!' $(OUT)/nexus-guide.log; false)
+	for i in 1 2; do lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null; done
+	cp $(OUT)/nexus-guide.pdf .
+clean:
+	rm -rf $(OUT)

docs/guide/chapters/appendix.tex

@@ -0,0 +1,120 @@
+\guidepart{slate}{Extras}{The extras}
+  {The cheat sheet, the command line, and words you might trip over.}
+  {\partitem{\iKeyboard}{Keyboard cheat sheet}
+   \partitem{\iTerminal}{Command-line options}
+   \partitem{\iBrain}{Glossary}}
+
+% =========================================================================================
+\chapter{Keyboard cheat sheet}\label{app:keys}
+\chapmeta{print it}{Stick this page next to your monitor}
+
+\newcommand\shortcut[2]{#1 & #2\\}
+\newcommand\sheet[3]{%
+  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=10pt, right=10pt, top=8pt, bottom=8pt,
+    before skip=0pt, after skip=10pt, fontupper=\small]
+  {\heavy\large\color{#1!85!black}#2}\par\vspace{4pt}
+  \renewcommand\arraystretch{1.5}\begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{36mm}@{}}#3\end{tabularx}
+  \end{tcolorbox}}
+
+\begin{multicols}{2}
+\sheet{accent}{\iRocket\enspace Everywhere}{%
+  \shortcut{Command palette}{\keys{\mod+K}}
+  \shortcut{New connection}{\keys{\mod+N}}
+  \shortcut{Quick Connect}{\keys{\mod+Shift+Q}}
+  \shortcut{Settings}{\keys{\mod+,}}
+  \shortcut{Full screen}{\kbd{F11}}}
+
+\sheet{violet}{\iSplit\enspace Tabs \& panes}{%
+  \shortcut{Close tab}{\keys{\mod+W}}
+  \shortcut{Next tab}{\keys{\mod+Tab}}
+  \shortcut{Previous tab}{\keys{\mod+Shift+Tab}}
+  \shortcut{Go to tab 1–9}{\keys{\mod+1}…\kbd{9}}
+  \shortcut{Split right}{\keys{\mod+Shift+D}}
+  \shortcut{Split down}{\keys{\mod+Shift+E}}}
+
+\sheet{teal}{\iWand\enspace Power tools}{%
+  \shortcut{Broadcast on/off}{\keys{\mod+Shift+B}}
+  \shortcut{Snippets}{\keys{\mod+Shift+S}}
+  \shortcut{Record on/off}{\keys{\mod+Shift+R}}}
+
+\sheet{amber}{\iTerminal\enspace In the terminal}{%
+  \shortcut{Copy selection}{\keys{\mod+C}}
+  \shortcut{Paste}{\keys{\mod+V}}
+  \shortcut{Find}{\keys{\mod+F}}
+  \shortcut{Next / previous match}{\kbd{Enter} / \keys{Shift+Enter}}
+  \shortcut{Scroll a page}{\keys{Shift+PageUp}}
+  \shortcut{Top / bottom}{\keys{Shift+Home} / \kbd{End}}
+  \shortcut{Previous / next prompt}{\keys{\mod+Shift+Up} / \kbd{Down}}
+  \shortcut{Open link}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}}
+
+\sheet{pink}{\iMap\enspace Mouse moves}{%
+  \shortcut{Select word / line}{double / triple-click}
+  \shortcut{Extend selection}{\kbd{Shift} + click}
+  \shortcut{Select several profiles}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}
+  \shortcut{Everything else}{right-click it}}
+\end{multicols}
+
+% =========================================================================================
+\chapter{Command-line options}\label{app:cli}
+\chapmeta{1 minute}{You'll script, demo and test with a few handy flags}
+
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\ttfamily\color{ink}}p{52mm}X@{}}
+  \toprule
+  --data-dir DIR        & Use another data folder (portable installs, demos, testing).\\
+  --theme pro|midnight|light & Start with this theme.\\
+  --connect NAME        & Connect to a saved profile by name at startup. Repeat it for several.\\
+  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security},
+                          \code{settings:diagnostics}, \code{snippets}, \code{keys}, \code{recordings}, \code{palette},
+                          \code{quick}…\\
+  --run-local CMD       & Open a local shell and run a command in it.\\
+  RUST\_LOG=debug        & (environment) More detail in \code{nexus.log}, and on the terminal you started from.\\
+  --version             & Print the version and exit.\\
+  \bottomrule
+\end{tabularx}
+
+\begin{sidequest}[How the screenshots in this guide were made]
+Every screenshot here is the real app, driven by \code{docs/guide/tools/screenshots.sh}: it starts throwaway
+SSH, IRC, VNC and GitHub-ish servers, fills a demo data folder, and runs Nexus Terminal headless with
+\code{--screenshot}, \code{--do} (run a palette command) and \code{--answer} (fill a password prompt; only accepted together with \code{--screenshot}). Change the app,
+rerun the script, rebuild the guide.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Glossary}\label{app:glossary}
+\chapmeta{dip in}{Words you might trip over, in one line each}
+
+\begin{multicols}{2}\small
+\begin{description}[leftmargin=0pt, itemsep=5pt]
+  \item[Agent] A background program holding your unlocked SSH keys, so you type the passphrase once.
+  \item[Asciicast] The file format for terminal recordings. Plays in Nexus Terminal and \code{asciinema}.
+  \item[Bastion / jump host] A server you go \emph{through} to reach the ones behind it.
+  \item[Baud rate] How fast a serial line talks. Both ends must agree.
+  \item[Broadcast] Typing into several sessions at once.
+  \item[Certificate authority] A key that vouches for other keys, so servers signed by it are trusted without a prompt.
+  \item[DTR / RTS] Serial control lines. Some boards use them for reset or flashing.
+  \item[Fingerprint] A short summary of a server's host key, used to spot imposters.
+  \item[Host key] A server's identity. Changes when it's rebuilt, or when someone's pretending.
+  \item[Keychain] Your operating system's password store.
+  \item[NLA] Network Level Authentication: Windows checks your password before building a desktop.
+  \item[OSC 133] The escape codes a shell uses to mark its prompts, which powers shell integration.
+  \item[Port forward] A tunnel carrying one TCP port through SSH.
+  \item[Profile] A saved connection.
+  \item[RAW TCP] A plain socket: bytes in, bytes out, no terminal rules.
+  \item[RDP] Microsoft's Remote Desktop Protocol, for Windows (and xrdp) desktops.
+  \item[SASL] How IRC networks log you in while you connect, instead of messaging NickServ afterwards.
+  \item[SFTP] File transfer over SSH.
+  \item[Snippet] A saved command, optionally with blanks to fill in.
+  \item[TOTP] Time-based one-time passwords: the six digits from your authenticator app.
+  \item[Trigger] A rule that watches output and reacts to a pattern.
+  \item[Vault] Nexus Terminal's encrypted password store, for when there's no keychain.
+  \item[VNC] A way of seeing and controlling another computer's desktop.
+\end{description}
+\end{multicols}
+
+\vfill
+\begin{center}
+\includegraphics[width=16mm]{img/logo.pdf}\par\vspace{6pt}
+{\heavy\color{ink}That's the lot.}\par
+{\small\color{muted}Go and connect to something. \iRocket}
+\end{center}

docs/guide/chapters/part1-start.tex

@@ -0,0 +1,247 @@
+\guidepart{accent}{Get going}{Get going}
+  {From zero to connected before your tea goes cold.}
+  {\partitem{\iRocket}{Five-minute start}
+   \partitem{\iMap}{The grand tour}
+   \partitem{\iList}{Profiles: your address book}}
+
+% =========================================================================================
+\chapter{Five-minute start}\label{ch:start}
+\chapmeta{5 minutes}{You'll be connected to something and know the one shortcut that matters}
+
+\begin{tldr}
+Install it, open it, press \keys{\mod+N}, fill in a host, hit \ui{Create \& Connect}. Done.
+Lost? Press \keys{\mod+K} and type what you want.
+\end{tldr}
+
+\section{Install it}
+
+Grab the zip for your machine from \code{dixon.cx/downloads/nexus}. They're named
+\code{NexusTerminal-<os>-<arch>.zip}, so a modern Mac wants \code{darwin-arm64} and most PCs want \code{amd64}.
+
+\begin{description}
+  \item[\iDesktop\enspace Windows] Unzip it and run \code{NexusTerminal-windows-amd64.exe}. No installer, no admin rights,
+    nothing in the registry. Pop it somewhere sensible like \code{C:\textbackslash Tools} and pin it to the taskbar.
+  \item[\iDesktop\enspace macOS] Unzip it and drag \code{NexusTerminal-darwin-arm64.app} into \ui{Applications}. If macOS
+    grumbles that it can't check the developer, right-click the app, choose \ui{Open}, then \ui{Open} again. You only
+    have to do that once.
+  \item[\iDesktop\enspace Linux] Unzip it and run \code{./install.sh}. It copies \code{nexus-terminal} into
+    \code{~/.local/bin} and adds a launcher entry with the icon, so it turns up in your app menu.
+    (Make sure \code{~/.local/bin} is on your \code{PATH}.)
+\end{description}
+
+\begin{sidequest}[Build it yourself]
+It's a single Rust program. With Rust installed: \code{cd rust \&\& cargo run --release}. The finished binary lands in
+\code{rust/target/release/nexus-terminal}. The build guide in \code{docs/build-and-release.md} has the full story.
+\end{sidequest}
+
+\section{Open it}
+
+The first time you open Nexus Terminal you get a calm, empty welcome screen. Three buttons, four shortcuts. That's it.
+
+\shot{welcome.png}{The welcome screen. Your saved connections will live down the left; here there are a few already.}
+
+\begin{headsup}[Got more than one computer?]
+Point \ui{Profile sync} at a shared folder and your connections follow you around. See
+\hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
+\end{headsup}
+
+\section{Make your first connection}
+
+\begin{enumerate}
+  \item Click \ui{New Connection}, or press \keys{\mod+N}.
+  \item Pick the protocol along the top: \proto[teal]{SSH}, \proto[amber]{Telnet}, \proto[violet]{RAW TCP},
+        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[rose]{RDP}, \proto[amber]{IRC} or \proto[accent]{Serial}.
+  \item Fill in the \ui{General} bit: a \ui{Display Name} you'll recognise, the \ui{Host}, the \ui{Port}
+        and your \ui{Username}.
+  \item Click \ui{Create \& Connect}.
+\end{enumerate}
+
+That's genuinely it. A tab opens, you log in, and next time it's one click in the sidebar.
+
+\crop{editor-new.png}{1515}{40}{0}{70}{0.52\linewidth}{A brand-new SSH profile. Only the top few fields are needed to get going.}
+
+\begin{quickwin}
+Click \ui{Test} before you save. Nexus Terminal checks the host and port are reachable and tells you the
+round-trip time. If that fails, no amount of password-fiddling will help, so it's a great first check.
+\end{quickwin}
+
+\section{Two shortcuts for impatient people}
+
+\subsection{Quick Connect}
+Press \keys{\mod+Shift+Q}.
+For a one-off session you don't want to save. Pick SSH, Telnet, RAW, IRC or Serial, type the host (or serial
+device), hit \kbd{Enter}. Nothing gets saved.
+
+\crop{quick.png}{951}{620}{946}{481}{0.5\linewidth}{Quick Connect. In, out, nobody gets hurt.}
+
+\subsection{Local terminal}
+Click \ui{Local Machine} at the top of the sidebar (or \ui{Local} on the welcome screen) for a shell on
+\emph{this} computer. When you type \code{exit}, the tab says \code{[Exited - press enter to restart]}.
+Press \kbd{Enter} and you've got a fresh shell in the same tab.
+
+\section{The one shortcut to rule them all}
+
+\begin{center}
+\begin{tcolorbox}[enhanced, width=0.8\linewidth, arc=10pt, boxrule=0pt, colback=ink, fontupper=\color{white},
+  halign=center, top=10pt, bottom=10pt, drop fuzzy shadow]
+{\scalebox{2.4}{\keys{\mod+K}}}\par\vspace{6pt}\par\vspace{4pt}
+{\color{white!70!ink} The command palette. If you remember nothing else, remember this.}
+\end{tcolorbox}
+\end{center}
+
+Type a few letters of \emph{anything}: a connection name, a tab, ``theme'', ``split'', ``lock'', ``snippets''. Use
+\kbd{↑}\kbd{↓} to pick, \kbd{Enter} to go, \kbd{Esc} to bail. It's fuzzy, so ``atl'' finds \emph{atlas} and
+``sft'' finds the \emph{SFTP Browser}.
+
+\crop{palette.png}{755}{732}{733}{154}{0.72\linewidth}{The command palette: every connection, tab and action in one searchable list.}
+
+\begin{quickwin}[Your five-minute checklist]
+\begin{checklist}
+  \item Installed and opened Nexus Terminal
+  \item Opened a \ui{Local Machine} tab and typed \code{exit}, then \kbd{Enter} to get it back
+  \item Made a profile with \keys{\mod+N} and clicked \ui{Test}
+  \item Connected to it
+  \item Opened the palette with \keys{\mod+K} and found something by typing three letters
+\end{checklist}
+All ticked? You're officially more productive than you were five minutes ago. \iConfetti
+\end{quickwin}
+
+% =========================================================================================
+\chapter{The grand tour}\label{ch:tour}
+\chapmeta{4 minutes}{You'll know what every bit of the window is for}
+
+\begin{tldr}
+Connections on the left. Sessions in tabs across the top. The terminal in the middle. Status along the bottom.
+Everything else is one \keys{\mod+K} away.
+\end{tldr}
+
+\begin{annotated}{ssh.png}
+  \callout{1}{0.124}{0.022}
+  \callout{2}{0.66}{0.022}
+  \callout{3}{0.888}{0.022}
+  \callout{4}{0.22}{0.067}
+  \callout{5}{0.03}{0.152}
+  \callout{6}{0.53}{0.063}
+  \callout{7}{0.966}{0.063}
+  \callout{8}{0.62}{0.42}
+  \callout{9}{0.16}{0.945}
+  \callout{10}{0.26}{0.985}
+  \callout{11}{0.86}{0.985}
+\end{annotated}
+
+\begin{multicols}{2}\small
+\begin{description}[leftmargin=0pt, labelsep=0.4em]
+  \item[\num{1} Menus] \menu{File}, \menu{Session}, \menu{View} and \menu{Help}. Drag the title bar to move the
+        window; double-click it to maximise.
+  \item[\num{2} Palette] The search box is the command palette. Click it or press \keys{\mod+K}.
+  \item[\num{3} Light/dark] Flip between the dark and light themes in one click.
+  \item[\num{4} Search] Fuzzy-search your connections by name, host, tag or protocol.
+  \item[\num{5} Sections] \ui{Local Machine}, \ui{Favourites} \iStar, \ui{Recent} (your last five), then one section
+        per group. Click a header to fold it away.
+  \item[\num{6} Tabs] One per session, with a coloured state dot, protocol badge and close button. SSH tabs get a
+        little \iFolder{} for files. A blue dot means ``new output while you weren't looking''.
+  \item[\num{7} New \& broadcast] \ui{+} opens a new connection; \iBroadcast{} toggles broadcast mode.
+  \item[\num{8} Workspace] Your terminal (or IRC chat, VNC desktop, GitHub list…). Split it into panes, too.
+  \item[\num{9} Footer] New connection, palette, import, export, recordings and settings.
+  \item[\num{10} Status] State, protocol and live latency for SSH. Shows \ui{REC} while recording and
+        \ui{BROADCAST} when broadcasting.
+  \item[\num{11} Sessions \& vault] How many sessions are connected and whether the vault is locked. Click the vault to
+        open security settings.
+\end{description}
+\end{multicols}
+
+\begin{protip}
+Drag the right-hand edge of the sidebar to make it wider or narrower. Toasts (the little pop-up messages in the
+top-right) tidy themselves away after a few seconds; click \ui{×} if you're impatient.
+\end{protip}
+
+\section{Three looks}
+
+Nexus Terminal comes in \ui{Pro} (the default, a soft charcoal), \ui{Midnight} (darker, bluer, for 2\,a.m.
+deploys) and \ui{Light} (for sunny days and projectors). Switch with the \iBulb{} button in the title bar, the
+\menu{View} menu, or type ``theme'' into the palette.
+
+\shotpair{welcome-midnight.png}{Midnight}{ssh-light.png}{Light, with a session open}
+
+The \emph{terminal} has its own colour schemes too: eleven of them, including \ui{Dracula}, \ui{Nord},
+\ui{Tokyo Night}, \ui{Catppuccin Mocha} and \ui{Rosé Pine}. Those live in \menu{Settings\then Terminal} and the \menu{View} menu.
+
+% =========================================================================================
+\chapter{Profiles: your address book}\label{ch:profiles}
+\chapmeta{6 minutes}{You'll keep dozens of connections tidy without thinking about it}
+
+\begin{tldr}
+A \emph{profile} is a saved connection. Give it a name and a group, star the ones you use daily, and
+right-click for everything else. Ctrl-click to select lots at once.
+\end{tldr}
+
+\section{Create, edit, copy}
+
+\begin{itemize}
+  \item \textbf{New:} \ui{+} in the sidebar footer or tab strip, \keys{\mod+N}, or right-click a group header and choose
+        \ui{New connection in …} (it lands in that group automatically).
+  \item \textbf{Edit:} double-click a profile, or right-click\then\ui{Edit}. The editor slides in on the right.
+  \item \textbf{Copy:} right-click\then\ui{Duplicate}. Great for ``same as web-01 but web-02''.
+  \item \textbf{Delete:} right-click\then\ui{Delete}. This also deletes the saved passwords for that profile.
+\end{itemize}
+
+\crop{editor-ssh.png}{1515}{40}{0}{70}{0.52\linewidth}{Editing an existing SSH profile. The editor scrolls; sections are grouped so you can ignore most of them.}
+
+\subsection{What goes in a profile}
+
+Every profile has the same \ui{General} section, then sections specific to its protocol (Part 2 covers each
+one). The common bits are:
+
+\renewcommand\arraystretch{1.4}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{32mm}X@{}}
+  \toprule
+  Display Name & What you'll see in the sidebar. Make it obvious: ``db-primary'', not ``server 3''.\\
+  Host / Port  & Where to connect. Serial profiles have a \ui{Device} instead.\\
+  Group        & Pick an existing group or type a new name to create one.\\
+  Description  & One line shown on hover.\\
+  Terminal     & Font, size (8–36), scrollback (0–100\,000 lines) and cursor style, just for this profile.\\
+  Tags \& Notes & Comma-separated tags (searchable!) and free-form notes for future-you.\\
+  \bottomrule
+\end{tabularx}
+
+Each protocol adds its own sections underneath. Here are four of them side by side; Part~2 goes through each one.
+
+\begin{center}
+\newcommand\mini[2]{\begin{minipage}[t]{0.24\linewidth}\centering\includegraphics[width=\linewidth, trim=1515 600 0 70, clip]{img/#1}\par\vspace{2pt}{\scriptsize\color{muted}#2}\end{minipage}}
+\mini{editor-telnet.png}{Telnet}\hfill\mini{editor-raw.png}{RAW TCP}\hfill\mini{editor-vnc.png}{VNC}\hfill\mini{editor-irc.png}{IRC}
+\end{center}
+
+\begin{protip}[Tags are secretly brilliant]
+Tag things by where they live and what they do (\code{eu-west}, \code{db}, \code{customer-x}). The sidebar search
+matches tags, so typing ``db'' instantly narrows hundreds of profiles to the database servers.
+\end{protip}
+
+\section{Favourites, groups and Recent}
+
+\begin{itemize}
+  \item Right-click\then\ui{Add to Favourites} pins a profile into the \ui{\iStar\ Favourites} section at the top.
+  \item \ui{Recent} always shows the last five things you connected to. You don't have to do anything.
+  \item Groups are just the \ui{Group} field. No group? It goes in \ui{Ungrouped}.
+\end{itemize}
+
+\section{Do lots at once}
+
+Hold \kbd{Ctrl} (\kbd{\ph{E1C4}} on a Mac) and click several profiles. A bar appears at the bottom of the sidebar:
+
+\begin{center}\small
+\begin{tabular}{@{}ll@{\qquad}ll@{}}
+  \ui{Connect all} & opens them all in tabs & \ui{Move group} & moves them (blank = Ungrouped)\\
+  \ui{Disconnect}  & closes their sessions & \ui{Delete} & deletes them (asks first)\\
+  \ui{Tags}        & add or replace tags & \ui{Clear} & forget the selection\\
+\end{tabular}
+\end{center}
+
+\begin{quickwin}
+Select every web server, choose \ui{Connect all}, then turn on broadcast (\keys{\mod+Shift+B}). You're now typing into
+all of them at once. Chapter~\ref{ch:repeat} has the details, and the safety advice.
+\end{quickwin}
+
+\section{``It's already open…''}
+
+Click a profile that already has a live session and Nexus Terminal asks whether to \ui{Use Existing} (jump to that
+tab), open a \ui{New Connection} alongside it, or \ui{Cancel}. No more accidental duplicate sessions.

docs/guide/chapters/part2-connect.tex

@@ -0,0 +1,333 @@
+\guidepart{teal}{Connect}{Connect to all the things}
+  {Nine ways in. Pick the one you need; skip the rest.}
+  {\partitem{\iTerminal}{SSH: the big one}
+   \partitem{\iUsb}{Serial: cables and consoles}
+   \partitem{\iPlug}{Telnet and RAW TCP}
+   \partitem{\iDesktop}{VNC remote desktops}
+   \partitem{\iDesktop}{RDP: Windows desktops}
+   \partitem{\iChat}{IRC}
+   \partitem{\iGithub}{GitHub}}
+
+% =========================================================================================
+\chapter{SSH: the big one}\label{ch:ssh}
+\chapmeta{10 minutes (or 2 for the basics)}{You'll log in with keys, hop through bastions and never type a 2FA code again}
+
+\begin{tldr}
+Host, username, key, done. Everything else (jump hosts, proxies, forwards, 2FA, login scripts) is optional and
+lives in its own fold-away section of the editor. Open only the ones you need.
+\end{tldr}
+
+\begin{glance}{teal}{SSH}
+  Default port & 22\\
+  Logs in with & Password, public key, keyboard-interactive, SSH agent\\
+  Extras       & SFTP file browser, port forwards, live latency, agent forwarding, TOTP 2FA\\
+  Good for     & Servers, VMs, Raspberry Pis, anything with \code{sshd}\\
+\end{glance}
+
+\section{The two-minute version}
+
+\begin{enumerate}
+  \item \keys{\mod+N}, leave the protocol on \proto[teal]{SSH}.
+  \item \ui{Host}, \ui{Username}. Leave the port on 22 unless you know otherwise.
+  \item Under \ui{Key \& Passphrase}, pick your key from the suggestions (Nexus Terminal lists the keys in your
+        \code{\textasciitilde/.ssh} folder) and check for a little green \ui{Key verified}.
+  \item \ui{Create \& Connect}. The first time, you'll be asked to trust the server's host key. Say yes if you
+        were expecting it.
+\end{enumerate}
+
+\crop{hostkey.png}{842}{720}{845}{589}{0.66\linewidth}{First time connecting? You'll be shown the server's fingerprint. \ui{Accept \& Save} if it's the server you meant.}
+
+\begin{headsup}
+Type the full path to a key if you're not using the suggestions. Nexus Terminal doesn't expand \code{\textasciitilde}
+in that box, so write \code{/home/you/.ssh/id\_ed25519} (or \code{C:\textbackslash Users\textbackslash you\textbackslash .ssh\textbackslash id\_ed25519}).
+\end{headsup}
+
+\section{How it logs in}
+
+Under \ui{Authentication}, tick which \ui{Auth Methods} to try: \ui{Public key}, \ui{Password} and
+\ui{Keyboard-interactive}. Under \ui{SSH Agent}, tick \ui{Use SSH Agent for Authentication} to use keys already
+loaded into \code{ssh-agent} (or Pageant, or the Windows OpenSSH agent).
+
+Got an SSH \emph{user certificate}? Put it next to the key with the usual name (\code{id\_ed25519-cert.pub} beside
+\code{id\_ed25519}) and Nexus Terminal presents it automatically. Servers that hand out \emph{host} certificates are
+covered in \hyperref[ch:hostkeys]{Host keys} (p.\,\pageref{ch:hostkeys}).
+
+Every password and passphrase has a \emph{mode}: save it securely, remember it until you quit, or ask every time.
+That's all explained in \hyperref[ch:secrets]{Passwords \& the vault} (p.\,\pageref{ch:secrets}).
+
+\begin{protip}[Agent forwarding]
+Tick \ui{Forward Agent to Remote} (it's \code{ssh -A}) and you can \code{git pull} or hop onwards from the server using
+the keys on \emph{your} machine. Only do it on servers you trust: anyone with root there can use your agent while
+you're connected.
+\end{protip}
+
+\section{Jump hosts: getting through the bastion}
+
+Lots of servers hide behind a bastion. Add one or more hops under \ui{Jump Hosts}, each with its own user, host,
+port and optional key. Nexus Terminal tunnels through them in order, so the chain
+\textit{you\then bastion\then internal-box\then db-primary} is just three rows.
+
+\section{Proxies}
+
+Stuck behind a corporate proxy? Under \ui{Proxy}, choose \ui{SOCKS5} or \ui{HTTP CONNECT} and fill in the host,
+port and (optional) username and password. The proxy is used to reach the SSH server, or the first jump host if
+you have some.
+
+\section{2FA without the phone faff}\label{sec:totp}
+
+If your server asks for a one-time code, paste the Base32 TOTP secret (the text version of the QR code) into
+\ui{TOTP Secret} and hit \ui{Save}. From then on, Nexus Terminal answers the ``Verification code:'' prompt itself.
+\ui{Test} shows today's code so you can check it matches your phone.
+
+\begin{headsup}
+Save the profile first, then save the TOTP secret. And make sure your computer's clock is right: TOTP codes are
+time-based, so a clock that's a minute out will produce wrong codes.
+\end{headsup}
+
+\section{Do things automatically on login}
+
+\begin{description}
+  \item[Startup] A \ui{Startup Command} to run once you're in (say, \code{tmux attach}), plus
+        \ui{Environment Variables} as \code{KEY=VALUE}, one per line.
+  \item[Login Script] For old-school boxes that ask questions. Add steps: \ui{Wait for} some text, then
+        \ui{Send} a reply. Repeat as needed.
+\end{description}
+
+\section{Keeping it alive}
+
+Under \ui{Advanced}: the \ui{Terminal Type}, the \ui{Keepalive Interval} and \ui{Max Missed Keepalives}, compression,
+and \ui{Auto-Reconnect} with a maximum number of attempts (1–20). Reconnection backs off politely: 1\,s, 2\,s,
+4\,s… up to 30\,s.
+
+\begin{sidequest}[What's that number in the status bar?]
+For SSH sessions the status bar shows live latency, the round trip to the server. Green is snappy. If it's
+in the hundreds and your typing feels sticky, it's the network, not you.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Serial: cables and consoles}\label{ch:serial}
+\chapmeta{4 minutes}{You'll be talking to a switch, router or microcontroller over USB}
+
+\begin{tldr}
+Plug in the adapter, pick the device, match the baud rate. 115200 8N1 is the default and usually right.
+Right-click the tab to send a break or wiggle DTR/RTS.
+\end{tldr}
+
+\begin{glance}{accent}{Serial}
+  Device       & \code{/dev/ttyUSB0}, \code{/dev/cu.usbserial-…} or \code{COM3}\\
+  Defaults     & 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, DTR and RTS on\\
+  Extras       & Send Break, toggle DTR/RTS, auto-reconnect when the cable comes back\\
+  Good for     & Network gear consoles, Arduinos, ESP32s, Raspberry Pi UARTs, 3D printers\\
+\end{glance}
+
+\crop{editor-serial.png}{1515}{40}{0}{70}{0.52\linewidth}{A serial profile for a switch console at 9600 baud. Click refresh after plugging in an adapter.}
+
+\section{Setting it up}
+
+\begin{description}
+  \item[Device] Pick it from the list (hit refresh after plugging in) or type the path.
+  \item[Line Settings] \ui{Baud Rate} (a preset from 300 to 1\,000\,000, or \ui{Custom}), \ui{Data Bits} (5–8),
+        \ui{Parity} (none, odd, even), \ui{Stop Bits} (1 or 2) and \ui{Flow Control} (none, XON/XOFF, RTS/CTS).
+  \item[Behaviour] \ui{Line Ending}, \ui{Encoding}, \ui{Local Echo} (for devices that don't echo what you type),
+        \ui{Assert DTR on connect}, \ui{Assert RTS on connect} and \ui{Auto-reconnect}.
+\end{description}
+
+\section{While you're connected}
+
+Right-click the tab for \ui{Send Break} (handy for getting into a router's ROMMON) and to toggle \ui{DTR} and
+\ui{RTS} (handy for resetting boards that wire those to reset). Pull the cable out and the session disconnects; with
+auto-reconnect on, it picks up again when you plug it back in.
+
+Serial tabs are proper terminals, so recording, triggers, broadcast, snippets, find and split panes all work.
+
+\begin{headsup}[Gibberish on screen?]
+Garbled characters nearly always mean the baud rate, parity or stop bits don't match the device. Check the
+device's manual. 9600 and 115200 are the usual suspects.
+\end{headsup}
+
+\begin{protip}[Linux and macOS quirks]
+On Linux, add yourself to the \code{dialout} group (\code{uucp} on some distributions) and log out and in again.
+On a Mac, use the \code{/dev/cu.*} device, not \code{/dev/tty.*}.
+\end{protip}
+
+% =========================================================================================
+\chapter{Telnet and RAW TCP}\label{ch:raw}
+\chapmeta{4 minutes}{You'll poke at old kit and raw sockets without reaching for netcat}
+
+\begin{tldr}
+Telnet is a terminal for old devices. RAW is a packet-level conversation with any TCP port, with a hex view.
+\end{tldr}
+
+\section{Telnet}
+
+\begin{glance}{amber}{Telnet}
+  Default port & 23\\
+  Options      & Local echo, line mode, terminal type, encoding (UTF-8, ASCII, ISO 8859-1), line endings, login script\\
+  Extras       & Send Break from the tab menu, \ui{Debug Negotiation} for when options go wrong\\
+\end{glance}
+
+\begin{danger}[Telnet is plain text]
+Everything, including your password, crosses the network unencrypted. Fine on a lab bench, not fine over the
+internet or café Wi-Fi.
+\end{danger}
+
+\section{RAW TCP}
+
+RAW connects to any TCP port and shows you exactly what goes back and forth. Instead of a terminal you get a
+traffic log with \ui{Text}, \ui{Hex} and \ui{Split} views.
+
+\shot{raw.png}{A RAW session to a chatty sensor, with timestamps and direction markers turned on.}
+
+\begin{itemize}
+  \item \textbf{Send bar:} pick \ui{Text}, \ui{Hex} or \ui{Escaped} (\code{\textbackslash r\textbackslash n} and friends),
+        type, press \kbd{Enter}. One-click buttons send \ui{NUL}, \ui{CR}, \ui{LF}, \ui{ETX} and \ui{EOT}.
+  \item \textbf{Presets:} save payloads you send often in the profile under \ui{Payload Presets}, then pick them from
+        \ui{Presets…}.
+  \item \textbf{Capture:} \ui{Pause}, \ui{Clear}, and \ui{Save} (writes the whole conversation as JSON).
+  \item \textbf{Profile options:} encoding (UTF-8, ASCII, Hex), line ending, timestamps, direction, timeouts and
+        auto-reconnect.
+\end{itemize}
+
+\begin{quickwin}
+Point a RAW profile at a web server on port 80 and send \code{HEAD / HTTP/1.0\textbackslash r\textbackslash n\textbackslash r\textbackslash n}
+in \ui{Escaped} mode. Instant HTTP headers, no browser required.
+\end{quickwin}
+
+% =========================================================================================
+\chapter{VNC remote desktops}\label{ch:vnc}
+\chapmeta{4 minutes}{You'll see and drive a remote desktop, safely}
+
+\begin{tldr}
+VNC shows you another computer's screen. Tunnel it through SSH (tick a box), because plain VNC isn't encrypted.
+\end{tldr}
+
+\begin{glance}{rose}{VNC}
+  Default port & 5900 (plus the display number: display \code{:1} is 5901)\\
+  Display      & \ui{View Only}, \ui{Scale to Fit}, \ui{Shared Session}, \ui{Quality (0-9)}\\
+  Security     & Optional SSH tunnel with password, key or agent login\\
+\end{glance}
+
+\shot{vnc.png}{A remote desktop, scaled to fit the tab.}
+
+\section{The toolbar}
+
+Connection state and desktop size on the left. On the right: switch between scaled and 1:1, refresh,
+\ui{Paste Clipboard} (sends your clipboard to the remote machine) and \ui{Ctrl+Alt+Del}. Click the desktop to give
+it your keyboard. Anything the remote machine copies lands on your clipboard automatically.
+
+\section{Tunnel it}
+
+Tick \ui{Enable SSH Tunnel} and fill in the SSH host, port, username and login method. The VNC traffic then
+travels inside an encrypted SSH connection. If you connect to a VNC profile \emph{without} a tunnel, Nexus Terminal
+warns you and offers \ui{Connect Anyway}, \ui{Edit Profile} or \ui{Cancel}.
+
+\begin{headsup}[Connecting to a Mac?]
+Turn on \ui{VNC viewers may control screen with password} in macOS Screen Sharing settings. Nexus Terminal uses
+standard VNC password authentication, not Apple's own login method.
+\end{headsup}
+
+% =========================================================================================
+\chapter{RDP: Windows desktops}\label{ch:rdp}
+\chapmeta{4 minutes}{You'll be on a Windows (or xrdp) desktop without leaving Nexus Terminal}
+
+\begin{tldr}
+Host, username, password. Nexus Terminal logs on with NLA, pins the server's certificate like an SSH host key, and
+can go through a proxy, an SSH tunnel or an RD Gateway.
+\end{tldr}
+
+\begin{glance}{rose}{RDP}
+  Default port & 3389\\
+  Logs in with & NLA (NTLM, or Kerberos with a KDC); \ui{Allow servers without NLA} for xrdp\\
+  Display      & \ui{Scale to Fit}, fixed size, \ui{Resize With Tab}\\
+  Extras       & Clipboard both ways, remote audio, printer, shared folder\\
+  Getting there & SOCKS5 or HTTP proxy, SSH tunnel, RD Gateway (experimental)\\
+\end{glance}
+
+\shot{rdp.png}{An xrdp desktop in a tab. Ctrl+Alt+Del and Paste Clipboard sit on the toolbar.}
+
+\section{Setting it up}
+
+\begin{enumerate}
+  \item \keys{\mod+N}, protocol \proto[rose]{RDP}.
+  \item \ui{Host} and \ui{Username}; add a \ui{Domain} if your account has one.
+  \item Pick how the password is kept (save it, remember it until you quit, or ask every time).
+  \item \ui{Create \& Connect}. The first time, you're shown the server's certificate fingerprint. Accept it if
+        it's the machine you meant.
+\end{enumerate}
+
+Windows checks your password \emph{before} it builds a desktop (Network Level Authentication), so a typo fails fast.
+Linux machines running xrdp don't speak NLA: tick \ui{Allow servers without NLA} for those. In an Active Directory
+shop, set a \ui{Kerberos KDC} (\code{host} or \code{host:port}) and use your realm as the domain.
+
+\begin{headsup}[A changed certificate]
+RDP servers mostly use self-signed certificates, so Nexus Terminal remembers the fingerprint in
+\ui{Known Hosts}. If it changes you get \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}, and nothing (not even your
+password) is sent until you choose.
+\end{headsup}
+
+\section{While you're connected}
+
+It works like the VNC viewer: click the desktop to give it your keyboard, \ui{Ctrl+Alt+Del} sends exactly that, and
+text you copy on either side turns up on the other. With \ui{Resize With Tab} the remote desktop follows the tab's
+size (Windows does this; other servers are scaled).
+
+Under \ui{Devices}: \ui{Play Remote Audio}; \ui{Redirect Printer}, which adds a \emph{Nexus Terminal} printer whose jobs
+land as PostScript files in your Downloads folder; and (Linux and macOS) a \ui{Shared Folder} that shows up remotely as
+a drive called Nexus. The server can read and change that folder, and nothing outside it.
+
+\section{Getting through}
+
+Pick \emph{one} of: a \ui{Proxy} (SOCKS5 or HTTP CONNECT), an \ui{SSH Tunnel} (same as VNC), or an \ui{RD Gateway}
+(experimental: the gateway needs a proper public certificate and Basic authentication over HTTPS).
+
+% =========================================================================================
+\chapter{IRC}\label{ch:irc}
+\chapmeta{3 minutes}{You'll be chatting in your project's channels from the same window as your servers}
+
+\begin{tldr}
+Nick, server, rooms to join. Tabs for each room, \code{/commands} as you'd expect, \kbd{Tab} completes nicks.
+\end{tldr}
+
+\begin{glance}{amber}{IRC}
+  Default port & 6667, or 6697 with \ui{Use TLS} (use TLS!)\\
+  Logs in with & SASL PLAIN (most networks want this now), or NickServ identify\\
+  Extras       & Auto-join rooms, room browser, real message times (IRCv3 server-time), SSH tunnel\\
+\end{glance}
+
+\shot{irc.png}{Chatting in \#nexus. Rooms down the right, users in the room below them.}
+
+\begin{itemize}
+  \item A \ui{Server} tab plus one per room or private conversation. A dot means unread messages.
+  \item Commands: \code{/join}, \code{/part}, \code{/msg}, \code{/me}, \code{/notice}, \code{/nick}, \code{/topic},
+        \code{/list}, \code{/names}, \code{/whois}, \code{/who}, \code{/raw}, \code{/quit} and \code{/help}.
+  \item \kbd{Tab} completes a nick; click a nick to mention them.
+  \item The side panel lists your rooms, a room browser with a filter (click to join) and who's in the current room.
+\end{itemize}
+
+% =========================================================================================
+\chapter{GitHub}\label{ch:github}
+\chapmeta{2 minutes}{You'll see all your repositories, freshest first}
+
+\crop{editor-github.png}{1515}{780}{0}{70}{0.5\linewidth}{A GitHub profile: just the API address and a token.}
+
+\begin{tldr}
+Paste a personal access token with the \code{repo} scope. Get a tidy, filterable list of every repository you can see.
+\end{tldr}
+
+\shot{github.png}{Repositories grouped by owner, with the latest commit and who made it.}
+
+\begin{itemize}
+  \item Grouped by owner or organisation, sorted by most recent activity.
+  \item Badges for \proto[rose]{Private}, \proto[violet]{Fork} and \proto[amber]{Archived}, plus language and stars.
+  \item Filter box, \ui{Refresh now}, \ui{Visit} (opens in your browser) and \ui{ZIP} (downloads an archive).
+  \item Works with GitHub Enterprise: set \ui{API Base URL} to your server's API address. Refreshes every 60–3600 seconds.
+\end{itemize}
+
+% =========================================================================================
+\chapter{Your own computer}\label{ch:local}
+\chapmeta{1 minute}{You'll stop alt-tabbing to a separate terminal app}
+
+Click \ui{Local Machine} for a shell on this computer. It uses your system's default shell unless you choose
+another in \menu{Settings\then General\then Local shell} (\code{pwsh}, \code{zsh}, \code{fish}, whatever you fancy).
+
+\shot[0.86\linewidth]{local.png}{A local shell, with all the same terminal powers as SSH.}

docs/guide/chapters/part3-faster.tex

@@ -0,0 +1,264 @@
+\guidepart{violet}{Work faster}{Work faster}
+  {Fewer clicks, less typing, more getting on with it.}
+  {\partitem{\iSplit}{Tabs and split panes}
+   \partitem{\iKeyboard}{Terminal superpowers}
+   \partitem{\iWand}{Never type it twice}
+   \partitem{\iFolder}{Files: SFTP and drag-and-drop}
+   \partitem{\iArrows}{Port forwards}
+   \partitem{\iFilm}{Recordings}}
+
+% =========================================================================================
+\chapter{Tabs and split panes}\label{ch:tabs}
+\chapmeta{4 minutes}{You'll juggle a dozen sessions without losing any of them}
+
+\begin{tldr}
+Right-click a tab for everything. \keys{\mod+Shift+D} splits right, \keys{\mod+Shift+E} splits down.
+\keys{\mod+1} to \keys{\mod+9} jump straight to a tab.
+\end{tldr}
+
+\section{Tabs}
+
+\begin{description}
+  \item[Move] Drag tabs about, or right-click\then\ui{Move Left} / \ui{Move Right}.
+  \item[Pin] Right-click\then\ui{Pin}. Pinned tabs stay at the front.
+  \item[Rename] Right-click\then\ui{Rename}. ``prod DB, DON'T TOUCH'' is a perfectly valid tab name.
+  \item[Duplicate] Opens another session to the same profile.
+  \item[Reconnect] Does what it says.
+  \item[Peek] Hover a tab for its name, host, state and when it connected.
+  \item[Close] The \ui{×}, \keys{\mod+W}, or right-click\then\ui{Close}. Connected tabs ask first (you can turn that
+        off in Settings).
+  \item[Switch] \keys{\mod+Tab} and \keys{\mod+Shift+Tab}, or \keys{\mod+1} to \keys{\mod+9}.
+\end{description}
+
+Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad. Quit with a dozen open and they're all back next
+time: \ui{Restore tabs at launch} (on by default) reconnects saved profiles and reopens local shells, splits and all,
+in the folder they were in.
+
+\section{Split panes}
+
+Want two sessions side by side? Split the focused pane right with \keys{\mod+Shift+D} or down with
+\keys{\mod+Shift+E} (also in the \menu{Session} menu, the right-click menu and the palette). The new pane asks
+what to open: \ui{Local Machine} or any of your terminal profiles.
+
+\shot{split.png}{A fresh split. Pick what goes in the new pane.}
+
+Drag a divider to resize. Click \ui{×} on a pane's header to close it and its neighbour takes the space. Closing
+the tab closes every pane in it.
+
+\begin{quickwin}
+Split right, open \code{htop} on one side and tail a log on the other. Now you look like a hacker in a film.
+\end{quickwin}
+
+% =========================================================================================
+\chapter{Terminal superpowers}\label{ch:terminal}
+\chapmeta{4 minutes}{You'll copy, search and scroll like you've used it for years}
+
+\begin{tldr}
+Select to copy, \keys{\mod+F} to search, Ctrl/\ph{E1C4}-click links. Right-click for the rest.
+\end{tldr}
+
+\section{Keyboard and mouse}
+
+\renewcommand\arraystretch{1.45}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{24mm}X@{}}
+  \toprule
+  Copy   & Select text, then \keys{\mod+C}. Nothing selected? \keys{Ctrl+C} interrupts the program as usual.\\
+  Paste  & \keys{\mod+V}. Pastes are bracketed when the program asks for it, so editors won't auto-indent your paste
+           into a staircase. Pasting several lines into a shell asks first (turn that off in Settings).\\
+  Select & Drag for a range, double-click a word, triple-click a line, \kbd{Shift}-click to extend.\\
+  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser. Real hyperlinks that
+           programs print (\code{ls --hyperlink}, compilers) get a dotted underline; hover to see where they really go.\\
+  Scroll & Mouse wheel, or \keys{Shift+PageUp}, \keys{Shift+PageDown}, \keys{Shift+Home}, \keys{Shift+End}.\\
+  \bottomrule
+\end{tabularx}
+
+\begin{sidequest}[Why does the scroll wheel move the cursor in less?]
+Full-screen programs (\code{less}, \code{vim}, \code{tmux}, \code{byobu}) use the terminal's ``alternate screen'', where the
+wheel sends arrow keys instead of scrolling. Programs with mouse support (\code{htop}, \code{vim} with
+\code{mouse=a}, \code{tmux} mouse mode) get your clicks directly. That's normal terminal behaviour, not a bug.
+\end{sidequest}
+
+\section{The right-click menu}
+
+\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Previous Prompt} / \ui{Next Prompt}, \ui{Copy Last Command
+Output}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right}, \ui{Split Down}, \ui{Export Output} (saves the
+whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+
+\section{Shell integration}
+
+If your shell marks its prompts (fish 4, Starship and Powerlevel10k do already), Nexus Terminal knows where every
+command starts and stops. \keys{\mod+Shift+Up} and \keys{\mod+Shift+Down} jump from prompt to prompt,
+\ui{Copy Last Command Output} grabs just what the last command printed, and a thin bar beside each prompt shows how it
+went: green for success, red for failure. Hover the bar for the exit code and how long it took.
+
+\shot{shell-integration.png}{\code{make test} failed (red bar), \code{ls} worked (green bar).}
+
+For bash, add this to \code{\textasciitilde/.bashrc} on the machine the shell runs on (the user manual has the zsh
+version):
+
+\begin{verbatim}
+PS0='\[\e]133;C\a\]'
+PROMPT_COMMAND='printf "\033]133;D;%s\007" "$?"; '"${PROMPT_COMMAND}"
+PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
+\end{verbatim}
+
+\section{Pictures in the terminal}
+
+Programs that print images the iTerm2 way (\code{imgcat}, \code{wezterm imgcat}, \code{chafa -f iterm}) show PNG,
+JPEG and GIF images right in the scrollback. They scroll with the text and never spill past the edge.
+
+\shot{inline-image.png}{An image printed by a script, with the text carrying on underneath.}
+
+\section{Find}
+
+\keys{\mod+F} opens the find bar. Toggle \ui{Aa} for case-sensitive and \ui{.*} for regular expressions.
+\kbd{Enter} for the next match, \keys{Shift+Enter} for the previous one, \kbd{Esc} to close. It shows
+``3 of 17'' so you know where you are.
+
+\section{When the connection drops}
+
+The pane dims and shows a \ui{Disconnected} card with \ui{Reconnect} and \ui{Close}. If auto-reconnect is on,
+it says \ui{Reconnecting…} with a \ui{Cancel} button, and a toast tells you which attempt it's on.
+
+If the problem was a password or host key, you get a friendly dialog explaining what happened, with
+\ui{Retry}, \ui{Edit Profile}, \ui{Known Hosts} (for host-key trouble) and \ui{Close}.
+
+% =========================================================================================
+\chapter{Never type it twice}\label{ch:repeat}
+\chapmeta{6 minutes}{You'll stop retyping the same commands, and let Nexus Terminal watch the logs for you}
+
+\begin{tldr}
+\textbf{Snippets} store commands. \textbf{Broadcast} types into many sessions at once. \textbf{Triggers} watch output and
+tap you on the shoulder.
+\end{tldr}
+
+\section{Snippets: \keys{\mod+Shift+S}}
+
+Save commands you use a lot, with a name, description and folder. Search them, click
+\ui{Send to Session}, and the command is typed into the active session followed by \kbd{Enter}.
+
+\crop{snippets.png}{633}{384}{611}{402}{0.8\linewidth}{The snippet library, organised into folders.}
+
+Snippets can have blanks to fill in:
+
+\begin{itemize}
+  \item \code{\{\{hostname\}\}}, \code{\{\{date\}\}}, \code{\{\{time\}\}} and \code{\{\{timestamp\}\}} are filled in for you.
+  \item Anything else, like \code{\{\{service\}\}}, is asked for when you send it.
+\end{itemize}
+
+So \code{journalctl -fu \{\{service\}\}} asks ``service?'' and tails whichever one you type.
+
+\section{Broadcast: \keys{\mod+Shift+B}}
+
+Turn broadcast on and everything you type goes to \emph{every} connected terminal. The status bar shows
+\ui{BROADCAST} so you can't forget it's on.
+
+\shot{broadcast.png}{Broadcast is on: the status bar says so in no uncertain terms.}
+
+To broadcast to only some sessions, right-click the \iBroadcast{} button (or \menu{Session\then Broadcast
+targets…}), tick the ones you want and click \ui{Apply \& Enable}.
+
+\begin{danger}[With great power…]
+Broadcast doesn't care which tab you \emph{meant}. Double-check the target list before you type anything
+destructive. \code{sudo reboot} into twenty servers is very efficient and very memorable.
+\end{danger}
+
+\section{Triggers: let it watch for you}
+
+\menu{Session\then Trigger Rules} (or the palette). Each rule has a pattern (plain text or a regular
+expression), a case-sensitivity switch, an on/off switch, and an action:
+
+\begin{center}\small
+\begin{tabular}{@{}ll@{}}
+  \ui{Notify} & shows a toast\\
+  \ui{Highlight tab} & briefly outlines the pane\\
+  \ui{Notify + Highlight} & both\\
+  \ui{Sound} & asks your OS for attention (a bouncing dock icon or flashing taskbar button) and shows a toast\\
+\end{tabular}
+\end{center}
+
+\crop{triggers.png}{725}{610}{725}{625}{0.75\linewidth}{Three rules: shout about errors, ping when a build finishes, and one switched off for now.}
+
+Rules check each complete line of output, with colours stripped out first.
+
+\begin{quickwin}
+Add a rule for \code{BUILD SUCCESSFUL} with the \ui{Sound} action, start a long build, and go and make a cup of tea.
+Nexus Terminal will tell you when it's done. (Or \code{(?i)error|fatal} for the opposite.)
+\end{quickwin}
+
+% =========================================================================================
+\chapter{Files: SFTP and drag-and-drop}\label{ch:files}
+\chapmeta{4 minutes}{You'll move files to and from servers without leaving the terminal}
+
+\begin{tldr}
+Click the \iFolder{} on an SSH tab. Or drop a file onto the terminal and choose \ui{Upload}.
+\end{tldr}
+
+\section{The SFTP browser}
+
+Click the \iFolder{} folder icon on an SSH tab, \menu{Session\then SFTP browser}, or type ``sftp'' in the palette.
+It opens in the side dock next to your terminal, in the folder your shell is in if the shell reports it
+(fish does; bash and zsh need a one-line hook, see the user manual).
+
+\shot{sftp.png}{Browsing the server's files next to the terminal.}
+
+\begin{itemize}
+  \item Move around with the breadcrumb trail, the \code{..} entry or \ui{Go to path}.
+  \item Upload files; download one or many to a folder you choose.
+  \item Rename, delete (it asks first), make folders, refresh.
+  \item \iStar{} bookmarks the current folder, per profile.
+  \item Ctrl-click (\ph{E1C4}-click) or Shift-click to select several things. Transfers show progress as they go.
+\end{itemize}
+
+\section{Drag and drop}
+
+Drop files onto a terminal and choose:
+
+\begin{description}
+  \item[Upload to current directory] Pick the remote folder (SSH only).
+  \item[Paste contents] Types the file's contents into the terminal, as if you'd typed it.
+\end{description}
+
+The upload picker looks like the SFTP browser but shows folders only, labelled \proto[amber]{READ ONLY} if you can't
+write there and \proto[rose]{NO READ} if you can't look inside. Keyboard fans: \kbd{↑}\kbd{↓} to move, \kbd{Enter} to
+choose, \kbd{Backspace} to go up, \kbd{Esc} to cancel. If the SFTP browser is open, the picker starts in the same folder.
+
+% =========================================================================================
+\chapter{Port forwards}\label{ch:forwards}
+\chapmeta{3 minutes}{You'll reach a database or web app that only listens on the server}
+
+\begin{tldr}
+\emph{Local} forwards bring a remote port to your machine. \emph{Remote} forwards do the opposite.
+\end{tldr}
+
+Forwards saved in an SSH profile (under \ui{Port Forwarding}, with \ui{Active} ticked) start when you connect.
+To manage them on a live session, right-click the terminal\then\ui{Port Forwards}, or \menu{Session\then Port forwards}.
+
+\begin{description}
+  \item[Local \iArrow] Listen on your computer, forward to somewhere the server can reach.
+        Example: \code{127.0.0.1:15432}\then\code{127.0.0.1:5432} lets your desktop database app talk to Postgres on
+        the server as if it were local.
+  \item[Remote \ph{E058}] Ask the server to listen and send connections back to somewhere \emph{your} computer can reach.
+        Great for showing a colleague the dev server running on your laptop.
+\end{description}
+
+Active forwards are listed with an \proto[accent]{L} or \proto[violet]{R} badge and a stop button. Toasts tell you when one
+starts, stops or fails.
+
+% =========================================================================================
+\chapter{Recordings}\label{ch:recordings}
+\chapmeta{2 minutes}{You'll have a replayable record of exactly what happened}
+
+\keys{\mod+Shift+R} starts and stops recording the active session. A red dot appears on the tab and \ui{REC} in
+the status bar. Recordings are standard asciicast v2 files, so other tools (like \code{asciinema}) can play them too.
+
+\crop{recordings.png}{712}{392}{690}{415}{0.75\linewidth}{The recordings browser. Play, delete, or tidy up in bulk.}
+
+The browser (sidebar footer, \menu{Session} menu or palette) shows how many recordings you have and how much space
+they take. Play or delete each one, or use \ui{Clean up} to remove recordings older than 7, 30 or 90 days, or to keep
+the total under 1\,GB or 5\,GB. Playback has play/pause, restart, a seek bar and speed control.
+
+\begin{protip}
+Record the next time you do something fiddly and rare (a database failover, a certificate rotation). Six months
+later, ``how did we do that again?'' has an answer you can literally watch.
+\end{protip}

docs/guide/chapters/part4-safe.tex

@@ -0,0 +1,139 @@
+\guidepart{amber}{Stay safe}{Stay safe}
+  {Passwords, keys and host checks, minus the jargon headache.}
+  {\partitem{\iLock}{Passwords and the vault}
+   \partitem{\iShield}{Host keys: is it really that server?}
+   \partitem{\iKey}{SSH keys}}
+
+% =========================================================================================
+\chapter{Passwords and the vault}\label{ch:secrets}
+\chapmeta{5 minutes}{You'll know exactly where your passwords live and who can read them}
+
+\begin{tldr}
+Passwords go in your OS keychain. If there isn't one, they go in an encrypted vault protected by a master password.
+For each password you choose: save it, remember it until you quit, or ask every time.
+\end{tldr}
+
+\section{Where secrets live}
+
+\begin{center}
+\begin{tikzpicture}[
+  box/.style={rounded corners=6pt, fill=#1!12, draw=#1!60, line width=0.6pt, minimum height=13mm, text width=40mm,
+    align=center, font=\small},
+  arr/.style={-latex, line width=0.8pt, color=muted}]
+  \node[box=accent] (need) {\heavy A session needs\\a password};
+  \node[box=green, right=12mm of need] (kc) {\heavy OS keychain\\{\footnotesize Keychain · Credential Manager · Secret Service}};
+  \node[box=amber, right=12mm of kc] (vault) {\heavy Encrypted vault\\{\footnotesize AES-256-GCM, Argon2id}};
+  \node[box=rose, below=9mm of kc] (ask) {\heavy Ask you\\{\footnotesize then carry on}};
+  \draw[arr] (need) -- (kc);
+  \draw[arr] (kc) -- node[above, font=\scriptsize]{not there?} (vault);
+  \draw[arr] (vault) |- node[pos=0.25, right, font=\scriptsize]{still not there?} (ask);
+\end{tikzpicture}
+\end{center}
+
+\begin{description}
+  \item[OS keychain first] macOS Keychain, Windows Credential Manager, or the Linux Secret Service (GNOME Keyring,
+        KWallet and friends).
+  \item[Encrypted vault as backup] If there's no keychain, or it refuses, secrets go into Nexus Terminal's own
+        vault: AES-256-GCM with a key derived from your master password by Argon2id using 128\,MiB of memory. In
+        plain English: very, very expensive to brute-force.
+\end{description}
+
+\section{Setting up the vault}
+
+\menu{Settings\then Security\then Initialise Secret Store}. Choose a master password; the strength meter goes from
+\proto[rose]{Weak} through \proto[amber]{Fair} and \proto[accent]{Good} to \proto[green]{Strong}. Unlock and lock it
+from the same page, from the palette, or by clicking the vault badge in the status bar. It locks itself when you quit.
+
+\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Security settings on a machine without an OS keychain: the vault does the job instead.}
+
+\begin{danger}[There's no ``forgot password'' link]
+Lose the master password and the secrets in the vault are gone for good. That's the point of encryption. Put it in
+your password manager.
+\end{danger}
+
+\section{Three ways to handle each password}
+
+Every password, passphrase, token or TOTP secret has its own setting:
+
+\begin{center}
+\begin{tabular}{@{}p{0.3\linewidth}p{0.3\linewidth}p{0.3\linewidth}@{}}
+  \begin{tcolorbox}[colback=green!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{green!60!black}\iLock\ Save securely}\par\smallskip Stored in the keychain or vault and used automatically. Most convenient.
+  \end{tcolorbox} &
+  \begin{tcolorbox}[colback=accent!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{accent!80!black}\iClock\ Remember for this session}\par\smallskip Asked once, kept in memory, never written to disk.
+  \end{tcolorbox} &
+  \begin{tcolorbox}[colback=amber!10, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{amber!75!black}\iDetective\ Ask every time}\par\smallskip Asked on every single connection. Most paranoid.
+  \end{tcolorbox}
+\end{tabular}
+\end{center}
+
+When Nexus Terminal needs a secret it doesn't have, it asks. Press \kbd{Esc} or \ui{Cancel} to give up on that
+connection.
+
+\section{Seeing and changing what's saved}
+
+\ui{Stored credentials} on the Security page lists every saved password, passphrase and token by profile, and whether
+it's in the keychain or the vault. \ui{Forget} deletes one. \ui{Change Master Password…} re-encrypts the whole vault
+under a new password in one go.
+
+\begin{sidequest}[What gets written down?]
+Connections, disconnections, profile changes, credential access, imports and exports go into an audit log in the
+database. Secrets themselves never do. TOTP secrets live in the keychain or vault too, never in the profile.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Host keys: is it really that server?}\label{ch:hostkeys}
+\chapmeta{3 minutes}{You'll understand the scary fingerprint dialog and what to do about it}
+
+\begin{tldr}
+Every SSH server (and every RDP server, via its certificate) has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
+A changed fingerprint means a reinstalled server, or someone in the middle. Find out which before carrying on.
+\end{tldr}
+
+Pick a policy per SSH profile under \ui{Host Verification}:
+
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{48mm}X@{}}
+  \toprule
+  Strict (known hosts only)   & Only connects to servers you've already trusted.\\
+  Ask on new or changed keys  & Shows the fingerprint and asks. New: \ui{Accept \& Save} or \ui{Reject}. Changed:
+                                \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}. The default.\\
+  Accept new, reject changed  & Trusts first-time servers silently, still refuses changed keys.\\
+  Insecure (accept anything)  & Exactly what it says. Lab use only.\\
+  \bottomrule
+\end{tabularx}
+
+Under \emph{Strict} and \emph{Accept new}, a key that differs from the saved one is rejected outright.
+
+\crop{settings-knownhosts.png}{581}{253}{576}{285}{0.8\linewidth}{Known hosts. Click a fingerprint to copy it; \ui{Remove} to forget a server.}
+
+\begin{quickwin}
+Nexus Terminal keeps its own list, but \ui{Import \textasciitilde/.ssh/known\_hosts} brings in everything your
+command-line \code{ssh} already trusts (hashed names can't be read back, so those are skipped). \ui{Export…} goes the
+other way, in OpenSSH format.
+\end{quickwin}
+
+\section{Certificate authorities}
+
+Big estates sign host keys with an SSH certificate authority instead of handing out fingerprints. \ui{Trust a CA…}
+adds the CA's public key for a host pattern in OpenSSH style (\code{*.corp.example}, \code{[jump.example]:2222},
+\code{!old.corp.example}); \code{@cert-authority} lines in an imported \code{known\_hosts} do the same. A server the CA
+covers must then show a certificate the CA signed, naming that host and in date. It's trusted without a prompt, and
+anything else is refused.
+
+% =========================================================================================
+\chapter{SSH keys}\label{ch:keys}
+\chapmeta{2 minutes}{You'll have a key pair without memorising ssh-keygen flags}
+
+\menu{Session\then SSH key manager} (or the palette) lists the key pairs in \code{\textasciitilde/.ssh} with their type. Copy a
+public key to the clipboard (ready to paste into GitHub or \code{authorized\_keys}), delete a pair, or generate a new
+\proto[teal]{Ed25519}, \proto[accent]{RSA} (2048 or 4096 bits) or \proto[violet]{ECDSA} key with an optional passphrase.
+
+\crop{keys.png}{725}{523}{725}{546}{0.75\linewidth}{The SSH key manager.}
+
+\begin{protip}
+Not sure which type? Pick Ed25519. It's small, fast and secure. Keys are generated inside Nexus Terminal and
+saved in the usual OpenSSH format, so \code{ssh} and \code{git} can use them too.
+\end{protip}

docs/guide/chapters/part5-yours.tex

@@ -0,0 +1,124 @@
+\guidepart{pink}{Make it yours}{Make it yours}
+  {Settings, backups, and keeping several computers in step.}
+  {\partitem{\iGear}{Settings}
+   \partitem{\iUpload}{Import and export}
+   \partitem{\iPlane}{Moving house}}
+
+% =========================================================================================
+\chapter{Settings}\label{ch:settings}
+\chapmeta{3 minutes}{You'll know where every setting lives}
+
+\keys{\mod+,} opens settings (also the \iGear{} in the sidebar footer and \menu{File\then Settings}). Change things,
+then click \ui{Save}.
+
+\begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
+
+\begin{description}
+  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, \ui{Restore tabs at launch}
+        (saved connections reconnect, local shells reopen in the folder they were in), whether to ask before closing or
+        disconnecting, whether remote programs may write to your clipboard, a confirmation before pasting several lines,
+        the update check, status bar, sidebar width, and the local shell (empty for the system default, or
+        \ui{Browse…}).
+  \item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
+        each profile can override them.
+  \item[Security] Keychain and vault status; set up, unlock or lock the vault; change the master password; your
+        stored credentials; profile sync.
+  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times; import and export
+        \code{known\_hosts}; trusted SSH certificate authorities.
+  \item[Diagnostics] Version, platform, where your data and log live, and the state of the keychain, vault and sync.
+        \ui{Copy Diagnostics} for bug reports (never includes credentials).
+  \item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
+  \item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
+\end{description}
+
+\crop{settings-diagnostics.png}{604}{600}{604}{20}{0.8\linewidth}{Diagnostics: everything a bug report needs, nothing secret.}
+
+\section{Updates}
+
+Nexus Terminal checks once at launch. If there's a newer version the status bar says \ui{Update available}; click it to
+see the release notes and a \ui{View release} button. Nothing downloads or installs behind your back.
+
+% =========================================================================================
+\chapter{Import and export}\label{ch:transfer}
+\chapmeta{3 minutes}{You'll back up your profiles, or copy them to another computer}
+
+\begin{tldr}
+\menu{File\then Export profiles…} makes a password-protected \code{.nexus} file. \menu{File\then Import profiles…}
+reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that too.
+\end{tldr}
+
+\begin{description}
+  \item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
+        included, so the file is safe to email to yourself.
+  \item[Encrypted import] Pick a \code{.nexus} file, enter its password and decide what happens to
+        profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
+  \item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
+        \ui{Include secrets} to keep passwords typed by login scripts, which are otherwise blanked. Proxy passwords and
+        TOTP secrets live in the keychain or vault, so no export carries them.
+  \item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
+        with host names, users, ports, identity files and jump hosts.
+\end{description}
+
+\crop{export.png}{906}{388}{904}{390}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
+
+\begin{danger}[JSON with secrets is not encrypted]
+A JSON export with \ui{Include secrets} ticked has those login-script passwords in plain text. Use the encrypted \code{.nexus} export to
+move things between machines.
+\end{danger}
+
+% =========================================================================================
+\chapter{Moving house}\label{ch:move}
+\chapmeta{3 minutes}{Your connections will follow you from laptop to desktop to work machine}
+
+\begin{tldr}
+Pick a folder every machine can see, set the same sync password on each, done. Profiles stay in step; passwords
+stay put on each machine.
+\end{tldr}
+
+\section{Profile sync}
+
+\menu{Settings\then Security\then Profile sync}. \ui{Choose…} a folder your machines share (Dropbox, iCloud Drive,
+OneDrive, Nextcloud, a network share, or a git checkout you commit) and set the same \ui{Sync password} everywhere.
+Nexus Terminal keeps one encrypted file there, \code{nexus-profiles.nexus}, and merges it at launch, a few seconds
+after you change a profile, every ten minutes and whenever you click \ui{Sync Now}.
+
+\begin{checklist}
+  \item[\color{green}\iCheck] Edited on two machines? The newer change wins, profile by profile.
+  \item[\color{green}\iCheck] Deleted on one machine? It goes from the others too (unless someone edited it afterwards).
+  \item[\color{rose}\ph{E4F6}] Saved passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
+        (Anything a login script \emph{sends} is part of the profile, so that does travel.)
+\end{checklist}
+
+\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Profile sync lives on the Security page, under your stored credentials.}
+
+\begin{headsup}
+Lose the sync password and the sync file can't be read, just like an encrypted export. Your local profiles are
+fine.
+\end{headsup}
+
+\section{One-off moves}
+
+Not worth setting up sync? \menu{File\then Export profiles…} on the old machine, \menu{File\then Import profiles…}
+on the new one (see \hyperref[ch:transfer]{Import and export}). Known hosts travel the same way through
+\ui{Export…} and \ui{Import} on the Known Hosts page.
+
+\section{Where everything lives}
+
+\renewcommand\arraystretch{1.45}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{20mm}X@{}}
+  \toprule
+  macOS   & \code{\textasciitilde/Library/Application Support/NexusTerminal}\\
+  Windows & \code{\%APPDATA\%\textbackslash NexusTerminal}\\
+  Linux   & \code{\$XDG\_CONFIG\_HOME/NexusTerminal}, usually \code{\textasciitilde/.config/NexusTerminal}\\
+  \bottomrule
+\end{tabularx}
+
+Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
+\code{vault/vault.json}, \code{recordings/}, \code{triggers.json}, \code{sftp-bookmarks.json} and \code{nexus.log}, the
+diagnostic log. Keychain entries are
+stored under the service name \code{NexusTerminal}.
+
+\begin{protip}[Try things without touching your real data]
+Start Nexus Terminal with \code{--data-dir /some/other/folder} and it uses that folder instead. Brilliant for
+experiments, demos and a portable install on a USB stick.
+\end{protip}

docs/guide/chapters/part6-fix.tex

@@ -0,0 +1,106 @@
+\guidepart{rose}{Fix it}{When things go wrong}
+  {Symptom first, fix second. No essays.}
+  {\partitem{\iLifebuoy}{Troubleshooting, by symptom}}
+\label{part:fix}
+
+% =========================================================================================
+\chapter{Troubleshooting, by symptom}\label{ch:trouble}
+\chapmeta{as long as it takes}{You'll find your symptom and the fix in one place}
+
+\begin{tldr}
+Find the heading that matches what you're seeing. Try the fixes in order. Most problems are the network, the
+password, or the baud rate.
+\end{tldr}
+
+\section{Connecting}
+
+\fix{``Authentication failed''}{%
+\begin{itemize}
+  \item Check the username, password, key path and the ticked \ui{Auth Methods}.
+  \item If the key has a passphrase, check how the passphrase is stored (\ui{Passphrase Mode}).
+  \item Two-factor server? Click \ui{Test} next to the TOTP secret and compare with your phone. Check your clock.
+  \item Saved password not being used? The vault might be locked: click \ui{Vault locked} in the status bar.
+\end{itemize}}
+
+\fix{``Host key verification failed''}{%
+The server's fingerprint changed since you last connected. That happens when a server is rebuilt, but it's also exactly
+what an attack looks like. \textbf{Check with whoever runs the server.} If it's legitimate:
+choose \ui{Accept \& Update} in the warning (or \ui{Accept Once} to defer the decision). Under a Strict or Accept-new
+policy there's no prompt: \menu{Settings\then Known Hosts}, \ui{Remove} the entry and reconnect.}
+
+\fix{It just says ``Connecting…'' forever}{%
+\begin{itemize}
+  \item Click \ui{Test} in the profile editor. If that fails too, it's the network, a firewall or the wrong port.
+  \item Behind a corporate proxy? Set one up under \ui{Proxy} (SSH profiles).
+  \item Going through a bastion? Check each jump host on its own first.
+\end{itemize}}
+
+\fix{The session keeps reconnecting}{%
+Check the network and the credentials, then the profile's auto-reconnect settings. Reconnection backs off (1\,s, 2\,s,
+4\,s… up to 30\,s) and stops after the maximum number of attempts.}
+
+\section{Serial}
+
+\fix{The port won't open}{%
+\begin{itemize}
+  \item Is the adapter plugged in? Hit refresh in the device list.
+  \item \textbf{Permission denied} on Linux: add yourself to \code{dialout} (or \code{uucp}), then log out and back in.
+  \item On a Mac, use \code{/dev/cu.*}, not \code{/dev/tty.*}.
+  \item \textbf{Port is in use by another program}: close \code{screen}, \code{minicom}, the Arduino IDE serial monitor or
+        whatever else has it open.
+\end{itemize}}
+
+\fix{Gibberish on screen}{The baud rate, parity or stop bits don't match the device. Check its manual.}
+
+\section{Remote desktops}
+
+\fix{VNC won't connect}{%
+\begin{itemize}
+  \item VNC ports are 5900 plus the display number: \code{:0} is 5900, \code{:1} is 5901.
+  \item Check the password and how it's stored.
+  \item Using an SSH tunnel? Check the tunnel's host, user, login method and key, and the host key policy.
+  \item Connecting to a Mac? Turn on password access in macOS Screen Sharing settings (see p.\,\pageref{ch:vnc}).
+\end{itemize}}
+
+\fix{RDP won't connect}{%
+\begin{itemize}
+  \item Linux box running xrdp? Tick \ui{Allow servers without NLA}.
+  \item ``Logon failed''? Check the domain. Kerberos users: the KDC must be reachable directly, not through the proxy.
+  \item Certificate warning after a server rebuild? That's expected once; compare the fingerprint, then
+        \ui{Accept \& Update}.
+  \item Going through an RD Gateway? It needs a certificate from a public CA and Basic authentication over HTTPS.
+\end{itemize}}
+
+\section{Files}
+
+\fix{Upload is greyed out or fails}{%
+The folder is probably \proto[amber]{READ ONLY} for your user. Pick another, or check permissions on the server. Uploads
+need an SSH session; other protocols can't do it.}
+
+\fix{``NO READ'' on a folder}{You don't have permission to look inside. Try the parent folder, or ask the server's admin.}
+
+\section{The terminal itself}
+
+\fix{The terminal is the wrong size}{%
+Resize the window or nudge a split divider; the terminal re-fits itself. Still wrong? Reconnect. Very old servers may
+prefer a different \ui{Terminal Type} in the profile (try \code{vt100}).}
+
+\fix{The scroll wheel moves the cursor instead of scrolling}{%
+You're in a full-screen program (\code{less}, \code{vim}, \code{tmux}). That's how terminals work: the wheel sends arrow keys
+there. Quit the program, or use its own scrolling (in \code{tmux}: \keys{Ctrl+B} then \kbd{[}).}
+
+\fix{Emoji are in black and white}{Known limitation: colour emoji show as monochrome glyphs. Everything else renders
+normally.}
+
+\begin{quickwin}[Still stuck?]
+Start Nexus Terminal with \code{--data-dir} pointing at an empty folder and try the same connection there. If it
+works, something in your profile is off; duplicate the working one and compare.
+\end{quickwin}
+
+\section{Still stuck?}
+
+\fix{Something odd that isn't on this list}{%
+Look at \code{nexus.log} in your data folder (\menu{Settings\then Diagnostics} shows where): connections, reconnects,
+host-key checks and errors, never passwords or what's on screen. Start Nexus Terminal with \code{RUST\_LOG=debug} for
+more detail. Reporting a bug? \ui{Copy Diagnostics} and paste it in.}
+

docs/guide/fonts/Phosphor-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Romet Tagobert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

docs/guide/nexus-guide.sty

@@ -0,0 +1,286 @@
+% Nexus Terminal user guide — look and feel. Build with lualatex (see Makefile).
+\NeedsTeXFormat{LaTeX2e}
+\ProvidesPackage{nexus-guide}
+
+\RequirePackage[a4paper,top=24mm,bottom=26mm,inner=22mm,outer=26mm,headsep=8mm,footskip=12mm]{geometry}
+% Latin Modern OpenType isn't always installed, and the kernel selects it once before the guide's own
+% fonts take over. Point that one use at Inter so the build only needs fonts from the repo.
+\DeclareFontShape{TU}{lmr}{m}{n}{<->"[../../rust/app/assets/fonts/Inter-Regular.ttf]:mode=node;"}{}
+\RequirePackage{fontspec}
+\RequirePackage[dvipsnames]{xcolor}
+\RequirePackage{graphicx}
+\RequirePackage[most]{tcolorbox}
+\RequirePackage{tikz}
+\usetikzlibrary{calc,positioning,shadows.blur,fadings}
+\RequirePackage{titlesec}
+\RequirePackage{fancyhdr}
+\RequirePackage{enumitem}
+\RequirePackage{tabularx}
+\RequirePackage{booktabs}
+\RequirePackage{multicol}
+\RequirePackage{eso-pic}
+\RequirePackage{etoolbox}
+\RequirePackage{needspace}
+\RequirePackage{microtype}
+\RequirePackage[hidelinks]{hyperref}
+\RequirePackage{bookmark}
+
+% --- Fonts: the app's own Inter + JetBrains Mono, and its Phosphor icons ----------------
+\defaultfontfeatures{Ligatures=TeX}
+\setmainfont{Inter-Regular.ttf}[
+  Path=../../rust/app/assets/fonts/,
+  BoldFont=Inter-SemiBold.ttf,
+  ItalicFont=Inter-Regular.ttf, ItalicFeatures={FakeSlant=0.18},
+  BoldItalicFont=Inter-SemiBold.ttf, BoldItalicFeatures={FakeSlant=0.18}]
+\setsansfont{Inter-Regular.ttf}[Path=../../rust/app/assets/fonts/, BoldFont=Inter-SemiBold.ttf]
+\setmonofont{JetBrainsMono-Regular.ttf}[Path=../../rust/app/assets/fonts/, Scale=0.92]
+\newfontfamily\heavy{Inter-SemiBold.ttf}[Path=../../rust/app/assets/fonts/]
+\newfontfamily\phfont{Phosphor.ttf}[Path=fonts/]
+\newfontfamily\phfill{Phosphor-Fill.ttf}[Path=fonts/]
+\linespread{1.18}
+\setlength{\parindent}{0pt}
+\setlength{\parskip}{0.62em}
+\raggedbottom
+\sloppy
+
+% --- Palette (mirrors the app's Pro theme) ---------------------------------------------
+\definecolor{ink}{HTML}{1B1B1F}
+\definecolor{ink2}{HTML}{26262C}
+\definecolor{body}{HTML}{2A2A33}
+\definecolor{muted}{HTML}{6B6B78}
+\definecolor{rule}{HTML}{E4E4EA}
+\definecolor{paper}{HTML}{F7F7FA}
+\definecolor{accent}{HTML}{3B82F6}
+\definecolor{teal}{HTML}{14B8A6}
+\definecolor{violet}{HTML}{8B5CF6}
+\definecolor{amber}{HTML}{F59E0B}
+\definecolor{rose}{HTML}{F43F5E}
+\definecolor{pink}{HTML}{EC4899}
+\definecolor{green}{HTML}{22C55E}
+\definecolor{slate}{HTML}{64748B}
+\color{body}
+
+% Page-level drawing. Everything that paints relative to the page goes through here, drawn at shipout
+% from the page's lower-left corner, so it never depends on remember-picture positions settling.
+% Inside, the node (pg) is the whole page: use pg.north west, pg.south east and so on.
+\newcommand\pgnode{\node[inner sep=0pt, minimum width=\paperwidth, minimum height=\paperheight, anchor=south west] (pg) at (0,0) {};}
+\newcommand\pagecanvas[1]{\AddToShipoutPictureBG*{\AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode#1\end{tikzpicture}}}}
+
+% Current part colour (set by \guidepart).
+\colorlet{partcol}{accent}
+\newcounter{guidepart}
+\newcommand\partshort{}
+
+% --- Icons ------------------------------------------------------------------------------
+\newcommand\ph[1]{{\phfont\symbol{"#1}}}
+\newcommand\phf[1]{{\phfill\symbol{"#1}}}
+\newcommand\iTerminal{\ph{EAE8}}  \newcommand\iBolt{\ph{E2DE}}     \newcommand\iBrain{\ph{E74E}}
+\newcommand\iWarn{\ph{E4E0}}      \newcommand\iBulb{\ph{E2DC}}     \newcommand\iCoffee{\ph{E1C2}}
+\newcommand\iRocket{\ph{E3FE}}    \newcommand\iCheck{\ph{E184}}    \newcommand\iTimer{\ph{E492}}
+\newcommand\iKeyboard{\ph{E2D8}}  \newcommand\iSparkle{\ph{E6A2}}  \newcommand\iShield{\ph{E40C}}
+\newcommand\iWand{\ph{E6B6}}      \newcommand\iBug{\ph{E5F4}}      \newcommand\iStar{\phf{E46A}}
+\newcommand\iSiren{\ph{E9B8}}     \newcommand\iWave{\ph{E580}}     \newcommand\iTarget{\ph{E47C}}
+\newcommand\iMap{\ph{E31A}}       \newcommand\iList{\ph{EADC}}     \newcommand\iBox{\ph{E45E}}
+\newcommand\iKey{\ph{E2D6}}       \newcommand\iPlugs{\ph{EB5A}}    \newcommand\iFolder{\ph{E256}}
+\newcommand\iBroadcast{\ph{E0F2}} \newcommand\iFilm{\ph{E792}}     \newcommand\iCode{\ph{E1BC}}
+\newcommand\iGear{\ph{E270}}      \newcommand\iLock{\ph{E2FA}}     \newcommand\iGithub{\ph{E576}}
+\newcommand\iChat{\ph{E16C}}      \newcommand\iDesktop{\ph{E560}}  \newcommand\iUsb{\ph{E956}}
+\newcommand\iTree{\ph{E67C}}      \newcommand\iArrows{\ph{E0A0}}   \newcommand\iCmd{\ph{E1C4}}
+\newcommand\iSearch{\ph{E30C}}    \newcommand\iSplit{\ph{E870}}    \newcommand\iLifebuoy{\ph{E63A}}
+\newcommand\iInfo{\ph{E2CE}}      \newcommand\iPin{\ph{E3E2}}      \newcommand\iConfetti{\ph{E81A}}
+\newcommand\iDetective{\ph{E83E}} \newcommand\iCompass{\ph{E1C8}}  \newcommand\iBinary{\ph{EE60}}
+\newcommand\iPalette{\ph{E6C8}}   \newcommand\iRecord{\ph{E3EE}}   \newcommand\iArrow{\ph{E06C}}
+\newcommand\iClock{\ph{E19A}}     \newcommand\iFlag{\ph{EA38}}     \newcommand\iPlug{\ph{E946}}
+\newcommand\iGhost{\ph{E62A}}     \newcommand\iBell{\ph{E5E8}}     \newcommand\iHourglass{\ph{E2B2}}
+\newcommand\iDownload{\ph{E20C}}  \newcommand\iUpload{\ph{E4C0}}   \newcommand\iPlane{\ph{E398}}
+
+% --- Inline bits --------------------------------------------------------------------------
+% \kbd{Ctrl} — a keycap. \keys{Ctrl+Shift+K} — keycaps joined with thin pluses.
+\newtcbox{\kbd}{on line, boxrule=0.4pt, arc=2.2pt, colback=paper, colframe=rule!70!slate,
+  boxsep=0pt, left=3.2pt, right=3.2pt, top=1.6pt, bottom=1.2pt, fontupper=\ttfamily\footnotesize\color{ink}}
+% \mod is "Ctrl, or ⌘ on a Mac": every shortcut in the guide is written \keys{\mod+K}.
+\renewcommand\mod{\kbd{Ctrl\,/\,\ph{E1C4}}}
+\def\keystop{\relax}\def\modtok{\mod}
+\DeclareRobustCommand\keys[1]{\keysplit#1+\relax+}
+\def\keysplit#1+{\def\kk{#1}\ifx\kk\keystop\else\keycap{#1}\expandafter\keysplitnext\fi}
+\def\keysplitnext#1+{\def\kk{#1}\ifx\kk\keystop\else{\kern0.15em\scriptsize\color{muted}+\kern0.15em}\keycap{#1}\expandafter\keysplitnext\fi}
+\newcommand\keycap[1]{\def\kc{#1}\ifx\kc\modtok\mod\else\kbd{#1}\fi}
+
+\newcommand\ui[1]{{\heavy\color{ink}#1}}               % on-screen labels
+\newcommand\code[1]{{\ttfamily\color{ink}#1}}           % file paths and commands
+\newcommand\menu[1]{{\heavy\color{ink}#1}}              % File → Thing
+\newcommand\then{\,{\color{muted}\iArrow}\,}
+\newcommand\proto[2][accent]{\tcbox[on line, arc=6pt, boxrule=0pt, colback=#1!14, boxsep=0pt,
+  left=4pt, right=4pt, top=1.2pt, bottom=1.2pt]{\scriptsize\heavy\color{#1!80!black}#2}}
+
+% --- Callout boxes ----------------------------------------------------------------------
+\tcbset{guidebox/.style={enhanced, breakable, arc=7pt, boxrule=0pt, left=12pt, right=12pt,
+  top=8pt, bottom=8pt, before skip=10pt, after skip=12pt, fontupper=\small,
+  parbox=false, before upper={\setlength{\parskip}{0.5em}}}}
+\newcommand\boxhead[3]{{\heavy\color{#1}\large#2\enspace\normalsize#3}\par\vspace{2pt}}
+
+\newtcolorbox{tldr}{guidebox, colback=partcol!8, borderline west={3pt}{0pt}{partcol},
+  before upper={\boxhead{partcol}{\iBolt}{TL;DR}\setlength{\parskip}{0.4em}}}
+\newtcolorbox{quickwin}[1][Quick win]{guidebox, colback=green!8, borderline west={3pt}{0pt}{green},
+  before upper={\boxhead{green!65!black}{\iTarget}{#1}}}
+\newtcolorbox{headsup}[1][Heads up]{guidebox, colback=amber!10, borderline west={3pt}{0pt}{amber},
+  before upper={\boxhead{amber!75!black}{\iWarn}{#1}}}
+\newtcolorbox{protip}[1][Pro tip]{guidebox, colback=accent!7, borderline west={3pt}{0pt}{accent},
+  before upper={\boxhead{accent!80!black}{\iBulb}{#1}}}
+\newtcolorbox{sidequest}[1][Side quest]{guidebox, colback=violet!7,
+  borderline west={3pt}{0pt}{violet}, borderline={0.5pt}{0pt}{violet!35,dashed},
+  before upper={\boxhead{violet}{\iCompass}{#1 {\normalfont\footnotesize\color{muted}\enspace·\enspace optional, skip it if you're in a hurry}}}}
+\newtcolorbox{danger}[1][Careful]{guidebox, colback=rose!8, borderline west={3pt}{0pt}{rose},
+  before upper={\boxhead{rose!85!black}{\iSiren}{#1}}}
+
+% "You are here": a one-line chapter header strip with reading time.
+\newcommand\chapmeta[2]{%
+  \begin{tcolorbox}[enhanced, arc=6pt, boxrule=0pt, colback=paper, left=10pt, right=10pt,
+    top=5pt, bottom=5pt, before skip=0pt, after skip=10pt, fontupper=\small\color{muted}]
+  {\color{partcol}\iTimer}\enspace about \textbf{#1}\hfill{\color{partcol}\iTarget}\enspace #2
+  \end{tcolorbox}}
+
+% Checklists.
+\newlist{checklist}{itemize}{1}
+\setlist[checklist]{label={\color{partcol}\large\iBox}, leftmargin=1.9em, itemsep=2pt, topsep=4pt}
+\setlist[itemize]{label={\color{partcol}\small\textbullet}, leftmargin=1.4em, itemsep=1pt, topsep=3pt}
+\setlist[enumerate]{label={\heavy\color{partcol}\arabic*}, leftmargin=1.6em, itemsep=2pt, topsep=4pt}
+\setlist[description]{font=\heavy\color{ink}, leftmargin=1.2em, itemsep=2pt}
+
+% --- Screenshots --------------------------------------------------------------------------
+% \shot[width]{file}{caption}
+\newcommand\shot[3][\linewidth]{%
+  \par\needspace{0.3\textheight}\begin{center}
+  \begin{tikzpicture}
+    \node[inner sep=0pt, rounded corners=6pt, blur shadow={shadow blur steps=8, shadow xshift=0pt,
+      shadow yshift=-2pt, shadow opacity=25}] (img) {\includegraphics[width=#1]{img/#2}};
+    \draw[rule!60!slate, line width=0.4pt, rounded corners=3pt] (img.south west) rectangle (img.north east);
+  \end{tikzpicture}\par\vspace{4pt}
+  {\footnotesize\color{muted}#3}\end{center}\vspace{-4pt}}
+
+% Two screenshots side by side.
+\newcommand\shotpair[4]{%
+  \par\needspace{0.22\textheight}\begin{center}
+  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#1}\par\vspace{3pt}{\footnotesize\color{muted}#2}\end{minipage}\hfill
+  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#3}\par\vspace{3pt}{\footnotesize\color{muted}#4}\end{minipage}
+  \end{center}}
+
+% A crop of a screenshot: \crop{file}{left}{bottom}{right}{top}{width}{caption}, trims in px of the 2720x1720 image.
+\newcommand\crop[7]{%
+  \par\needspace{0.2\textheight}\begin{center}
+  \begin{tikzpicture}
+    \node[inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
+      {\includegraphics[width=#6, trim=#2 #3 #4 #5, clip]{img/#1}};
+    \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
+  \end{tikzpicture}\par\vspace{4pt}{\footnotesize\color{muted}#7}\end{center}\vspace{-4pt}}
+
+% Annotated screenshot: \begin{annotated}{file} \callout{1}{x}{y} … \end{annotated}, x/y in 0–1 from top left.
+\newenvironment{annotated}[1]{%
+  \par\begin{center}\begin{tikzpicture}
+  \node[anchor=north west, inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
+    {\includegraphics[width=\linewidth]{img/#1}};
+  \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
+  \begin{scope}[x={(img.north east)}, y={($(img.north west)-(img.south west)$)}, shift={(img.north west)}]}
+  {\end{scope}\end{tikzpicture}\end{center}}
+\newcommand\callout[3]{%
+  \node[circle, fill=partcol, text=white, font=\heavy\footnotesize, inner sep=0pt, minimum size=15pt,
+    draw=white, line width=1.4pt, blur shadow={shadow blur steps=5, shadow opacity=40}] at (#2,-#3) {#1};}
+\newcommand\num[1]{\tikz[baseline=(n.base)]\node[circle, fill=partcol, text=white, font=\heavy\scriptsize,
+  inner sep=0pt, minimum size=13pt] (n) {#1};}
+
+% "At a glance" fact card for each connection type.
+\newenvironment{glance}[2]{%
+  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=12pt, right=12pt, top=9pt, bottom=9pt,
+    before skip=6pt, after skip=12pt, fontupper=\small,
+    overlay={\node[anchor=north east, font=\heavy\tiny, text=#1!80!black, inner sep=8pt] at (frame.north east) {AT A GLANCE};}]
+  {\heavy\Large\color{#1!85!black}#2}\par\vspace{4pt}
+  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}>{\leavevmode}p{0.72\linewidth}@{}}}
+  {\end{tabular}\end{tcolorbox}}
+
+% --- Headings --------------------------------------------------------------------------
+\titleformat{\chapter}[display]{\normalfont}{%
+  \pagecanvas{\fill[partcol] (pg.north west) rectangle ([yshift=-9mm]pg.north east);
+    \fill[partcol!12] ([yshift=-9mm]pg.north west) rectangle ([yshift=-11mm]pg.north east);}%
+  {\heavy\small\color{partcol}\MakeUppercase{\partshort}\enspace·\enspace CHAPTER \thechapter}}{2pt}
+  {\heavy\fontsize{30}{34}\selectfont\color{ink}}
+\titlespacing*{\chapter}{0pt}{0pt}{14pt}
+\titleformat{\section}{\heavy\Large\color{ink}}{%
+  \tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white, font=\heavy\small, inner sep=3pt, minimum width=18pt] (n) {\thesection};}{8pt}{}
+\titlespacing*{\section}{0pt}{18pt}{4pt}
+\titleformat{\subsection}{\heavy\large\color{ink}}{}{0pt}{{\color{partcol}\iArrow}\enspace}
+\titlespacing*{\subsection}{0pt}{12pt}{2pt}
+\renewcommand\thesection{\arabic{chapter}.\arabic{section}}
+\setcounter{secnumdepth}{1}
+\setcounter{tocdepth}{1}
+
+% --- Running heads + thumb tabs ---------------------------------------------------------
+\pagestyle{fancy}
+\fancyhf{}
+\renewcommand{\headrulewidth}{0pt}
+\renewcommand\chaptermark[1]{\markboth{#1}{}}
+\fancyhead[LE]{\footnotesize\color{muted}\heavy Nexus Terminal\enspace\normalfont·\enspace User Guide}
+\fancyhead[RO]{\footnotesize\color{muted}\leftmark}
+\fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white,
+  font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}
+\fancyfoot[RE,LO]{\footnotesize\color{muted}\partshort}
+\fancypagestyle{plain}{\fancyhf{}\fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt,
+  text=white, font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}}
+
+% Thumb tabs on the page edge, one slot per part, so you can flick to a part in print.
+\newif\ifthumbs
+\AddToShipoutPictureBG{%
+  \ifthumbs\ifnum\value{guidepart}>0
+  \AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode
+    \pgfmathsetmacro\slot{28 + (\value{guidepart}-1)*30}
+    \ifodd\value{page}
+      \fill[partcol, rounded corners=4pt] ([xshift=-7mm, yshift=-\slot mm]pg.north east) rectangle ++(9mm,-26mm);
+      \node[rotate=-90, text=white, font=\heavy\tiny] at ([xshift=-3.6mm, yshift=-\slot mm - 13mm]pg.north east) {\MakeUppercase{\partshort}};
+    \else
+      \fill[partcol, rounded corners=4pt] ([xshift=7mm, yshift=-\slot mm]pg.north west) rectangle ++(-9mm,-26mm);
+      \node[rotate=90, text=white, font=\heavy\tiny] at ([xshift=3.6mm, yshift=-\slot mm - 13mm]pg.north west) {\MakeUppercase{\partshort}};
+    \fi
+  \end{tikzpicture}}\fi\fi}
+
+% \guidepart{colour}{short name}{Title}{tagline}{list of chapters}
+\newcommand\guidepart[5]{%
+  \clearpage
+  \stepcounter{guidepart}\colorlet{partcol}{#1}\renewcommand\partshort{#2}
+  \phantomsection\addcontentsline{toc}{part}{\protect\textcolor{#1}{\arabic{guidepart}}\quad #3}
+  \thispagestyle{empty}\thumbsfalse
+  \pagecanvas{
+    \fill[ink] (pg.south west) rectangle (pg.north east);
+    \fill[#1, opacity=0.9] (pg.north west) rectangle ([yshift=-95mm]pg.north east);
+    \fill[#1!70!black, opacity=0.35] ([yshift=-95mm]pg.north west) -- ++(0,-18mm) -- ([yshift=-95mm]pg.north east) -- cycle;
+    \node[anchor=north west, text=white, font=\heavy\fontsize{150}{150}\selectfont, opacity=0.25]
+      at ([xshift=14mm, yshift=-4mm]pg.north west) {\arabic{guidepart}};
+    \node[anchor=south west, text=white, font=\heavy\small] at ([xshift=24mm, yshift=-72mm]pg.north west) {PART \arabic{guidepart}};
+    \node[anchor=north west, text=white, font=\heavy\fontsize{38}{42}\selectfont, text width=160mm]
+      at ([xshift=24mm, yshift=-73mm]pg.north west) {#3};
+    \node[anchor=north west, text=white!80!#1, font=\large, text width=150mm]
+      at ([xshift=24mm, yshift=-125mm]pg.north west) {#4};
+    \node[anchor=north west, text=white, font=\normalsize, text width=150mm]
+      at ([xshift=24mm, yshift=-145mm]pg.north west) {#5};
+  }\null\clearpage\thumbstrue}
+\newcommand\partitem[2]{{\color{partcol}\large#1}\enspace #2\par\vspace{5pt}}
+
+% Table of contents.
+\RequirePackage{tocloft}
+\renewcommand\cftpartfont{\heavy\large\color{ink}}
+\renewcommand\cftpartpagefont{\heavy\color{ink}}
+\renewcommand\cftchapfont{\color{body}}
+\renewcommand\cftchappagefont{\color{muted}}
+\renewcommand\cftchapleader{\cftdotfill{\cftdotsep}}
+\setlength\cftbeforepartskip{14pt}
+\setlength\cftbeforechapskip{3pt}
+\renewcommand\cfttoctitlefont{\heavy\fontsize{30}{34}\selectfont\color{ink}}
+
+% Symptom → fix cards for troubleshooting.
+\newcommand\fix[2]{%
+  \begin{tcolorbox}[enhanced, breakable, arc=7pt, boxrule=0.5pt, colframe=rule, colback=white, left=11pt, right=11pt,
+    top=8pt, bottom=8pt, before skip=6pt, after skip=8pt, fontupper=\small, parbox=false,
+    title={\heavy\color{ink}\normalsize{\color{partcol}\iBug}\enspace #1}, coltitle=ink, colbacktitle=paper,
+    titlerule=0pt, toptitle=5pt, bottomtitle=5pt, attach title to upper={}, detach title, before upper={\tcbtitle\par\vspace{4pt}}]
+  #2\end{tcolorbox}}
+
+% Big pull-quote line used to break up long stretches.
+\newcommand\breather[1]{\par\vspace{6pt}{\centering\heavy\large\color{partcol}#1\par}\vspace{6pt}}

docs/guide/nexus-guide.tex

@@ -0,0 +1,100 @@
+% Nexus Terminal — User Guide. Build: make (in docs/guide), or: lualatex nexus-guide && lualatex nexus-guide
+\documentclass[10pt,twoside,openany]{book}
+\usepackage{nexus-guide}
+
+\hypersetup{pdftitle={Nexus Terminal: The User Guide}, pdfauthor={Andy Dixon},
+  pdfsubject={SSH, Telnet, RAW, Serial, VNC, RDP, IRC and GitHub in one native app}}
+
+\begin{document}
+\frontmatter
+\pagestyle{empty}
+
+% --- Cover ------------------------------------------------------------------------------
+\pagecanvas{
+  \fill[ink] (pg.south west) rectangle (pg.north east);
+  \shade[left color=accent, right color=violet, opacity=0.55]
+    ([yshift=-60mm]pg.north west) -- ([yshift=-20mm]pg.north east) --
+    ([yshift=-130mm]pg.north east) -- ([yshift=-170mm]pg.north west) -- cycle;
+  \shade[left color=teal, right color=accent, opacity=0.35]
+    ([yshift=-150mm]pg.north west) -- ([yshift=-120mm]pg.north east) --
+    ([yshift=-150mm]pg.north east) -- ([yshift=-185mm]pg.north west) -- cycle;
+  \node[anchor=north east, inner sep=0pt] at ([xshift=-22mm, yshift=-24mm]pg.north east)
+    {\includegraphics[width=34mm]{img/logo.pdf}};
+  \node[anchor=north west, text=white!70!ink, font=\heavy\small] at ([xshift=22mm, yshift=-30mm]pg.north west)
+    {THE USER GUIDE};
+  \node[anchor=north west, text=white, font=\heavy\fontsize{58}{60}\selectfont, text width=170mm]
+    at ([xshift=22mm, yshift=-36mm]pg.north west) {Nexus\\[-2pt]Terminal};
+  \node[anchor=north west, text=white, font=\Large, text width=150mm]
+    at ([xshift=22mm, yshift=-88mm]pg.north west)
+    {Every terminal you need. One window.\\Zero faff.};
+  \node[anchor=north west, text=white!65!ink, font=\normalsize, text width=150mm]
+    at ([xshift=22mm, yshift=-110mm]pg.north west)
+    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace RDP\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
+  \node[anchor=south west, inner sep=0pt] at ([xshift=22mm, yshift=22mm]pg.south west)
+    {\begin{tikzpicture}
+      \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}};
+    \end{tikzpicture}};
+  \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right]
+    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 3.0.2\\October 2026\\dixon.cx};
+}\null
+\cleardoublepage
+
+% --- How to use this guide ----------------------------------------------------------------
+\colorlet{partcol}{accent}
+{\heavy\fontsize{30}{34}\selectfont\color{ink} Start here.\par}
+\vspace{2pt}{\large\color{muted} (Yes, even if you never read manuals. \emph{Especially} then.)\par}
+\vspace{10pt}
+
+This guide is built for skimming. You do \textbf{not} have to read it in order, cover to cover, like it's
+homework. Find the bit you need, grab it, get back to work. Every chapter opens with the time it takes and
+what you'll be able to do afterwards, and a \textbf{TL;DR} if you only want the gist.
+
+\vspace{4pt}
+{\heavy\large\color{ink}\iMap\enspace I just want to…}\par\vspace{2pt}
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{52mm}@{}}
+  \toprule
+  …get connected to something \emph{right now} & \hyperref[ch:start]{Five-minute start}, p.\,\pageref{ch:start}\\
+  …work out what all the buttons do & \hyperref[ch:tour]{The grand tour}, p.\,\pageref{ch:tour}\\
+  …SSH into a server (keys, jump hosts, 2FA) & \hyperref[ch:ssh]{SSH}, p.\,\pageref{ch:ssh}\\
+  …talk to a router or Arduino over a USB cable & \hyperref[ch:serial]{Serial}, p.\,\pageref{ch:serial}\\
+  …copy files to and from a server & \hyperref[ch:files]{Files}, p.\,\pageref{ch:files}\\
+  …type the same thing into ten servers at once & \hyperref[ch:repeat]{Never type it twice}, p.\,\pageref{ch:repeat}\\
+  …keep my passwords safe & \hyperref[ch:secrets]{Passwords \& the vault}, p.\,\pageref{ch:secrets}\\
+  …keep two computers in step & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
+  …fix something that's broken & \hyperref[part:fix]{When things go wrong}, p.\,\pageref{ch:trouble}\\
+  …just see the keyboard shortcuts & \hyperref[app:keys]{The cheat sheet}, p.\,\pageref{app:keys}\\
+  \bottomrule
+\end{tabularx}
+
+\vspace{8pt}
+{\heavy\large\color{ink}\iSparkle\enspace The little boxes}\par\vspace{-2pt}
+\begin{multicols}{2}\small
+\begin{tldr}The whole chapter in three lines.\end{tldr}
+\begin{quickwin}Something you can try in under a minute.\end{quickwin}
+\begin{protip}A trick that saves you time later.\end{protip}
+\columnbreak
+\begin{headsup}A thing that might trip you up.\end{headsup}
+\begin{danger}Could lose data or weaken security. Read it.\end{danger}
+\begin{sidequest}Interesting, but not needed to get the job done.\end{sidequest}
+\end{multicols}
+
+\vspace{-6pt}
+{\small\color{muted}\textbf{Shortcuts:} \mod{} means \kbd{Ctrl} on Windows and Linux, \kbd{\ph{E1C4}} (Command) on a Mac. So
+\keys{\mod+K} is \kbd{Ctrl}+\kbd{K} or \kbd{\ph{E1C4}}+\kbd{K} depending on your machine.}
+
+\clearpage
+\pagestyle{plain}
+{\hypersetup{linkcolor=body}\tableofcontents}
+\clearpage
+
+\mainmatter
+\pagestyle{fancy}
+\input{chapters/part1-start}
+\input{chapters/part2-connect}
+\input{chapters/part3-faster}
+\input{chapters/part4-safe}
+\input{chapters/part5-yours}
+\input{chapters/part6-fix}
+\input{chapters/appendix}
+\end{document}

docs/guide/tools/demo-shell.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
+# ForceCommand for the throwaway screenshot sshd: never a login shell (no ~/.profile, no byobu).
+DEMO_HOME=$1 SFTP_SERVER=$2
+export LC_ALL=C.UTF-8
+case "$SSH_ORIGINAL_COMMAND" in
+  *sftp*) exec "$SFTP_SERVER" -d "$DEMO_HOME" ;;
+  ?*) cd "$DEMO_HOME" && HOME="$DEMO_HOME" exec bash --norc --noprofile -c "$SSH_ORIGINAL_COMMAND" ;;
+esac
+cd "$DEMO_HOME" || exit 1
+export HOME="$DEMO_HOME" PS1='\[\e[1;32m\]andy@atlas\[\e[0m\]:\[\e[1;34m\]\w\[\e[0m\]\$ '
+row() { # boxed line, padded on visible width
+  local plain; plain=$(printf '%b' "$1" | sed 's/\x1b\[[0-9;]*m//g')
+  printf '\e[1;36m│\e[0m  %b%*s\e[1;36m│\e[0m\n' "$1" $((44 - ${#plain})) ''
+}
+printf '\e[1;36m╭──────────────────────────────────────────────╮\e[0m\n'
+row 'Welcome to \e[1matlas\e[0m · Debian 13 · kernel 6.12'
+row 'Load \e[32m0.42\e[0m   Memory \e[33m61%\e[0m   Disk \e[32m38%\e[0m'
+row 'Last deploy: \e[1m2 hours ago\e[0m by andy'
+printf '\e[1;36m╰──────────────────────────────────────────────╯\e[0m\n\n'
+printf '\e[1;32m$\e[0m ls -l --color\n'; ls -l --color=always
+printf '\n\e[1;32m$\e[0m ./deploy.sh --dry-run\n'
+for s in "Resolving build" "Uploading artefacts" "Rolling out to 4 nodes" "Health checks"; do
+  printf '  \e[32m✔\e[0m %-26s \e[2m%s\e[0m\n' "$s" "$((RANDOM % 900 + 100))ms"
+done
+printf '  \e[33m⚠\e[0m 1 warning: \e[1mnginx.conf\e[0m has a deprecated directive\n'
+printf '  \e[1;32mDone.\e[0m Nothing was actually deployed (dry run).\n\n'
+exec bash --norc --noprofile -i

docs/guide/tools/fakes.py

@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
+"""Tiny fake servers for the user-guide screenshots: RAW sensor feed (42023), IRC (42667),
+GitHub API (42080) and a VNC desktop (42900). Stdlib only. Runs until killed."""
+
+import json, math, random, socket, socketserver, struct, threading, time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+
+class Threaded(socketserver.ThreadingMixIn, socketserver.TCPServer):
+    allow_reuse_address = True
+    daemon_threads = True
+
+
+# --- RAW: a chatty sensor --------------------------------------------------------------
+
+class Raw(socketserver.BaseRequestHandler):
+    def handle(self):
+        s = self.request
+        s.sendall(b"SENSOR-7 ready. Commands: STATUS, RESET\n")
+        t = 20.5
+        s.settimeout(0.25)
+        for i in range(400):
+            t += random.uniform(-0.3, 0.3)
+            s.sendall(f"temp={t:.2f}C hum={48 + 4 * math.sin(i / 3):.1f}% seq={i}\n".encode())
+            try:
+                if (cmd := s.recv(256)):
+                    s.sendall(b"OK " + cmd.strip() + b"\n")
+            except socket.timeout:
+                pass
+
+
+# --- IRC: a small, friendly network ----------------------------------------------------
+
+CHAT = [
+    ("ferris", "anyone tried the new Nexus build yet?"),
+    ("crabby", "yep, the split panes are lovely"),
+    ("ferris", "the serial console support saved my afternoon tbh"),
+    ("lin", "does it do jump hosts?"),
+    ("crabby", "lin: multiple hops, plus SOCKS5/HTTP proxies"),
+    ("ferris", "and it's Rust all the way down now :)"),
+]
+
+
+class Irc(socketserver.StreamRequestHandler):
+    def send(self, line):
+        self.wfile.write((line + "\r\n").encode())
+
+    def handle(self):
+        nick = "andy"
+        for raw in self.rfile:
+            line = raw.decode(errors="replace").strip()
+            cmd, _, rest = line.partition(" ")
+            if cmd == "NICK":
+                nick = rest.strip()
+            elif cmd == "USER":
+                self.send(f":irc.demo 001 {nick} :Welcome to the Demo IRC Network, {nick}")
+                self.send(f":irc.demo 375 {nick} :- irc.demo Message of the Day -")
+                self.send(f":irc.demo 372 {nick} :- Be excellent to each other.")
+                self.send(f":irc.demo 376 {nick} :End of /MOTD command.")
+            elif cmd == "JOIN":
+                for room in rest.split()[0].split(","):
+                    self.send(f":{nick}!u@demo JOIN {room}")
+                    self.send(f":irc.demo 332 {nick} {room} :Nexus Terminal chat · be kind · no pasting walls of logs")
+                    self.send(f":irc.demo 353 {nick} = {room} :@ferris +crabby lin {nick} octo rustacean")
+                    self.send(f":irc.demo 366 {nick} {room} :End of /NAMES list.")
+                    if room == "#nexus":
+                        for who, msg in CHAT:
+                            self.send(f":{who}!u@demo PRIVMSG #nexus :{msg}")
+                    else:
+                        self.send(f":octo!u@demo PRIVMSG {room} :borrow checker 1, me 0")
+            elif cmd == "LIST":
+                for room, n, topic in [("#nexus", 42, "Nexus Terminal"), ("#rust", 3110, "Rust"), ("#linux", 905, "Linux"), ("#homelab", 77, "Racks & routers")]:
+                    self.send(f":irc.demo 322 {nick} {room} {n} :{topic}")
+                self.send(f":irc.demo 323 {nick} :End of /LIST")
+            elif cmd == "PING":
+                self.send(f":irc.demo PONG irc.demo {rest}")
+            elif cmd == "QUIT":
+                return
+
+
+# --- GitHub API --------------------------------------------------------------------------
+
+REPOS = [
+    ("andydixon", "nexus-terminal", "SSH, Telnet, Serial, IRC and VNC in one tidy native app", "Rust", 128, False, False, False, 1),
+    ("andydixon", "leviathan", "The egui design system Nexus borrows its looks from", "Rust", 64, False, False, False, 3),
+    ("andydixon", "dotfiles", "Shell, editor and terminal config", "Shell", 12, False, False, False, 6),
+    ("andydixon", "homelab-ansible", "Playbooks for the rack under the stairs", "Jinja", 7, True, False, False, 9),
+    ("andydixon", "alchementary-link", "The Wails/Go predecessor to Nexus Terminal", "Go", 31, False, False, True, 40),
+    ("alchementary", "website", "Marketing site", "TypeScript", 3, True, False, False, 2),
+    ("alchementary", "infra", "Terraform for everything", "HCL", 2, True, False, False, 5),
+    ("alchementary", "russh", "Fork with a jump-host fix", "Rust", 0, False, True, False, 15),
+]
+WHO = ["Andy Dixon", "ferris", "crabby", "dependabot[bot]"]
+
+
+def iso(days):
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(time.time() - days * 86400 - 3600 * 5))
+
+
+class Github(BaseHTTPRequestHandler):
+    def log_message(self, *a):
+        pass
+
+    def reply(self, obj):
+        body = json.dumps(obj).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        if self.path == "/user":
+            return self.reply({"login": "andydixon"})
+        if self.path.startswith("/user/repos"):
+            page = 1 if "page=1" in self.path else 2
+            if page != 1:
+                return self.reply([])
+            return self.reply([
+                {"full_name": f"{o}/{n}", "name": n, "description": d, "html_url": f"https://github.com/{o}/{n}",
+                 "default_branch": "main", "private": p, "fork": f, "archived": a, "language": l,
+                 "stargazers_count": s, "pushed_at": iso(age), "updated_at": iso(age), "owner": {"login": o}}
+                for o, n, d, l, s, p, f, a, age in REPOS])
+        if "/commits/" in self.path:
+            i = sum(map(ord, self.path)) % len(WHO)
+            age = next((r[8] for r in REPOS if f"/{r[1]}/" in self.path), 1)
+            return self.reply({"commit": {"committer": {"name": WHO[i], "date": iso(age)}, "author": {"name": WHO[i], "date": iso(age)}}})
+        self.send_error(404)
+
+
+# --- VNC: a static "desktop" ---------------------------------------------------------------
+
+W, H = 1280, 800
+
+
+def desktop():
+    px = bytearray(W * H * 4)
+    wins = [(90, 90, 620, 420, (40, 44, 52)), (560, 260, 1180, 700, (250, 250, 252)), (140, 560, 460, 740, (32, 140, 120))]
+    for y in range(H):
+        for x in range(W):
+            # Diagonal violet → teal wallpaper.
+            k = (x + y) / (W + H)
+            r, g, b = int(88 * (1 - k) + 20 * k), int(40 * (1 - k) + 150 * k), int(160 * (1 - k) + 170 * k)
+            for x0, y0, x1, y1, c in wins:
+                if x0 <= x < x1 and y0 <= y < y1:
+                    r, g, b = (200, 70, 90) if y < y0 + 28 else c
+                    if y >= y0 + 28 and c == (40, 44, 52) and (y - y0) % 22 < 9 and x0 + 20 < x < x0 + 20 + ((y * 37) % 400):
+                        r, g, b = (120, 220, 140) if (y // 22) % 3 else (230, 200, 120)
+            if y >= H - 40:
+                r, g, b = 24, 24, 30
+            i = (y * W + x) * 4
+            px[i:i + 4] = bytes((r, g, b, 0))
+    return bytes(px)
+
+
+PIXELS = None
+
+
+class Vnc(socketserver.BaseRequestHandler):
+    def recv(self, n):
+        b = b""
+        while len(b) < n:
+            c = self.request.recv(n - len(b))
+            if not c:
+                raise EOFError
+            b += c
+        return b
+
+    def handle(self):
+        s = self.request
+        s.sendall(b"RFB 003.008\n")
+        self.recv(12)
+        s.sendall(bytes([1, 1]))  # one security type: None
+        self.recv(1)
+        s.sendall(struct.pack(">I", 0))
+        self.recv(1)  # ClientInit
+        name = b"studio:0 (demo)"
+        s.sendall(struct.pack(">HH", W, H) + bytes([32, 24, 0, 1, 0, 255, 0, 255, 0, 255, 0, 8, 16, 0, 0, 0]) + struct.pack(">I", len(name)) + name)
+        sent = False
+        try:
+            while True:
+                t = self.recv(1)[0]
+                if t == 0:
+                    self.recv(19)
+                elif t == 2:
+                    n = struct.unpack(">xH", self.recv(3))[0]
+                    self.recv(4 * n)
+                elif t == 3:
+                    self.recv(9)
+                    if not sent:
+                        s.sendall(struct.pack(">BxH", 0, 1) + struct.pack(">HHHHi", 0, 0, W, H, 0) + PIXELS)
+                        sent = True
+                    else:
+                        time.sleep(0.5)
+                        s.sendall(struct.pack(">BxH", 0, 0))
+                elif t == 4:
+                    self.recv(7)
+                elif t == 5:
+                    self.recv(5)
+                elif t == 6:
+                    n = struct.unpack(">3xI", self.recv(7))[0]
+                    self.recv(n)
+                else:
+                    return
+        except (EOFError, ConnectionError):
+            pass
+
+
+if __name__ == "__main__":
+    PIXELS = desktop()
+    for port, handler in [(42023, Raw), (42667, Irc), (42900, Vnc)]:
+        threading.Thread(target=Threaded(("127.0.0.1", port), handler).serve_forever, daemon=True).start()
+    print("fakes ready", flush=True)
+    ThreadingHTTPServer(("127.0.0.1", 42080), Github).serve_forever()

docs/guide/tools/screenshots.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
+# Regenerates docs/guide/img/*.png: a throwaway sshd (ForceCommand, never a login shell),
+# fake RAW/IRC/GitHub/VNC servers, a demo data directory, then one headless app run per shot.
+# Needs: xvfb-run, sshd, ssh-keygen, python3, ImageMagick. Usage: docs/guide/tools/screenshots.sh [shot...]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+GUIDE=$PWD
+B=${NEXUS_GUIDE_TMP:-/tmp/nexus-guide}
+IMG=$GUIDE/img
+APP=$GUIDE/../../rust/target/debug/nexus-terminal
+SCALE=${SCALE:-2}
+mkdir -p "$IMG"
+rm -rf "$B" && mkdir -p "$B/home/.ssh" "$B/sshd"
+
+(cd ../../rust && cargo build -q -p nexus && cargo build -q -p nexus-core --example demo_data)
+
+# Demo home: what the SFTP browser, the shell and the SSH key manager see.
+H=$B/home
+mkdir -p "$H"/{projects/nexus,backups,logs,www/static}
+printf 'server {\n  listen 443 ssl;\n}\n' > "$H/nginx.conf"
+echo '#!/bin/sh' > "$H/deploy.sh"; chmod +x "$H/deploy.sh"
+head -c 180000 /dev/urandom > "$H/backups/db-2026-10-10.sql.gz"
+head -c 52000 /dev/urandom > "$H/logs/access.log"
+echo "# Notes" > "$H/README.md"
+ssh-keygen -q -t ed25519 -N '' -C 'andy@laptop' -f "$H/.ssh/id_ed25519"
+ssh-keygen -q -t rsa -b 2048 -N '' -C 'andy@work' -f "$H/.ssh/work_rsa"
+ssh-keygen -q -t ecdsa -N '' -C 'deploy-bot' -f "$H/.ssh/deploy_ecdsa"
+
+# sshd on 42022 (ForceCommand keeps it away from ~/.profile).
+S=$B/sshd
+ssh-keygen -q -t ed25519 -N '' -f "$S/host"
+cp "$H/.ssh/id_ed25519.pub" "$S/authorized_keys"
+SFTP=$(ls /usr/lib/openssh/sftp-server /usr/libexec/openssh/sftp-server /usr/libexec/sftp-server 2>/dev/null | head -1 || true)
+cat > "$S/config" <<CFG
+Port 42022
+ListenAddress 127.0.0.1
+HostKey $S/host
+AuthorizedKeysFile $S/authorized_keys
+PidFile $S/pid
+StrictModes no
+UsePAM no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+PrintMotd no
+PrintLastLog no
+Subsystem sftp $SFTP
+ForceCommand $GUIDE/tools/demo-shell.sh $H $SFTP
+CFG
+"$(command -v sshd)" -f "$S/config" -E "$S/log"
+python3 -I "$GUIDE/tools/fakes.py" > "$B/fakes.log" 2>&1 &
+FAKES=$!
+trap 'kill $FAKES 2>/dev/null; kill "$(cat "$S/pid" 2>/dev/null)" 2>/dev/null || true' EXIT
+until grep -q ready "$B/fakes.log"; do sleep 0.2; done
+
+"$(dirname "$APP")/examples/demo_data" "$B/data" "$H/.ssh/id_ed25519" > /dev/null
+cp -r "$B/data" "$B/data.clean"
+
+shot() { # name, then app args
+  local name=$1; shift
+  if [ ${#ONLY[@]} -gt 0 ] && [[ ! " ${ONLY[*]} " =~ " $name " ]]; then return 0; fi
+  rm -rf "$B/data" && cp -r "$B/data.clean" "$B/data"
+  HOME=$H WINIT_X11_SCALE_FACTOR=$SCALE timeout 60 xvfb-run -a -s "-screen 0 3200x2000x24" \
+    "$APP" --data-dir "$B/data" --size 1360x860 --screenshot "$IMG/$name.png" "$@" 2>> "$B/app.log" || echo "  ! $name failed"
+  # 256-colour PNGs are a quarter of the size and look identical for UI shots.
+  [ -f "$IMG/$name.png" ] && magick "$IMG/$name.png" -colors 256 "PNG8:$IMG/$name.png"
+  echo "  $name"
+}
+ONLY=("$@")
+
+shot welcome
+shot welcome-midnight --theme midnight
+shot welcome-light    --theme light
+shot ssh              --connect "Sensor feed" --connect "Libera Chat" --connect atlas --shot-delay 5500
+shot ssh-light        --theme light --connect atlas --shot-delay 5500
+shot hostkey          --connect hello-ssh --shot-delay 5000
+shot split            --connect atlas --do "Split Pane Right" --shot-delay 5500
+shot sftp             --connect atlas --do "SFTP Browser" --shot-delay 6000
+shot broadcast        --connect build-runner --connect atlas --do "Toggle Broadcast Mode" --shot-delay 5500
+shot raw              --connect "Sensor feed" --shot-delay 5500
+shot irc              --connect "Libera Chat" --shot-delay 5500
+shot github           --connect GitHub --answer ghp_demo --shot-delay 6000
+shot vnc              --connect "Studio desktop" --answer demo --shot-delay 6000
+shot local            --run-local 'printf "\e[1;35mhello from the local shell\e[0m\n"; ls -la --color=always' --shot-delay 5000
+shot palette          --open palette
+shot quick            --open quick
+shot editor-ssh       --open editor:ssh
+shot editor-new       --open editor:new
+shot editor-serial    --open editor:serial
+shot editor-telnet    --open editor:telnet
+shot editor-raw       --open editor:raw
+shot editor-vnc       --open editor:vnc
+shot editor-rdp       --open editor:rdp
+shot editor-irc       --open editor:irc
+shot editor-github    --open editor:github
+for t in general terminal security knownhosts diagnostics help about; do shot "settings-$t" --open "settings:$t"; done
+shot keys             --open keys
+shot snippets         --open snippets
+shot triggers         --open triggers
+shot recordings       --open recordings
+shot export           --open export

docs/overview.md

@@ -0,0 +1,281 @@
+# Nexus Terminal Overview
+
+Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
+
+It is a single Rust application drawn with egui: there is no webview, no bundled browser engine and no runtime to install. Terminal output goes straight from the network into the terminal emulator, so large outputs stay responsive.
+
+## Product positioning
+
+Nexus Terminal is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, serial consoles, IRC, GitHub repository visibility and repeatable operational workflows.
+
+Use Nexus Terminal when you need to:
+
+- Connect quickly to many systems without re-entering credentials.
+- Keep multiple live sessions organised with tabs, pinned tabs, split panes and status indicators.
+- Move files over SSH without leaving the terminal workspace.
+- Work safely with host key verification, encrypted secrets, TOTP support and audit logging.
+- Reuse commands, automate login flows, record sessions and react to terminal output.
+- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, serial consoles, VNC desktops, IRC networks, GitHub repositories and local shells.
+
+## Main feature groups
+
+### Multi-protocol connections
+
+- **SSH** for secure remote terminal access.
+- **Telnet** for legacy devices and services.
+- **RAW TCP** for direct socket interaction, protocol testing and device troubleshooting.
+- **Serial** for USB-serial adapters, console cables, development boards and network gear.
+- **VNC** and **RDP** for remote desktop access, with native viewers.
+- **IRC** for chat networks, with rooms, users and an optional SSH tunnel.
+- **GitHub** for repository browsing and download workflows.
+- **Local terminal** for opening a shell on the local machine.
+- **Quick connect** for one-off SSH, Telnet, RAW, IRC or Serial sessions without saving a profile.
+- **Saved profiles** for repeat connections.
+
+### Profile management
+
+- Create, edit, duplicate and delete connection profiles.
+- Store display names, descriptions, notes, groups, tags and favourites.
+- Fuzzy search across name, host, tags and protocol.
+- Sidebar sections for Local Machine, Favourites, Recent (last five), groups and Ungrouped.
+- Multi-select profiles with Ctrl/Cmd-click for bulk connect, disconnect, tagging, moving between groups and deleting.
+- Test basic host and port reachability before connecting.
+- Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files and jump hosts.
+- Sync profiles between machines through any shared folder, as one encrypted file (newest change wins; deletions propagate; credentials stay local).
+- Export and import profiles using encrypted `.nexus` bundles.
+- Plain JSON export and import, with secrets redacted unless you choose to include them.
+- Choose import behaviour for duplicates: skip, overwrite or duplicate.
+
+### Multi-session workspace
+
+- Custom title bar with File, Session, View and Help menus, a command palette launcher and a light/dark toggle.
+- Tabbed sessions with protocol badges, connection state dots and activity markers.
+- Pin tabs to keep important systems at the front.
+- Rename, duplicate, reconnect and reorder tabs (drag, or Move Left/Right).
+- Scroll overflowing tabs and hover them to see the host, state and connection start time.
+- Split the active tab right or down, as many times as you like, with draggable dividers.
+- Switch tabs by keyboard shortcut.
+- Broadcast input to all connected terminal sessions, or to a chosen set.
+- Disconnected and error overlays with one-click reconnect.
+- Auto-reconnect with exponential backoff for SSH, Telnet, RAW TCP, Serial and IRC profiles.
+- Guided error dialogs for authentication and host-key failures, with shortcuts to edit the profile or open Known Hosts.
+- Command palette for connections, tabs, new profiles, settings, import/export, themes, the secret store, SSH keys, snippets, triggers, recordings and terminal actions.
+- Status bar with session state, protocol, recording indicator, SSH latency, broadcast state, vault state, session count and update notices.
+
+### Terminal experience
+
+- Native terminal emulation (alacritty_terminal) with full colour, mouse reporting, bracketed paste and IME input.
+- Eleven terminal colour schemes, applied to every open terminal at once.
+- Configurable font family, font size, scrollback and cursor style, per profile or as defaults.
+- Find in terminal output, with case-sensitive and regular-expression options and a match counter.
+- Copy with Ctrl/Cmd+C when text is selected (otherwise it sends an interrupt), paste with Ctrl/Cmd+V.
+- Double-click selects a word, triple-click selects a line, Shift-click extends a selection.
+- Ctrl/Cmd-click a web link to open it in your browser, including OSC 8 hyperlinks (from `ls --hyperlink`, `git`, compilers…), which are underlined with a dotted line and show their real target on hover. Only http(s) links open.
+- Shift+PageUp/PageDown/Home/End and the mouse wheel scroll the scrollback; on the alternate screen the wheel sends arrow keys, so `tmux`, `screen` and `byobu` scroll naturally.
+- Context menu with Copy, Paste, Select All, Find, Send Snippet, Port Forwards, Split Right, Split Down, Export Output, Clear and Reset.
+- Export the whole scrollback as plain text.
+- Tabs and split panes are restored at the next launch: connections reconnect and local shells reopen in their last directory.
+- Inline images in the iTerm2 format (`imgcat`, `wezterm imgcat`, `chafa -f iterm`…): PNG, JPEG and GIF, sized in cells, pixels or percent, scrolling with the text.
+- Shell integration (OSC 133): jump between prompts, copy the last command's output, and see each command's exit status and duration beside its prompt.
+- Status-bar latency for the active SSH session.
+- Settings → Diagnostics summarises versions, paths, credential storage and sync status for bug reports; Settings → Security lists stored credentials per profile and changes the vault master password.
+
+### SSH capabilities
+
+- SSH certificates: host certificates from trusted CAs (by OpenSSH host pattern) skip the first-use prompt; user certificates (`*-cert.pub`) are used for login.
+- Import and export `~/.ssh/known_hosts`, including `@cert-authority` lines.
+- Password, public key, keyboard-interactive and SSH agent authentication.
+- SSH agent forwarding.
+- Private key suggestions from `~/.ssh`, with a key file check.
+- SSH key manager for listing, generating, copying and deleting key pairs (Ed25519, RSA 2048/4096 and ECDSA, optional passphrase).
+- TOTP / 2FA secret storage and automatic code entry for keyboard-interactive logins.
+- Host key verification policies per profile: Strict, Ask, Accept new and Insecure.
+- Known hosts storage and management.
+- Jump hosts for bastion and multi-hop access.
+- SOCKS5 and HTTP CONNECT proxies.
+- Local and remote port forwarding, started on connect or managed at runtime.
+- Startup commands, custom environment variables and terminal type.
+- Keepalive interval and missed-keepalive settings, and compression.
+- Expect-style login scripts with wait and send steps.
+- Built-in SFTP browser for file transfer.
+
+### SFTP file browser
+
+- Opens in a resizable dock beside the terminal.
+- Navigate remote folders with breadcrumbs, or go directly to a path.
+- Bookmark remote locations (kept per profile).
+- Refresh listings and create folders.
+- Upload files, and download single or multiple selected files.
+- Rename and delete files and folders.
+- Multi-select for batch actions.
+- Transfer queue with progress.
+- Drag and drop files onto an SSH terminal, then upload them or paste their contents.
+- Upload directory picker with folder filtering, breadcrumbs, keyboard navigation and READ ONLY / NO READ badges.
+
+### Telnet capabilities
+
+- Telnet option negotiation, including echo, terminal type and NAWS window-size updates.
+- Local echo and line mode options.
+- Configurable line endings: LF, CR, CRLF or none.
+- Configurable encoding: UTF-8, ASCII and ISO 8859-1.
+- Negotiation debug mode.
+- Expect-style login scripts.
+- Auto-reconnect with a configurable retry count.
+
+### RAW TCP capabilities
+
+- Direct TCP socket sessions.
+- Text, hex and split data views.
+- Send data as text, hex or escaped bytes.
+- Quick insert buttons for NUL, CR, LF, ETX and EOT.
+- Payload presets for reusable test messages.
+- Optional timestamps and send/receive direction labels.
+- Pause and resume display updates, and clear the capture buffer.
+- Save RAW session captures as JSON.
+- Configurable encoding and line endings.
+- Connect and read timeouts.
+- Auto-reconnect option.
+
+### Serial capabilities
+
+- Pick a device from the detected port list, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- Baud rate from common presets or any custom value, 5–8 data bits, none/odd/even parity, 1 or 2 stop bits.
+- Flow control: none, XON/XOFF (software) or RTS/CTS (hardware).
+- Line ending, encoding and local echo.
+- Assert DTR and RTS on connect (both on by default).
+- Auto-reconnect: unplugging the adapter disconnects the session, and the port is reopened when it comes back.
+- Clear hints for permission-denied and busy ports.
+- Works with everything a terminal session supports: recording, triggers, broadcast, snippets, find and split panes.
+
+### RDP capabilities
+
+- Native RDP viewer (IronRDP) with Network Level Authentication (CredSSP/NTLM) and optional TLS-only logon for servers such as xrdp.
+- Server certificate pinned by fingerprint in Known Hosts, checked before credentials are sent.
+- Direct, SOCKS5, HTTP CONNECT, SSH-tunnelled or (experimental) RD Gateway connections.
+- Scale-to-fit or 1:1, a fixed resolution or one that follows the tab (Display Control).
+- Keyboard (scancodes for keys and shortcuts, Unicode for text), mouse and wheel; Ctrl+Alt+Del; text clipboard sharing in both directions.
+- Password storage modes, domain logon, and Kerberos through a configured KDC.
+- Remote audio playback, a printer whose jobs are saved as PostScript files, and a shared folder redirected as a drive (Linux and macOS), confined to that folder.
+
+### VNC capabilities
+
+- Native VNC viewer inside the Nexus Terminal workspace (RFB 3.3–3.8; Raw, CopyRect, Hextile, ZRLE and Tight encodings).
+- Password prompt and password storage modes.
+- View-only mode.
+- Scale-to-fit or 1:1 display, switchable from the toolbar.
+- Shared-session option and a quality setting.
+- Send the local clipboard to the remote desktop, send Ctrl+Alt+Del, and request a full refresh.
+- SSH tunnel option for VNC traffic, with password, public key or SSH agent authentication.
+- A warning before connecting without a tunnel, because classic VNC traffic is not encrypted.
+
+### IRC capabilities
+
+- IRCv3 capability negotiation with SASL PLAIN login and server-time timestamps.
+- Nick, real name, TLS and an optional server password.
+- NickServ identification on connect.
+- Auto-join rooms.
+- A Server tab plus one tab per room or private conversation, with unread markers.
+- Slash commands such as `/join`, `/part`, `/msg`, `/me`, `/nick`, `/topic`, `/list`, `/names`, `/whois` and `/raw`.
+- Tab nick completion, and click a nick to mention it.
+- Room browser with a filter, and a users list for the current room.
+- mIRC colour and formatting codes rendered in the conversation.
+- Optional SSH tunnel and auto-reconnect.
+
+### GitHub capabilities
+
+- GitHub profile type using a personal access token.
+- GitHub.com and GitHub Enterprise API base URL support.
+- Repository viewer grouped by owner or organisation.
+- Repository filtering.
+- Repositories sorted by latest commit activity.
+- Repository metadata such as language, stars, private/fork/archived state, latest committer and latest commit time.
+- Manual refresh and a configurable refresh interval.
+- Open repositories in the browser.
+- Download repository ZIP archives.
+
+### Automation and reusable workflows
+
+- Snippet library for saved commands, with names, descriptions and folders.
+- Send snippets to the active session.
+- Built-in snippet variables (`{{hostname}}`, `{{date}}`, `{{time}}`, `{{timestamp}}`) and prompted custom variables.
+- Broadcast input mode for running the same command across connected sessions.
+- Trigger rules that watch terminal output, matching plain text or regular expressions.
+- Trigger actions for notifications, tab highlighting, both, or a sound (attention request).
+- Expect-style login scripts for SSH and Telnet.
+- Startup commands for SSH sessions.
+
+### Session recording
+
+- Start and stop terminal recording per session.
+- Recording indicator on the tab and in the status bar.
+- Recordings saved in asciicast v2 format.
+- Recording browser with storage usage and clean-up by age or total size.
+- Playback with play/pause, restart, a seek bar and speed control.
+- Delete saved recordings.
+
+### Security and credential handling
+
+- OS keychain first where available: macOS Keychain, Linux Secret Service and Windows Credential Manager.
+- Encrypted vault fallback, using AES-256-GCM with an Argon2id-derived key.
+- Secret store lock and unlock workflow, with a master-password strength meter.
+- Per-credential secret modes: Save securely, Remember for this session, and Ask every time.
+- Encrypted storage for TOTP secrets.
+- Known host verification and known host management.
+- Audit log of connections, disconnections, profile changes, credential access, imports and exports. Secrets are never written to it.
+- Encrypted profile exports with password-based AES-256-GCM encryption and Argon2id key derivation.
+
+### Settings and maintenance
+
+- App theme (Pro, Midnight or Light) and terminal colour scheme.
+- Default protocol preference.
+- Default terminal font, size, scrollback and cursor settings.
+- Confirm-on-close and confirm-on-disconnect preferences.
+- Status bar visibility and sidebar width.
+- Local shell selection.
+- Secret store settings.
+- Known hosts management.
+- Help topics and troubleshooting inside Settings.
+- A background update check at launch (can be turned off in Settings → General), and a manual check in Settings → About.
+
+## Website-ready summary
+
+### Suggested headline
+
+Nexus Terminal: one native desktop workspace for SSH, files, sockets, serial consoles, remote desktops, chat and repositories.
+
+### Suggested subheadline
+
+Manage SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
+
+### Short product description
+
+Nexus Terminal helps developers, operators, support engineers, network and hardware engineers, and homelab users manage many connections without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, talk to serial devices, open VNC desktops, join IRC networks, browse GitHub repositories, and keep credentials protected with keychain and encrypted-vault storage.
+
+### Product page feature bullets
+
+- All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shells.
+- Native and fast: no webview, with a terminal that stays responsive under heavy output.
+- Multi-session interface with tabs, pinned sessions, split panes, reconnect and broadcast input.
+- Rich SSH support including agent auth and forwarding, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts and host key policies.
+- Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload and permission-aware directory picking.
+- RAW TCP tooling with text, hex and split views, payload presets, captures, timestamps and byte-level sending.
+- Serial consoles with full line settings, flow control, DTR/RTS control and auto-reconnect on replug.
+- Native VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions and optional SSH tunnelling.
+- IRC client with rooms, nick completion, NickServ and mIRC formatting.
+- GitHub repository browser with organisation grouping, filtering, activity sorting, ZIP downloads and GitHub Enterprise support.
+- Secure credential model using the OS keychain first, encrypted vault fallback, per-credential secret modes, known hosts, encrypted exports and audit logging.
+- Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export and local terminal.
+
+## Who it is for
+
+- Developers who connect to many application servers, staging environments and production hosts.
+- Platform and DevOps teams who need organised, secure access across infrastructure.
+- Support teams who troubleshoot customer systems, network appliances and legacy Telnet devices.
+- Network and hardware engineers who need RAW TCP, Telnet and serial tools beside normal SSH workflows.
+- Homelab users who want SSH, VNC, file transfer, serial consoles and repo access in one desktop app.
+
+## Learn more
+
+For a short guide, see the quick start: [docs/quick-start.md](quick-start.md).
+
+For a full guide, see the user manual: [docs/user-manual.md](user-manual.md).

docs/quick-start.md

@@ -0,0 +1,80 @@
+# Nexus Terminal Quick Start
+
+Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
+
+## Get connected in minutes
+
+1. Open Nexus Terminal.
+2. Click **+** at the bottom of the sidebar, or press **Cmd+N** (macOS) / **Ctrl+N** (Windows/Linux).
+3. Choose a protocol at the top of the editor and enter the connection details.
+4. Click **Create & Connect** to save the profile and open the session in a new tab.
+
+Next time, just click the profile in the sidebar.
+
+One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect. Need a local shell? Click **Local Machine** at the top of the sidebar.
+
+## Daily workflow
+
+- **Command palette**: Press **Cmd+K** / **Ctrl+K** to connect, switch tabs or run any command by typing a few letters.
+- **Tabs and splits**: Drag tabs to reorder them, right-click a tab to pin, rename, duplicate or reconnect it, and split the workspace with **Cmd+Shift+D** / **Ctrl+Shift+D** (right) or **Cmd+Shift+E** / **Ctrl+Shift+E** (down).
+- **Scrollable tabs**: Use the mouse wheel or trackpad over the tab strip when many tabs are open. Hover a tab to see its host, state and connection start time.
+- **Broadcast input**: Toggle with **Cmd+Shift+B** / **Ctrl+Shift+B** to send the same keystrokes to every connected terminal. Right-click the broadcast button on the tab strip to pick targets.
+- **Snippets**: Save common commands with **Cmd+Shift+S** / **Ctrl+Shift+S** and send them with one click.
+- **Search**: Press **Cmd+F** / **Ctrl+F** to search within the active terminal.
+- **Copy, paste and links**: Select text and press **Cmd+C** / **Ctrl+C** to copy (with nothing selected, Ctrl+C interrupts as usual). **Cmd+V** / **Ctrl+V** pastes. **Cmd-click** / **Ctrl-click** a URL to open it.
+- **Reconnect quickly**: If a session drops, click **Reconnect** on the disconnected overlay.
+
+## Serial consoles
+
+Create a **Serial** profile, pick the device from the list (click refresh after plugging in an adapter) and set the baud rate and line settings to match the device — 115200 8N1 with no flow control is the default. On Linux your user needs to be in the `dialout` (or `uucp`) group; on macOS use the `/dev/cu.*` device.
+
+## VNC remote desktops
+
+Create a **VNC** profile for remote desktop sessions. Use the SSH tunnel option when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic is not encrypted, so Nexus Terminal asks before connecting without a tunnel.
+
+## RDP remote desktops
+
+Create an **RDP** profile with the host, your username and, if needed, a domain. Windows servers use Network Level Authentication by default; for xrdp and other servers without it, tick **Allow servers without NLA**. The first connection shows the server certificate's fingerprint to trust. Use the **Proxy** or **SSH Tunnel** sections to reach desktops behind a jump host or proxy.
+
+## File transfers on SSH
+
+Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename and delete files, create folders and bookmark locations.
+
+### Drag and drop files
+
+Drop file(s) onto a terminal and choose to:
+
+- **Upload to current directory** — pick a remote folder (SSH sessions only), or
+- **Paste contents** into the terminal as if typed.
+
+The upload picker lists folders only and marks permissions:
+
+- **READ ONLY**: you can read but cannot write
+- **NO READ**: you cannot access the folder
+
+## Security basics
+
+- Credentials are stored in the OS keychain where available.
+- An encrypted vault (AES-256-GCM, Argon2id) is used as a fallback; set it up in **Settings → Security**.
+- Each password, passphrase or token can be saved, remembered for the session only, or asked for every time.
+- SSH host key checks can be set per profile (Strict, Ask, Accept new, Insecure).
+
+## Common shortcuts
+
+| macOS Shortcut  | Windows/Linux Shortcut | Action                   |
+| --------------- | ---------------------- | ------------------------ |
+| Cmd + K         | Ctrl + K               | Command palette          |
+| Cmd + N         | Ctrl + N               | New connection           |
+| Cmd + W         | Ctrl + W               | Close tab                |
+| Cmd + F         | Ctrl + F               | Find in terminal         |
+| Cmd + Shift + S | Ctrl + Shift + S       | Snippet library          |
+| Cmd + Shift + B | Ctrl + Shift + B       | Broadcast input          |
+| Cmd + Shift + Q | Ctrl + Shift + Q       | Quick connect            |
+| Cmd + Shift + R | Ctrl + Shift + R       | Toggle session recording |
+| Cmd + Shift + D | Ctrl + Shift + D       | Split pane right         |
+| Cmd + Shift + E | Ctrl + Shift + E       | Split pane down          |
+
+## Need more detail?
+
+- Product overview: [docs/overview.md](overview.md)
+- User manual: [docs/user-manual.md](user-manual.md)

docs/rust-port-plan.md

@@ -0,0 +1,481 @@
+# Rust port plan: Nexus Terminal, a native egui app with no Go and no webview
+
+> **Status (11 October 2026): converted.** Every phase below has been carried out on the
+> `rust-port` branch; Go, Node and Wails are gone. What was verified and what wasn't:
+>
+> - **Verified here (Linux):** the Go-generated fixtures (database, vault, `.link` export,
+>   recording) load; SSH against a real OpenSSH server (key and agent auth, PTY shell, exec,
+>   local/remote forwards, SFTP, jump host, agent forwarding, host-key rejection), including
+>   through the GUI with the host-key prompt and login scripts; local shell, RAW, Telnet/RAW/serial
+>   client tests (serial on a pty pair); the session manager (events, reconnect backoff, restart of
+>   an exited local shell); the terminal renderer (colours, 256/true colour, CJK fallback); every
+>   window rendered headlessly; `cargo clippy` clean; the Windows target builds and links.
+> - **Not verified:** macOS builds (need Apple's C toolchain), running on Windows or macOS, the OS
+>   keychain on a real desktop session (none was available, so the go-keyring compatibility in §3
+>   is untested), IRC, GitHub and VNC against real servers (tested against fakes), serial hardware.
+> - **Update URLs:** moved to `https://dixon.cx/downloads/nexus` (§7).
+
+Goal: rebuild Alchementary Link in Rust as **Nexus Terminal**, a single Rust application in the
+style of Leviathan Desktop (`../leviathan/rust`).
+- **UI:** the Wails webview (HTML/CSS/JS, xterm.js) is replaced by an **eframe/egui 0.36** shell with
+  Leviathan's design system: `Tokens` themes, Inter and JetBrains Mono, Phosphor icons, a custom title
+  bar, a navigator rail, document tabs, a dock, a status bar, and the Ctrl/Cmd+K palette over one `Cmd`
+  enum. Full functional parity is required.
+- **Backend:** the Go core is ported to Rust. At the end, Go, Node and Wails are gone from the repo.
+- **Rename:** back to **Nexus Terminal** (§7). Existing Alchementary Link data is migrated on first
+  run.
+- **Removed:**
+  - the hidden **Leviathan** mode (`internal/leviathan/*`, `leviathan.js`, the Konami toggle). It now lives in Leviathan Desktop.
+  - the **VS Code bridge** (`cmd/vscode-bridge`).
+- **New:** a Serial protocol (§4).
+- **VNC is included, not deferred.** Rust has a usable RFB client crate (§6a).
+
+### Crates
+
+| Need | Crate | Notes |
+|---|---|---|
+| UI | `eframe`/`egui` 0.36, `egui-phosphor`, `rfd`, `image` | Same versions and features as Leviathan (`glow`, `wayland`, `x11`, `accesskit`, `persistence`) |
+| Async runtime | `tokio` (multi-thread, 2 workers) | Network sessions only. The UI thread never blocks on it |
+| SSH, SFTP | `russh`, `russh-sftp`, `ssh-key` | Strict-kex (Terrapin) support; client-side **agent forwarding** (`server_channel_open_agent_forward`); `direct-tcpip` for jump hosts; `tcpip-forward` for remote forwards |
+| Terminal emulation | `alacritty_terminal` | VT parser, grid, scrollback, selection and regex search (the same engine Zed uses). We draw it with egui's painter (§6) |
+| Local shell | `portable-pty` | `forkpty` on Unix, ConPTY on Windows |
+| Serial | `serialport` | Baud/bits/parity/stop, RTS/CTS and XON/XOFF, DTR/RTS, break, port enumeration |
+| IRC | none (our own client over std TCP, `rustls` for TLS) | Registration, PING, CTCP, NickServ via PRIVMSG; reconnect and channel-state persistence are ours |
+| VNC | none (our own RFB client; `des`, `flate2`, `image` for Tight JPEG) | RFB 3.3–3.8, VNC auth, Raw/CopyRect/Hextile/ZRLE/Tight → egui texture |
+| HTTP (GitHub, updater) | `ureq` 3 | Blocking calls on `spawn_blocking` |
+| SQLite | `rusqlite` (`bundled`) | SQLite compiled in, so no system library is needed |
+| Vault, export | `argon2`, `aes-gcm`, `rand` | Native Argon2id at 128 MiB takes about 0.3 s |
+| Keychain | `keyring` 3 (pure-Rust D-Bus via zbus on Linux) | Must read entries written by go-keyring (§3) |
+| TOTP | none (`hmac` + `sha1`, ~30 lines) | RFC 6238, normalised like pquerna/otp |
+| JSON | `serde`, `serde_json` | Protocol configs stay JSON columns |
+| Telnet, RAW, recordings | none (tokio `TcpStream`, serde) | Small ports of the Go code |
+
+There are **no system C libraries**. SQLite is compiled in, and TLS uses rustls. The Linux binary needs
+only the X11/Wayland/GL libraries that eframe loads, as Leviathan does.
+
+## 1. Architecture
+
+Like Leviathan, the project is engine-first: a UI-free core crate, and the egui app is one client of it.
+
+```
+rust/
+├── core/    nexus-core: storage, secrets, models, protocol clients, SessionManager, Service. No egui.
+└── app/     nexus: the egui shell
+```
+
+- **`Service`** keeps the **same method names** as today's `api.Service` (`connect_session`,
+  `sftp_list`, …), and **`Event`** is one enum whose variants match today's event names
+  (`SessionData`, `SessionState`, `SecretPrompt`, `HostKeyVerify`, …). The checklist in §10 refers to
+  these names. They are now plain Rust calls with no serialisation.
+- **The UI thread** runs egui and owns all UI state. Each frame it drains a
+  `crossbeam_channel::Receiver<Event>`. `Service` methods that touch SQLite are fast and run inline
+  (rusqlite behind a `Mutex<Connection>`, in WAL mode).
+- **One tokio task per session** (SSH, Telnet, RAW, IRC, GitHub refresh, VNC). Serial and local-shell
+  sessions each get a blocking thread (`serialport` and `portable-pty` have blocking APIs). Each session
+  has an `mpsc` outbound queue (keystrokes, resize, break, DTR/RTS). Inbound bytes are batched per read
+  and sent as one `Event::SessionData`, followed by `ctx.request_repaint()`. Sending raw bytes instead
+  of base64 JSON is the main performance gain over the Wails app.
+- **Credential prompts:** when a session task needs a secret or a host-key decision while connecting,
+  it sends `Event::SecretPrompt { reply: oneshot::Sender }` and awaits the answer. Closing the session
+  drops the receiver, which cancels the prompt. This is the same contract as the Go channel.
+- **Long jobs** (SFTP transfers, archive download, `test_connection`, key generation) are tokio tasks
+  or `spawn_blocking`, and report progress through events.
+
+## 2. SSH (russh)
+
+| Feature | Approach |
+|---|---|
+| Interactive shell | `channel.request_pty(term type from the profile)`, env vars, `request_shell`, `window_change` |
+| Auth | password, public key (files, with passphrase), agent (`SSH_AUTH_SOCK`; Pageant and the Windows OpenSSH pipe through russh's agent client), keyboard-interactive, with TOTP answering the prompts |
+| Host keys | `Handler::check_server_key` against **our** SQLite known-hosts table (strict/ask/accept-new/insecure). Never `~/.ssh/known_hosts` |
+| Keepalive | russh `keepalive_interval`/`keepalive_max` from the profile |
+| Jump hosts | Hop N opens `channel_open_direct_tcpip`, and its stream is passed to hop N+1 as the transport (`connect_stream`). No loopback socket is needed |
+| SOCKS5 and HTTP proxies | `tokio-socks` for SOCKS5; HTTP CONNECT is about 40 lines. The resulting stream goes to `connect_stream` |
+| Local forwards | A `TcpListener` per forward → `channel_open_direct_tcpip` → `copy_bidirectional` |
+| Remote forwards | `tcpip_forward`, plus `Handler::server_channel_open_forwarded_tcpip` |
+| Agent forwarding | `agent_forward` request plus `server_channel_open_agent_forward`, bridged to the local agent. ⚠ Prove this in the phase 0 spike |
+| SFTP | `russh-sftp` on a second channel: list/stat/mkdir/rename/remove/upload/download, with progress events |
+| Key manager | `ssh-key`: generate ed25519, RSA 2048/4096 and ECDSA; write OpenSSH private keys (encrypted with bcrypt-pbkdf + aes256-ctr); public-key export; `file_is_private_key`. The key comment becomes `name@nexus-terminal` |
+| `~/.ssh/config` import | Port of `sshconfig` (~300 lines of Go) |
+| Compression | russh `zlib@openssh.com` when the profile enables it |
+
+The fallback, if a russh gap blocks the spike, is `ssh2` (libssh2 with vendored OpenSSL). It has no
+API for accepting agent-forwarding channels, and it brings C back into the build.
+
+## 3. Porting the Go backend
+
+Sizes are Go lines, excluding tests. The Go tree is 41k lines. Leviathan (25.5k), VNC's Go side and the bridge are not
+ported, which leaves about 15k lines to port.
+
+| Go package | Lines | Rust replacement |
+|---|---|---|
+| `storage` + `migrations/*.sql` | 949 | rusqlite. **Embed the same `.sql` files** with `include_str!` and keep the same migrations table, so existing databases open unchanged |
+| `models`, `validation`, `preferences`, `audit`, `knownhosts`, `config` | ~1.5k | Plain modules. Protocol configs stay JSON columns, read as `serde_json::Value` or, where the UI edits them, as `#[derive(Deserialize)]` structs with `#[serde(default)]`. Leviathan preferences (`leviathanEnabled`, …) are ignored on read |
+| `secrets` (vault + keychain) | 460 | Vault: `argon2` + `aes-gcm`. Keychain: `keyring`, with explicit target names to match go-keyring (see below) |
+| `exportimport` | 209 | Same envelope and the same crypto; `.nexus` extension (§7) |
+| `sessions` + `api` | ~6k | `SessionManager` + `Service` (§1): reconnect with attempts and backoff, login scripts, broadcast, recording hooks, secret resolution (saved / session-only / ask every time). The Leviathan methods are dropped |
+| `sshclient`, `sftpclient`, `sshconfig`, `terminalenv` | ~1.7k | §2 |
+| `telnetclient` | 603 | tokio `TcpStream` and the option state machine (echo, SGA, NAWS, TTYPE, BRK) |
+| `rawclient` | 561 | tokio; history, capture, and hex/escaped encoders |
+| `ircclient` (on `girc`) | 833 | `irc` crate plus our own state: rooms, NAMES, LIST, topic, reconnect, channel-state persistence (migration 006) |
+| `githubclient` | 408 | `ureq` + serde; periodic refresh; archive download |
+| `localshell` | 294 | `portable-pty` |
+| `recording` | 538 | asciicast v2 writer and reader; the files are the same |
+| `updater` | 303 | `ureq`; same manifest format; URLs per §7 |
+| `vncclient` | 340 | §6a |
+| `leviathan/*` | 25.5k | **Deleted.** |
+| `cmd/vscode-bridge` | 357 | **Deleted.** |
+
+### Data compatibility (hard requirement)
+
+Existing users upgrade in place. **Before any Go is deleted**, generate fixtures from the Go code and
+commit them under `rust/core/tests/fixtures/`:
+- a database with every protocol, snippets and known hosts, migrated through 006
+- a vault file with a known password
+- `.link` exports
+- recordings
+- keychain entries written by go-keyring, on each OS in CI
+
+Rust must read every fixture byte for byte. The formats are:
+- **Vault:** JSON `{version, salt(b64, 32 bytes), secrets: key → b64(nonce12 ‖ ciphertext ‖ tag)}`;
+  Argon2id with t=3, m=128 MiB, lanes=4, and a 32-byte key.
+- **Export:** `[1 byte version][32 bytes salt][12 bytes nonce][ciphertext]`, with the Argon2 parameters
+  from `exportimport.go`. Only the extension changes (`.link` → `.nexus`).
+- **Keychain:** ⚠ go-keyring and `keyring` don't store entries the same way by default:
+  - **macOS:** both use a generic password stored under service and account, so they match.
+  - **Windows:** go-keyring's target is `service:user`, but `keyring` defaults to `user.service`. Use `Entry::new_with_target`.
+  - **Linux:** both use the Secret Service, but with different attribute sets. Search by `service` + `username`.
+
+  The phase 0 spike proves all three against the fixtures.
+
+## 4. New protocol: Serial
+
+- **Library:** `serialport`.
+- **Migration:** `007_serial_protocol.sql` adds `serial` to the protocol CHECK, plus a `serial_config` JSON column.
+- **Config fields and defaults:** `baudRate 115200, dataBits 8, parity none|odd|even, stopBits 1|2,
+  flowControl none|xonxoff|rtscts, lineEnding cr|lf|crlf, localEcho false, dtrOnConnect true,
+  rtsOnConnect true, encoding, autoReconnect true, maxReconnectTries 5`.
+  Mark/space parity and 1.5 stop bits are left out because `serialport` doesn't support them. If they're needed, add them
+  through `termios`/`DCB` on the raw handle (about 30 lines per OS).
+- **Device path:** stored in `host`, with `port` 0, so the sidebar, search and palette work unchanged.
+- **Session:** a terminal session through `TermView`, so recording, triggers, broadcast, find, snippets
+  and split panes all work. Unplugging the adapter sets the session to disconnected, and auto-reconnect re-opens the path.
+  New service methods: `list_serial_ports`, `set_serial_lines(dtr, rts)`, `send_break`.
+- **UI:**
+  - an editor page (device combo with refresh, line settings, behaviour settings)
+  - a Quick Connect entry
+  - Send Break and DTR/RTS toggles on the tab
+  - a badge colour
+  - error hints: the `dialout`/`uucp` group on Linux, `/dev/cu.*` on macOS, and busy ports
+  - a Help topic
+
+## 5. Toolchain and platforms
+
+- **Toolchain:** pin the same `rust-toolchain.toml` as Leviathan (`1.99.0`), edition 2024.
+- **Targets:** keep the current release matrix in full: darwin amd64 and arm64 (one universal `.app`),
+  linux amd64 and arm64, and windows amd64 and arm64.
+- **UI code from Leviathan:** copy these files into `app/src/` once, then let them evolve
+  independently. There is no dependency on the Leviathan repo:
+  - `theme.rs` (Tokens, fonts; 278 lines)
+  - `widgets.rs` (198 lines)
+  - the title bar, command palette and frame layout from `app.rs`
+  - `hexview.rs`, for the RAW hex view
+  - bundled fonts
+  - the `packaging/` layout
+
+## 5a. UI mapping: webview module → egui
+
+egui is immediate mode. Lists are virtualised with `ScrollArea::show_rows`, so the 1000/200/5000-row caps go away.
+Terminal views are repainted only when their session receives data, and for input and cursor blink.
+
+| Current (JS) | egui replacement |
+|---|---|
+| `index.html` grid layout | Leviathan's frame: custom title bar (Nexus mark, menus, active-session title, ⌘K launcher, window controls); a **navigator rail** holding the connection sidebar (resizable 180–500); a central **tab strip + workspace** with an empty state; a right **dock** for SFTP and the profile editor; a **status bar** |
+| Shortcuts (`app.js`) | The `Cmd` enum plus a shortcut table. `Modifiers::COMMAND` maps to ⌘ on macOS and Ctrl elsewhere. The palette enumerates every `Cmd` |
+| `tabs.js` | A painted tab strip (Leviathan's tab style) with a protocol badge, status dot, activity marker, pin and 📁; pinned tabs first; drag to reorder; scroll with edge fades; context menu; tooltip with "Connected since"; close confirmation |
+| `terminal.js` + xterm.js | `TermView` (§6) |
+| `splitpane.js` | A binary tree of `Pane::{Leaf(session), Split{dir, ratio, a, b}}` laid out by rect, with draggable dividers (minimum 100 px). A placeholder leaf shows the connection picker. Child sessions get no tab |
+| `sidebar.js` | Collapsing sections (Local Machine, ★ Favourites, Recent 5, folders, Ungrouped), a protocol dot and ★, Ctrl/Cmd-click multi-select, a context menu, a bulk-action bar, and fuzzy search |
+| `profiles.js` drawer | A dock panel: protocol selector plus one section per protocol. List editors (jump hosts, forwards, RAW presets, login script) are `egui::Grid` rows with ▲▼✕ |
+| `settings.js` | Settings window with tabs: General, Terminal, Security, Known Hosts, Help, About |
+| `secrets.js` | Modal windows: secret prompt, master password (strength meter using the same formula), host-key dialog |
+| `sshkeys.js` | SSH Keys window: list, generate, copy public key, delete |
+| `sftp.js` | A dock panel per session: breadcrumb, table, bookmarks, and a transfer queue with progress bars. Dialogs via `rfd` |
+| Drop files on terminal | `ctx.input(\|i\| i.raw.dropped_files)` gives real paths. The File Drop dialog stays. Upload by path, so the 768 KiB base64 chunking goes away |
+| `raw.js` | Text view, hex view (the copied `hexview`, read-only), or split; a send bar (format combo, input, quick-byte buttons, presets); Save via `rfd` |
+| `irc.js` | Room tabs + a read-only `TermView` fed by the ported mIRC→ANSI formatter + a composer + side lists (rooms, room list, users) |
+| `github.js` | Painted repo cards under group headers; a filter; Refresh; ZIP and Visit buttons |
+| `vnc.js` | `VncView` (§6a) |
+| `commands.js` | The copied palette widget, with Nexus's sections and a port of `fuzzyMatch` |
+| `snippets.js`, `triggers.js`, `recordings.js` | Windows. Playback uses its own `TermView`, with a scrubber, speed control and autoplay |
+| `notifications.js` | A toast stack painted top-right in an `egui::Area`, auto-dismissed after 4 s (6 s for errors). About 60 lines; no crate needed |
+| `themes.js` | App chrome uses `Tokens` (Pro/Midnight/Light). `terminal_themes.rs` is a const table of the 11 terminal palettes (charcoal … rose-pine) |
+| Help tab HTML | The help topics minus Leviathan, as `include_str!` text with simple heading and paragraph styling |
+| `BrowserOpenURL`, clipboard, fullscreen | `ctx.open_url`, `ctx.copy_text` and egui paste events, `ViewportCommand::Fullscreen` |
+
+**App theme:** every widget is drawn by egui, so the theme applies everywhere.
+
+## 6. TermView (the critical path)
+
+- **Model:** one `alacritty_terminal::Term` per view, behind a `FairMutex`, fed by
+  `vte::ansi::Processor`. Session data events are fed straight in as bytes; UTF-8 is the parser's job.
+- **Drawing:** for each visible row, group cells into runs with the same attributes, then draw one
+  `painter.text` call per run, plus background rectangles, cursor, selection and search highlights.
+  Cache each row's layout by a hash of its content. Use the profile's font, falling back to the
+  preferences (JetBrains Mono is bundled). Wide and emoji cells take the terminal's cell width.
+- **Scrollback:** `Config.scrolling_history`, from the profile, falling back to `defaultScrollback`
+  (0–100000).
+- **Input:**
+  - egui `Key` events map to escape sequences, respecting the terminal mode (application cursor keys, keypad).
+  - `Event::Text` and `Event::Ime(Commit)` send the text, so IME input works.
+  - Paste is bracketed when the application enables it.
+  - Output goes to `write_session` and to the broadcast targets.
+- **Mouse:**
+  - When the application enables mouse reporting, send SGR/X10 reports.
+  - Otherwise: drag selects, double-click selects a word, triple-click selects a line.
+  - The wheel scrolls the scrollback. On the alternate screen it sends ↑/↓ once per notch (the existing tmux behaviour).
+  - Ctrl/Cmd-click on a URL opens it.
+- **Behaviours to keep:**
+  - **Clipboard:** Ctrl/Cmd+C copies when there is a selection and otherwise sends SIGINT; Ctrl/Cmd+V pastes.
+  - **Resize:** debounced; recompute columns and rows, then `term.resize` and `resize_session`.
+  - **Right-click menu:** all 11 items.
+  - **Find bar:** alacritty `RegexSearch`, with case and regex options, "i of N", Enter and Shift+Enter.
+  - **Overlays:** the disconnect overlay with Reconnect, and the local shell's "[Exited - press enter to restart]".
+  - **Cursor:** style (block, underline or bar) and blink.
+- **Performance target:** `cat` of a 50 MB file stays responsive, at parity with or better than xterm.js.
+  Parsing runs on the UI thread inside the event drain. If profiling shows that's too slow, feed `Term` on the session
+  thread and keep only drawing on the UI thread (the `FairMutex` already allows this).
+- **Reference:** `egui_term` (alacritty_terminal + egui) is prior art. Read it, but don't depend on it,
+  because it lags egui releases.
+
+## 6a. VNC
+
+**As built:** `vnc-rs` was not used; the fallback below (our own RFB client) is what shipped.
+
+- `vnc-rs` on a tokio task, with an optional SSH tunnel through §2's `direct-tcpip`.
+- Decoded rectangles are applied to an RGBA buffer, and dirty frames update a `TextureHandle`, scaled to fit.
+- Input: pointer → `PointerEvent`; keys → X11 keysyms (port the keysym map from `vnc.js`).
+- If `vnc-rs` doesn't work with the servers users run, the fallback is our own RFB client: Raw, CopyRect and ZRLE
+  in about 600 lines, plus Tight's JPEG via the `image` crate.
+
+## 7. Rename to Nexus Terminal and migrate data
+
+The rebrand to Alchementary Link (commit `1a380a0`) renamed every path and **migrated nothing**. This rename
+undoes it and migrates the data.
+
+| Item | Alchementary Link (now) | Nexus Terminal |
+|---|---|---|
+| Product and window title | Alchementary Link | Nexus Terminal |
+| Binary, bundle and app id | `AlchementaryLink` | `NexusTerminal` / `nexus-terminal` |
+| Config dir | `…/AlchementaryLink` | `…/NexusTerminal` |
+| Database and log | `link.db`, `link.log` | `nexus.db`, `nexus.log` |
+| Keychain service | `AlchementaryLink` | `NexusTerminal` |
+| Export file | `.link`, "Link Export" | `.nexus`, "Nexus Export" (import accepts both) |
+| Updater User-Agent and GitHub fallback | `AlchementaryLink-UpdateChecker`, `alchementary-link` | `NexusTerminal-UpdateChecker`, `nexus-terminal` |
+| Update and release URLs | `alchementary.co.uk/download/link/…` | `dixon.cx/downloads/nexus/…` |
+| Icons and brand mark | `alchementary-link-*.png`, ">_ AlchementaryLink" | Restore the `nexus-terminal-*` icons from git history (pre-`1a380a0`), redrawn for the egui title bar |
+
+**First-run migration** (in `nexus-core`, before the database is opened):
+1. If `NexusTerminal/nexus.db` exists, use it. This covers users from before the rebrand, whose data was never moved.
+2. Otherwise, if `AlchementaryLink/link.db` exists, **copy** (don't move) `link.db` → `nexus.db`, plus the
+   `vault/` directory and the recordings, into `NexusTerminal/`. Write a `migrated-from` marker.
+   The old directory is left untouched, so the Wails build still works if a user rolls back.
+3. **Keychain:** when a read under `NexusTerminal` misses, try `AlchementaryLink`. If it's found there, write it under
+   `NexusTerminal`. Old entries are not deleted.
+4. If both directories hold a database (a user who ran both builds), Nexus wins, and the toast says so.
+
+The old update channel must point existing Alchementary Link installs at the first Nexus release. That's one
+manifest entry on the update server, so existing users get the Rust build.
+
+## 8. Phases and milestones
+
+Each phase ends with a runnable build and its slice of the §10 checklist ticked off. **The Wails app keeps
+shipping until phase 7**, and Go is deleted only then.
+
+| # | Phase | Delivers | Milestone |
+|---|---|---|---|
+| 0 | Fixtures and spikes | The Go-generated fixtures (§3). Spikes, each answering one question: (a) a russh PTY shell against OpenSSH with an ed25519 key, strict-kex, a jump host and **agent forwarding**; (b) `TermView` on alacritty_terminal with vim, tmux, htop, IME input, and `cat` of 50 MB; (c) `keyring` reads go-keyring entries on all three OSes; (d) `vnc-rs` against TigerVNC and macOS Screen Sharing | Go/no-go on each risk in §2, §3 and §6a |
+| 1 | Core foundation | `nexus-core`: storage and migrations, models, validation, preferences, audit, known hosts, vault, keychain, export/import, `Service`/`Event`, and the **§7 migration**. App skeleton in Leviathan's frame: rail, sidebar, tabs, status bar, toasts, and the secret, master-password and host-key modals | Opens an existing Alchementary Link user's data as Nexus; profiles listed; lock and unlock |
+| 2 | Terminal | `TermView` (§6), terminal themes, local shell, Telnet, **Serial**, state handling (reconnect toast, error classifier, "Connection Already Open") | A usable local, Telnet and serial terminal |
+| 3 | SSH | §2 in full, plus SFTP and the key manager | Usable as a daily SSH client |
+| 4 | Forms | Profile editor (every field in §10.3), Quick Connect, Settings, Known Hosts, SSH Keys, encrypted export/import, update check | All profile CRUD and settings |
+| 5 | Power features | Split panes, broadcast, snippets, triggers, recording and playback, port-forward dialog, SFTP dock and file drop, palette, shortcuts, fullscreen | Every terminal-session feature |
+| 6 | RAW, IRC, GitHub, VNC | Rust clients and their views | Every protocol |
+| 7 | Ship; delete Go | Packaging and CI (§9). Delete `go.mod`, `go.sum`, `main.go`, `internal/`, `cmd/`, `frontend/`, `wails.json`, the Wails `build/` assets, and the Go build scripts (`build*.sh`, `build.ps1`, `Makefile`, `build-all.sh`). Rewrite the docs, README and `.github/copilot-instructions.md` as Nexus Terminal. Publish the update-server entry that moves users across (§7) | Nexus Terminal released from a tag; no Go or JS left |
+
+## 9. Build and release
+
+- **Build:** `cargo build --release --target …`.
+  - Version: `CARGO_PKG_VERSION`, set by `release.sh` in `Cargo.toml`.
+  - Update URL: `option_env!("NEXUS_UPDATE_URL")`, defaulting to the URL decided in §7. This replaces Go's `-ldflags -X`.
+- **Packaging:** Leviathan's `packaging/` layout, renamed:
+  - **macOS:** a universal `NexusTerminal.app` via `build-app.sh`, with Developer ID signing and notarisation.
+  - **Windows:** an `.exe` with an icon and version info from `build.rs`/`winresource`, using the GUI subsystem.
+  - **Linux:** a tarball, plus `install.sh` and a `.desktop` file.
+- **CI:** rewrite `release-builds.yml` with `dtolnay/rust-toolchain` and a native runner per OS and arch.
+  Drop Go, Node, Wails and `libwebkit2gtk`. Run `cargo test` on every platform.
+- **Unchanged:** the update server (`updates/index.php`) and the manifest format. `release.sh` gets the new names.
+
+## 10. Parity checklist
+
+This is the acceptance list, built from a full read of `frontend/src/js/*`. A feature is done when it works in the native build.
+
+### 10.1 Shell, tabs, sessions
+- [ ] Layout: sidebar, tab strip (+ New, Broadcast: left-click toggles, right-click picks targets), workspace empty state (New Connection, Quick Connect), status bar
+- [ ] Sidebar footer: New, ⌘K, Import, Export, Recordings, Settings
+- [ ] Shortcuts: ⌘K, ⌘N, ⌘W, ⌘Tab/⇧⌘Tab (wrap), ⌘1–9, ⌘, (Settings), ⌘F, ⇧⌘D, ⇧⌘E, ⇧⌘R, ⇧⌘B, ⇧⌘S, ⇧⌘Q, F11; Esc closes palette and exits fullscreen
+- [ ] Events handled: `session:data`, `session:state` (with attempt/maxRetries/delaySec toast), `session:closed`, `session:raw:data`, `session:github:*`, `session:irc:event`, `session:forward:started/stopped/error` toasts, `session:recording:started/stopped`, `session:sftp:progress`, `session:secret:prompt`, `session:hostkey:verify`, `app:open-about`
+- [ ] Connect flow: "Connection Already Open" (Cancel / New Connection / Use Existing), "Connecting to X…" toast, refit and resize at 50/300/800 ms after connect
+- [ ] Error classifier: auth errors → Close / Edit Profile / Retry; host-key errors also offer Known Hosts
+- [ ] Tabs:
+  - [ ] Visuals: protocol badge, status dot, activity marker cleared on activate, pinned-first order
+  - [ ] Interaction: drag reorder; wheel scroll with overflow fades; scroll the active tab into view; hover hint (name + "Connected since"); close activates the nearest neighbour
+  - [ ] Context menu: Rename, Duplicate, Pin/Unpin, Move Left/Right, Reconnect, Close
+  - [ ] Close confirm when the pref is on (not for GitHub tabs)
+- [ ] Session close is idempotent and cleans up splits, SFTP, triggers, recordings and viewers
+- [ ] Local shell: `ConnectLocal`, exit and restart-on-Enter
+- [ ] Quick Connect: SSH/Telnet/RAW/IRC/Serial, default ports, username (SSH/IRC), nick (IRC), Enter/Esc
+- [ ] Broadcast: toggle toast, target picker with Select All (all selected means null, i.e. all sessions)
+- [ ] Status bar latency: <100 good, <250 warn, else bad; stops on error
+- [ ] Toasts: 4 types, × dismiss, 4 s / 6 s auto-dismiss
+
+### 10.2 Terminal
+- [ ] §6 in full; 11 themes; switching theme updates every open terminal
+- [ ] Find bar (case, regex, count, next/prev, clear highlights)
+- [ ] Context menu: all 11 items, with the shortcut labels for the platform
+- [ ] File drop: Paste contents / Upload to current directory (SSH only) via the directory picker (breadcrumb, filter, Up, Refresh, READ ONLY / NO READ badges, "Use this folder" disabled when the directory isn't writable, keyboard navigation)
+- [ ] Port Forwards dialog: list, Stop, add (L/R, bind, dest, label)
+- [ ] Split panes: split the focused pane right/down, placeholder picker (Local Machine + profiles), divider drag with live refit, per-pane ✕ promotes the sibling, late connects to a closed pane are disconnected, closing the tab closes child sessions
+- [ ] Recording toggle and a visible tab indicator
+
+### 10.3 Profiles, sidebar, settings, security
+- [ ] Sidebar:
+  - [ ] Sections: Local Machine, Favourites, Recent 5, folders (sorted), Ungrouped / "All Connections"; collapsible
+  - [ ] Search: fuzzy over name, host, tags and protocol; empty states
+  - [ ] Mouse: click connects; Ctrl/Cmd-click multi-selects; double-click edits
+  - [ ] Context menu: Connect, Edit, Duplicate, Favourite toggle, Delete (confirm)
+  - [ ] Bulk bar: Connect all, Disconnect (confirm), Tags add/replace, Move Group, Clear
+- [ ] Profile editor, common:
+  - [ ] Protocol switch keeps common fields
+  - [ ] Validation: host, port, IRC nick and rooms, IRC SSH tunnel
+  - [ ] Buttons: Test (Reachable — N ms), Delete (confirm), Create/Save, Save & Connect
+  - [ ] General fields: Display Name, Host, Port, Username, Group (autocomplete), Description
+  - [ ] Terminal fields: font, size 8–36, scrollback 0–100000, cursor style
+  - [ ] Tags and Notes
+- [ ] SSH fields:
+  - [ ] Password mode, auth methods
+  - [ ] Key path with `ListSSHKeys` autocomplete, Browse, and checks (reject `~`, `FileExists`, `FileIsPrivateKey`); passphrase mode
+  - [ ] Host key policy (strict/ask/accept-new/insecure)
+  - [ ] Jump hosts list, port forwards list
+  - [ ] Startup command, env KEY=VALUE, login script (wait/send, timeout 1–120, reorder)
+  - [ ] Agent auth and forwarding
+  - [ ] TOTP: show/hide, Test (code shown 5 s), Save/Delete, placeholder when a secret is saved
+  - [ ] Proxy (none/socks5/http, host, port 1080, user, password)
+  - [ ] Advanced: terminalType, keepalive interval/count, compression, autoReconnect, maxReconnectTries 1–20
+- [ ] Telnet fields: localEcho, lineMode, terminalType, encoding, line ending, negotiationDebug, login script, reconnect
+- [ ] RAW fields: encoding, line ending, showTimestamps, showDirection, payload presets (name/payload/format), timeouts, autoReconnect
+- [ ] GitHub fields: API base URL, token storage, refresh interval 60–3600
+- [ ] IRC fields: nick, realName, TLS, server password and mode, NickServ, auto-join rooms, SSH tunnel, reconnect
+- [ ] VNC fields: every current field, saved round-trip
+- [ ] Settings:
+  - [ ] General: theme, default protocol, confirm on close/disconnect, status bar, sidebar width, local shell (Browse)
+  - [ ] Terminal: theme, font, size, scrollback, cursor
+  - [ ] Security: init/unlock/lock
+  - [ ] Known Hosts: table, Remove
+  - [ ] Help: 13 topics
+  - [ ] About: version, Check for Updates, View release, Import ~/.ssh/config
+- [ ] Master password dialog: strength meter (Weak/Fair/Good/Strong), confirm match
+- [ ] Secret prompt (Esc cancels → `cancelled:true`)
+- [ ] Host key dialog (Reject / Accept & Save)
+- [ ] SSH Key Manager: list (name, type, bits), copy public key, delete, generate (ed25519/rsa 2048|4096/ecdsa, passphrase)
+- [ ] Encrypted export (`.nexus`; import also accepts `.link`) (profile checkboxes, password + confirm) and import (password, skip/overwrite/duplicate)
+- [ ] Command palette:
+  - [ ] Sections: Connections, Actions, Tabs, Application, Security (lock/unlock), Terminal (Trigger Rules; split/clear/reset when a session is active)
+  - [ ] Fuzzy ranking, ↑↓ Enter Esc
+- [ ] Snippets: search, CRUD (name, description, command, folder), send to the active connected session, `{{hostname|date|time|timestamp}}` built-ins plus prompted variables
+- [ ] Triggers: CRUD; name, pattern, regex, case-sensitive, enabled; actions notify/highlight/both/sound; line-buffered matching with CSI stripped
+- [ ] Recordings:
+  - [ ] Browser: list, storage info, delete, cleanup by age (7/30/90) and size (1 GB / 5 GB)
+  - [ ] Playback: play/pause, restart, scrubber seek (replay to the target), m:ss, speed 0.5–10×, autoplay
+
+### 10.4 SFTP, RAW, IRC, GitHub, VNC
+- [ ] SFTP panel:
+  - [ ] Layout: toggle, resizable, breadcrumb, Go to path, New folder, Upload, Refresh, Close
+  - [ ] File list: folders first, `..` entry, extension icons, size with modified-time hint, loading/empty/error + Retry
+  - [ ] Actions: multi-select, Download (files), Rename (single), Delete (confirm)
+  - [ ] Bookmarks
+  - [ ] Transfer queue with progress; refresh when an upload is done; toast when the panel is closed
+- [ ] RAW:
+  - [ ] Views: Text/Hex/Split, Pause/Resume, Clear, Save capture, byte counter, 5000-entry buffer
+  - [ ] Prefixes: timestamps and direction per the profile
+  - [ ] Send: Text/Hex/Escaped formats, NUL/CR/LF/ETX/EOT, presets, Enter sends, local echo of the sent entry
+- [ ] IRC:
+  - [ ] Room tabs: Server tab, unread markers, 2000-line buffers
+  - [ ] Composer: /commands via `IRCHandleInput`, Tab nick completion, click a nick to insert `@nick`
+  - [ ] Room lists: join box, joined rooms with topic hint, room list (filter, click to join)
+  - [ ] Users list with prefixes stripped
+  - [ ] Formatting: all event types formatted as today, nick colour hash, full mIRC formatting (^B ^] ^^ ^_ ^V ^O ^C fg,bg ^D hex)
+- [ ] GitHub:
+  - [ ] Status line, filter, Refresh
+  - [ ] Ordering: owner groups ordered by newest repo (own login first on ties)
+  - [ ] Card contents: Private/Fork/Archived badges, last commit and committer, description, language colour, stars, relative pushed time
+  - [ ] Actions: ZIP (save dialog → `DownloadGitHubRepoArchiveToPath`), Visit
+- [ ] VNC: connect (direct or SSH-tunnelled), scaled framebuffer, mouse and keyboard, clipboard, disconnect overlay
+
+### 10.4a Serial
+- [ ] Profiles: create, edit and duplicate, and export/import round-trip including `serialConfig`
+- [ ] Editor: device list and refresh
+- [ ] Line settings: all baud, data-bit, parity, stop-bit and flow-control options applied
+- [ ] Session behaviour:
+  - [ ] data in the terminal
+  - [ ] local echo, line ending and encoding
+  - [ ] DTR/RTS on connect and as toggles
+  - [ ] Send Break
+  - [ ] XON/XOFF and RTS/CTS flow control honoured
+  - [ ] unplug → disconnected overlay; auto-reconnect when the device returns
+- [ ] Quick Connect Serial; recording, triggers, broadcast, snippets, find and split panes all work on serial sessions
+- [ ] Permission-denied and busy-port hints
+
+### 10.5 Rename and migration
+- [ ] Every user-visible string, window title, bundle, binary and icon says Nexus Terminal
+- [ ] First run migrates `AlchementaryLink/` → `NexusTerminal/`, copying the database, vault and recordings, and leaves the old directory intact
+- [ ] Pre-rebrand `NexusTerminal/nexus.db` is used as-is
+- [ ] Keychain entries under `AlchementaryLink` are found and re-saved under `NexusTerminal`
+- [ ] Import accepts `.link` and `.nexus`; export writes `.nexus`
+- [ ] An existing Alchementary Link install updates to Nexus through the update server
+
+
+## 11. Existing quirks: default is to fix during the port
+
+| Quirk | Native default |
+|---|---|
+| RAW Save passes the capture content as a file path (`raw.js:217` → `SaveSessionCapture(sid, path)`) | Save dialog, pass the path (fixes the bug) |
+| Rename prompt's OK button says "Connect" | "Rename" |
+| Recording tab dot never shows (wrong selectors) | Indicator drawn by the tab strip |
+| `#status-protocol` never filled | Show the active session's protocol |
+| Adding or removing a jump host, forward or preset discards unsaved edits | Grid editing keeps them |
+| `folder` dropped when switching protocol | Keep it |
+| RAW decodes received data as Latin-1 | Decode as UTF-8 in text view (hex view unchanged) |
+| SFTP bookmarks keyed by session id (lost on disconnect) | Key by profile id |
+| Help says sidebar supports drag between groups (it doesn't) | Fix the Help text; use "Move Group" |
+| Trigger "sound" uses a WebAudio 880 Hz beep | the system bell |
+
+Client-side state that is **not migrated**: trigger rules and SFTP bookmarks live in WebKit localStorage. Users recreate them; everything else is in the SQLite DB, the vault and the keychain, which are read as-is (§3).
+
+## 12. Tests
+
+- **Before Go is deleted:** the §3 fixtures.
+- **`cargo test` in `nexus-core`:**
+  - **Compatibility:** every §3 fixture read and round-tripped: database, vault, `.link` exports, recordings, and the keychain on each OS.
+  - **Migration (§7):** old dir only → copied; new dir only → untouched; both → Nexus wins; keychain fallback.
+  - **Ported Go test tables:** `validation`, `secrets`, `storage`, `exportimport`, `sshconfig`, `knownhosts`,
+    `terminalenv`, `rawclient` encoding and history, `models` defaults, and `updater` manifest parsing.
+  - **Ported JS tests:** IRC mIRC→ANSI (`test-irc.js`), and split-tree lifecycle with late-connect
+    rejection (`test-session-lifecycle.js`).
+  - **Pure logic:** fuzzy match, snippet variables, trigger line buffering, and password strength.
+  - **Serial:** a pty pair on Linux, covering data, echo, line endings and XON/XOFF.
+- **SSH integration:** a CI job against an `openssh-server` container, covering password, key,
+  keyboard-interactive with TOTP, jump host, local and remote forwards, agent forwarding, an SFTP round trip,
+  and a host-key mismatch.
+- **Screenshots:** copy Leviathan's `--screenshot out.png` flag, and check each view under `xvfb-run` in CI.
+- `test-regressions.js` is retired; §10 replaces it.

docs/user-manual.md

@@ -0,0 +1,551 @@
+# Nexus Terminal User Manual
+
+## Contents
+
+1. Getting started
+2. The interface at a glance
+3. Creating and managing profiles
+4. Connection types
+5. Tabs and split panes
+6. Terminal actions and search
+7. Snippets, broadcast input and triggers
+8. SFTP file browser
+9. Drag-and-drop uploads and paste
+10. Port forwards
+11. Session recordings
+12. Security and credentials
+13. Import and export
+14. Settings and updates
+15. Data locations
+16. Troubleshooting
+
+---
+
+## 1. Getting started
+
+### Launch and connect
+
+- Start Nexus Terminal.
+- Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**), choose a protocol, and fill in the profile details.
+- Click **Create & Connect** to save the profile and open a session in a new tab, or **Create** to save it for later.
+- Click a profile in the sidebar to connect to it.
+
+### Quick connect
+
+Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. Choose SSH, Telnet, RAW, IRC or Serial, enter the host (or serial device), port, and username or nick where relevant, then press **Enter**. This starts a one-off session without saving a profile.
+
+### Local terminal
+
+Click **Local Machine** at the top of the sidebar, choose **File → Local terminal**, or click **Local** on the welcome screen to open a shell on this computer. When the shell exits, the tab shows `[Exited - press enter to restart]`; press **Enter** to start a new shell in the same tab.
+
+### Command palette
+
+Press **Cmd+K** / **Ctrl+K**, or click the search box in the title bar, to open the command palette. Type a few letters to find a connection, switch to a tab, create a profile, open a window, change theme, lock or unlock the secret store, or run a terminal action. Use **Up/Down** to move, **Enter** to run, and **Esc** to close.
+
+---
+
+## 2. The interface at a glance
+
+- **Title bar**: the File, Session, View and Help menus, the active session's name and host, the command palette launcher, a light/dark toggle, and the window controls. Drag the title bar to move the window; double-click it to maximise.
+- **Sidebar**: a search box, then **Local Machine**, **★ Favourites**, **Recent** (the last five connections), one section per group, and **Ungrouped** (or **All Connections** when you have no groups). Sections collapse when you click their headers. The footer has buttons for New connection, Command palette, Import, Export, Recordings and Settings. Drag the sidebar edge to resize it.
+- **Tab strip**: one tab per session, with a state dot, protocol badge, pin marker, activity dot and close button. SSH tabs also have a folder icon for SFTP. On the right are **+** (new connection) and the broadcast button.
+- **Workspace**: the active terminal or viewer; split panes appear here. With no tabs open it shows a welcome screen with **New Connection**, **Quick Connect** and **Local** buttons.
+- **Right dock**: the profile editor or the SFTP browser, resizable.
+- **Status bar**: the active session's state and protocol, a **REC** marker while recording, latency for SSH sessions, a **BROADCAST** marker, the vault state (click it to open Security settings), the number of connected sessions, and an update notice when a new version is available.
+
+Notifications appear as toasts in the top-right corner and dismiss themselves after a few seconds; click **×** to dismiss one early.
+
+---
+
+## 3. Creating and managing profiles
+
+### Create a new profile
+
+1. Click **+** in the sidebar footer or on the tab strip, press **Cmd+N** / **Ctrl+N**, or right-click a group header and choose **New connection in …**.
+2. Choose the protocol (SSH, Telnet, RAW TCP, GitHub, VNC, IRC or Serial) at the top of the editor. Switching protocol keeps the common fields.
+3. Fill in the **General** section: Display Name, Host (or Device for serial), Port, Username, Group and Description.
+4. Fill in the protocol sections and, for terminal protocols, the **Terminal** section (font family, font size 8–36, scrollback 0–100000 lines, cursor style).
+5. Optionally add **Tags** (comma-separated) and **Notes**.
+6. Click **Create & Connect**, or **Create** to save without connecting.
+
+Click **Test** to check that the host and port are reachable; a toast reports the round-trip time. Fields with problems are highlighted when you save.
+
+The **Group** field suggests existing groups; type a new name to create one.
+
+### Edit, duplicate, favourite, export or delete
+
+Right-click a profile in the sidebar for **Connect**, **Edit**, **Duplicate**, **Add to Favourites** / **Remove from Favourites**, **Export…** and **Delete**. Double-click a profile to edit it. Deleting a profile also removes its saved credentials.
+
+### Bulk actions
+
+Ctrl-click (Cmd-click on macOS) profiles to select several. A bar appears at the bottom of the sidebar with:
+
+- **Connect all**
+- **Disconnect** (asks first when **Confirm on disconnect** is on)
+- **Tags** → **Add tags…** or **Replace tags…**
+- **Move group** (leave the name empty to move to Ungrouped)
+- **Delete**
+- **Clear** (clear the selection)
+
+### Search
+
+Type in the sidebar search box to fuzzy-search profiles by name, host, tag and protocol.
+
+### Already open?
+
+If you connect to a profile that already has a live session, Nexus Terminal asks whether to **Use Existing**, open a **New Connection**, or **Cancel**.
+
+---
+
+## 4. Connection types
+
+### SSH
+
+- **Authentication**: password, public key, keyboard-interactive and SSH agent. Choose which methods to try under **Auth Methods**, and tick **Use SSH Agent for Authentication** to use `ssh-agent` (Pageant or the OpenSSH agent on Windows).
+- **Key & Passphrase**: choose a key from the suggestions (keys in `~/.ssh`), click **Browse**, or type a full path (`~` is not expanded). The editor checks that the file exists and is a private key.
+- **Host Verification**: the host key policy (see section 12).
+- **Jump Hosts**: one or more bastions, each with user, host, port and an optional key. Nexus Terminal tunnels through each hop in order.
+- **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect. A remote forward with no bind address listens on the server's loopback only (as `ssh -R` does); set it to `0.0.0.0` to expose it to the server's network, which also needs `GatewayPorts` on the server.
+- **Startup**: a startup command and environment variables (`KEY=VALUE`, one per line).
+- **Login Script**: expect-style steps (see below).
+- **SSH Agent**: agent authentication and **Forward Agent to Remote** (like `ssh -A`).
+- **TOTP / 2FA**: store a Base32 TOTP secret to answer two-factor prompts automatically. Click **Test** to show the current code, **Save** to store the secret, and **Delete** to remove it. Save the profile first.
+- **Proxy**: none, SOCKS5 or HTTP CONNECT, with host, port and optional username and password. The proxy is used to reach the SSH server, or the first jump host.
+- **Advanced**: terminal type, keepalive interval, max missed keepalives, compression, auto-reconnect and the maximum number of reconnect attempts (1–20).
+
+The SFTP browser, port forwards and status-bar latency are available on SSH sessions.
+
+### Telnet
+
+- **Login**: local echo and line mode.
+- **Terminal & Encoding**: terminal type and encoding (UTF-8, ASCII or ISO 8859-1).
+- **Echo & Line Endings**: LF, CR, CRLF or none.
+- **Negotiation**: **Debug Negotiation** for troubleshooting option negotiation.
+- **Login Script** and **Reconnection** settings.
+
+Telnet sends everything in plain text. Avoid it for anything sensitive over an untrusted network.
+
+### RAW TCP
+
+- **Encoding & Framing**: encoding (UTF-8, ASCII or Hex) and line ending.
+- **Display**: show timestamps and show direction.
+- **Payload Presets**: named payloads with a format (Text, Hex or Escaped) for quick sending.
+- **Timeouts & Reconnect**: connect and read timeouts, and auto-reconnect.
+
+A RAW session opens a viewer instead of a terminal:
+
+- **Text**, **Hex** and **Split** views of everything sent and received.
+- **Pause** / **Resume**, **Clear**, and **Save** (writes the capture as JSON).
+- A send bar with a format selector (Text, Hex or Escaped), a **Presets…** menu, and quick buttons for EOT, ETX, LF, CR and NUL. Press **Enter** to send.
+
+### Serial
+
+Serial profiles open a terminal on a local serial port.
+
+- **Device**: pick the port from the list and click refresh after plugging in an adapter, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- **Line Settings**: baud rate (a preset from 300 to 1000000, or a custom value), data bits (5–8), parity (none, odd or even), stop bits (1 or 2) and flow control (none, XON/XOFF or RTS/CTS).
+- **Behaviour**: line ending, encoding, local echo (for devices that don't echo), **Assert DTR on connect**, **Assert RTS on connect**, and auto-reconnect.
+
+The defaults are 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, and DTR and RTS asserted.
+
+While connected, right-click the tab to **Send Break** or toggle **DTR** and **RTS**. Telnet tabs also offer **Send Break**.
+
+When the adapter is unplugged the session disconnects; with auto-reconnect on, the port is reopened when the device returns. Serial sessions support everything other terminals do: recording, triggers, broadcast, snippets, find and split panes.
+
+### VNC
+
+- **VNC Server**: VNC host (defaults to the profile's Host), port, and password storage mode.
+- **Display**: **View Only**, **Scale to Fit**, **Shared Session** and **Quality (0-9)**.
+- **SSH Tunnel**: carry VNC traffic through SSH, with host, port, username and password, public key or SSH agent authentication.
+
+The viewer's toolbar shows the connection state and desktop size, and has buttons to switch between scaled and 1:1 display, refresh the screen, **Paste Clipboard** (send your local clipboard to the remote desktop) and **Ctrl+Alt+Del**. Text the remote desktop copies arrives on your local clipboard. Click the desktop to give it keyboard focus.
+
+Use SSH tunnelling for VNC whenever possible. If a VNC profile has no tunnel, Nexus Terminal warns that the traffic is unencrypted and offers **Connect Anyway**, **Edit Profile** or **Cancel**.
+
+### RDP
+
+- **RDP**: domain (optional), password storage mode, **Certificate Policy** and **Allow servers without NLA**. The username, host and port (3389) are the profile's own.
+- **Display**: **Scale to Fit**, a fixed **Width** and **Height** (0 × 0 fits the tab) and **Resize With Tab**.
+- **RD Gateway** (experimental): reach the desktop through a Remote Desktop Gateway (`host` or `host:port`) with its own username and password. The gateway's certificate must be valid for its name (public CA); only gateways that accept Basic authentication over HTTPS work.
+- **Proxy**: **SOCKS5** or **HTTP CONNECT**, with an optional username and password.
+- **Devices**: **Play Remote Audio**; **Redirect Printer**, which adds a *Nexus Terminal* printer on the remote desktop whose jobs are saved as PostScript files in your Downloads folder (up to 256 MiB per job); and on Linux and macOS a **Shared Folder** that appears on the remote desktop as a drive named Nexus. The server can read and change everything in that folder and nothing outside it: paths that try to leave it (`..`, or symlinks pointing elsewhere) are refused.
+- **SSH Tunnel**: carry RDP through SSH, as for VNC. Use either a proxy or a tunnel, not both.
+
+Nexus Terminal logs on with Network Level Authentication (CredSSP), so your password is checked before a session is set up. It uses NTLM unless you set a **Kerberos KDC** (`host` or `host:port`), in which case it gets a Kerberos ticket from that KDC over TCP; the KDC must be reachable directly (not through the profile's proxy or tunnel). Use your Kerberos realm as the domain. Servers without NLA, such as xrdp, need **Allow servers without NLA**; the password is then passed to the server's own logon. Smart cards are not supported.
+
+RDP servers usually present self-signed certificates, so the certificate is pinned like an SSH host key: its SHA-256 fingerprint is shown the first time and stored in **Known Hosts**, and a changed certificate offers Reject, Accept Once or Accept & Update. The check happens before any credentials are sent.
+
+The viewer works like the VNC one: click the desktop to give it keyboard focus, **Ctrl+Alt+Del** sends the key combination, and text is shared through the clipboard both ways: text you copy on the remote desktop arrives on your clipboard (subject to the remote-clipboard setting), and your clipboard is sent to the remote desktop only when you paste (Ctrl+V / Cmd+V on the desktop, or **Paste Clipboard**), so a server can't read what you last copied. Files and images are not shared. With **Resize With Tab**, the remote desktop follows the tab's size on servers that support it (Windows); otherwise the picture is scaled.
+
+### IRC
+
+- **IRC**: nick, real name, **Use TLS** (port 6697 for most TLS networks) and an optional server password.
+- **SASL**: log in during registration with SASL PLAIN (account defaults to your nick), which most networks now expect; Nexus Terminal only sends it (or a server or NickServ password) over TLS, an SSH tunnel or to a server on this machine; on a plain connection the Server tab says the password was held back. If the network doesn't offer SASL or rejects the login, the Server tab says so and the connection carries on.
+- **NickServ**: identify on connect, with an optional account name and password.
+- **Rooms**: rooms to join automatically, one per line or comma-separated. Networks that support IRCv3 server-time stamp messages with the time they were sent, so replayed history shows its real times.
+- **SSH Tunnel** and **Reconnection** settings.
+
+The IRC view has a **Server** tab and a tab per room or conversation, with a dot on tabs that have unread messages. Type messages or `/commands` in the composer (`/join`, `/part`, `/msg`, `/me`, `/notice`, `/nick`, `/topic`, `/list`, `/names`, `/whois`, `/who`, `/raw`, `/quit`, `/help`). Press **Tab** to complete a nick, or click a nick to mention it. The side panel lists joined rooms, a room browser with a filter (click a room to join it), and the users in the current room.
+
+### GitHub
+
+- **API**: API base URL (`https://api.github.com`, or your GitHub Enterprise API URL) and personal access token storage. The token needs the `repo` scope.
+- **Refresh**: refresh interval, 60–3600 seconds.
+
+Repositories are grouped by owner or organisation and sorted by most recent activity. Each card shows Private, Fork and Archived badges, language, stars, description, and the last commit and committer. Use the filter box to narrow the list, **Refresh now** to update it, **Visit** to open a repository in your browser, and **ZIP** to download an archive.
+
+---
+
+## 5. Tabs and split panes
+
+- **Reorder** tabs by dragging them, or right-click and choose **Move Left** / **Move Right**.
+- **Pin** important sessions from the tab's right-click menu; pinned tabs stay at the front.
+- **Rename**, **Duplicate** (open another session to the same profile) and **Reconnect** from the right-click menu.
+- **Scroll** the tab strip with the mouse wheel or trackpad when many tabs are open.
+- **Hover** a tab to see its name, host, state and, for connected sessions, the connection start time.
+- **Close** a tab with its **×**, **Cmd+W** / **Ctrl+W**, or **Close** in the right-click menu. When **Confirm on close** is on, closing a connected tab asks first (GitHub tabs close straight away).
+- **Switch** tabs with **Cmd+Tab** / **Ctrl+Tab**, **Cmd+Shift+Tab** / **Ctrl+Shift+Tab**, or **Cmd+1–9** / **Ctrl+1–9**.
+- A dot on a background tab means it has new output.
+
+### Split panes
+
+- **Cmd+Shift+D** / **Ctrl+Shift+D** splits the focused pane to the right (side by side).
+- **Cmd+Shift+E** / **Ctrl+Shift+E** splits it downwards (top and bottom).
+- Split Right and Split Down are also in the Session menu, the terminal's right-click menu and the command palette.
+
+A new pane offers **Local Machine** and your terminal profiles (SSH, Telnet and Serial); click one to open it in that pane. Drag a divider to resize panes. Click **×** on a pane's header to close it; its neighbour takes the space. Closing the tab closes every pane in it.
+
+---
+
+## 6. Terminal actions and search
+
+### Inline images
+
+Programs that print images in the iTerm2 format (`imgcat`, `wezterm imgcat`, `chafa -f iterm`) show PNG, JPEG and GIF (first frame) images inline, sized as the program asks and never wider than the terminal; the text continues below the image. Images scroll with the text and are dropped with the scrollback. Very large images (over 8192 pixels a side) are ignored, and each terminal keeps at most 32 megapixels of images, dropping the oldest. Sixel and kitty graphics aren't supported.
+
+### Shell integration
+
+When the shell marks its prompts and commands (the OSC 133 sequences), Nexus Terminal knows where each command starts and ends:
+
+- **Ctrl+Shift+Up / Ctrl+Shift+Down** (**Cmd+Shift** on macOS), or **Previous Prompt** / **Next Prompt** in the right-click menu, jump between prompts in the scrollback.
+- **Copy Last Command Output** in the right-click menu copies what the last finished command printed.
+- A thin bar beside each finished command's prompt shows how it ended: green for success, red for a non-zero exit. Hover it for the exit code and how long the command took.
+
+fish 4 and several prompt themes (Starship, Powerlevel10k with its shell integration option) send the marks already. For bash, add this to `~/.bashrc` on the machine the shell runs on:
+
+```bash
+PS0='\[\e]133;C\a\]'
+PROMPT_COMMAND='printf "\033]133;D;%s\007" "$?"; '"${PROMPT_COMMAND}"
+PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
+```
+
+For zsh, add to `~/.zshrc`:
+
+```zsh
+precmd() { print -Pn "\e]133;D;$?\a\e]133;A\a" }
+preexec() { print -n "\e]133;C\a" }
+PS1="$PS1%{\e]133;B\a%}"
+```
+
+Shells that also report their working directory (OSC 7; fish, and zsh/bash with the usual `printf '\e]7;file://%s%s\a' "$HOSTNAME" "$PWD"` hook) let **SFTP Browser** open in that directory.
+
+### Keyboard and mouse
+
+- **Copy**: select text and press **Cmd+C** / **Ctrl+C**. With nothing selected, **Ctrl+C** sends an interrupt as usual.
+- **Paste**: **Cmd+V** / **Ctrl+V**. Pastes are bracketed when the remote application asks for it.
+- **Select**: drag to select, double-click for a word, triple-click for a line, Shift-click to extend.
+- **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser. Programs can also print real hyperlinks (OSC 8, as `ls --hyperlink` and many build tools do); these have a dotted underline, and hovering one shows where it really points. Only http(s) links are opened.
+- **Scroll**: the mouse wheel, or **Shift+PageUp**, **Shift+PageDown**, **Shift+Home** and **Shift+End**. On the alternate screen (for example in `tmux`, `screen`, `byobu` or `less`) the wheel sends arrow keys instead.
+- Applications that use the mouse (such as `htop`, `vim` or `tmux` with mouse mode) receive mouse clicks and the wheel directly.
+
+### Context menu
+
+Right-click in the terminal for:
+
+- Copy and Paste
+- Select All
+- Find
+- Send Snippet
+- Port Forwards (SSH)
+- Split Right and Split Down
+- Export Output (save the whole scrollback as a text file)
+- Clear and Reset
+
+### Search
+
+Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle **Aa** for case-sensitive matching and **.\*** for regular expressions. The bar shows "*n* of *total*"; press **Enter** for the next match, **Shift+Enter** for the previous one, and **Esc** to close.
+
+### Disconnects and errors
+
+When a session drops, the pane is dimmed and shows a **Disconnected** (or **Connection error**) card with **Reconnect** and **Close**. While auto-reconnect is running it shows **Reconnecting…** with a **Cancel** button, and a toast shows the attempt number and delay.
+
+If a connection fails because of authentication or a host key, a guided dialog explains what happened and offers **Retry**, **Edit Profile**, **Known Hosts** (for host-key errors) and **Close**.
+
+---
+
+## 7. Snippets, broadcast input and triggers
+
+### Snippets
+
+Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux), from the Session menu, or with **Send Snippet** in the terminal's right-click menu. Create snippets with a name, description, command and folder, search them, and click **Send to Session** to type the command into the active session followed by Enter.
+
+Snippets can use variables:
+
+- `{{hostname}}`, `{{date}}`, `{{time}}` and `{{timestamp}}` are filled in automatically.
+- Any other `{{name}}` is asked for when you send the snippet.
+
+### Broadcast input
+
+Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux), the broadcast button on the tab strip, or the Session menu. While it is on, everything you type is also sent to every other connected terminal session, and the status bar shows **BROADCAST**.
+
+To broadcast to only some sessions, right-click the broadcast button (or choose **Session → Broadcast targets…**), tick the sessions you want, and click **Apply & Enable**.
+
+### Trigger rules
+
+Open **Trigger Rules** from the Session menu or the command palette. Each rule has a name, a pattern (plain text or regular expression), a case-sensitive option, an enabled switch and an action:
+
+- **Notify**: show a toast.
+- **Highlight tab**: briefly outline the pane.
+- **Notify + Highlight**: both.
+- **Sound**: ask the operating system for attention (for example, a bouncing dock icon or flashing taskbar button) and show a toast.
+
+Rules are checked against each complete line of terminal output, with colour codes removed.
+
+---
+
+## 8. SFTP file browser
+
+Open the file browser with the **folder** icon on an SSH tab, or **Session → SFTP browser**. It opens in the right dock beside the terminal. You can:
+
+- Navigate folders using the breadcrumb trail, the `..` entry, or **Go to path**.
+- Upload files, and download one or more selected files to a folder you choose.
+- Rename a single item, and delete one or more items (with confirmation).
+- Create folders and refresh the listing.
+- Bookmark the current folder with the star button; bookmarks are kept per profile.
+- Watch transfers and their progress in the transfer list.
+
+Ctrl-click (Cmd-click) or Shift-click to select several items. Drag the dock edge to resize it.
+
+---
+
+## 9. Drag-and-drop uploads and paste
+
+When you drop file(s) onto an active terminal, Nexus Terminal asks whether to:
+
+- **Upload to current directory** — choose a remote directory (SSH sessions only), or
+- **Paste contents** into the terminal as if typed.
+
+### Upload directory picker
+
+The picker looks like the SFTP browser and lists remote folders only. It shows:
+
+- **READ ONLY** for folders you cannot write to.
+- **NO READ** for folders you cannot access.
+
+Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. **Use this folder** is disabled when the folder is not writable. You can also use the keyboard:
+
+- **Up/Down**: move selection
+- **Enter**: choose the selected folder
+- **Backspace**: go up a folder (when the filter is empty)
+- **Escape**: cancel
+
+If the SFTP browser is already open, the picker starts in the same directory.
+
+Tip: Use the filter box to jump quickly to common folders.
+
+---
+
+## 10. Port forwards
+
+Forwards saved in an SSH profile start when the session connects. To manage forwards on a live SSH session, choose **Port Forwards** from the terminal's right-click menu or **Session → Port forwards**. The dialog lists active forwards (marked **L** for local or **R** for remote) with a stop button, and lets you start a new one:
+
+- **Local →**: listen on a local bind address and port, and forward to a destination reachable from the server.
+- **Remote ←**: ask the server to listen, and forward connections back to a destination reachable from this computer.
+
+Toasts report when a forward starts, stops or fails.
+
+---
+
+## 11. Session recordings
+
+Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux), or **Session → Toggle recording**. A red dot appears on the tab and **REC** in the status bar. Recordings are saved as asciicast v2 files.
+
+Open the recordings browser from the sidebar footer, the Session menu or the command palette. It shows how many recordings you have and how much space they use, lets you play or delete each one, and has **Clean up** for removing recordings older than 7, 30 or 90 days, or keeping the total under 1 GB or 5 GB.
+
+Playback starts automatically and has play/pause, restart, a seek bar with elapsed and total time, and speed control.
+
+---
+
+## 12. Security and credentials
+
+### Where credentials are stored
+
+- **OS keychain first** (macOS Keychain, Linux Secret Service or Windows Credential Manager).
+- **Encrypted vault** fallback, using AES-256-GCM with an Argon2id-derived key (128 MiB of memory, which makes brute-force attacks expensive).
+
+If the keychain is unavailable, or refuses to store a secret, credentials go to the vault. Set the vault up in **Settings → Security** with **Initialise Secret Store**; the master-password dialog shows a strength meter (Weak, Fair, Good, Strong) and asks you to confirm the password. Unlock and lock it from the same page, the command palette, or by clicking the vault state in the status bar. The vault is locked again when Nexus Terminal quits.
+
+Without the master password, credentials in the vault cannot be recovered.
+
+### Secret modes
+
+Each password, passphrase, token or TOTP secret has its own mode:
+
+- **Save securely**: stored in the keychain or vault and used automatically.
+- **Remember for this session**: asked for once, kept in memory for that session, never written to disk.
+- **Ask every time**: asked for on every connection.
+
+When a session needs a credential it doesn't have, a prompt appears; press **Esc** or **Cancel** to abandon the connection.
+
+### Host key verification
+
+Choose one of the following policies per SSH profile:
+
+- **Strict (known hosts only)**: only accept previously saved host keys.
+- **Ask on new or changed keys**: prompt before trusting a new host key; the dialog shows the key type and fingerprint with **Accept & Save** and **Reject**.
+- **Accept new, reject changed**: trust first-time keys automatically.
+- **Insecure (accept anything)**: accept any key (not recommended).
+
+**Settings → Known Hosts** can **Import ~/.ssh/known_hosts** (hashed host names can't be read back and are skipped) and **Export…** the list in OpenSSH format, so Nexus Terminal and `ssh` can share what they trust.
+
+**SSH certificates.** **Trust a CA…** adds a certificate authority for a host pattern in OpenSSH syntax (`*.example.com`, `[host]:2222`, `!excluded.example.com`; `@cert-authority` lines in an imported known_hosts work too). Servers covered by a trusted CA are asked for their host certificate, and a certificate that the CA signed, that names the host and that is in date is trusted without a first-use prompt; any other certificate is refused. For logging in, a user certificate next to your key (`id_ed25519-cert.pub` beside `id_ed25519`) is used automatically.
+
+Under every policy except Insecure, a key that differs from the saved one is rejected. Nexus Terminal keeps its own known-hosts list and does not read `~/.ssh/known_hosts`. Review and remove entries in **Settings → Known Hosts**; click a fingerprint to copy it.
+
+### TOTP / 2FA
+
+Store a TOTP secret in the profile editor to answer verification-code prompts automatically during SSH keyboard-interactive authentication. Secrets are stored in the keychain or vault, never in the profile database.
+
+### SSH key manager
+
+Open **SSH key manager** from the Session menu or the command palette. It lists key pairs in `~/.ssh` with their type, lets you copy a public key to the clipboard or delete a pair, and generates new Ed25519, RSA (2048 or 4096 bits) or ECDSA keys with an optional passphrase. Key generation uses the `ssh-keygen` program.
+
+### Audit log
+
+Connections, disconnections, profile changes, credential access, imports and exports are recorded in an audit log in the database. Secrets are never written to it.
+
+---
+
+## 13. Import and export
+
+### Profile sync
+
+**Settings → Security → Profile sync** keeps connection profiles the same on several machines. Choose a folder all of them can reach (a Dropbox, iCloud Drive, OneDrive or Nextcloud folder, a network share, or a git checkout you commit), and set the same **sync password** on each. Nexus Terminal keeps one encrypted file there, `nexus-profiles.nexus` (Argon2id + AES-256-GCM, like an encrypted export), and merges it at launch, a few seconds after you change a profile, every ten minutes and when you click **Sync Now**:
+
+- for a profile changed on both sides, the more recent change wins;
+- a profile deleted on one machine is deleted on the others (unless it was edited after the deletion);
+- saved passwords, keys and tokens are never synced; each machine keeps its own in its keychain or vault. Values that a login script `send`s (including a password typed after a `wait "Password:"`) are part of the profile and do travel, as they do in an export;
+- timestamps in the shared file are never trusted beyond the local clock, so a file edited to claim a future date can't override later local changes;
+- if a synced (or imported) profile now points at a different host, user, GitHub API URL or RD Gateway, this machine forgets the credentials it had saved for it and asks again, rather than sending them to the new destination.
+
+
+- **Encrypted export**: **File → Export profiles…**, the sidebar footer, the command palette, or **Export…** on a profile's right-click menu. Choose the profiles, set a password and save a `.nexus` file. Credentials saved in the keychain or vault are not included.
+- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file, enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
+- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; passwords in login-script `send` steps that answer a password prompt are blanked unless you tick **Include secrets**. Proxy passwords and TOTP secrets live in the keychain or vault, never in the profile, so no export carries them.
+- **OpenSSH config**: **File → Import ~/.ssh/config** or **Settings → About → Import ~/.ssh/config** creates profiles from your `Host` blocks, including hostnames, usernames, ports, identity files and jump hosts.
+
+---
+
+## 14. Settings and updates
+
+Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux), the sidebar footer, or **File → Settings**. Click **Save** to apply changes.
+
+- **General**: app theme (Pro, Midnight or Light), default protocol, restore tabs at launch (reopens the last session's tabs and split panes: saved connections reconnect, local shells start in the directory they were in; Quick Connect tabs aren't restored), confirm on close, confirm on disconnect, remote clipboard writes (OSC 52 and VNC; a toast shows what was copied), multi-line paste confirmation, the launch-time update check, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
+- **Terminal**: colour scheme, font family, font size, scrollback lines and cursor style. These are the defaults for new profiles; profiles can override them.
+- **Security**: keychain and vault status; initialise, unlock or lock the secret store; **Change Master Password…** (re-encrypts every saved credential under the new password in one step); **Stored credentials**, listing each profile's saved passwords, passphrases and tokens and whether they're in the keychain or the vault, with **Forget**; and profile sync.
+- **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**; import/export `~/.ssh/known_hosts` and trusted SSH certificate authorities.
+- **Diagnostics**: version, platform, data, database and log locations, keychain and vault state, counts and sync status, with **Copy Diagnostics** for bug reports (no credentials are included).
+- **Help**: built-in help topics, including connection types, shortcuts and troubleshooting.
+- **About**: version, **Check for Updates**, and **Import ~/.ssh/config**.
+
+The app theme and terminal colour scheme can also be changed from the **View** menu, and the light/dark button in the title bar.
+
+### Updates
+
+Nexus Terminal checks for a new version once at launch. When one is available, the status bar shows **Update available**; click it to open **Settings → About**, which shows the current and latest versions, release notes and a **View release** button. Nothing is downloaded or installed automatically.
+
+---
+
+## 15. Data locations
+
+### Data locations
+
+| OS      | Data directory                                     |
+| ------- | -------------------------------------------------- |
+| macOS   | `~/Library/Application Support/NexusTerminal`      |
+| Windows | `%APPDATA%\NexusTerminal`                          |
+| Linux   | `$XDG_CONFIG_HOME/NexusTerminal` (usually `~/.config/NexusTerminal`) |
+
+The directory holds:
+
+- `nexus.db` — profiles, known hosts, preferences, snippets, IRC channel state and the audit log (SQLite)
+- `vault/vault.json` — the encrypted vault
+- `recordings/` — session recordings
+- `triggers.json` — trigger rules
+- `sftp-bookmarks.json` — SFTP bookmarks
+- `nexus.log` — the diagnostic log (owner-only, rotated to `nexus.log.1` at 5 MiB): connections, reconnects, host-key and certificate checks and errors. Credentials and terminal contents are never logged. Set `RUST_LOG` (for example `RUST_LOG=debug`) for more detail; it then also goes to the terminal you started Nexus Terminal from.
+
+Credentials saved in the OS keychain are stored under the service name `NexusTerminal`.
+
+---
+
+## 16. Troubleshooting
+
+### Session shows as disconnected
+
+- The pane is dimmed and shows a **Disconnected** overlay when the connection drops.
+- Click **Reconnect** to reopen the session with the same profile.
+
+### Authentication fails
+
+- Check the username, password, key path and the auth methods ticked in the profile.
+- If the key has a passphrase, check the passphrase mode.
+- If the server uses two-factor prompts, check the TOTP secret with **Test** and make sure your system clock is accurate.
+
+### "Host key verification failed"
+
+The server's key differs from the one saved earlier. This can happen when a server is reinstalled, but it can also indicate an attack. If you're certain it's safe, open **Settings → Known Hosts**, remove the entry, and reconnect.
+
+### Upload fails or is greyed out
+
+- Check the folder is writable; **READ ONLY** indicates no write permission.
+- Confirm the session is connected over SSH; upload isn't available for other protocols.
+
+### Cannot read a folder
+
+- **NO READ** indicates insufficient permissions.
+- Try a parent folder or check remote access controls.
+
+### Serial port won't open
+
+- Check the device path and that the adapter is plugged in; refresh the device list in the editor.
+- **Permission denied** on Linux: add your user to the `dialout` group (`uucp` on some distributions), then log out and back in.
+- On macOS, use the `/dev/cu.*` device rather than `/dev/tty.*`.
+- **Port is in use by another program**: close any other program that has the port open, such as `screen`, `minicom` or an IDE serial monitor.
+- Garbled output usually means the baud rate, parity or stop bits don't match the device.
+
+### VNC will not connect
+
+- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
+- If using a password, check whether it is set to save securely, remember for this session, or ask every time.
+- If using an SSH tunnel, verify the tunnel host, username, authentication method, private key and SSH host key policy.
+- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
+
+### The secret store is locked
+
+If a saved credential isn't used, the vault may be locked. Click the vault state in the status bar, or open **Settings → Security**, and unlock it.
+
+### Session keeps reconnecting
+
+- Check network stability and credentials.
+- Review the auto-reconnect settings in the profile. Reconnection backs off exponentially (1 s, 2 s, 4 s … up to 30 s) and stops after the maximum number of attempts.
+
+### Terminal size looks wrong
+
+- Resize the window or drag a split divider; the terminal re-fits automatically.
+- Try disconnecting and reconnecting the session.
+- Some older servers don't support modern terminal features; try a different terminal type in the profile.
+
+### Trying things safely
+
+To try something without touching your real data, start Nexus Terminal with `--data-dir DIR` to use a different data directory.

frontend/embed.go

@@ -1,13 +0,0 @@
-// Package frontend provides the embedded frontend assets for the Wails application.
-package frontend
-
-import "embed"
-
-// Assets contains the frontend files served by the Wails asset server.
-// We embed the root index.html and the entire src/ tree (stylesheets,
-// scripts, vendor libs and static assets) so that `go build` works
-// without a separate npm build step.
-//
-//go:embed index.html
-//go:embed all:src
-var Assets embed.FS

frontend/index.html

@@ -1,180 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Nexus Terminal</title>
-
-    <!-- Vendor styles -->
-    <link rel="stylesheet" href="/src/css/lib/xterm.css">
-
-    <!-- Design system -->
-    <link rel="stylesheet" href="/src/css/tokens.css">
-    <link rel="stylesheet" href="/src/css/base.css">
-    <link rel="stylesheet" href="/src/css/components.css">
-    <link rel="stylesheet" href="/src/css/layout.css">
-    <link rel="stylesheet" href="/src/css/sidebar.css">
-    <link rel="stylesheet" href="/src/css/tabs.css">
-    <link rel="stylesheet" href="/src/css/terminal.css">
-    <link rel="stylesheet" href="/src/css/forms.css">
-    <link rel="stylesheet" href="/src/css/modals.css">
-    <link rel="stylesheet" href="/src/css/github.css">
-</head>
-<body>
-    <div id="app" class="app">
-
-        <!-- ============================================================
-             Sidebar — connection manager
-             ============================================================ -->
-        <aside class="sidebar" id="sidebar">
-            <div class="sidebar-header wails-drag">
-                <div class="sidebar-logo">
-                    <!-- Terminal prompt icon -->
-                    <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24"
-                         fill="none" stroke="currentColor" stroke-width="2"
-                         stroke-linecap="round" stroke-linejoin="round">
-                        <polyline points="4 17 10 11 4 5"></polyline>
-                        <line x1="12" y1="19" x2="20" y2="19"></line>
-                    </svg>
-                    <span class="sidebar-title">Nexus Terminal</span>
-                </div>
-            </div>
-
-            <div class="sidebar-search">
-                <div class="search-wrapper">
-                    <input type="text"
-                           class="search-input"
-                           id="profile-search"
-                           placeholder="Search connections…"
-                           autocomplete="off"
-                           spellcheck="false">
-                </div>
-            </div>
-
-            <nav class="sidebar-nav" id="sidebar-nav">
-                <!-- Dynamically managed by sidebar.js -->
-                <div id="sidebar-profiles" class="sidebar-profiles"></div>
-            </nav>
-
-            <div class="sidebar-footer">
-                <button class="btn btn-ghost btn-sm" id="btn-new-connection" title="New Connection">
-                    <span>+ New</span>
-                </button>
-                <button class="btn btn-ghost btn-icon btn-sm" id="btn-import" title="Import">
-                    <!-- Upload icon -->
-                    <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24"
-                         fill="none" stroke="currentColor" stroke-width="2"
-                         stroke-linecap="round" stroke-linejoin="round">
-                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
-                        <polyline points="17 8 12 3 7 8"></polyline>
-                        <line x1="12" y1="3" x2="12" y2="15"></line>
-                    </svg>
-                </button>
-                <button class="btn btn-ghost btn-icon btn-sm" id="btn-settings" title="Settings">
-                    <!-- Cog icon -->
-                    <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24"
-                         fill="none" stroke="currentColor" stroke-width="2"
-                         stroke-linecap="round" stroke-linejoin="round">
-                        <circle cx="12" cy="12" r="3"></circle>
-                        <path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0
-                                 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65
-                                 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0
-                                 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9
-                                 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0
-                                 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06A1.65 1.65 0
-                                 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0
-                                 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6
-                                 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0
-                                 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65
-                                 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2
-                                 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0
-                                 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2
-                                 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65
-                                 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51
-                                 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65
-                                 1.65 0 0 0-1.51 1z"></path>
-                    </svg>
-                </button>
-            </div>
-        </aside>
-
-        <!-- ============================================================
-             Tab bar — session tabs
-             ============================================================ -->
-        <div class="tab-bar" id="tab-bar">
-            <div class="tab-list" id="tab-list">
-                <!-- Tabs are injected dynamically by JS -->
-            </div>
-            <button class="tab-new" id="btn-new-tab" title="New Tab">+</button>
-        </div>
-
-        <!-- ============================================================
-             Workspace — terminal area
-             ============================================================ -->
-        <main class="workspace" id="workspace">
-            <!-- Empty state — shown when no sessions are active -->
-            <div class="empty-state" id="empty-state">
-                <div class="empty-state-icon">
-                    <!-- Terminal icon -->
-                    <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24"
-                         fill="none" stroke="currentColor" stroke-width="1.5"
-                         stroke-linecap="round" stroke-linejoin="round">
-                        <polyline points="4 17 10 11 4 5"></polyline>
-                        <line x1="12" y1="19" x2="20" y2="19"></line>
-                    </svg>
-                </div>
-                <h2>No active sessions</h2>
-                <p>Select a connection from the sidebar or create a new one to get started.</p>
-                <div class="empty-state-actions">
-                    <button class="btn btn-primary" id="btn-empty-connect">New Connection</button>
-                    <button class="btn btn-secondary" id="btn-empty-quick">Quick Connect</button>
-                </div>
-            </div>
-
-            <!-- Session panels are injected here dynamically by tabs.js -->
-            <div id="panel-container" class="panel-container"></div>
-        </main>
-
-        <!-- ============================================================
-             Status bar
-             ============================================================ -->
-        <footer class="status-bar" id="status-bar">
-            <span id="status-connection">
-                <span class="status-dot is-disconnected"></span>
-                Disconnected
-            </span>
-            <span id="status-protocol"></span>
-            <span id="status-session-count">0 sessions</span>
-            <span class="status-spacer"></span>
-            <span id="status-vault">🔒 Locked</span>
-        </footer>
-    </div>
-
-    <!-- Modal container (dynamically populated) -->
-    <div id="modals"></div>
-
-    <!-- Notification toasts -->
-    <div id="notifications" class="notifications-container"></div>
-
-    <!-- Vendor libraries -->
-    <script src="/src/js/lib/xterm.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-fit.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-search.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-web-links.min.js"></script>
-
-    <!-- Application scripts (loaded in dependency order) -->
-    <script src="/src/js/utils.js"></script>
-    <script src="/src/js/state.js"></script>
-    <script src="/src/js/notifications.js"></script>
-    <script src="/src/js/sidebar.js"></script>
-    <script src="/src/js/tabs.js"></script>
-    <script src="/src/js/terminal.js"></script>
-    <script src="/src/js/profiles.js"></script>
-    <script src="/src/js/raw.js"></script>
-    <script src="/src/js/github.js"></script>
-    <script src="/src/js/settings.js"></script>
-    <script src="/src/js/commands.js"></script>
-    <script src="/src/js/secrets.js"></script>
-    <script src="/src/js/app.js"></script>
-</body>
-</html>

frontend/package-lock.json

@@ -1,56 +0,0 @@
-{
-  "name": "nexus-terminal-frontend",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "nexus-terminal-frontend",
-      "version": "0.1.0",
-      "hasInstallScript": true,
-      "dependencies": {
-        "xterm": "5.3.0",
-        "xterm-addon-fit": "0.8.0",
-        "xterm-addon-search": "0.13.0",
-        "xterm-addon-web-links": "0.9.0"
-      }
-    },
-    "node_modules/xterm": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/xterm/-/xterm-5.3.0.tgz",
-      "integrity": "sha512-8QqjlekLUFTrU6x7xck1MsPzPA571K5zNqWm0M0oroYEWVOptZ0+ubQSkQ3uxIEhcIHRujJy6emDWX4A7qyFzg==",
-      "deprecated": "This package is now deprecated. Move to @xterm/xterm instead.",
-      "license": "MIT"
-    },
-    "node_modules/xterm-addon-fit": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/xterm-addon-fit/-/xterm-addon-fit-0.8.0.tgz",
-      "integrity": "sha512-yj3Np7XlvxxhYF/EJ7p3KHaMt6OdwQ+HDu573Vx1lRXsVxOcnVJs51RgjZOouIZOczTsskaS+CpXspK81/DLqw==",
-      "deprecated": "This package is now deprecated. Move to @xterm/addon-fit instead.",
-      "license": "MIT",
-      "peerDependencies": {
-        "xterm": "^5.0.0"
-      }
-    },
-    "node_modules/xterm-addon-search": {
-      "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/xterm-addon-search/-/xterm-addon-search-0.13.0.tgz",
-      "integrity": "sha512-sDUwG4CnqxUjSEFh676DlS3gsh3XYCzAvBPSvJ5OPgF3MRL3iHLPfsb06doRicLC2xXNpeG2cWk8x1qpESWJMA==",
-      "deprecated": "This package is now deprecated. Move to @xterm/addon-search instead.",
-      "license": "MIT",
-      "peerDependencies": {
-        "xterm": "^5.0.0"
-      }
-    },
-    "node_modules/xterm-addon-web-links": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/xterm-addon-web-links/-/xterm-addon-web-links-0.9.0.tgz",
-      "integrity": "sha512-LIzi4jBbPlrKMZF3ihoyqayWyTXAwGfu4yprz1aK2p71e9UKXN6RRzVONR0L+Zd+Ik5tPVI9bwp9e8fDTQh49Q==",
-      "deprecated": "This package is now deprecated. Move to @xterm/addon-web-links instead.",
-      "license": "MIT",
-      "peerDependencies": {
-        "xterm": "^5.0.0"
-      }
-    }
-  }
-}

frontend/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "nexus-terminal-frontend",
-  "version": "0.1.0",
-  "private": true,
-  "description": "Frontend for Nexus Terminal desktop SSH client",
-  "scripts": {
-    "install:assets": "node scripts/copy-assets.js",
-    "build": "node scripts/build.js",
-    "dev": "node scripts/build.js --watch",
-    "postinstall": "npm run install:assets"
-  },
-  "dependencies": {
-    "xterm": "5.3.0",
-    "xterm-addon-fit": "0.8.0",
-    "xterm-addon-search": "0.13.0",
-    "xterm-addon-web-links": "0.9.0"
-  }
-}

frontend/package.json.md5

@@ -1 +0,0 @@
-a25ea4f4df93e50eb6c41092b5187a9d

frontend/scripts/build.js

@@ -1,164 +0,0 @@
-/**
- * build.js — Build script for the Nexus Terminal frontend.
- *
- * In production mode (no flags): copies vendor assets, assembles the
- * dist/ directory with all files needed by the Wails embed, and validates
- * that every required file is present.
- *
- * In watch mode (--watch): performs the same build, then watches for
- * source changes and prints a notification when files change.  Wails dev
- * mode handles the actual live-reload; this script simply keeps the
- * process alive so the frontend:dev:watcher contract is satisfied.
- */
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-const frontendDir = path.resolve(__dirname, '..');
-const distDir     = path.join(frontendDir, 'dist');
-const watchMode   = process.argv.includes('--watch');
-
-// Files that must exist after a successful build (relative to frontend/)
-const requiredFiles = [
-  'dist/index.html',
-  'dist/src/css/lib/xterm.css',
-  'dist/src/js/lib/xterm.min.js',
-  'dist/src/js/lib/xterm-addon-fit.min.js',
-  'dist/src/js/lib/xterm-addon-search.min.js',
-  'dist/src/js/lib/xterm-addon-web-links.min.js',
-];
-
-/**
- * Recursively copies a directory tree, creating parents as needed.
- */
-function copyDirSync(src, dest) {
-  fs.mkdirSync(dest, { recursive: true });
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const srcPath  = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
-    } else {
-      fs.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-
-/**
- * Removes a directory tree if it exists.
- */
-function cleanDir(dir) {
-  if (fs.existsSync(dir)) {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-/**
- * Runs the asset copy script to pull xterm files into src/js/lib/ and
- * src/css/lib/.
- */
-function copyAssets() {
-  console.log('[build] Copying vendor library assets…');
-  execSync('node scripts/copy-assets.js', {
-    cwd:   frontendDir,
-    stdio: 'inherit',
-  });
-}
-
-/**
- * Assembles the dist/ directory with everything the Wails embed needs:
- *   dist/index.html
- *   dist/src/css/  (application + lib stylesheets)
- *   dist/src/js/   (application + lib scripts)
- *   dist/src/components/  (if present)
- *   dist/src/assets/      (if present)
- */
-function buildDist() {
-  console.log('[build] Assembling dist/ directory…');
-
-  // Start fresh so stale files are removed
-  cleanDir(distDir);
-  fs.mkdirSync(distDir, { recursive: true });
-
-  // Copy the root index.html
-  fs.copyFileSync(
-    path.join(frontendDir, 'index.html'),
-    path.join(distDir, 'index.html'),
-  );
-
-  // Copy the entire src/ tree (CSS, JS, components, assets, lib files)
-  const srcDir = path.join(frontendDir, 'src');
-  if (fs.existsSync(srcDir)) {
-    copyDirSync(srcDir, path.join(distDir, 'src'));
-  }
-
-  console.log('[build] dist/ assembled.');
-}
-
-/**
- * Validates that every required file exists.
- * Returns true if all files are present.
- */
-function validate() {
-  console.log('[build] Validating required files…');
-  let valid = true;
-  for (const relPath of requiredFiles) {
-    const full = path.join(frontendDir, relPath);
-    if (!fs.existsSync(full)) {
-      console.error(`  ✗ Missing: ${relPath}`);
-      valid = false;
-    } else {
-      console.log(`  ✓ ${relPath}`);
-    }
-  }
-  return valid;
-}
-
-/**
- * Watches the src/ directory for changes (development mode).
- * Wails dev mode picks up the changes; we just keep the process alive.
- */
-function watch() {
-  const srcDir = path.join(frontendDir, 'src');
-  console.log(`[build] Watching ${srcDir} for changes…`);
-
-  // Use fs.watch recursively where supported (macOS, Windows).
-  // On Linux this falls back to non-recursive — acceptable for dev use.
-  try {
-    fs.watch(srcDir, { recursive: true }, (_event, filename) => {
-      if (filename) {
-        const stamp = new Date().toLocaleTimeString('en-GB');
-        console.log(`[build] ${stamp} — changed: ${filename}`);
-      }
-    });
-  } catch (err) {
-    console.warn('[build] Recursive watch not supported; polling fallback.');
-  }
-
-  // Prevent the process from exiting
-  setInterval(() => {}, 60_000);
-}
-
-// --- Main ---
-
-try {
-  copyAssets();
-} catch (err) {
-  console.error('[build] Asset copy failed:', err.message);
-  process.exit(1);
-}
-
-buildDist();
-
-if (!validate()) {
-  console.error('[build] Validation failed — some required files are missing.');
-  process.exit(1);
-}
-
-console.log('[build] Frontend build complete.');
-
-if (watchMode) {
-  watch();
-}

frontend/scripts/copy-assets.js

@@ -1,83 +0,0 @@
-/**
- * copy-assets.js — Copies xterm library assets from node_modules into
- * the frontend source tree so they can be served directly by Wails.
- *
- * Run automatically via the postinstall hook in package.json.
- */
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-
-const frontendDir = path.resolve(__dirname, '..');
-
-// Mapping: source (relative to node_modules) → destination (relative to frontend/)
-const assets = [
-  {
-    src:  'xterm/css/xterm.css',
-    dest: 'src/css/lib/xterm.css',
-  },
-  {
-    src:  'xterm/lib/xterm.js',
-    dest: 'src/js/lib/xterm.min.js',
-  },
-  {
-    src:  'xterm-addon-fit/lib/xterm-addon-fit.js',
-    dest: 'src/js/lib/xterm-addon-fit.min.js',
-  },
-  {
-    src:  'xterm-addon-search/lib/xterm-addon-search.js',
-    dest: 'src/js/lib/xterm-addon-search.min.js',
-  },
-  {
-    src:  'xterm-addon-web-links/lib/xterm-addon-web-links.js',
-    dest: 'src/js/lib/xterm-addon-web-links.min.js',
-  },
-];
-
-/**
- * Ensures the parent directory of the given file path exists.
- */
-function ensureDir(filePath) {
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-}
-
-/**
- * Copies a single asset, logging the result.
- */
-function copyAsset(entry) {
-  const srcPath  = path.join(frontendDir, 'node_modules', entry.src);
-  const destPath = path.join(frontendDir, entry.dest);
-
-  if (!fs.existsSync(srcPath)) {
-    console.error(`  ✗ Source not found: ${entry.src}`);
-    return false;
-  }
-
-  ensureDir(destPath);
-  fs.copyFileSync(srcPath, destPath);
-  console.log(`  ✓ ${entry.src} → ${entry.dest}`);
-  return true;
-}
-
-// --- Main ---
-
-console.log('[copy-assets] Copying xterm library files…');
-
-let failures = 0;
-for (const entry of assets) {
-  if (!copyAsset(entry)) {
-    failures++;
-  }
-}
-
-if (failures > 0) {
-  console.error(`\n[copy-assets] ${failures} file(s) could not be copied.`);
-  console.error('[copy-assets] Have you run "npm install" first?');
-  process.exit(1);
-}
-
-console.log('[copy-assets] All assets copied successfully.');

frontend/src/css/base.css

@@ -1,187 +0,0 @@
-/* ==========================================================================
-   Nexus Terminal — Base / Reset
-   Modern CSS reset and foundational element styles.
-   ========================================================================== */
-
-/* -----------------------------------------------------------------------
-   Box-model reset
-   ----------------------------------------------------------------------- */
-*,
-*::before,
-*::after {
-    box-sizing: border-box;
-    margin: 0;
-    padding: 0;
-}
-
-/* -----------------------------------------------------------------------
-   Root element
-   ----------------------------------------------------------------------- */
-html,
-body {
-    height: 100%;
-    overflow: hidden;
-    font-family: var(--font-sans);
-    font-size: var(--text-base);
-    line-height: var(--leading-normal);
-    color: var(--text-primary);
-    background: var(--bg-base);
-    -webkit-font-smoothing: antialiased;
-    -moz-osx-font-smoothing: grayscale;
-    user-select: none;
-}
-
-/* -----------------------------------------------------------------------
-   Scrollbar styling (Webkit / Blink)
-   ----------------------------------------------------------------------- */
-::-webkit-scrollbar {
-    width: 6px;
-    height: 6px;
-}
-
-::-webkit-scrollbar-track {
-    background: transparent;
-}
-
-::-webkit-scrollbar-thumb {
-    background: var(--border-strong);
-    border-radius: var(--radius-full);
-}
-
-::-webkit-scrollbar-thumb:hover {
-    background: var(--text-tertiary);
-}
-
-/* Firefox scrollbar */
-* {
-    scrollbar-width: thin;
-    scrollbar-color: var(--border-strong) transparent;
-}
-
-/* -----------------------------------------------------------------------
-   Text selection
-   ----------------------------------------------------------------------- */
-::selection {
-    background: var(--accent-strong);
-    color: var(--text-primary);
-}
-
-/* -----------------------------------------------------------------------
-   Focus management
-   ----------------------------------------------------------------------- */
-:focus-visible {
-    outline: 2px solid var(--accent);
-    outline-offset: 2px;
-}
-
-:focus:not(:focus-visible) {
-    outline: none;
-}
-
-/* -----------------------------------------------------------------------
-   Links
-   ----------------------------------------------------------------------- */
-a {
-    color: var(--accent);
-    text-decoration: none;
-    transition: color var(--transition-fast);
-}
-
-a:hover {
-    color: var(--accent-hover);
-}
-
-/* -----------------------------------------------------------------------
-   Images
-   ----------------------------------------------------------------------- */
-img,
-svg {
-    display: block;
-    max-width: 100%;
-}
-
-/* -----------------------------------------------------------------------
-   Lists
-   ----------------------------------------------------------------------- */
-ul,
-ol {
-    list-style: none;
-}
-
-/* -----------------------------------------------------------------------
-   Tables
-   ----------------------------------------------------------------------- */
-table {
-    border-collapse: collapse;
-    border-spacing: 0;
-}
-
-/* -----------------------------------------------------------------------
-   Buttons & inputs — inherit font
-   ----------------------------------------------------------------------- */
-button,
-input,
-select,
-textarea {
-    font: inherit;
-    color: inherit;
-    background: none;
-    border: none;
-}
-
-button {
-    cursor: pointer;
-}
-
-/* -----------------------------------------------------------------------
-   Monospace elements
-   ----------------------------------------------------------------------- */
-code,
-pre,
-kbd,
-.mono {
-    font-family: var(--font-mono);
-}
-
-/* -----------------------------------------------------------------------
-   Hidden utility
-   ----------------------------------------------------------------------- */
-[hidden],
-.hidden {
-    display: none !important;
-}
-
-.sr-only {
-    position: absolute;
-    width: 1px;
-    height: 1px;
-    padding: 0;
-    margin: -1px;
-    overflow: hidden;
-    clip: rect(0, 0, 0, 0);
-    white-space: nowrap;
-    border: 0;
-}
-
-/* -----------------------------------------------------------------------
-   Text utilities
-   ----------------------------------------------------------------------- */
-.truncate {
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-}
-
-.text-secondary { color: var(--text-secondary); }
-.text-tertiary  { color: var(--text-tertiary); }
-.text-accent    { color: var(--accent); }
-.text-success   { color: var(--success); }
-.text-warning   { color: var(--warning); }
-.text-error     { color: var(--error); }
-
-/* -----------------------------------------------------------------------
-   Wails window drag region
-   ----------------------------------------------------------------------- */
-.wails-drag {
-    --wails-draggable: drag;
-}

frontend/src/css/components.css

@@ -1,901 +0,0 @@
-/* ==========================================================================
-   Nexus Terminal — Reusable Components
-   Buttons, form controls, badges, dropdowns, modals, notifications, etc.
-   ========================================================================== */
-
-/* =======================================================================
-   BUTTONS
-   ======================================================================= */
-
-.btn {
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    gap: var(--space-2);
-    height: 30px;
-    padding: 0 var(--space-3);
-    font-size: var(--text-sm);
-    font-weight: var(--weight-medium);
-    line-height: 1;
-    border-radius: var(--radius-md);
-    border: 1px solid transparent;
-    cursor: pointer;
-    white-space: nowrap;
-    transition:
-        background var(--transition-fast),
-        border-color var(--transition-fast),
-        color var(--transition-fast),
-        box-shadow var(--transition-fast);
-    user-select: none;
-}
-
-.btn:disabled {
-    opacity: 0.45;
-    cursor: not-allowed;
-    pointer-events: none;
-}
-
-/* Primary — accent filled */
-.btn-primary {
-    background: var(--accent);
-    color: var(--text-inverse);
-    border-color: var(--accent);
-}
-.btn-primary:hover {
-    background: var(--accent-hover);
-    border-color: var(--accent-hover);
-}
-.btn-primary:active {
-    background: #3da69f;
-    border-color: #3da69f;
-}
-
-/* Accent — success-tinted action, e.g. "Save & Connect" */
-.btn-accent {
-    background: var(--success);
-    color: var(--text-inverse);
-    border-color: var(--success);
-}
-.btn-accent:hover {
-    background: #57a85c;
-    border-color: #57a85c;
-}
-.btn-accent:active {
-    background: #4a9a4e;
-    border-color: #4a9a4e;
-}
-
-/* Secondary — subtle border */
-.btn-secondary {
-    background: transparent;
-    color: var(--text-secondary);
-    border-color: var(--border-default);
-}
-.btn-secondary:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-    border-color: var(--border-strong);
-}
-.btn-secondary:active {
-    background: var(--bg-active);
-}
-
-/* Ghost — transparent, hover only */
-.btn-ghost {
-    background: transparent;
-    color: var(--text-secondary);
-}
-.btn-ghost:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-}
-.btn-ghost:active {
-    background: var(--bg-active);
-}
-
-/* Danger */
-.btn-danger {
-    background: transparent;
-    color: var(--error);
-    border-color: var(--error);
-}
-.btn-danger:hover {
-    background: rgba(239, 83, 80, 0.12);
-}
-.btn-danger:active {
-    background: rgba(239, 83, 80, 0.20);
-}
-
-.btn-danger-filled {
-    background: var(--error);
-    color: #fff;
-    border-color: var(--error);
-}
-.btn-danger-filled:hover {
-    background: #e53935;
-    border-color: #e53935;
-}
-
-/* Size variants */
-.btn-sm {
-    height: 26px;
-    padding: 0 var(--space-2);
-    font-size: var(--text-xs);
-}
-
-.btn-xs {
-    height: 22px;
-    padding: 0 var(--space-2);
-    font-size: var(--text-xs);
-    border-radius: var(--radius-sm);
-}
-
-/* Icon-only button (square) */
-.btn-icon {
-    width: 30px;
-    padding: 0;
-    flex-shrink: 0;
-}
-.btn-icon.btn-sm {
-    width: 26px;
-}
-.btn-icon.btn-xs {
-    width: 22px;
-}
-
-/* Button group */
-.btn-group {
-    display: inline-flex;
-}
-
-/* Outline button — transparent background, subtle border */
-.btn-outline {
-    background: transparent;
-    border: 1px solid var(--border);
-    color: var(--text-secondary);
-}
-.btn-outline:hover {
-    background: var(--surface-2);
-    color: var(--text-primary);
-}
-
-.btn-group .btn {
-    border-radius: 0;
-}
-.btn-group .btn:first-child {
-    border-radius: var(--radius-md) 0 0 var(--radius-md);
-}
-.btn-group .btn:last-child {
-    border-radius: 0 var(--radius-md) var(--radius-md) 0;
-}
-.btn-group .btn + .btn {
-    margin-left: -1px;
-}
-
-
-/* =======================================================================
-   FORM CONTROLS
-   ======================================================================= */
-
-.form-group {
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-1);
-}
-
-.form-label {
-    font-size: var(--text-sm);
-    font-weight: var(--weight-medium);
-    color: var(--text-secondary);
-    user-select: none;
-}
-
-.form-label-required::after {
-    content: ' *';
-    color: var(--error);
-}
-
-/* Text input, select, textarea share a common treatment */
-.form-input,
-.form-select,
-.form-textarea {
-    height: 30px;
-    padding: 0 var(--space-3);
-    font-size: var(--text-sm);
-    color: var(--text-primary);
-    background: var(--bg-input);
-    border: 1px solid var(--border-default);
-    border-radius: var(--radius-md);
-    transition:
-        border-color var(--transition-fast),
-        box-shadow var(--transition-fast);
-}
-
-.form-input::placeholder,
-.form-textarea::placeholder {
-    color: var(--text-disabled);
-}
-
-.form-input:hover,
-.form-select:hover,
-.form-textarea:hover {
-    border-color: var(--border-strong);
-}
-
-.form-input:focus,
-.form-select:focus,
-.form-textarea:focus {
-    border-color: var(--accent);
-    box-shadow: 0 0 0 2px var(--accent-muted);
-    outline: none;
-}
-
-.form-input:disabled,
-.form-select:disabled,
-.form-textarea:disabled {
-    opacity: 0.5;
-    cursor: not-allowed;
-}
-
-/* Select arrow */
-.form-select {
-    appearance: none;
-    padding-right: var(--space-8);
-    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='10' height='6'%3E%3Cpath d='M0 0l5 6 5-6z' fill='%236e6e88'/%3E%3C/svg%3E");
-    background-repeat: no-repeat;
-    background-position: right 10px center;
-    cursor: pointer;
-}
-
-/* Textarea */
-.form-textarea {
-    height: auto;
-    min-height: 64px;
-    padding: var(--space-2) var(--space-3);
-    resize: vertical;
-    line-height: var(--leading-normal);
-}
-
-/* Help text */
-.form-help {
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    line-height: var(--leading-normal);
-}
-
-/* Error message */
-.form-error {
-    font-size: var(--text-xs);
-    color: var(--error);
-    line-height: var(--leading-normal);
-}
-
-/* Error state on inputs */
-.form-input.is-error,
-.form-select.is-error,
-.form-textarea.is-error {
-    border-color: var(--error);
-}
-.form-input.is-error:focus,
-.form-select.is-error:focus,
-.form-textarea.is-error:focus {
-    box-shadow: 0 0 0 2px rgba(239, 83, 80, 0.20);
-}
-
-/* Inline layout (label beside control) */
-.form-inline {
-    flex-direction: row;
-    align-items: center;
-    gap: var(--space-3);
-}
-.form-inline .form-label {
-    min-width: 100px;
-    flex-shrink: 0;
-}
-
-/* Checkbox */
-.form-checkbox {
-    display: inline-flex;
-    align-items: center;
-    gap: var(--space-2);
-    cursor: pointer;
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    user-select: none;
-}
-
-.form-checkbox input[type="checkbox"] {
-    appearance: none;
-    width: 16px;
-    height: 16px;
-    border: 1px solid var(--border-strong);
-    border-radius: var(--radius-sm);
-    background: var(--bg-input);
-    flex-shrink: 0;
-    cursor: pointer;
-    transition:
-        background var(--transition-fast),
-        border-color var(--transition-fast);
-    position: relative;
-}
-
-.form-checkbox input[type="checkbox"]:checked {
-    background: var(--accent);
-    border-color: var(--accent);
-}
-
-.form-checkbox input[type="checkbox"]:checked::after {
-    content: '';
-    position: absolute;
-    top: 2px;
-    left: 5px;
-    width: 4px;
-    height: 8px;
-    border: solid var(--text-inverse);
-    border-width: 0 2px 2px 0;
-    transform: rotate(45deg);
-}
-
-.form-checkbox input[type="checkbox"]:focus-visible {
-    outline: 2px solid var(--accent);
-    outline-offset: 2px;
-}
-
-/* Toggle switch */
-.form-toggle {
-    display: inline-flex;
-    align-items: center;
-    gap: var(--space-2);
-    cursor: pointer;
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    user-select: none;
-}
-
-.form-toggle input[type="checkbox"] {
-    appearance: none;
-    width: 32px;
-    height: 18px;
-    border-radius: var(--radius-full);
-    background: var(--border-strong);
-    position: relative;
-    cursor: pointer;
-    flex-shrink: 0;
-    transition: background var(--transition-normal);
-}
-
-.form-toggle input[type="checkbox"]::after {
-    content: '';
-    position: absolute;
-    top: 2px;
-    left: 2px;
-    width: 14px;
-    height: 14px;
-    border-radius: 50%;
-    background: var(--text-secondary);
-    transition: transform var(--transition-normal), background var(--transition-normal);
-}
-
-.form-toggle input[type="checkbox"]:checked {
-    background: var(--accent);
-}
-
-.form-toggle input[type="checkbox"]:checked::after {
-    transform: translateX(14px);
-    background: var(--text-inverse);
-}
-
-
-/* =======================================================================
-   BADGES
-   ======================================================================= */
-
-.badge {
-    display: inline-flex;
-    align-items: center;
-    height: 18px;
-    padding: 0 var(--space-2);
-    font-size: 10px;
-    font-weight: var(--weight-semibold);
-    line-height: 1;
-    border-radius: var(--radius-sm);
-    white-space: nowrap;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-    background: var(--bg-overlay);
-    color: var(--text-secondary);
-}
-
-/* Protocol badges */
-.badge-ssh {
-    background: rgba(78, 205, 196, 0.15);
-    color: var(--protocol-ssh);
-}
-.badge-telnet {
-    background: rgba(255, 167, 38, 0.15);
-    color: var(--protocol-telnet);
-}
-.badge-raw {
-    background: rgba(171, 71, 188, 0.15);
-    color: var(--protocol-raw);
-}
-.badge-github {
-    background: rgba(124, 138, 255, 0.15);
-    color: var(--protocol-github);
-}
-
-/* Status badges */
-.badge-status {
-    gap: var(--space-1);
-}
-.badge-status::before {
-    content: '';
-    width: 6px;
-    height: 6px;
-    border-radius: 50%;
-    background: var(--text-tertiary);
-    flex-shrink: 0;
-}
-.badge-status.is-connected::before    { background: var(--success); }
-.badge-status.is-connecting::before   { background: var(--warning); animation: pulse-dot 1.2s ease infinite; }
-.badge-status.is-error::before        { background: var(--error); }
-.badge-status.is-disconnected::before { background: var(--text-tertiary); }
-
-@keyframes pulse-dot {
-    0%, 100% { opacity: 1; }
-    50%      { opacity: 0.4; }
-}
-
-
-/* =======================================================================
-   CARDS & SURFACES
-   ======================================================================= */
-
-.surface {
-    background: var(--bg-elevated);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-lg);
-    box-shadow: var(--shadow-sm);
-}
-
-.card {
-    background: var(--bg-elevated);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-lg);
-    padding: var(--space-4);
-    cursor: pointer;
-    transition:
-        background var(--transition-fast),
-        border-color var(--transition-fast),
-        box-shadow var(--transition-fast);
-}
-.card:hover {
-    background: var(--bg-hover);
-    border-color: var(--border-default);
-    box-shadow: var(--shadow-md);
-}
-.card:active {
-    background: var(--bg-active);
-}
-
-
-/* =======================================================================
-   DROPDOWN / CONTEXT MENU
-   ======================================================================= */
-
-.dropdown {
-    position: relative;
-    display: inline-flex;
-}
-
-.dropdown-menu {
-    position: absolute;
-    top: 100%;
-    left: 0;
-    z-index: var(--z-dropdown);
-    min-width: 160px;
-    padding: var(--space-1) 0;
-    background: var(--bg-overlay);
-    border: 1px solid var(--border-default);
-    border-radius: var(--radius-md);
-    box-shadow: var(--shadow-lg);
-    opacity: 0;
-    visibility: hidden;
-    transform: translateY(-4px);
-    transition:
-        opacity var(--transition-fast),
-        visibility var(--transition-fast),
-        transform var(--transition-fast);
-}
-
-.dropdown.is-open .dropdown-menu,
-.dropdown-menu.is-visible {
-    opacity: 1;
-    visibility: visible;
-    transform: translateY(2px);
-}
-
-/* Right-aligned variant */
-.dropdown-menu.is-right {
-    left: auto;
-    right: 0;
-}
-
-.dropdown-item {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    width: 100%;
-    padding: var(--space-1) var(--space-3);
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    cursor: pointer;
-    transition: background var(--transition-fast), color var(--transition-fast);
-    border: none;
-    background: none;
-    text-align: left;
-}
-
-.dropdown-item:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-}
-
-.dropdown-item.is-danger {
-    color: var(--error);
-}
-.dropdown-item.is-danger:hover {
-    background: rgba(239, 83, 80, 0.10);
-}
-
-.dropdown-item.is-disabled {
-    opacity: 0.4;
-    pointer-events: none;
-}
-
-.dropdown-item-icon {
-    width: 16px;
-    text-align: center;
-    flex-shrink: 0;
-    font-size: var(--text-md);
-}
-
-.dropdown-item-shortcut {
-    margin-left: auto;
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-}
-
-.dropdown-separator {
-    height: 1px;
-    margin: var(--space-1) 0;
-    background: var(--border-subtle);
-}
-
-.dropdown-header {
-    padding: var(--space-1) var(--space-3);
-    font-size: var(--text-xs);
-    font-weight: var(--weight-semibold);
-    color: var(--text-tertiary);
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-}
-
-
-/* =======================================================================
-   NOTIFICATIONS (toast)
-   ======================================================================= */
-
-.notifications-container {
-    position: fixed;
-    top: var(--space-4);
-    right: var(--space-4);
-    z-index: var(--z-notification);
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-2);
-    pointer-events: none;
-}
-
-.notification {
-    display: flex;
-    align-items: flex-start;
-    gap: var(--space-3);
-    min-width: 280px;
-    max-width: 400px;
-    padding: var(--space-3) var(--space-4);
-    background: var(--bg-overlay);
-    border: 1px solid var(--border-default);
-    border-radius: var(--radius-lg);
-    box-shadow: var(--shadow-xl);
-    pointer-events: auto;
-    animation: notification-in var(--transition-slow) ease forwards;
-}
-
-.notification.is-leaving {
-    animation: notification-out var(--transition-normal) ease forwards;
-}
-
-@keyframes notification-in {
-    from { opacity: 0; transform: translateX(20px); }
-    to   { opacity: 1; transform: translateX(0); }
-}
-@keyframes notification-out {
-    from { opacity: 1; transform: translateX(0); }
-    to   { opacity: 0; transform: translateX(20px); }
-}
-
-.notification-icon {
-    flex-shrink: 0;
-    width: 20px;
-    height: 20px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    border-radius: 50%;
-    font-size: 11px;
-    font-weight: var(--weight-bold);
-    line-height: 1;
-    color: var(--text-inverse);
-    background: var(--text-tertiary);
-}
-
-.notification-success .notification-icon { background: var(--success); }
-.notification-error .notification-icon   { background: var(--error); }
-.notification-warning .notification-icon { background: var(--warning); }
-.notification-info .notification-icon    { background: var(--info); }
-
-.notification-body {
-    flex: 1;
-    min-width: 0;
-}
-
-.notification-title {
-    font-size: var(--text-sm);
-    font-weight: var(--weight-semibold);
-    color: var(--text-primary);
-    margin-bottom: 2px;
-}
-
-.notification-message {
-    font-size: var(--text-xs);
-    color: var(--text-secondary);
-    line-height: var(--leading-normal);
-}
-
-.notification-close {
-    flex-shrink: 0;
-    width: 20px;
-    height: 20px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    border-radius: var(--radius-sm);
-    color: var(--text-tertiary);
-    cursor: pointer;
-    transition: background var(--transition-fast), color var(--transition-fast);
-}
-.notification-close:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-}
-
-/* Colour variants (left border accent) */
-.notification-success { border-left: 3px solid var(--success); }
-.notification-error   { border-left: 3px solid var(--error); }
-.notification-warning { border-left: 3px solid var(--warning); }
-.notification-info    { border-left: 3px solid var(--info); }
-
-
-/* =======================================================================
-   DISCLOSURE / ACCORDION
-   ======================================================================= */
-
-.disclosure {
-    border-bottom: 1px solid var(--border-subtle);
-}
-
-.disclosure-header {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    width: 100%;
-    padding: var(--space-3) var(--space-4);
-    font-size: var(--text-sm);
-    font-weight: var(--weight-medium);
-    color: var(--text-secondary);
-    cursor: pointer;
-    transition: background var(--transition-fast), color var(--transition-fast);
-    user-select: none;
-    text-align: left;
-    background: none;
-    border: none;
-}
-
-.disclosure-header:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-}
-
-.disclosure-chevron {
-    width: 16px;
-    height: 16px;
-    flex-shrink: 0;
-    transition: transform var(--transition-normal);
-    color: var(--text-tertiary);
-}
-
-.disclosure.is-open .disclosure-chevron {
-    transform: rotate(90deg);
-}
-
-.disclosure-content {
-    overflow: hidden;
-    max-height: 0;
-    transition: max-height var(--transition-slow);
-}
-
-.disclosure.is-open .disclosure-content {
-    max-height: 2000px;
-}
-
-.disclosure-content-inner {
-    padding: 0 var(--space-4) var(--space-4);
-}
-
-
-/* =======================================================================
-   SEARCH INPUT
-   ======================================================================= */
-
-.search-input {
-    width: 100%;
-    height: 30px;
-    padding: 0 var(--space-3) 0 var(--space-8);
-    font-size: var(--text-sm);
-    color: var(--text-primary);
-    background: var(--bg-input);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-md);
-    transition: border-color var(--transition-fast), box-shadow var(--transition-fast);
-}
-
-.search-input::placeholder {
-    color: var(--text-disabled);
-}
-
-.search-input:hover {
-    border-color: var(--border-default);
-}
-
-.search-input:focus {
-    border-color: var(--accent);
-    box-shadow: 0 0 0 2px var(--accent-muted);
-    outline: none;
-}
-
-/* Wrapper with icon */
-.search-wrapper {
-    position: relative;
-}
-
-.search-wrapper::before {
-    content: '⌕';
-    position: absolute;
-    left: var(--space-3);
-    top: 50%;
-    transform: translateY(-50%);
-    font-size: var(--text-sm);
-    color: var(--text-tertiary);
-    pointer-events: none;
-}
-
-
-/* =======================================================================
-   EMPTY STATE
-   ======================================================================= */
-
-.empty-state {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    justify-content: center;
-    flex: 1;
-    padding: var(--space-8);
-    text-align: center;
-}
-
-.empty-state-icon {
-    font-size: 48px;
-    color: var(--text-tertiary);
-    margin-bottom: var(--space-4);
-    opacity: 0.5;
-}
-
-.empty-state h2 {
-    font-size: var(--text-lg);
-    font-weight: var(--weight-semibold);
-    color: var(--text-secondary);
-    margin-bottom: var(--space-2);
-}
-
-.empty-state p {
-    font-size: var(--text-sm);
-    color: var(--text-tertiary);
-    max-width: 320px;
-    line-height: var(--leading-relaxed);
-    margin-bottom: var(--space-6);
-}
-
-.empty-state-actions {
-    display: flex;
-    gap: var(--space-3);
-}
-
-
-/* =======================================================================
-   TOOLTIP
-   ======================================================================= */
-
-.tooltip {
-    position: absolute;
-    z-index: var(--z-tooltip);
-    padding: var(--space-1) var(--space-2);
-    font-size: var(--text-xs);
-    font-weight: var(--weight-medium);
-    color: var(--text-primary);
-    background: var(--bg-overlay);
-    border: 1px solid var(--border-default);
-    border-radius: var(--radius-sm);
-    box-shadow: var(--shadow-md);
-    white-space: nowrap;
-    pointer-events: none;
-    opacity: 0;
-    transition: opacity var(--transition-fast);
-}
-
-.tooltip.is-visible {
-    opacity: 1;
-}
-
-
-/* =======================================================================
-   DIVIDER
-   ======================================================================= */
-
-.divider {
-    height: 1px;
-    background: var(--border-subtle);
-    margin: var(--space-2) 0;
-}
-
-.divider-vertical {
-    width: 1px;
-    align-self: stretch;
-    background: var(--border-subtle);
-    margin: 0 var(--space-2);
-}
-
-
-/* =======================================================================
-   LOADING / SPINNER
-   ======================================================================= */
-
-.spinner {
-    width: 16px;
-    height: 16px;
-    border: 2px solid var(--border-strong);
-    border-top-color: var(--accent);
-    border-radius: 50%;
-    animation: spin 0.6s linear infinite;
-}
-
-.spinner-sm {
-    width: 12px;
-    height: 12px;
-    border-width: 1.5px;
-}
-
-@keyframes spin {
-    to { transform: rotate(360deg); }
-}

frontend/src/css/forms.css

@@ -1,519 +0,0 @@
-/* ==========================================================================
-   Nexus Terminal — Profile Editor & Form Polish
-   Section headers, grouped fields, protocol-specific visibility,
-   inline validation, tag input, jump host list, key file selector.
-   ========================================================================== */
-
-/* -----------------------------------------------------------------------
-   Form panel (profile editor container)
-   ----------------------------------------------------------------------- */
-.form-panel {
-    display: flex;
-    flex-direction: column;
-    height: 100%;
-    overflow: hidden;
-}
-
-.form-panel-header {
-    display: flex;
-    align-items: center;
-    gap: var(--space-3);
-    padding: var(--space-3) var(--space-4);
-    border-bottom: 1px solid var(--border-subtle);
-    flex-shrink: 0;
-}
-
-.form-panel-title {
-    font-size: var(--text-md);
-    font-weight: var(--weight-semibold);
-    color: var(--text-primary);
-    flex: 1;
-}
-
-.form-panel-body {
-    flex: 1;
-    overflow-y: auto;
-    padding: var(--space-4);
-}
-
-.form-panel-footer {
-    display: flex;
-    align-items: center;
-    justify-content: flex-end;
-    gap: var(--space-2);
-    padding: var(--space-3) var(--space-4);
-    border-top: 1px solid var(--border-subtle);
-    flex-shrink: 0;
-}
-
-/* -----------------------------------------------------------------------
-   Form sections (disclosure-based grouping)
-   ----------------------------------------------------------------------- */
-.form-section {
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-lg);
-    margin-bottom: var(--space-4);
-    overflow: hidden;
-}
-
-.form-section-header {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    width: 100%;
-    padding: var(--space-3) var(--space-4);
-    font-size: var(--text-sm);
-    font-weight: var(--weight-semibold);
-    color: var(--text-primary);
-    cursor: pointer;
-    user-select: none;
-    -webkit-user-select: none;
-    background: var(--bg-elevated);
-    border: none;
-    cursor: pointer;
-    user-select: none;
-    text-align: left;
-    transition: background var(--transition-fast);
-}
-
-.form-section-header:hover {
-    background: var(--bg-hover);
-}
-
-.form-section-chevron {
-    width: 14px;
-    height: 14px;
-    color: var(--text-tertiary);
-    transition: transform var(--transition-normal);
-    flex-shrink: 0;
-}
-
-.form-section.is-open .form-section-chevron {
-    transform: rotate(90deg);
-}
-
-.form-section-icon {
-    width: 16px;
-    text-align: center;
-    flex-shrink: 0;
-    font-size: var(--text-sm);
-    color: var(--text-tertiary);
-}
-
-.form-section-body,
-.form-section-content {
-    padding: var(--space-4);
-    display: none;
-}
-
-.form-section.is-open .form-section-body,
-.form-section.is-open .form-section-content {
-    display: block;
-}
-
-/* -----------------------------------------------------------------------
-   Field grid (two-column layout for compact forms)
-   ----------------------------------------------------------------------- */
-.form-fields {
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-3);
-}
-
-.form-row {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: var(--space-3);
-}
-
-/* Single-column override */
-.form-row.full-width {
-    grid-template-columns: 1fr;
-}
-
-/* Three-column for port + protocol combos */
-.form-row.triple {
-    grid-template-columns: 1fr 100px 120px;
-}
-
-/* -----------------------------------------------------------------------
-   Protocol-specific field visibility
-   Fields are hidden unless their protocol class is active.
-   ----------------------------------------------------------------------- */
-.proto-only-ssh,
-.proto-only-telnet,
-.proto-only-raw {
-    display: none;
-}
-
-.protocol-ssh .proto-only-ssh,
-.protocol-telnet .proto-only-telnet,
-.protocol-raw .proto-only-raw,
-.protocol-github .proto-only-github {
-    display: flex;
-}
-
-/* For block-level protocol fields */
-.protocol-ssh .proto-only-ssh.form-section,
-.protocol-telnet .proto-only-telnet.form-section,
-.protocol-raw .proto-only-raw.form-section,
-.protocol-github .proto-only-github.form-section {
-    display: block;
-}
-
-/* -----------------------------------------------------------------------
-   Tag input
-   ----------------------------------------------------------------------- */
-.tag-input-wrapper {
-    display: flex;
-    flex-wrap: wrap;
-    align-items: center;
-    gap: var(--space-1);
-    min-height: 30px;
-    padding: var(--space-1) var(--space-2);
-    background: var(--bg-input);
-    border: 1px solid var(--border-default);
-    border-radius: var(--radius-md);
-    cursor: text;
-    transition: border-color var(--transition-fast);
-}
-
-.tag-input-wrapper:hover {
-    border-color: var(--border-strong);
-}
-
-.tag-input-wrapper:focus-within {
-    border-color: var(--accent);
-    box-shadow: 0 0 0 2px var(--accent-muted);
-}
-
-.tag-item {
-    display: inline-flex;
-    align-items: center;
-    gap: 3px;
-    height: 20px;
-    padding: 0 var(--space-2);
-    font-size: var(--text-xs);
-    color: var(--accent);
-    background: var(--accent-muted);
-    border-radius: var(--radius-sm);
-    white-space: nowrap;
-}
-
-.tag-item-remove {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    width: 12px;
-    height: 12px;
-    font-size: 10px;
-    cursor: pointer;
-    border-radius: 50%;
-    color: var(--accent);
-    transition: background var(--transition-fast);
-}
-
-.tag-item-remove:hover {
-    background: var(--accent-strong);
-}
-
-.tag-input {
-    flex: 1;
-    min-width: 60px;
-    border: none;
-    background: transparent;
-    font-size: var(--text-sm);
-    color: var(--text-primary);
-    outline: none;
-    height: 22px;
-}
-
-.tag-input::placeholder {
-    color: var(--text-disabled);
-}
-
-/* -----------------------------------------------------------------------
-   Jump host / proxy list
-   ----------------------------------------------------------------------- */
-.jump-host-list {
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-2);
-}
-
-.jump-host-item {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    padding: var(--space-2) var(--space-3);
-    background: var(--bg-input);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-md);
-    font-size: var(--text-sm);
-}
-
-.jump-host-item .jump-host-order {
-    font-size: var(--text-xs);
-    color: var(--text-disabled);
-    min-width: 16px;
-    text-align: center;
-}
-
-.jump-host-item .jump-host-value {
-    flex: 1;
-    font-family: var(--font-mono);
-    color: var(--text-secondary);
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-}
-
-.jump-host-item .jump-host-actions {
-    display: flex;
-    gap: var(--space-1);
-    opacity: 0;
-    transition: opacity var(--transition-fast);
-}
-
-.jump-host-item:hover .jump-host-actions {
-    opacity: 1;
-}
-
-.jump-host-add {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    padding: var(--space-2);
-    font-size: var(--text-sm);
-    color: var(--text-tertiary);
-    border: 1px dashed var(--border-default);
-    border-radius: var(--radius-md);
-    cursor: pointer;
-    transition: border-color var(--transition-fast), color var(--transition-fast);
-}
-
-.jump-host-add:hover {
-    border-color: var(--accent);
-    color: var(--accent);
-}
-
-/* -----------------------------------------------------------------------
-   Key file selector row
-   ----------------------------------------------------------------------- */
-.file-selector {
-    display: flex;
-    gap: var(--space-2);
-}
-
-.file-selector .form-input {
-    flex: 1;
-}
-
-.file-selector .btn {
-    flex-shrink: 0;
-}
-
-/* File path display */
-.file-path {
-    font-family: var(--font-mono);
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    background: var(--bg-input);
-    padding: var(--space-1) var(--space-2);
-    border-radius: var(--radius-sm);
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-}
-
-/* -----------------------------------------------------------------------
-   Inline validation
-   ----------------------------------------------------------------------- */
-.form-group.is-valid .form-input {
-    border-color: var(--success);
-}
-
-.form-group.is-valid .form-input:focus {
-    box-shadow: 0 0 0 2px rgba(102, 187, 106, 0.20);
-}
-
-.form-group.is-invalid .form-input {
-    border-color: var(--error);
-}
-
-.form-group.is-invalid .form-input:focus {
-    box-shadow: 0 0 0 2px rgba(239, 83, 80, 0.20);
-}
-
-.form-validation-icon {
-    position: absolute;
-    right: var(--space-3);
-    top: 50%;
-    transform: translateY(-50%);
-    font-size: var(--text-sm);
-}
-
-.form-group.is-valid .form-validation-icon   { color: var(--success); }
-.form-group.is-invalid .form-validation-icon { color: var(--error); }
-
-/* -----------------------------------------------------------------------
-   Help text under sections
-   ----------------------------------------------------------------------- */
-.form-section-help {
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    padding: 0 var(--space-4) var(--space-3);
-    line-height: var(--leading-relaxed);
-}
-
-/* -----------------------------------------------------------------------
-   Colour preview (for terminal colour settings)
-   ----------------------------------------------------------------------- */
-.colour-preview {
-    display: inline-block;
-    width: 18px;
-    height: 18px;
-    border-radius: var(--radius-sm);
-    border: 1px solid var(--border-default);
-    vertical-align: middle;
-    cursor: pointer;
-}
-
-/* -----------------------------------------------------------------------
-   Number input with stepper
-   ----------------------------------------------------------------------- */
-.form-number {
-    display: flex;
-    align-items: center;
-}
-
-.form-number .form-input {
-    border-radius: var(--radius-md) 0 0 var(--radius-md);
-    text-align: center;
-    width: 60px;
-    /* Hide browser spinners */
-    -moz-appearance: textfield;
-}
-.form-number .form-input::-webkit-inner-spin-button,
-.form-number .form-input::-webkit-outer-spin-button {
-    appearance: none;
-}
-
-.form-number-btn {
-    width: 24px;
-    height: 30px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    background: var(--bg-input);
-    border: 1px solid var(--border-default);
-    border-left: none;
-    cursor: pointer;
-    transition: background var(--transition-fast), color var(--transition-fast);
-}
-
-.form-number-btn:last-child {
-    border-radius: 0 var(--radius-md) var(--radius-md) 0;
-}
-
-.form-number-btn:hover {
-    background: var(--bg-hover);
-    color: var(--text-primary);
-}
-
-/* -----------------------------------------------------------------------
-   Form action row (test connection, etc.)
-   ----------------------------------------------------------------------- */
-.form-actions-inline {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    padding-top: var(--space-3);
-    border-top: 1px solid var(--border-subtle);
-    margin-top: var(--space-3);
-}
-
-.form-actions-inline .btn {
-    flex-shrink: 0;
-}
-
-.form-actions-inline .form-actions-status {
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    flex: 1;
-}
-
-/* -----------------------------------------------------------------------
-   Form hint — inline help text below fields
-   ----------------------------------------------------------------------- */
-.form-hint {
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    margin-top: var(--space-1);
-    line-height: var(--leading-relaxed);
-}
-
-.form-hint.secret-error {
-    color: var(--danger);
-}
-
-/* -----------------------------------------------------------------------
-   Toggle wrapper — label + toggle switch in a row
-   ----------------------------------------------------------------------- */
-.form-toggle-wrapper {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: var(--space-3);
-    padding: var(--space-1) 0;
-}
-
-.form-toggle-label {
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    flex: 1;
-}
-
-/* -----------------------------------------------------------------------
-   Jump host rows
-   ----------------------------------------------------------------------- */
-.jump-hosts-list {
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-2);
-}
-
-.jump-host-row {
-    display: grid;
-    grid-template-columns: 1fr 80px 1fr auto;
-    gap: var(--space-2);
-    align-items: center;
-}
-
-/* -----------------------------------------------------------------------
-   Payload preset rows
-   ----------------------------------------------------------------------- */
-.payload-presets-list {
-    display: flex;
-    flex-direction: column;
-    gap: var(--space-2);
-}
-
-.preset-row {
-    display: grid;
-    grid-template-columns: 120px 1fr 100px auto;
-    gap: var(--space-2);
-    align-items: center;
-}
-
-/* -----------------------------------------------------------------------
-   Small / compact form controls — used inside repeater rows
-   ----------------------------------------------------------------------- */
-.form-input-sm,
-.form-select-sm {
-    font-size: var(--text-xs);
-    padding: var(--space-1) var(--space-2);
-    height: 30px;
-}

frontend/src/css/github.css

@@ -1,266 +0,0 @@
-/* =========================================================================
-   GitHub Repository Viewer
-   Styles for the non-terminal GitHub connection panel.
-   ========================================================================= */
-
-.github-viewer {
-    display: flex;
-    flex-direction: column;
-    height: 100%;
-    background: var(--bg-primary);
-    color: var(--text-primary);
-    font-family: var(--font-family);
-}
-
-/* ── Header bar ────────────────────────────────────────────────────────── */
-
-.github-viewer-header {
-    display: flex;
-    align-items: center;
-    gap: var(--space-3);
-    padding: var(--space-3) var(--space-4) var(--space-3) var(--space-5);
-    background: var(--bg-secondary);
-    border-bottom: 1px solid var(--border-subtle);
-    flex-shrink: 0;
-}
-
-.github-viewer-title-area {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    flex-shrink: 0;
-}
-
-.github-viewer-icon {
-    display: flex;
-    align-items: center;
-    color: var(--protocol-github);
-    opacity: 0.9;
-}
-
-.github-viewer-title {
-    font-size: var(--font-size-lg);
-    font-weight: 600;
-    color: var(--text-primary);
-    white-space: nowrap;
-}
-
-.github-viewer-search {
-    flex: 1;
-    max-width: 360px;
-}
-
-.github-viewer-search-input {
-    width: 100%;
-    padding: var(--space-1) var(--space-3);
-    background: var(--bg-tertiary);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-sm);
-    color: var(--text-primary);
-    font-size: var(--font-size-sm);
-    outline: none;
-    transition: border-color 0.15s;
-}
-
-.github-viewer-search-input:focus {
-    border-color: var(--protocol-github);
-}
-
-.github-viewer-search-input::placeholder {
-    color: var(--text-muted);
-}
-
-.github-viewer-refresh {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    width: 32px;
-    height: 32px;
-    background: var(--bg-tertiary);
-    border: 1px solid var(--border-subtle);
-    border-radius: var(--radius-sm);
-    color: var(--text-secondary);
-    font-size: 16px;
-    cursor: pointer;
-    transition: all 0.15s;
-    flex-shrink: 0;
-}
-
-.github-viewer-refresh:hover {
-    background: var(--bg-hover);
-    color: var(--protocol-github);
-    border-color: var(--protocol-github);
-}
-
-/* ── Status bar ────────────────────────────────────────────────────────── */
-
-.github-viewer-status {
-    padding: var(--space-1) var(--space-4) var(--space-1) var(--space-5);
-    font-size: var(--font-size-xs);
-    color: var(--text-muted);
-    background: var(--bg-secondary);
-    border-bottom: 1px solid var(--border-subtle);
-    flex-shrink: 0;
-}
-
-.github-viewer-status-error {
-    color: var(--red);
-}
-
-/* ── Repo list ─────────────────────────────────────────────────────────── */
-
-.github-viewer-list {
-    flex: 1;
-    overflow-y: auto;
-    padding: var(--space-3) var(--space-4) var(--space-3) var(--space-5);
-}
-
-.github-viewer-empty {
-    padding: var(--space-8) var(--space-4);
-    text-align: center;
-    color: var(--text-muted);
-    font-size: var(--font-size-sm);
-}
-
-/* ── Group ─────────────────────────────────────────────────────────────── */
-
-.github-group {
-    margin-bottom: var(--space-4);
-}
-
-.github-group-header {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    padding: var(--space-1) 0;
-    margin-bottom: var(--space-2);
-    border-bottom: 1px solid var(--border-subtle);
-}
-
-.github-group-name {
-    font-size: var(--font-size-sm);
-    font-weight: 600;
-    color: var(--text-secondary);
-    text-transform: none;
-    letter-spacing: 0.01em;
-}
-
-.github-group-count {
-    font-size: var(--font-size-xs);
-    color: var(--text-muted);
-    background: var(--bg-tertiary);
-    padding: 1px 6px;
-    border-radius: var(--radius-full);
-}
-
-/* ── Repo card ─────────────────────────────────────────────────────────── */
-
-.github-repo-card {
-    padding: var(--space-2) var(--space-3);
-    margin-bottom: 2px;
-    border-radius: var(--radius-sm);
-    cursor: pointer;
-    transition: background 0.12s;
-}
-
-.github-repo-card:hover {
-    background: var(--bg-hover);
-}
-
-.github-repo-top {
-    display: flex;
-    align-items: center;
-    gap: var(--space-2);
-    margin-bottom: 2px;
-}
-
-.github-repo-name {
-    font-size: var(--font-size-sm);
-    font-weight: 600;
-    color: var(--protocol-github);
-}
-
-.github-repo-badge {
-    font-size: 10px;
-    padding: 0 5px;
-    border-radius: var(--radius-full);
-    line-height: 16px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.03em;
-}
-
-.github-repo-private {
-    background: rgba(255, 167, 38, 0.12);
-    color: #ffa726;
-}
-
-.github-repo-fork {
-    background: rgba(78, 205, 196, 0.12);
-    color: #4ecdc4;
-}
-
-.github-repo-archived {
-    background: rgba(255, 255, 255, 0.06);
-    color: var(--text-muted);
-}
-
-.github-repo-desc {
-    font-size: var(--font-size-xs);
-    color: var(--text-secondary);
-    line-height: 1.4;
-    margin-bottom: 4px;
-    display: -webkit-box;
-    -webkit-line-clamp: 2;
-    -webkit-box-orient: vertical;
-    overflow: hidden;
-}
-
-.github-repo-meta {
-    display: flex;
-    align-items: center;
-    gap: var(--space-3);
-    font-size: 11px;
-    color: var(--text-muted);
-}
-
-.github-repo-lang {
-    display: flex;
-    align-items: center;
-    gap: 4px;
-}
-
-.github-lang-dot {
-    width: 8px;
-    height: 8px;
-    border-radius: 50%;
-    display: inline-block;
-    flex-shrink: 0;
-}
-
-.github-repo-stars {
-    /* Star colour is inherent in the text */
-}
-
-.github-repo-pushed {
-    /* Relative time text */
-}
-
-/* ── Scrollbar styling ─────────────────────────────────────────────────── */
-
-.github-viewer-list::-webkit-scrollbar {
-    width: 6px;
-}
-
-.github-viewer-list::-webkit-scrollbar-track {
-    background: transparent;
-}
-
-.github-viewer-list::-webkit-scrollbar-thumb {
-    background: var(--scrollbar-thumb);
-    border-radius: 3px;
-}
-
-.github-viewer-list::-webkit-scrollbar-thumb:hover {
-    background: var(--scrollbar-thumb-hover);
-}

frontend/src/css/layout.css

@@ -1,155 +0,0 @@
-/* ==========================================================================
-   Nexus Terminal — Application Layout
-   Grid shell, sidebar, tab bar, workspace, and status bar structure.
-   ========================================================================== */
-
-/* -----------------------------------------------------------------------
-   Main application grid
-   ----------------------------------------------------------------------- */
-.app {
-    display: grid;
-    grid-template-columns: var(--sidebar-width) 1fr;
-    grid-template-rows: var(--tab-bar-height) 1fr var(--status-bar-height);
-    height: 100vh;
-    overflow: hidden;
-    background: var(--bg-base);
-}
-
-/* Collapsed sidebar variant */
-.app.sidebar-collapsed {
-    grid-template-columns: var(--sidebar-width-collapsed) 1fr;
-}
-
-/* -----------------------------------------------------------------------
-   Sidebar
-   ----------------------------------------------------------------------- */
-.sidebar {
-    grid-row: 1 / -1;
-    grid-column: 1;
-    background: var(--bg-surface);
-    border-right: 1px solid var(--border-subtle);
-    display: flex;
-    flex-direction: column;
-    overflow: hidden;
-    z-index: var(--z-sticky);
-}
-
-/* -----------------------------------------------------------------------
-   Tab bar
-   ----------------------------------------------------------------------- */
-.tab-bar {
-    grid-column: 2;
-    grid-row: 1;
-    background: var(--bg-surface);
-    border-bottom: 1px solid var(--border-subtle);
-    display: flex;
-    align-items: center;
-    min-height: var(--tab-bar-height);
-    overflow: hidden;
-}
-
-.tab-list {
-    display: flex;
-    align-items: center;
-    flex: 1;
-    min-width: 0;
-    overflow-x: auto;
-    overflow-y: hidden;
-    scrollbar-width: none;          /* Firefox */
-}
-.tab-list::-webkit-scrollbar {
-    display: none;
-}
-
-/* -----------------------------------------------------------------------
-   Workspace
-   ----------------------------------------------------------------------- */
-.workspace {
-    grid-column: 2;
-    grid-row: 2;
-    position: relative;
-    overflow: hidden;
-    background: var(--bg-base);
-    display: flex;
-    flex-direction: column;
-}
-
-/* Panel container — fills workspace, holds session panels */
-.panel-container {
-    flex: 1;
-    position: relative;
-    overflow: hidden;
-}
-
-/* Individual session panel — one per tab, fills the panel container */
-.session-panel {
-    position: absolute;
-    inset: 0;
-    display: flex;
-    flex-direction: column;
-    overflow: hidden;
-}
-
-/* Terminal container — fills workspace */
-.terminal-container {
-    position: absolute;
-    inset: 0;
-    padding: var(--space-1);
-}
-
-/* -----------------------------------------------------------------------
-   Status bar
-   ----------------------------------------------------------------------- */
-.status-bar {
-    grid-column: 2;
-    grid-row: 3;
-    background: var(--bg-surface);
-    border-top: 1px solid var(--border-subtle);
-    display: flex;
-    align-items: center;
-    padding: 0 var(--space-3);
-    font-size: var(--text-xs);
-    color: var(--text-tertiary);
-    gap: var(--space-4);
-    white-space: nowrap;
-    overflow: hidden;
-}
-
-.status-bar span {
-    display: inline-flex;
-    align-items: center;
-    gap: var(--space-1);
-}
-
-.status-spacer {
-    flex: 1;
-}
-
-/* Status bar indicator dots */
-.status-bar .status-dot {
-    width: 6px;
-    height: 6px;
-    border-radius: 50%;
-    display: inline-block;
-}
-.status-dot.is-connected    { background: var(--success); }
-.status-dot.is-connecting   { background: var(--warning); }
-.status-dot.is-error        { background: var(--error); }
-.status-dot.is-disconnected { background: var(--text-tertiary); }
-
-/* -----------------------------------------------------------------------
-   Resize handle (between sidebar and workspace)
-   ----------------------------------------------------------------------- */
-.resize-handle {
-    position: absolute;
-    top: 0;
-    right: -3px;
-    width: 6px;
-    height: 100%;
-    cursor: col-resize;
-    z-index: var(--z-sticky);
-}
-.resize-handle:hover,
-.resize-handle.is-dragging {
-    background: var(--accent-muted);
-}