docs: illustrated LaTeX user guide (docs/guide) with generated screenshots

The defaults still pointed at a stale dixon.cx placeholder from before
the rebrand. Releases are now published under
https://alchementary.co.uk/download/link, so future release.sh runs
without an explicit LINK_UPDATE_URL/LINK_RELEASE_BASE_URL embed the
real update-check and download URLs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n

.github/copilot-instructions.md

@@ -1,109 +1,86 @@
 # Copilot Instructions — Nexus Terminal
 
+Nexus Terminal is a native desktop client (SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub, local shell) written in Rust with an eframe/egui UI. All the code lives in the Cargo workspace under `rust/`.
+
 ## Build & Test
 
 ```bash
-make deps              # go mod download + npm install
-make build             # production build → build/bin/nexus-terminal.app
-make dev               # wails dev with hot reload
-make test              # go test ./... -v -count=1
-make lint              # golangci-lint run ./...
+cd rust
+cargo run --release                                     # the app (binary `nexus-terminal`)
+cargo test --workspace                                  # unit and integration tests
+cargo clippy --workspace --all-targets -- -D warnings   # must be clean
+cargo fmt --all --check                                 # must be clean
 
-# Single package test
-go test ./internal/storage/ -v -count=1 -run TestProfileCRUD
+# Single test
+cargo test -p nexus-core --lib storage::
+cargo test -p nexus-core --test ssh_integration
 ```
 
-The frontend has no separate build step — `npm run build` (called by Wails) copies xterm vendor libs from `node_modules` into `frontend/src/js/lib/` and `frontend/src/css/lib/`. All frontend assets are embedded at compile time via `frontend/embed.go`.
+CI (`.github/workflows/ci.yml`) runs `cargo test --locked`, `cargo fmt --check` and `cargo clippy --all-targets -D warnings` on Linux, macOS and Windows. The toolchain is pinned in `rust/rust-toolchain.toml`. Platform prerequisites and release packaging are in `docs/build-and-release.md`.
 
 ## Architecture
 
-Wails v2 desktop app: Go backend + HTML/CSS/JS frontend rendered in a native webview (WKWebView on macOS).
+The project is engine-first: a UI-free core crate, and the egui app is one client of it.
 
-**Go backend** (`internal/`):
-- `app/` — lifecycle bootstrap: opens SQLite, inits secret stores, wires everything together
-- `api/` — single `Service` struct bound to Wails; every public method is callable from JS as `window.go.api.Service.MethodName()`
-- `sessions/` — manages concurrent protocol sessions; owns SSH/Telnet/RAW/GitHub client lifecycles; handles auto-reconnect, login scripts, broadcast
-- `storage/` — SQLite repository (WAL mode) with embedded sequential migrations in `storage/migrations/`
-- `secrets/` — two-tier credential storage: OS keychain (preferred) → AES-256-GCM encrypted file vault (fallback)
-- `models/` — shared domain types and defaults; protocol configs are JSON-encoded in the DB
-- `sshclient/` — SSH client with agent, TOTP/2FA, and SOCKS5/HTTP proxy support
-- `telnetclient/`, `rawclient/`, `githubclient/` — protocol implementations
-- `sftpclient/` — SFTP file operations (browse, upload, download, rename, delete)
-- `sshconfig/` — OpenSSH `~/.ssh/config` parser and importer
-- `recording/` — asciicast v2 session recording and playback
-- `exportimport/` — encrypted profile bundles (.nexus format)
-- `updater/` — GitHub Releases update checker
-- `knownhosts/` — SSH host key management
-- `validation/` — profile and protocol validation
-- `audit/` — timestamped audit logging
+```
+rust/
+├── core/   nexus-core: storage, secrets, models, protocol clients, session Manager, Service. No egui.
+│   ├── migrations/       numbered SQL migrations, embedded with include_str!
+│   └── tests/            sessions.rs, ssh_integration.rs, fixtures/
+└── app/    nexus: the egui shell (binary `nexus-terminal`)
+```
 
-**Frontend** (`frontend/`):
-- Plain HTML/CSS/JS — no framework, no bundler, no ES modules
-- `index.html` is the app shell; loads CSS then JS in strict order
-- `src/js/` — 18 modules, each IIFE-wrapped, exporting to `window.NexusTerminal`
-- `src/css/` — modular stylesheets; `tokens.css` defines all design tokens
-- Vendor libs (xterm.js, addons) live in `src/js/lib/` and `src/css/lib/` — auto-copied, gitignored
+**Core (`rust/core/src/`):**
+- `service.rs` — `Service`, the app-facing API: profiles, connect/reconnect, credentials, known hosts, preferences, snippets, import/export, SSH keys, SFTP, updates. File dialogs live in the UI; methods here take paths.
+- `sessions.rs` — `Manager`: concurrent sessions, auto-reconnect with backoff, login scripts, broadcast writes, recording hooks, secret resolution (saved / session-only / ask every time), host-key checks. It reports through one `Event` enum (`Data`, `State`, `Closed`, `RawData`, `Irc`, `Github*`, `Forward*`, `Recording*`, `SftpProgress`, `SecretPrompt`, `HostKeyVerify`, `Vnc*`).
+- `clients/` — one module per protocol (`ssh`, `sftp`, `telnet`, `raw`, `serial`, `local`, `irc`, `github`, `vnc`). Read the conventions at the top of `clients/mod.rs` before touching one: `connect()` blocks its (worker) thread and returns once usable; the client then owns its reader thread(s) and reports through `Callbacks` (data, fatal error, close exactly once); `write`/`resize`/`close` are callable from any thread and `close` is idempotent. russh-based clients use the shared tokio runtime from `clients::rt()`; the rest use plain threads.
+- `storage.rs` (SQLite via rusqlite, WAL), `secrets.rs` (keychain + vault), `config.rs` (data directories and Alchementary Link migration), `models.rs`, `validation.rs`, `exportimport.rs`, `recording.rs` (asciicast v2), `sshconfig.rs`, `updater.rs`, `ircformat.rs`, `terminalenv.rs`, `keyfiles.rs`.
 
-**Go ↔ JS communication:**
-- **Synchronous:** Frontend calls `window.go.api.Service.*()` (returns Promise)
-- **Asynchronous:** Backend pushes events via `wailsRuntime.EventsEmit()`; frontend listens with `window.runtime.EventsOn()`
-- **Bidirectional events** for secret prompts and host key verification: backend emits a request event with a `requestID`, frontend shows a modal, then emits a response event with the same ID. The Go side blocks on a channel keyed by that ID.
+**App (`rust/app/src/`):**
+- `main.rs` parses flags, opens the `Service` and starts eframe. `app.rs` owns `App`: it installs an event sink that forwards `Event`s over a channel and calls `request_repaint`, drains them each frame (`on_event`), handles `Request`s, the keyboard shortcuts (`shortcuts()`), and lays out the frame.
+- `state.rs` — `Shared` (service handle, cached profiles and preferences, tabs, panes, toasts) and the `Request` queue features use to ask the main window to act.
+- `views.rs` — `View::{Terminal, Raw, Irc, Github, Vnc}`, one per pane.
+- `terminal.rs` (`TermView`: alacritty_terminal drawn with egui's painter), `tabs.rs` (tab strip, workspace, find bar, overlays), `splits.rs` (split tree), `sidebar.rs`, `chrome.rs` (title bar, status bar, command palette `Cmd` enum, prompts, dialogs, toasts).
+- Feature windows: `profile_editor.rs`, `quick_connect.rs`, `settings.rs` (including the Help topics), `ssh_keys.rs`, `transfer.rs` (import/export), `sftp.rs`, `forwards.rs`, `snippets.rs`, `triggers.rs`, `recordings.rs`.
+- Protocol views: `raw_view.rs`, `irc_view.rs`, `github_view.rs`, `vnc_view.rs`.
 
-Key events: `session:data`, `session:state`, `session:closed`, `session:raw:data`, `session:github:repos`, `session:secret:prompt`/`session:secret:response`, `session:hostkey:verify`/`session:hostkey:response`.
-
-## WKWebView Constraints (Critical)
-
-The macOS webview silently blocks or breaks several standard web APIs. These constraints affect every frontend change:
-
-1. **No `window.confirm()`, `window.prompt()`, `window.alert()`** — they either return false/null silently or do nothing. All user prompts must use the custom modal system (DOM-based backdrop + modal with `is-visible` class toggling).
-
-2. **No ES modules** — `<script type="module">` fails silently. All JS files use plain `<script>` tags and IIFE wrappers: `(function() { ... })();`
-
-3. **Click swallowing on text-selectable elements** — WKWebView initiates a text selection gesture on `mousedown` for `<div>` elements, which swallows the first `click` event (appears to require double-click). Fix: add `mousedown` handler with `e.preventDefault()` on any clickable non-input element (section headers, list items, etc.).
-
-4. **Modal visibility pattern** — both `.modal-backdrop` AND `.modal` elements start with `opacity: 0; visibility: hidden` in CSS. You must add the `is-visible` class to **both** elements, not just the backdrop.
-
-5. **Wails runtime injection** — `window.go` and `window.runtime` are injected by Wails before scripts execute. Do NOT add explicit script tags for Wails scripts. The frontend polls for their availability at startup (max 5s).
+**Flow:** UI → `Service` / `Manager` method (plain Rust call) → protocol client on a worker thread → `Callbacks` → `Manager` emits `Event` → app channel → `App::on_event` on the next frame. Credential and host-key questions are `Event::SecretPrompt` / `Event::HostKeyVerify` carrying an `mpsc::Sender` reply; the connecting thread blocks on the receiver, and dropping the sender (closing the prompt or the session) cancels it.
 
 ## Conventions
 
-**Language:** All code comments in British English (colour, initialise, behaviour, etc.).
+- **British English** in comments, docs and UI strings (colour, initialise, behaviour, favourite).
+- **Never block the UI thread.** Anything that touches the network, the keychain, `ssh-keygen` or slow disk work runs on a worker thread: `Shared::spawn` (errors become toasts), `settings::Job` (poll a result each frame), or a module's own inbox. Call `ctx.request_repaint()` when the work finishes. Quick SQLite calls through `Service` are fine inline.
+- **Colours come from `Tokens`** (`theme.rs`, `Tokens::get(ctx)`): `text`, `text_dim`, `text_faint`, `accent`, `success`, `warning`, `danger`, `field`, `card`, `dock`, … Don't hard-code colours; all three app themes (Pro, Midnight, Light) must work. Protocol colours and badges come from `views::protocol_color` / `protocol_badge`; terminal palettes from `terminal_themes.rs`.
+- **Icons are Phosphor** (`egui_phosphor::regular as icon`), usually as `format!("{}  Label", icon::X)`. Reuse the helpers in `widgets.rs` (`primary`, `button`, `icon_button`, `hint`, `empty`, `chip`, `section`, `kv`) and `chrome::modal` for modal dialogs.
+- **Shortcut labels** go through `state::keys("Mod+Shift+K")`, which renders ⌘ on macOS and Ctrl elsewhere. A new shortcut needs an entry in `App::shortcuts()`, the command palette (`chrome::commands`), the menu, the Help "Keyboard Shortcuts" topic and the README table.
+- **Formatting:** `rustfmt.toml` sets `max_width = 160` with `use_small_heuristics = "Max"`, so long single-line expressions are normal. Run `cargo fmt --all` rather than wrapping by hand.
+- Errors are `nexus_core::Result<T>` (`Box<dyn Error + Send + Sync>`); use `?` and `format!` messages that read well in a toast.
+- Protocol configs are `Option<…Config>` fields on `Profile` (`ssh`, `telnet`, `raw`, `github`, `vnc`, `irc`, `serial`), stored as JSON columns; `Profile::new(protocol)` fills the defaults, and the structs use `#[serde(default)]` so older rows still load.
+- A `ponytail:` comment marks a deliberate simplification and names its limit; keep them accurate when you change that code.
 
-**Go patterns:**
-- String-typed enums: `type Protocol string` with `const ProtocolSSH Protocol = "ssh"` etc.
-- Protocol configs are pointer fields on `Profile` (`SSH *SSHConfig`, `Telnet *TelnetConfig`, etc.) — nil when not applicable
-- `NewProfile(protocol)` factory in `defaults.go` populates sensible defaults per protocol
-- Storage uses `nullableJSON()` helper to write nil for unused config columns
-- Tests use `t.TempDir()` for isolation, `t.Fatalf()` for setup failures
+**Adding a protocol** touches: `models.rs` (`Protocol`, config struct, defaults, labels), `validation.rs`, a new migration (CHECK constraint and config column) plus the column lists in `storage.rs`, a client in `clients/`, the `Manager` connect/close/write paths in `sessions.rs`, the profile editor section, Quick Connect if relevant, a view (or `TermView` for terminal protocols), `views::protocol_badge`/`protocol_color`, the palette, and a Help topic.
 
-**Frontend patterns:**
-- Every JS file is IIFE-wrapped and exports to `window.NexusTerminal` namespace
-- Script load order matters (defined in `index.html`) — utils → state → notifications → sidebar → tabs → themes → terminal → profiles → raw → github → settings → commands → secrets → recordings → sftp → splitpane → snippets → app
-- DOM helpers: `createElement(tag, className, attrs)` from utils.js (supports `textContent`, `innerHTML`, `dataset`, `on*` event handlers)
-- Profile editor uses `_renderSection(title, fields)` pattern with `_field(type, name, label, value, opts)` helper for form generation
-- Login script editor uses `_renderLoginScriptSection(prefix, steps)` for expect-style step lists
-- TOTP section uses `_renderTOTPSection(profile)` with encrypted vault storage
-- `protocolColour()` returns CSS class names like `proto-ssh`; tab badges use `badge-ssh` class naming (different pattern)
+## Data compatibility (hard rules)
 
-**CSS patterns:**
-- Design tokens in `tokens.css`: `--bg-base`, `--bg-surface`, `--bg-elevated`, `--text-primary`, `--accent`, `--protocol-ssh`, etc.
-- Dark charcoal palette — not Material Design literally, but Material-inspired layering
-- Protocol colours: SSH=teal `#4ecdc4`, Telnet=amber `#ffa726`, RAW=purple `#ab47bc`, GitHub=indigo `#7c8aff`
+Existing users upgrade in place, and their data came from the Go app first. Nexus Terminal must keep reading it.
 
-**Adding a new protocol:**
-1. Add `Protocol` constant + config struct in `models/models.go`
-2. Add defaults in `models/defaults.go` `NewProfile()` switch
-3. Create client package in `internal/<proto>client/`
-4. Add `connect<Proto>()` in `sessions/manager.go` + case in `Connect()` switch
-5. Add API methods in `api/api.go` if needed
-6. Add DB migration in `storage/migrations/` (update CHECK constraint, add config column)
-7. Update `storage/store.go`: all SELECT/INSERT/UPDATE queries + both scan functions
-8. Frontend: add DEFAULTS in `profiles.js`, render sections, collect form values, protocol tab
-9. Frontend: add viewer in new JS file (IIFE-wrapped), include in `index.html`, wire in `app.js`
-10. Add CSS: protocol colour token, sidebar indicator, tab badge, viewer styles
+- **Never change the database, vault, export or recording formats incompatibly.** The vault (`vault/vault.json`: Argon2id t=3, m=128 MiB, 4 lanes; AES-256-GCM per secret), the export envelope (`[version][32-byte salt][12-byte nonce][ciphertext]`, `.nexus`; `.link` must still import) and asciicast v2 recordings are fixed.
+- **Fixtures** generated by the old Go app live in `rust/core/tests/fixtures/` (`link.db`, `vault/`, `profiles.link`, `recordings/`). Tests in `storage.rs`, `secrets.rs`, `exportimport.rs` and `recording.rs` read them. Don't regenerate or edit them to make a test pass.
+- **Schema changes are new SQL files** in `rust/core/migrations/` (`008_….sql`, …), added to `MIGRATIONS` in `storage.rs`. Each ends with `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'));`. Never edit an applied migration. SQLite has no `ALTER COLUMN`; use the recreate-table pattern.
+- **Keychain** entries are stored under the service `NexusTerminal`; reads fall back to `AlchementaryLink` and copy forward. Don't change key names (`profile:<id>:<kind>`).
+- **Data directory** names (`NexusTerminal`, `nexus.db`, `vault/`, `recordings/`) and the first-run migration from `AlchementaryLink/` in `config.rs` are user-facing; keep them stable.
 
-**Database migrations:**
-- Numbered SQL files: `001_initial.sql`, `002_github_protocol.sql`, etc.
-- Each must `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'))` at the end
-- SQLite has no `ALTER COLUMN` — use the recreate-table pattern (CREATE new → INSERT INTO new SELECT FROM old → DROP old → ALTER TABLE RENAME)
-- Every query in `store.go` that touches the profiles table must be updated when columns change (there are ~8 SELECT column lists + 2 scan functions)
+## Testing tips
+
+- **Never point a test or manual run at your real data.** Use `--data-dir DIR` (a temporary directory) for manual runs; tests create their own directory under `std::env::temp_dir()`, as the existing ones do.
+- **App flags** (`rust/app/src/main.rs`):
+  - `--data-dir DIR` — use another data directory.
+  - `--screenshot out.png` — render, save a PNG and exit (works under `xvfb-run`); combine with `--size WxH` and `--theme pro|midnight|light`.
+  - `--open WINDOW` — open a window at startup: `editor[:protocol|id]`, `quick`, `settings[:terminal|security|knownhosts|help|about]`, `keys`, `snippets`, `triggers`, `recordings`, `palette`, `export`, `import`.
+  - `--connect NAME` — connect a saved profile by display name or id.
+  - `--run-local CMD` — open a local terminal and type `CMD` into it once connected.
+
+  For example: `cargo run -- --data-dir /tmp/nx --open settings:help --screenshot /tmp/help.png`.
+- **SSH integration tests** (`core/tests/ssh_integration.rs`) start a throwaway `sshd` as the current user on a random port and skip themselves when OpenSSH isn't installed. They **must never open an interactive login shell** — the user's shell profile can auto-attach tmux/byobu to a real session. Set the profile's startup command to `/bin/sh -i`, as the existing `profile()` helper does.
+- `core/tests/sessions.rs` drives the `Manager` end to end against local TCP listeners; follow its `manager()` and `wait()` helpers for event-driven tests.
+- UI logic that can be tested without a window (parsers, fuzzy matching, split trees, snippet variables, trigger matching) has `#[cfg(test)]` unit tests next to it; add one with any non-trivial change.

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+    push:
+        branches: ["**"]
+    pull_request:
+
+jobs:
+    test:
+        name: Test (${{ matrix.os }})
+        runs-on: ${{ matrix.os }}
+        strategy:
+            fail-fast: false
+            matrix:
+                os: [ubuntu-22.04, macos-14, windows-latest]
+        defaults:
+            run:
+                shell: bash
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@v4
+            - name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
+              if: runner.os == 'Linux'
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev openssh-server
+            - run: cargo test --locked --workspace
+            - run: cargo fmt --all --check
+            - run: cargo clippy --locked --workspace --all-targets -- -D warnings

.github/workflows/release-builds.yml

@@ -17,121 +17,50 @@ jobs:
             fail-fast: false
             matrix:
                 include:
-                    - platform: darwin/amd64
-                      runner: macos-13
-                      os: darwin
-                      arch: amd64
-                      archive_type: zip
-                    - platform: darwin/arm64
-                      runner: macos-14
-                      os: darwin
-                      arch: arm64
-                      archive_type: zip
-                    - platform: linux/amd64
-                      runner: ubuntu-latest
-                      os: linux
-                      arch: amd64
-                      archive_type: tar
-                    - platform: linux/arm64
-                      runner: ubuntu-24.04-arm64
-                      os: linux
-                      arch: arm64
-                      archive_type: tar
-                    - platform: windows/amd64
-                      runner: windows-latest
-                      os: windows
-                      arch: amd64
-                      archive_type: zip
-                    - platform: windows/arm64
-                      runner: ubuntu-latest
-                      os: windows
-                      arch: arm64
-                      archive_type: zip
-                      cross: true
-
+                    - { platform: darwin/amd64, runner: macos-13 }
+                    - { platform: darwin/arm64, runner: macos-14 }
+                    - { platform: linux/amd64, runner: ubuntu-22.04 }
+                    - { platform: linux/arm64, runner: ubuntu-22.04-arm }
+                    - { platform: windows/amd64, runner: windows-latest }
+                    - { platform: windows/arm64, runner: windows-11-arm }
+        defaults:
+            run:
+                shell: bash
+                working-directory: rust
         steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Set up Go
-              uses: actions/setup-go@v5
+            - uses: actions/checkout@v4
               with:
-                  go-version-file: go.mod
+                  fetch-depth: 0
 
-            - name: Set up Node
-              uses: actions/setup-node@v4
-              with:
-                  node-version: "20"
+            - name: Rust toolchain (pinned by rust-toolchain.toml)
+              run: rustup show active-toolchain || rustup toolchain install
 
-            - name: Install Wails
-              run: go install github.com/wailsapp/wails/v2/cmd/wails@$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v2)
-
-            - name: Install frontend dependencies
-              run: npm ci
-              working-directory: frontend
-
-            - name: Install Linux build dependencies
-              if: matrix.os == 'linux'
+            - name: Linux build dependencies
+              if: runner.os == 'Linux'
               run: |
                   sudo apt-get update
-                  sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
 
-            - name: Install Windows cross-compiler
-              if: matrix.os == 'windows' && matrix.cross
-              run: |
-                  sudo apt-get update
-                  sudo apt-get install -y gcc-mingw-w64-x86-64 gcc-mingw-w64-aarch64 zip
+            - name: Test
+              run: cargo test --locked --workspace
 
-            - name: Build (non-Windows runners)
-              if: matrix.runner != 'windows-latest'
+            - name: Build and package
               env:
-                  CGO_ENABLED: "1"
-              run: |
-                  if [ "${{ matrix.os }}" = "windows" ] && [ "${{ matrix.cross }}" = "true" ]; then
-                    export CC=aarch64-w64-mingw32-gcc
-                  fi
-                  wails build -platform "${{ matrix.platform }}" -ldflags "-s -w"
+                  NEXUS_RELEASE_TARGETS: ${{ matrix.platform }}
+                  NEXUS_RELEASE_ROOT: ${{ github.workspace }}/build/releases
+              run: ./release.sh
 
-            - name: Build (Windows runner)
-              if: matrix.runner == 'windows-latest'
-              shell: pwsh
-              env:
-                  CGO_ENABLED: "1"
-              run: |
-                  wails build -platform "${{ matrix.platform }}" -ldflags "-s -w"
-
-            - name: Package (zip)
-              if: matrix.archive_type == 'zip' && matrix.runner != 'windows-latest'
-              run: |
-                  archive="nexus-terminal-${{ matrix.platform }}.zip"
-                  cd build/bin
-                  zip -r "../../${archive}" .
-
-            - name: Package (tar)
-              if: matrix.archive_type == 'tar'
-              run: |
-                  archive="nexus-terminal-${{ matrix.platform }}.tar.gz"
-                  tar -czf "${archive}" -C build/bin .
-
-            - name: Package (Windows zip)
-              if: matrix.archive_type == 'zip' && matrix.runner == 'windows-latest'
-              shell: pwsh
-              run: |
-                  $archive = "nexus-terminal-${{ matrix.platform }}.zip"
-                  Compress-Archive -Path "build/bin/*" -DestinationPath $archive
-
-            - name: Upload artifact
+            - name: Upload artefacts
               uses: actions/upload-artifact@v4
               with:
-                  name: nexus-terminal-${{ matrix.platform }}
+                  name: nexus-terminal-${{ matrix.runner }}
                   path: |
-                      nexus-terminal-${{ matrix.platform }}.zip
-                      nexus-terminal-${{ matrix.platform }}.tar.gz
+                      build/releases/*/NexusTerminal-*.zip
+                      build/releases/manifest-*.json
+                      build/releases/version-*.txt
 
             - name: Attach to GitHub Release
               if: startsWith(github.ref, 'refs/tags/')
               uses: softprops/action-gh-release@v2
               with:
-                  files: |
-                      nexus-terminal-${{ matrix.platform }}.zip
-                      nexus-terminal-${{ matrix.platform }}.tar.gz
+                  files: build/releases/*/NexusTerminal-*.zip

.gitignore

@@ -3,33 +3,8 @@
 # ==========================================================================
 
 # ── Build output ──────────────────────────────────────────────────────────
-build/bin/
-dist/
-
-# ── Build platform resources (tracked — icons, plists, manifests) ─────────
-# build/darwin/, build/windows/, build/linux/ are tracked for icons & metadata
-
-# ── Go ────────────────────────────────────────────────────────────────────
-vendor/
-.tools/
-.cache/
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-*.test
-*.out
-__debug_bin*
-coverage.out
-coverage.html
-
-# ── Frontend ──────────────────────────────────────────────────────────────
-frontend/node_modules/
-frontend/src/js/lib/
-
-# ── Wails auto-generated bindings (recreated on every build) ──────────────
-frontend/wailsjs/
+rust/target/
+build/releases/
 
 # ── IDE / editor ──────────────────────────────────────────────────────────
 .idea/
@@ -37,20 +12,12 @@ frontend/wailsjs/
 *.swp
 *.swo
 *~
-*.sublime-project
-*.sublime-workspace
-.project
-.classpath
-.settings/
 
 # ── OS metadata ───────────────────────────────────────────────────────────
 .DS_Store
-.DS_Store?
 ._*
 Thumbs.db
-ehthumbs.db
 Desktop.ini
-$RECYCLE.BIN/
 
 # ── Application data (never commit user data or secrets) ──────────────────
 *.db
@@ -59,9 +26,12 @@ $RECYCLE.BIN/
 vault.json
 *.pem
 *.key
-!build/appicon.png
 
+# Compatibility fixtures generated from the last Go build are deliberate test data.
+!rust/core/tests/fixtures/**
 
-# Builds
-build/releases/v*
-build/releases/manifest*
+# Agent worktrees
+.claude/worktrees/
+
+# User guide LaTeX output
+docs/guide/build/

Makefile

@@ -1,89 +0,0 @@
-.PHONY: all build build-compressed dev clean test test-cover lint install deps frontend-deps upx-check run package release help
-
-# Resolve the Wails binary. Prefer wails on PATH; fall back to GOPATH/bin.
-WAILS := $(or $(shell which wails 2>/dev/null),$(shell go env GOPATH)/bin/wails)
-VERSION := $(shell git describe --tags --abbrev=0 2>/dev/null || echo dev)-$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
-LD_UPDATE_URL := $(if $(NEXUS_UPDATE_URL),-X github.com/andydixon/nexus/internal/api.appUpdateURL=$(NEXUS_UPDATE_URL),)
-UPX_FLAGS ?=
-NEXUS_FORCE_MACOS_UPX ?= 0
-GOBIN_DIR := $(shell go env GOPATH)/bin
-export PATH := $(GOBIN_DIR):$(PATH)
-
-# Default target
-all: build
-
-# Install all dependencies
-deps: frontend-deps
-	go mod download
-
-upx-check:
-	@command -v upx >/dev/null 2>&1 || { echo "UPX is required for compressed builds. Install it first, for example: brew install upx"; exit 1; }
-	@if [ "$$(uname -s)" = "Darwin" ] && [ "$(NEXUS_FORCE_MACOS_UPX)" != "1" ]; then \
-		echo "UPX compression is disabled for macOS by default. Use ./release.sh for a zipped .app, or run NEXUS_FORCE_MACOS_UPX=1 UPX_FLAGS='--force-macos --best --no-color --no-progress' make build-compressed."; \
-		exit 1; \
-	fi
-	@if [ "$$(uname -s)" = "Darwin" ] && [ "$(NEXUS_FORCE_MACOS_UPX)" = "1" ] && ! printf '%s\n' "$(UPX_FLAGS)" | grep -q -- '--force-macos'; then \
-		echo "macOS UPX builds must pass --force-macos in UPX_FLAGS."; \
-		exit 1; \
-	fi
-
-# Install frontend dependencies
-frontend-deps:
-	cd frontend && npm install
-
-# Development mode with hot reload
-dev: deps
-	$(WAILS) dev
-
-# Production build
-build: deps
-	CGO_CFLAGS="$${CGO_CFLAGS:--O2 -g0}" CGO_CXXFLAGS="$${CGO_CXXFLAGS:--O2 -g0}" $(WAILS) build -trimpath -ldflags "-s -w -buildid= -X github.com/andydixon/nexus/internal/api.appVersion=$(VERSION) $(LD_UPDATE_URL)"
-
-# Production build with UPX compression
-build-compressed: deps upx-check
-	CGO_CFLAGS="$${CGO_CFLAGS:--O2 -g0}" CGO_CXXFLAGS="$${CGO_CXXFLAGS:--O2 -g0}" $(WAILS) build -trimpath -upx $(if $(UPX_FLAGS),-upxflags "$(UPX_FLAGS)",) -ldflags "-s -w -buildid= -X github.com/andydixon/nexus/internal/api.appVersion=$(VERSION) $(LD_UPDATE_URL)"
-
-# Run tests
-test:
-	go test ./... -v -count=1
-
-# Run tests with coverage
-test-cover:
-	go test ./... -v -count=1 -coverprofile=coverage.out
-	go tool cover -html=coverage.out -o coverage.html
-
-# Clean build artefacts
-clean:
-	rm -rf build/bin
-	rm -rf frontend/node_modules
-	rm -rf frontend/src/js/lib
-	rm -rf frontend/src/css/lib
-	go clean -testcache
-
-# Lint (requires golangci-lint)
-lint:
-	golangci-lint run ./...
-
-# Package for distribution
-package: build
-	@echo "Binary built at build/bin/"
-
-# Build and package release artefacts for all platforms
-release:
-	./release.sh
-
-# Help
-help:
-	@echo "Nexus Terminal — Build Targets"
-	@echo ""
-	@echo "  make deps          — Install all dependencies"
-	@echo "  make dev           — Run in development mode with hot reload"
-	@echo "  make build         — Production build"
-	@echo "  make build-compressed — Production build with UPX compression"
-	@echo "  make test          — Run tests"
-	@echo "  make test-cover    — Run tests with coverage report"
-	@echo "  make clean         — Clean build artefacts"
-	@echo "  make lint          — Run linter (requires golangci-lint)"
-	@echo "  make package       — Build and package for distribution"
-	@echo "  make release       — Build multi-platform release artefacts"
-	@echo "  make help          — Show this help"

README.md

@@ -1,55 +1,73 @@
 # Nexus Terminal
 
-**A desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminals, and Leviathan binary analysis — with secure credential handling and a focused, multi-session workflow.**
+**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
 
-Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence.
+Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence. It is a single Rust application with no webview, so it starts quickly and stays responsive under heavy terminal output.
 
 ## Highlights
 
-- SSH, Telnet, RAW TCP, VNC, GitHub, and local terminal sessions in one app
-- Tabbed sessions with split panes, pinning, and reordering
-- SFTP browser with drag-and-drop uploads and a directory picker
-- Leviathan binary workbench with hex editing, entropy, carving, BinSnoop, structure parsers, transforms, and spectrogram tools
-- Disconnected overlay with one-click reconnect
-- Broadcast input, snippets, and terminal search
-- Session recording and playback
-- Secure credential storage with OS keychain and encrypted vault fallback
+- SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions in one app
+- Tabbed sessions with split panes, pinning and drag-to-reorder
+- SFTP browser with drag-and-drop uploads and a permission-aware directory picker
+- SSH jump hosts, SOCKS5/HTTP proxies, local and remote port forwards, agent forwarding and TOTP auto-fill
+- Serial consoles with full line settings (baud, data bits, parity, stop bits, flow control)
+- Native VNC viewer, optionally tunnelled over SSH
+- Disconnected overlay with one-click reconnect, and auto-reconnect with backoff
+- Broadcast input, snippets, trigger rules and terminal search
+- Session recording (asciicast v2) and playback
+- Secure credential storage with the OS keychain first and an encrypted vault fallback
 
 ## Quick start
 
 1. Launch Nexus Terminal.
-2. Click **New** in the sidebar and create a connection profile.
-3. Click **Connect** to open a session in a new tab.
+2. Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**) and create a connection profile.
+3. Click **Create & Connect** to save it and open a session in a new tab. Afterwards, click the profile in the sidebar to connect.
 
-Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect.
+Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect, or click **Local Machine** in the sidebar for a local shell.
 
 If a session drops, use the **Reconnect** button in the disconnected overlay.
 
+### Coming from Alchementary Link?
+
+On first run, Nexus Terminal copies your Alchementary Link profiles, encrypted vault and recordings into its own data directory, and picks up credentials saved in the OS keychain. The old data is left untouched. Older `.link` export files can still be imported.
+
 ## Documentation
 
 - Product overview: [docs/overview.md](docs/overview.md)
 - Quick start (shareable): [docs/quick-start.md](docs/quick-start.md)
 - User manual: [docs/user-manual.md](docs/user-manual.md)
+- Illustrated user guide (PDF): [docs/guide/nexus-guide.pdf](docs/guide/nexus-guide.pdf), built from LaTeX in [docs/guide](docs/guide) (`make` there; `tools/screenshots.sh` regenerates the screenshots)
 - Build and release: [docs/build-and-release.md](docs/build-and-release.md)
 
 ## Keyboard shortcuts
 
 All shortcuts use **Cmd** on macOS and **Ctrl** on Windows/Linux.
 
-| macOS Shortcut    | Windows/Linux Shortcut | Action                      |
-| ----------------- | ---------------------- | --------------------------- |
-| Cmd + K           | Ctrl + K               | Open command palette        |
-| Cmd + N           | Ctrl + N               | New connection              |
-| Cmd + W           | Ctrl + W               | Close current tab           |
-| Cmd + Tab         | Ctrl + Tab             | Next tab                    |
-| Cmd + Shift + Tab | Ctrl + Shift + Tab     | Previous tab                |
-| Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number     |
-| Cmd + ,           | Ctrl + ,               | Open settings               |
-| Cmd + F           | Ctrl + F               | Find in terminal            |
-| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane vertically       |
-| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane horizontally     |
-| Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording    |
-| Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode |
-| Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library        |
-| Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect               |
-| F11               | F11                    | Toggle fullscreen           |
+| macOS Shortcut    | Windows/Linux Shortcut | Action                           |
+| ----------------- | ---------------------- | -------------------------------- |
+| Cmd + K           | Ctrl + K               | Open command palette             |
+| Cmd + N           | Ctrl + N               | New connection                   |
+| Cmd + W           | Ctrl + W               | Close current tab                |
+| Cmd + Tab         | Ctrl + Tab             | Next tab                         |
+| Cmd + Shift + Tab | Ctrl + Shift + Tab     | Previous tab                     |
+| Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number          |
+| Cmd + ,           | Ctrl + ,               | Open settings                    |
+| Cmd + F           | Ctrl + F               | Find in terminal                 |
+| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane right (side by side)  |
+| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane down (top and bottom) |
+| Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording         |
+| Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode      |
+| Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library             |
+| Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect                    |
+| F11               | F11                    | Toggle fullscreen                |
+
+## Building from source
+
+Nexus Terminal is a Rust workspace in `rust/`. With [rustup](https://rustup.rs) installed:
+
+```bash
+cd rust
+cargo run --release
+```
+
+See [docs/build-and-release.md](docs/build-and-release.md) for platform prerequisites, tests and release packaging.

audits/20260624-0945-functionalityNextSteps.md

@@ -0,0 +1,79 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix-mode pass improved VS Code extension robustness by hardening the local bridge and webview CSP handling. The highest-impact next step is runtime validation in a real VS Code host: the source-level tests pass, but the extension panels and long-lived bridge event stream deserve manual smoke coverage after the HTTP timeout and nonce changes.
+
+The codebase already has useful regression coverage for prior security fixes. The main opportunity now is to reduce duplicated webview HTML patterns and add integration tests around the VS Code bridge, because that surface currently depends heavily on static checks.
+
+## 2. Current Functional Risks
+
+- VS Code bridge `/events` uses a long-lived SSE stream. The new server has read/header/idle limits but intentionally no global write timeout, so a real VS Code smoke test should confirm events still flow correctly during SSH/SFTP/VNC/GitHub sessions.
+- VS Code webview HTML is duplicated across many panel classes. CSP, nonce generation, escaping, and message wiring are now correct in reviewed files, but duplication increases future regression risk.
+- The Node extension bridge client reads bridge responses without an explicit response-size cap or request timeout. The bridge is local and trusted, but a stuck bridge can still degrade the extension UX.
+- Frontend/webview coverage is mostly static regression assertions. It catches known bug patterns but does not prove that panels render and handlers fire inside VS Code.
+
+## 3. Code Quality Improvements
+
+- Centralise webview scaffolding in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`: CSP generation, nonce creation, common style policy, and HTML shell construction should live in one helper per extension or a shared local module.
+- Wrap bridge HTTP requests in a small client helper with timeout, response-size cap, JSON decode error handling, and consistent error messages.
+- Consider replacing large inline template-string webviews with smaller render helpers that build trusted static shell plus escaped dynamic content. The current approach is workable, but it makes security review repetitive.
+- Keep the bridge handler helpers small and testable. `newBridgeHTTPServer` and `decodeLimitedJSON` are a useful pattern for future endpoints.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+- Add manual smoke steps for Nexus Connections, terminal, RAW, GitHub, IRC, VNC, Profile Editor, Settings, SFTP, Leviathan Tools, Leviathan Hex, and Leviathan tool panels.
+- Add non-sensitive `console.error` or visible status handling for JSON parse failures in VS Code webview message handlers where currently errors may be silent.
+- Validate that reconnect, resize, SFTP directory actions, GitHub refresh/download, and Leviathan tool execution still fire their expected events after panel reloads.
+- Confirm no webview logs secrets, bearer tokens, passwords, passphrases, private key material, or raw sensitive bridge responses.
+
+## 5. Testing Roadmap
+
+- Unit tests: keep `cmd/vscode-bridge` tests for server settings and body caps; add request method/auth tests for all bridge routes.
+- Integration tests: add socket-level bridge tests for slow headers, oversized headers, and idle connection cleanup.
+- VS Code extension smoke tests: exercise webview creation, command registration, bridge startup, one RPC, and one event frame.
+- Frontend interaction tests: use a browser/DOM harness for key Wails UI flows where practical, especially SFTP upload, profile import, SSH key management, and Leviathan mode switching.
+- Abuse-case tests: retain oversized import/upload/config tests and add edge cases whenever new parsers or bridge endpoints are introduced.
+- Release smoke tests: package VSIX files and assert expected files, CSP strings, media resources, and bridge executable permissions.
+
+## 6. Recommended New Functionality
+
+- Add an in-extension bridge diagnostics command that shows bridge status, version, last RPC error, and whether the event stream is connected, without exposing the bearer token.
+- Add a developer-only test command for the VS Code extension that opens each webview and posts a benign fixture state. This would make manual and automated smoke testing faster.
+- Add a small security status page or command that reports vault state, known-host policy, update-check source, and active local bridge address without sensitive values.
+
+## 7. Next-Level Opportunities
+
+- Create a shared webview rendering module for both Nexus and Leviathan extension panels, with typed helpers for CSP, escaping, buttons, and event wiring.
+- Introduce structured bridge RPC method allow-list metadata rather than reflective method dispatch alone. Reflection is convenient, but a visible allow-list would make the trust boundary easier to review.
+- Add observability around bridge request counts, rejected oversized requests, active event clients, and session lifecycle errors.
+- Add accessibility checks for VS Code webview panels, especially keyboard focus, button labels, and status updates in terminal/disconnected flows.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Smoke-test the committed fix in a real VS Code host.
+- Confirm `/events` remains stable during session state changes.
+
+Short-term:
+
+- Add bridge client timeout and response-size caps in the Node extension code.
+- Add VS Code extension smoke tests for panel construction and bridge RPC.
+- Consolidate CSP nonce creation and webview HTML policy helpers.
+
+Medium-term:
+
+- Replace static-only regression assertions with executable DOM or VS Code integration tests for high-value panels.
+- Add bridge route coverage for auth failures, method errors, malformed JSON, and event subscription lifecycle.
+
+Long-term:
+
+- Build a release validation pipeline for desktop app, bridge binary, and VSIX packages.
+- Add structured diagnostics and observability for local bridge health and rejected requests.
+
+## 9. Caveats and Validation Needed
+
+- Source and automated tests passed, but VS Code runtime behaviour was not manually exercised in this pass.
+- The CSP nonce change should be behaviour-preserving, but every webview panel should still be opened once in VS Code.
+- The bridge timeout settings are conservative for local RPC; long-running operations should continue reporting progress through events rather than blocking a single HTTP request indefinitely.

audits/20260624-0945-securityAudit.md

@@ -0,0 +1,361 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed the Nexus desktop app, VS Code extensions, local bridge process, frontend regression harness, prior audit findings, dependency manifests, and build/test configuration. The codebase is in a materially better posture than the earlier June audits: major Wails, SFTP, VNC proxy, GitHub API, import-size, SSH key generation, and frontend DOM issues were already fixed and covered by tests.
+
+Two remaining issues were confirmed and fixed in commit `3a16a14`:
+
+- The VS Code bridge's localhost HTTP server had no explicit header/body read timeouts and decoded JSON request bodies without a hard cap.
+- VS Code webview CSP nonces were derived from `Date.now()`, which made a script allow-list nonce predictable rather than cryptographically random.
+
+Verification passed with targeted bridge tests, full Go tests, frontend regression checks, frontend build, `npm audit --omit=dev`, `govulncheck`, JavaScript syntax checks, and `git diff --check`.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go backend packages under `internal/` and the `cmd/vscode-bridge` localhost JSON-RPC/SSE bridge.
+- Browser-facing frontend JavaScript and regression checks under `frontend/`.
+- VS Code extension webviews in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`.
+- Dependency manifests: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`, VS Code extension package manifests.
+- Build, release, and CI files including shell scripts and `.github/workflows/release-builds.yml`.
+- Existing audit reports under `audits/` to avoid duplicate findings.
+
+Not fully live-tested:
+
+- Packaged VS Code extensions inside a real VS Code host after the CSP nonce change.
+- Long-lived bridge event streams under deliberate slow-client conditions.
+- Packaged Wails binaries on all target operating systems.
+
+## 3. Methodology
+
+I used static review, adversarial attack-surface mapping, dependency review, configuration review, DoS review, frontend/webview review, and targeted regression tests. I traced attacker-controlled inputs from webviews, the VS Code extension host, local HTTP requests, imported files, remote services, and session events into filesystem, process, network, DOM, and parser boundaries.
+
+Commands run:
+
+- `node --check vscode/nexus/extension.js`
+- `node --check vscode/leviathan/extension.js`
+- `node --check frontend/scripts/test-regressions.js`
+- `go test ./cmd/vscode-bridge -count=1`
+- `npm --prefix frontend test`
+- `git diff --check`
+- `go test ./... -count=1`
+- `npm --prefix frontend run build`
+- `npm --prefix frontend audit --omit=dev`
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`
+
+## 4. Risk Rating Method
+
+Severity reflects attacker position, exploit practicality, affected trust boundary, and confidentiality/integrity/availability impact. Confidence reflects direct source evidence and regression coverage.
+
+- Critical: unauthenticated remote compromise or credential disclosure.
+- High: practical credential theft, code execution, or privilege escalation.
+- Medium: meaningful local, renderer, or connected-service abuse with realistic prerequisites.
+- Low: defence-in-depth or bounded local robustness issue.
+- Informational: hardening or validation gaps without a direct exploit path.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound API methods callable from the renderer.
+- VS Code extension webviews and their `postMessage` handlers.
+- `cmd/vscode-bridge` localhost HTTP endpoints: `/health`, `/rpc`, `/events`, and `/runtime/event`.
+- SSH, SFTP, Telnet, RAW TCP, VNC, GitHub, IRC, local shell, updater, recording, export/import, and Leviathan binary-analysis workflows.
+
+Trust boundaries:
+
+- Renderer/webview to Go backend.
+- Local browser or extension host to localhost bridge.
+- Local selected files and profile imports to parsers.
+- Remote GitHub, SSH/SFTP/VNC/IRC/Telnet/RAW endpoints to client code.
+- OS keychain/vault to profile/session runtime.
+
+Attacker starting positions considered:
+
+- Local unprivileged process attempting bridge resource exhaustion.
+- Malicious or compromised extension webview state.
+- Hostile remote service data rendered into webviews.
+- Malicious selected local file or imported profile/export.
+- Compromised connected host attempting terminal/session abuse.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---|---|---|---|---|
+| SEC-20260624-0945-001 | Low | High | VS Code bridge accepted unbounded HTTP parser work | `cmd/vscode-bridge` | Fixed in `3a16a14` |
+| SEC-20260624-0945-002 | Low | High | VS Code webview CSP nonces used predictable timestamps | `vscode/nexus`, `vscode/leviathan` | Fixed in `3a16a14` |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260624-0945-001
+
+#### Title
+
+VS Code bridge accepted unbounded HTTP parser work
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `cmd/vscode-bridge/main.go:120`
+- `cmd/vscode-bridge/main.go:212`
+- `cmd/vscode-bridge/main.go:230`
+- `cmd/vscode-bridge/main.go:336`
+- `cmd/vscode-bridge/main.go:346`
+- `cmd/vscode-bridge/main_test.go:11`
+- `cmd/vscode-bridge/main_test.go:28`
+- `cmd/vscode-bridge/main_test.go:48`
+
+#### Description
+
+The bridge listens only on localhost and requires a random bearer token, but the HTTP server previously used default server timeouts and decoded JSON bodies directly from `r.Body`. A local process, or a compromised component with bridge token access, could keep connections open or send oversized JSON to force unnecessary parser work and memory use.
+
+#### Evidence
+
+Before the fix, `server := &http.Server{Handler: mux}` used default timeout values, and `/rpc` plus `/runtime/event` called `json.NewDecoder(r.Body).Decode(...)` without `http.MaxBytesReader`.
+
+The fix adds explicit bridge limits at `cmd/vscode-bridge/main.go:50`, uses `newBridgeHTTPServer` at `cmd/vscode-bridge/main.go:126`, and applies `decodeLimitedJSON` in both POST handlers at `cmd/vscode-bridge/main.go:218` and `cmd/vscode-bridge/main.go:236`.
+
+#### Attack Scenario
+
+A local unprivileged process repeatedly connects to the bridge and sends slow headers or a large authenticated JSON body. Without timeouts and body caps, the bridge can spend disproportionate time and memory on unauthorised or oversized traffic.
+
+#### Impact
+
+Local denial of service against the VS Code extension bridge, causing sluggishness, failed RPCs, or event-stream disruption.
+
+#### Recommendation
+
+Set bounded HTTP server timeouts and header limits. Cap JSON request bodies before decoding. Keep long-lived SSE compatibility by avoiding a global `WriteTimeout` that would break event streams.
+
+#### Safer Example
+
+Implemented:
+
+```go
+r.Body = http.MaxBytesReader(w, r.Body, bridgeMaxJSONBodyBytes)
+return json.NewDecoder(r.Body).Decode(dst)
+```
+
+#### Suggested Tests
+
+Added tests that assert bridge timeout/header settings and oversized `/rpc` plus `/runtime/event` bodies are rejected before reflective service dispatch.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- OWASP ASVS 12.1: File and resource handling
+- OWASP API Security Top 10 API4: Unrestricted Resource Consumption
+
+#### Assumptions / Limitations
+
+The practical attacker is local, because the bridge binds to `127.0.0.1`. The bearer token remains an important control, but it is not a substitute for parser and server resource limits.
+
+### Finding ID: SEC-20260624-0945-002
+
+#### Title
+
+VS Code webview CSP nonces used predictable timestamps
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `vscode/nexus/extension.js:5`
+- `vscode/nexus/extension.js:10`
+- `vscode/nexus/extension.js:219`
+- `vscode/nexus/extension.js:554`
+- `vscode/nexus/extension.js:895`
+- `vscode/nexus/extension.js:1061`
+- `vscode/nexus/extension.js:1162`
+- `vscode/nexus/extension.js:1260`
+- `vscode/nexus/extension.js:1375`
+- `vscode/nexus/extension.js:1618`
+- `vscode/nexus/extension.js:1832`
+- `vscode/leviathan/extension.js:5`
+- `vscode/leviathan/extension.js:10`
+- `vscode/leviathan/extension.js:189`
+- `vscode/leviathan/extension.js:497`
+- `vscode/leviathan/extension.js:773`
+- `frontend/scripts/test-regressions.js:222`
+
+#### Description
+
+The VS Code webviews use CSP script nonces, but each nonce was previously `String(Date.now())`. CSP nonces are intended to be high-entropy, per-render allow-list values. A timestamp nonce is guessable and weakens CSP if an HTML injection primitive is introduced elsewhere.
+
+#### Evidence
+
+All `const nonce = String(Date.now());` occurrences in the VS Code extension files were replaced with `createCSPNonce()`, backed by `crypto.randomBytes(16).toString('base64')`.
+
+#### Attack Scenario
+
+An attacker finds or later introduces a webview HTML injection path that can emit a `<script nonce="...">` tag. A predictable timestamp nonce materially reduces the barrier to bypassing CSP, especially when the webview creation time is observable or inferable.
+
+#### Impact
+
+Defence-in-depth weakness for webview script execution controls. A full exploit still requires an injection path, but predictable nonces undermine the CSP layer that should contain that class of defect.
+
+#### Recommendation
+
+Generate CSP nonces with cryptographically secure random bytes for every webview render, and keep regression coverage preventing timestamp nonce reintroduction.
+
+#### Safer Example
+
+Implemented:
+
+```js
+function createCSPNonce() {
+  return crypto.randomBytes(16).toString('base64');
+}
+```
+
+#### Suggested Tests
+
+Added regression assertions that both VS Code extension files use `crypto.randomBytes(16).toString('base64')` and that `const nonce = String(Date.now());` is absent under `vscode/`.
+
+#### References
+
+- CWE-345: Insufficient Verification of Data Authenticity
+- CWE-693: Protection Mechanism Failure
+- OWASP ASVS 14.4: Security headers
+
+#### Assumptions / Limitations
+
+I did not confirm a current exploitable webview injection path in these files during this pass. This fix preserves the CSP guarantee if a future DOM/HTML bug appears.
+
+## 8. Blackhat-Style Abuse Paths
+
+Path 1: Local bridge exhaustion.
+
+Prerequisite: local code execution on the same machine. The attacker opens many slow or oversized bridge requests. Before the fix, default server settings and uncapped JSON decoding provided weaker resistance. Defensive breakpoint: `ReadHeaderTimeout`, `ReadTimeout`, `IdleTimeout`, `MaxHeaderBytes`, and `http.MaxBytesReader`.
+
+Path 2: Future webview injection to script execution.
+
+Prerequisite: an HTML injection sink in a VS Code webview. Predictable CSP nonces made it easier to craft a nonce-bearing script. Defensive breakpoint: cryptographic per-render nonces and continued escaping/text-node rendering.
+
+## 9. Denial-of-Service Review
+
+Fixed:
+
+- Local bridge header/body parsing now has explicit limits.
+- Oversized bridge JSON bodies are rejected before reflective RPC dispatch.
+
+Previously fixed and still covered by tests:
+
+- VNC WebSocket frame read limits.
+- SFTP upload chunk and streaming size controls.
+- SSH config import file and Host-block caps.
+- GitHub archive stream cap.
+- Update response caps.
+- Leviathan and recording file-size limits in reviewed paths.
+
+Residual DoS considerations:
+
+- Long-lived `/events` streams intentionally remain open; they should be observed under slow-client conditions in VS Code.
+- Remote SFTP operations still rely on remote server responsiveness and transport-level behaviour.
+- Binary-analysis features should continue adding per-tool time and output caps as new parsers are added.
+
+## 10. Dependency and Supply-Chain Review
+
+`npm --prefix frontend audit --omit=dev` reported zero production vulnerabilities. `govulncheck` reported no reachable Go vulnerabilities. The release workflow uses pinned major versions of common GitHub Actions but still installs Wails dynamically from the module version; that is acceptable but should be monitored in release hardening.
+
+## 11. Secrets and Sensitive Data Review
+
+No new hard-coded credentials or private keys were found in the changed files. The bridge token remains generated with `crypto/rand` and is emitted to the extension process over stdout. Secret storage continues to use OS keychain and encrypted vault mechanisms reviewed in earlier audits.
+
+## 12. Authentication and Authorisation Review
+
+The bridge still requires `Authorization: Bearer <token>`. The fix does not change bridge authorisation semantics. No new auth bypass was identified in this pass. Host key handling, SFTP path validation, GitHub URL validation, and profile validation had existing regression coverage from prior fixes.
+
+## 13. Input Validation and Output Encoding Review
+
+Fixed:
+
+- Bridge JSON input is bounded to 1 MiB before decoding.
+
+Checked:
+
+- VS Code webviews continue escaping interpolated profile, repository, SFTP, and Leviathan state before `innerHTML` usage in reviewed areas.
+- Frontend regression tests include prior checks for SSH key manager error rendering and SFTP upload name handling.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+Fixed:
+
+- VS Code webview CSP nonces are now cryptographically random.
+
+Checked:
+
+- Existing frontend regression script still passes.
+- JavaScript syntax checks pass for both VS Code extension files and the regression script.
+
+Manual validation still needed:
+
+- Open the Nexus and Leviathan VS Code webviews in a real VS Code host and confirm all panels load under the stricter nonce generation.
+
+## 15. Infrastructure and Deployment Review
+
+The GitHub Actions release workflow was reviewed for obvious command injection or secret leakage. No new finding was fixed here. It still uses broad `contents: write` permissions for release attachment, which is appropriate for the release job but should remain isolated to tag/manual workflows.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+Bridge oversized-body failures return structured JSON errors through the existing RPC error path. No sensitive values are logged by the new code. The bridge still logs startup/server failures through `log`.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added:
+
+- Bridge server resource-limit tests.
+- Oversized `/rpc` body test.
+- Oversized `/runtime/event` body test.
+- Regression assertions preventing timestamp CSP nonces in VS Code webviews.
+
+Remaining gaps:
+
+- No automated VS Code host integration test exercises all webview panels.
+- No slowloris-style integration test measures bridge timeout behaviour over real sockets.
+- No e2e test validates the long-lived SSE event stream after server timeout changes.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Manually smoke-test the packaged VS Code extension panels and bridge event stream.
+
+Short-term:
+
+- Add a small VS Code extension integration smoke test for webview creation and bridge RPC.
+- Add a socket-level bridge test for slow headers and idle connections.
+
+Medium-term:
+
+- Centralise VS Code webview HTML helpers so CSP, escaping, and nonce generation are not duplicated.
+- Add response-size caps and request timeouts in the Node extension bridge client.
+
+Long-term:
+
+- Add release-time security checks for packaged VSIX contents, binary hashes, and expected CSP coverage.
+
+## 19. False Positives / Needs Manual Verification
+
+- The CSP nonce issue is a defence-in-depth finding, not evidence of a currently exploitable XSS.
+- Bridge DoS impact is local because the bridge binds to localhost.
+- VS Code runtime behaviour was not manually validated inside the actual editor during this audit.
+
+## 20. Final Notes
+
+The confirmed issues were fixed and committed in `3a16a14`. The residual risk is mainly operational validation: verify the VS Code extension panels in a real host and keep expanding integration coverage for bridge and webview behaviour.

audits/20260729-1237-functionalityNextSteps.md

@@ -0,0 +1,197 @@
+# Functionality and Next Steps Report
+
+## 1. Executive Summary
+
+This fix-mode pass makes long-running Nexus processes more predictable:
+reconnect prompts no longer accumulate runtime listeners, unfinished SFTP
+uploads are bounded and cancelled with their owning sessions, and application
+shutdown drains prompt, listener, session, and upload state. IPv6 literals now
+work in the reviewed VNC, IRC tunnel, and connection-test paths.
+
+The full backend, race, frontend, build, syntax, and dependency checks pass.
+The highest-value next step is a packaged long-duration soak test using real
+local and remote tabs. Unit tests prove the new ownership rules, but only a live
+test will show whether CPU, memory, goroutine, descriptor, and remote-session
+counts remain flat across thousands of open/close/reconnect cycles.
+
+## 2. Current Functional Risks
+
+- Application-level cleanup is now explicit, but remote libraries and OS
+  resources need live soak validation with real SSH, SFTP, VNC, IRC, Telnet,
+  RAW, and local shell sessions.
+- SFTP partial-file removal is best-effort. If a transport is already dead,
+  Nexus can close its local writer but may be unable to remove the remote
+  partial file.
+- External Leviathan extractors can run subprocesses without a shared timeout,
+  output-byte cap, or file-count cap. This path should remain unexposed until
+  those controls exist.
+- Parser test coverage varies by format. Complex hostile files may still find
+  correctness or performance edge cases not represented by current fixtures.
+- Several frontend areas still render trusted templates through `innerHTML`.
+  Existing dynamic values are escaped in reviewed paths, but DOM-based
+  construction would be less fragile for future edits.
+- Four Go module versions have advisories in code paths Nexus does not call.
+  They are not current reachable vulnerabilities, but routine dependency
+  refresh will reduce future uncertainty.
+- POSIX permission tests do not establish equivalent Windows ACL behaviour.
+
+## 3. Code Quality Improvements
+
+- Make ownership visible in types and naming. Sessions should own reconnect
+  contexts, uploads, protocol clients, terminal resources, and timers through a
+  single idempotent close path.
+- Introduce a small lifecycle registry for application-level Wails listeners.
+  The new stored unsubscribe functions are correct; a shared helper would make
+  future listeners harder to leak.
+- Replace `time.After` in long-lived or high-frequency paths with owned timers
+  when cancellation or reuse matters. The current reconnect prompt has bounded
+  frequency, but an owned timer makes resource lifetime more explicit.
+- Return structured cleanup results for unfinished uploads: local writer
+  closed, remote partial removed, or remote removal unavailable. This would
+  improve diagnostics without turning cleanup failure into a tab-close
+  blocker.
+- Centralise network endpoint formatting so every protocol consistently uses
+  `net.JoinHostPort` and one port-validation helper.
+- Keep frontend regression assertions aligned with tracked source. The audit
+  removed assertions for the intentionally deleted VS Code tree and replaced
+  the obsolete CGO flag check with the current pure-Go invariant.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+- When a tab closes during an upload, display a brief non-blocking message that
+  the upload was cancelled and whether a remote partial file may remain.
+- Make credential-prompt cancellation explicit in the UI so a reconnect
+  cancellation is distinguishable from a wrong password or timeout.
+- Add an unobtrusive diagnostics panel showing counts only: open tabs, active
+  protocol sessions, reconnect workers, pending prompts, streaming uploads,
+  goroutines, and recent cleanup failures.
+- Disable or debounce reconnect controls while a reconnect is already in
+  progress.
+- Prefer `textContent`, element creation, and event delegation for dynamic UI
+  state. Keep `innerHTML` for reviewed static templates only.
+- Ensure every async action rechecks that its tab/session still exists before
+  updating the DOM. This prevents late remote responses from reviving stale
+  state or producing confusing errors.
+- Never put passwords, vault contents, tokens, private keys, bridge tokens, or
+  terminal contents in diagnostics or frontend logs.
+
+## 5. Testing Roadmap
+
+Immediate automated coverage:
+
+- Add tests that call `Service.Shutdown` and `Manager.Shutdown` twice to enforce
+  idempotence.
+- Add a race test where an SFTP chunk write, session close, and shutdown overlap.
+- Add tests for a capacity race where two upload starts pass the pre-check and
+  only one may claim the final slot.
+- Add address-table tests for IPv4, DNS names, bare IPv6, and scoped IPv6
+  literals.
+
+Packaged soak coverage:
+
+- Start with zero tabs and record CPU, RSS, goroutines, descriptors, and
+  listener/upload counts.
+- Repeat local terminal open/write/close and SSH open/reconnect/close at least
+  1,000 times.
+- Repeat cancelled credential prompts and interrupted SFTP uploads.
+- Leave two idle tabs open for several hours and confirm resource counts and
+  CPU settle rather than grow.
+- Shut down and verify all subprocesses, sockets, PTYs, uploads, and runtime
+  listeners terminate.
+
+Protocol integration coverage:
+
+- Real SFTP server: finish, cancel, disconnect mid-chunk, reconnect, dead
+  transport, and remote partial-file cleanup.
+- Real IPv6 endpoints for VNC and SSH-tunnelled IRC/VNC.
+- Host-key accept/reject/cancel and secret prompt cancel/timeout.
+- Slow or malicious peers for protocol read limits and cancellation.
+
+Parser and frontend coverage:
+
+- Fuzz the PE, ELF, Mach-O, SquashFS, PDF, archive, and transform entry points.
+- Add DOM tests for tab close during asynchronous callbacks.
+- Keep `npm test`, frontend build, `go vet`, focused race tests,
+  `govulncheck`, and `npm audit` as release gates.
+
+## 6. Recommended New Functionality
+
+- Add a resource diagnostics view with current and peak counts for tabs,
+  sessions, reconnects, prompts, uploads, goroutines, file descriptors where
+  available, and local child processes.
+- Add an optional "delete partial remote upload on disconnect" status/history
+  entry, including a retry action after reconnect.
+- Add a developer soak command that scripts repeated open/reconnect/close
+  cycles against safe fixture servers and emits a machine-readable resource
+  summary.
+- Add an export-permission warning when the destination filesystem cannot
+  enforce private file access.
+- Add a dependency-health command for development builds that reports the Go
+  toolchain version and last audit result without contacting external services
+  during normal application use.
+
+## 7. Next-Level Opportunities
+
+- Build one lifecycle coordinator that owns application listeners, service
+  uploads, sessions, reconnect workers, protocol clients, timers, and local
+  subprocesses. A small dependency graph would make shutdown ordering
+  testable.
+- Add pprof-enabled development builds and automated before/after heap,
+  goroutine, mutex, and CPU profile comparisons during soak tests.
+- Introduce fault injection around remote writes, EOF, connection resets,
+  prompt cancellation, delayed events, and shutdown.
+- Wrap external analysis tools in a sandbox-oriented runner with a context
+  deadline, process-group kill, private working directory, output byte/file
+  limits, and a minimal environment.
+- Add signed, reproducible release metadata and verify the expected Go
+  toolchain, module graph, frontend lock file, and artefact hashes in CI.
+
+## 8. Prioritised Action Plan
+
+Immediate:
+
+- Run a packaged local/remote tab soak test and capture resource graphs before
+  and after `b5c7528`.
+- Validate interrupted SFTP uploads against a real server.
+- Confirm shutdown leaves no Nexus child process, PTY, listener, or open
+  connection.
+
+Short-term:
+
+- Add shutdown-idempotence and overlapping upload/close race tests.
+- Add resource counters and a development diagnostics view.
+- Refresh modules with unreachable advisories under a dedicated compatibility
+  change.
+- Add live IPv6 integration tests.
+
+Medium-term:
+
+- Add parser fuzzing and external extractor limits.
+- Reduce dynamic HTML construction and add DOM lifecycle tests.
+- Add fault-injected protocol integration tests.
+
+Long-term:
+
+- Make packaged soak, vulnerability, dependency, race, and artefact checks part
+  of release qualification.
+- Track resource-count baselines so gradual lifecycle regressions fail before
+  release.
+
+## 9. Caveats and Validation Needed
+
+- Automated checks passed, but no packaged Wails application was opened during
+  this audit.
+- No real remote protocol server was used, so remote partial-file behaviour and
+  third-party client cleanup still need live confirmation.
+- The CPU symptom was not reproduced under a profiler in this pass. The
+  reconnect listener leak and upload leak were confirmed from source and fixed,
+  but they should not be claimed as the only possible causes of historical
+  high CPU without a profile from an affected long-running process.
+- Filesystem permission behaviour was validated on the current POSIX host, not
+  Windows ACLs or every network filesystem.
+- `clear` reduces the lifetime of mutable sensitive byte slices but does not
+  guarantee complete memory erasure in Go.
+- `govulncheck` reports no reachable vulnerability after the toolchain update;
+  its four module-only advisories still deserve normal upgrade testing.
+- The deleted VS Code extension sources were not audited as current code. Only
+  the still-tracked Go bridge was reviewed.

audits/20260729-1237-securityAudit.md

@@ -0,0 +1,858 @@
+# Security Audit Report
+
+## 1. Executive Summary
+
+This fix-mode audit reviewed the current Nexus desktop application, its local
+VS Code bridge process, browser-facing frontend, session and upload lifecycles,
+credential handling, network clients, encrypted storage and export, Leviathan
+file analysis, build/release configuration, dependencies, and earlier audit
+reports.
+
+No Critical or High severity vulnerability was confirmed. Four
+evidence-backed findings were fixed in commit `b5c7528`:
+
+- Auto-reconnect credential prompts registered a permanent Wails listener on
+  every prompt. Long-running processes with repeated reconnects accumulated
+  callbacks and unnecessary event-dispatch work.
+- Interrupted streaming SFTP uploads could retain open remote writers and
+  in-memory upload entries after their session closed. Concurrent unfinished
+  uploads were not bounded.
+- The accepted Go toolchain range included versions affected by a reachable
+  standard-library TLS privacy vulnerability.
+- Encrypted exports and Leviathan carve output did not consistently enforce
+  private local file permissions. Short-lived plaintext and derived key byte
+  slices were also retained until garbage collection.
+
+The same commit fixed malformed IPv6 host/port construction in VNC, IRC SSH
+tunnels, and the connection tester, and repaired stale frontend regression
+assertions left behind when the VS Code extension tree and CGO build were
+removed.
+
+All Go tests, focused race tests, Go vet, the complete frontend test suite,
+frontend production build, JavaScript and shell syntax checks, PHP syntax
+check, `npm audit`, and the reachable Go vulnerability scan pass. Live remote
+protocol testing and packaged desktop testing remain manual validation items.
+
+## 2. Scope Reviewed
+
+Reviewed:
+
+- Go packages under `internal/`, including sessions, SSH, SFTP, VNC, IRC,
+  Telnet, RAW TCP, local shells, storage, vault/keychain integration,
+  recording, updater, GitHub client, import/export, and Leviathan.
+- The localhost service bridge in `cmd/vscode-bridge`.
+- Frontend source, lifecycle handling, DOM construction, timers, Wails event
+  subscriptions, build scripts, and regression harness under `frontend/`.
+- Network address construction, host-key verification, connection setup, and
+  session shutdown paths.
+- Dependency manifests and lock files.
+- Build, release, update, and CI configuration.
+- Earlier reports under `audits/`, to distinguish regressions from already
+  fixed findings.
+
+Not live-tested:
+
+- Packaged Wails applications on every supported operating system.
+- Real SSH, SFTP, VNC, IRC, Telnet, RAW, GitHub, or update endpoints.
+- Malicious network peers under sustained load.
+- External Leviathan extractor tools. Their extraction path is not currently
+  exposed by the active Wails document response.
+- A VS Code extension runtime, because the `vscode/` source tree was
+  intentionally removed in commit `4fc3b19`.
+
+## 3. Methodology
+
+The review combined:
+
+- Repository and Git-history inspection.
+- Trust-boundary and attacker-starting-position mapping.
+- Static review of authentication, authorisation, secrets, cryptography,
+  filesystem operations, command execution, parsers, network clients, event
+  listeners, goroutines, timers, and cleanup paths.
+- Adversarial resource-exhaustion review, with particular attention to a
+  process that has run for a long time while tabs and sessions are repeatedly
+  opened, reconnected, and closed.
+- Frontend sink/source review for unsafe HTML, event-listener accumulation,
+  timers, stale state, and privileged Wails calls.
+- Dependency and supply-chain scanning.
+- Focused regression tests followed by broad test, race, build, syntax, and
+  static-analysis checks.
+
+Principal validation commands:
+
+- `go test ./... -count=1`
+- `go test -race ./internal/sessions ./internal/api ./internal/exportimport ./internal/vncclient ./cmd/vscode-bridge -count=1`
+- `go vet ./...`
+- `go run golang.org/x/vuln/cmd/govulncheck@latest -show verbose ./...`
+- `go run github.com/securego/gosec/v2/cmd/gosec@latest ./...`
+- `npm test` in `frontend/`
+- `npm run build` in `frontend/`
+- `npm audit --json` in `frontend/`
+- `node --check` for changed JavaScript
+- `bash -n build.sh build-all.sh release.sh scripts/build-common.sh`
+- `php -l updates/index.php`
+- `git diff --check`
+
+## 4. Risk Rating Method
+
+Severity reflects attacker position, prerequisites, exploit repeatability,
+trust-boundary impact, and confidentiality, integrity, and availability
+consequences.
+
+- Critical: practical unauthenticated remote compromise or broad secret
+  disclosure.
+- High: practical code execution, credential theft, or privilege escalation.
+- Medium: meaningful local, renderer, connected-peer, or privacy impact with
+  realistic prerequisites.
+- Low: bounded local exposure, defence-in-depth weakness, or correctness issue
+  with a security consequence.
+- Informational: hardening or validation work without a confirmed exploit.
+
+Confidence reflects the strength of source evidence, reproduction, scanner
+evidence, and regression coverage. Severity is not increased merely because a
+scanner reports a possible pattern.
+
+## 5. Attack Surface Map
+
+Entry points:
+
+- Wails-bound service methods invoked by the desktop renderer.
+- Runtime events crossing between frontend JavaScript and Go.
+- The token-authenticated localhost bridge endpoints.
+- User-selected SSH, SFTP, VNC, IRC, Telnet, RAW TCP, GitHub, and update
+  endpoints.
+- Imported profiles, OpenSSH configuration, encrypted Nexus exports,
+  recordings, and files selected for Leviathan analysis.
+- Local shell commands and SSH key generation.
+
+Trust boundaries:
+
+- Renderer to privileged Go backend.
+- Local bridge client to localhost HTTP/RPC service.
+- OS keychain or encrypted vault to runtime session credentials.
+- Remote network data to protocol clients and frontend rendering.
+- User-selected or hostile files to parsers and external analysis tooling.
+- Release workflow and update manifest to installed application binaries.
+
+Attacker starting positions considered:
+
+- A malicious or compromised remote service.
+- A hostile local file or imported configuration.
+- A local unprivileged process targeting the localhost bridge or filesystem
+  artefacts.
+- A renderer injection or future renderer compromise invoking bound methods.
+- An observer of TLS traffic.
+- A legitimate local user accidentally creating unbounded resource state over
+  a long-running process.
+
+## 6. Findings Summary Table
+
+| ID | Severity | Confidence | Title | Component | Status |
+|---|---|---|---|---|---|
+| SEC-20260729-1237-001 | Medium | High | Reconnect credential prompts accumulated permanent runtime listeners | `internal/sessions` | Fixed in `b5c7528` |
+| SEC-20260729-1237-002 | Medium | High | Interrupted SFTP uploads retained resources without a concurrency bound | `internal/api` | Fixed in `b5c7528` |
+| SEC-20260729-1237-003 | Medium | High | Build accepted a Go toolchain with a reachable TLS privacy vulnerability | `go.mod`, build scripts | Fixed in `b5c7528` |
+| SEC-20260729-1237-004 | Low | High | Sensitive local artefacts did not consistently enforce private permissions | Export/import and Leviathan | Fixed in `b5c7528` |
+
+## 7. Detailed Findings
+
+### Finding ID: SEC-20260729-1237-001
+
+#### Title
+
+Reconnect credential prompts accumulated permanent runtime listeners
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/sessions/manager.go:110`
+- `internal/sessions/manager.go:676`
+- `internal/sessions/manager.go:2577`
+- `internal/sessions/manager.go:2615`
+- `internal/sessions/manager.go:2654`
+- `internal/sessions/manager_test.go:383`
+- `cmd/vscode-bridge/main.go:187`
+- `internal/app/app.go:118`
+
+#### Description
+
+Every credential request created during automatic reconnect registered another
+`session:secret:response` Wails listener. The listener was never unregistered,
+including after a response, timeout, cancelled reconnect, session close, or
+application shutdown.
+
+The request ID check prevented one prompt from accepting another prompt's
+value, but all historical callbacks were still invoked for every future
+credential response. A process left open for a long time could therefore
+accumulate event callbacks in proportion to its reconnect history. A closed
+session could also leave a credential prompt waiting for its full timeout.
+
+#### Evidence
+
+Before the fix, `buildInteractiveSecretCallback` called
+`wailsRuntime.EventsOn` inside the callback created for each prompt and
+discarded the returned unsubscribe function.
+
+The fix registers one manager-level response router from `SetContext`, stores
+the unsubscribe function, routes responses through a request-ID map, honours
+frontend cancellation, and selects on the reconnect context. `Shutdown`
+unregisters both host-key and credential listeners and releases all waiters.
+Application and bridge shutdown now call the complete service and manager
+shutdown methods.
+
+#### Attack Scenario
+
+A remote SSH or IRC service repeatedly drops connections after authentication,
+or a user repeatedly opens and reconnects profiles that require an interactive
+secret. Historical event listeners accumulate. Later secret responses fan out
+to all callbacks, increasing CPU work and retained memory even though old tabs
+are closed.
+
+#### Impact
+
+Progressive memory and CPU consumption in a long-running process, sluggish
+credential prompts, delayed shutdown, and eventual application availability
+loss. The request-ID routing means no cross-session secret disclosure was
+confirmed.
+
+#### Recommendation
+
+Use one application-lifetime event listener per event type, route responses by
+opaque request ID, bind every waiter to a cancellation context, and explicitly
+unsubscribe and release waiters during shutdown.
+
+#### Safer Example
+
+Implemented in outline:
+
+```go
+cancel := wailsRuntime.EventsOn(ctx, "session:secret:response", m.handleSecretResponse)
+m.secretListenerCancel = cancel
+
+select {
+case response := <-ch:
+    return response.value, cancellationError(response)
+case <-ctx.Done():
+    return "", ctx.Err()
+}
+```
+
+#### Suggested Tests
+
+Added tests verify request-ID routing, reconnect-context cancellation, frontend
+cancellation, pending-map cleanup, and shutdown waiter release. The focused
+race suite passes.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-772: Missing Release of Resource after Effective Lifetime
+
+#### Assumptions / Limitations
+
+No packaged Wails runtime stress test was run. The defect and fix are directly
+visible in source, and the routing/cancellation logic is covered at Go level.
+
+### Finding ID: SEC-20260729-1237-002
+
+#### Title
+
+Interrupted SFTP uploads retained resources without a concurrency bound
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/api/api.go:52`
+- `internal/api/api.go:117`
+- `internal/api/api.go:469`
+- `internal/api/api.go:475`
+- `internal/api/api.go:515`
+- `internal/api/api.go:1569`
+- `internal/api/api.go:2189`
+- `internal/api/api.go:2202`
+- `internal/api/api_test.go:145`
+
+#### Description
+
+Streaming SFTP upload state held an open remote writer in the service upload
+map. Finish and explicit cancel removed it, but disconnecting, reconnecting, or
+closing the owning session did not. Application shutdown also did not drain
+unfinished uploads. There was no limit on the number of simultaneously open
+streaming uploads.
+
+#### Evidence
+
+The earlier lifecycle paths called the session manager directly without
+visiting the upload map. `SFTPUploadStart` inserted every new writer without a
+capacity check.
+
+The fix:
+
+- Caps active streaming uploads at 16.
+- Checks capacity before opening a remote writer and atomically rechecks before
+  insertion.
+- Removes and closes uploads belonging to a session before disconnect or
+  reconnect.
+- Drains every upload during close-all and service shutdown.
+- Best-effort removes the partial remote file.
+- Releases secret-prompt waiters and the service's Wails listener during
+  shutdown as part of the same lifecycle hardening.
+
+#### Attack Scenario
+
+A compromised renderer, automation loop, or repeated user action starts
+uploads and closes the associated tabs or sessions without finishing them.
+Each iteration can retain a local map entry, SFTP request state, remote file
+handle, and partially written file. Repetition eventually exhausts descriptors,
+memory, or server-side resources.
+
+#### Impact
+
+Local and remote resource exhaustion, failed subsequent uploads, leaked partial
+files, and degraded session availability.
+
+#### Recommendation
+
+Make resource ownership explicit: uploads must be owned by a session and
+cancelled when that session ends. Bound concurrent work and keep a race-safe
+second capacity check after expensive setup.
+
+#### Safer Example
+
+Implemented:
+
+```go
+func (s *Service) DisconnectSession(sessionID string) error {
+    s.cancelSFTPUploads(sessionID)
+    return s.sessions.Disconnect(sessionID)
+}
+```
+
+#### Suggested Tests
+
+Added tests verify session-scoped cancellation, unrelated-upload preservation,
+the active-upload limit, writer closure, and shutdown cleanup. Full and race
+tests pass.
+
+#### References
+
+- CWE-400: Uncontrolled Resource Consumption
+- CWE-404: Improper Resource Shutdown or Release
+- CWE-772: Missing Release of Resource after Effective Lifetime
+
+#### Assumptions / Limitations
+
+No real SFTP server was used to verify partial-file deletion after a transport
+failure. Removal is best-effort because the session may already be unavailable;
+local writer and map cleanup do not depend on remote deletion succeeding.
+
+### Finding ID: SEC-20260729-1237-003
+
+#### Title
+
+Build accepted a Go toolchain with a reachable TLS privacy vulnerability
+
+#### Severity
+
+Medium
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `go.mod:3`
+- `go.mod:5`
+- `build.sh:21`
+- `build-all.sh:20`
+
+#### Description
+
+The build accepted Go 1.25.0 and the local build used Go 1.26.4.
+`govulncheck` identified GO-2026-5856 / CVE-2026-42505 in a reachable
+`crypto/tls` path. Affected clients could expose TLS PSK identities in a
+plaintext ClientHello while Encrypted Client Hello was in use, allowing a
+passive observer to undermine ECH privacy.
+
+#### Evidence
+
+The pre-fix scan reported the standard-library vulnerability as reachable.
+The [official Go vulnerability record](https://pkg.go.dev/vuln/GO-2026-5856)
+states that Go 1.25 is fixed in 1.25.12 and Go 1.26 is fixed in 1.26.5.
+
+The fix raises the module minimum to Go 1.25.12, requests toolchain Go 1.26.5,
+and aligns both Unix build scripts with the new minimum. The post-fix verbose
+scan used the Go 1.26.5 standard library and reported zero symbol or package
+vulnerabilities affecting Nexus.
+
+#### Attack Scenario
+
+Where ECH and PSK resumption are used, a passive network observer records the
+client's plaintext ClientHello and correlates an exposed PSK identity with the
+protected destination.
+
+#### Impact
+
+Conditional network privacy disclosure. No private key or application
+credential extraction was demonstrated. Nexus does not explicitly configure
+ECH, so actual exposure depends on TLS configuration and runtime behaviour.
+
+#### Recommendation
+
+Enforce fixed toolchain floors in `go.mod`, local build scripts, and CI. Keep
+`govulncheck` in release validation so standard-library vulnerabilities cannot
+be missed by module-only scanners.
+
+#### Safer Example
+
+Implemented:
+
+```text
+go 1.25.12
+toolchain go1.26.5
+```
+
+#### Suggested Tests
+
+Run `go version` and verbose `govulncheck` in release CI, and fail if a
+reachable symbol-level vulnerability is reported.
+
+#### References
+
+- GO-2026-5856
+- CVE-2026-42505
+- CWE-200: Exposure of Sensitive Information
+
+#### Assumptions / Limitations
+
+The scanner established a reachable TLS symbol path, not that Nexus actively
+negotiated ECH with a vulnerable server during this audit. Severity therefore
+reflects conditional exploitability.
+
+### Finding ID: SEC-20260729-1237-004
+
+#### Title
+
+Sensitive local artefacts did not consistently enforce private permissions
+
+#### Severity
+
+Low
+
+#### Confidence
+
+High
+
+#### Affected Files / Components
+
+- `internal/exportimport/exportimport.go:68`
+- `internal/exportimport/exportimport.go:111`
+- `internal/exportimport/exportimport.go:116`
+- `internal/exportimport/exportimport.go:170`
+- `internal/exportimport/exportimport_test.go:108`
+- `internal/leviathan/binsnoop/binsnoop.go:137`
+- `internal/leviathan/binsnoop/binsnoop.go:141`
+- `internal/leviathan/binsnoop/extract.go:17`
+- `internal/leviathan/binsnoop/extract.go:20`
+- `internal/leviathan/binsnoop/common_test.go:25`
+
+#### Description
+
+Encrypted profile exports were created through `os.Create`, which normally
+uses mode `0666` filtered by the process umask. Overwriting an existing file
+also preserved its existing mode. Leviathan carved binary data and extraction
+directories used `0644` and `0755`. Carved content can include credentials,
+private keys, firmware configuration, or other forensic secrets.
+
+Export encryption keys, password byte slices, and decrypted plaintext byte
+slices also remained live until garbage collection after use.
+
+#### Evidence
+
+The fix opens exports with mode `0600` and explicitly applies `Chmod(0600)` so
+an existing permissive destination is tightened. Leviathan-owned carve files
+now use `0600`, and directories use `0700`. Export/import makes a best-effort
+`clear` of transient password, derived-key, and plaintext byte slices.
+
+#### Attack Scenario
+
+On a multi-user host, another local account reads a carved private key or
+configuration from a world-readable output file. For an export destination
+that already had permissive permissions, another account can copy the
+encrypted profile bundle for offline password guessing.
+
+#### Impact
+
+Local confidentiality exposure. The export remains protected by Argon2id and
+AES-GCM, which significantly reduces its immediate sensitivity; raw carve
+output has no equivalent encryption.
+
+#### Recommendation
+
+Create sensitive artefacts and parent directories with private modes, tighten
+existing destinations explicitly, and minimise the lifetime of mutable
+plaintext and key buffers. Document that Go strings and internal copies cannot
+be guaranteed to be erased.
+
+#### Safer Example
+
+Implemented:
+
+```go
+f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+if err == nil {
+    err = f.Chmod(0600)
+}
+```
+
+#### Suggested Tests
+
+POSIX-only regression tests verify `0600` export and carve files and a `0700`
+carve directory, including overwriting a pre-existing `0644` export.
+
+#### References
+
+- CWE-276: Incorrect Default Permissions
+- CWE-316: Cleartext Storage of Sensitive Information in Memory
+
+#### Assumptions / Limitations
+
+POSIX mode bits are not equivalent on Windows, so permission tests skip there.
+`clear` is best-effort in Go and cannot erase immutable password strings,
+copies held by libraries, or compiler-created copies. External extraction
+tools may choose their own modes for files they create beneath the private
+directory.
+
+## 8. Blackhat-Style Abuse Paths
+
+### Path 1: Reconnect churn to process exhaustion
+
+Prerequisite: a profile needs an interactive credential during automatic
+reconnect. A hostile endpoint repeatedly drops the connection. Before the fix,
+each prompt left another Wails listener behind. Defensive breakpoint:
+application-level listener routing, context cancellation, and shutdown
+unsubscribe.
+
+### Path 2: Renderer-driven SFTP handle exhaustion
+
+Prerequisite: renderer access to bound service methods. Start streaming uploads
+without finishing them, then close or reconnect sessions repeatedly. Before the
+fix, writers and upload entries survived. Defensive breakpoint: the 16-upload
+cap and session-owned cancellation.
+
+### Path 3: Passive observation of vulnerable TLS ECH
+
+Prerequisite: affected Go runtime, ECH/PSK behaviour, and network visibility.
+Observe plaintext ClientHello state and correlate exposed PSK identity.
+Defensive breakpoint: Go 1.25.12 or 1.26.5 and later.
+
+### Path 4: Local recovery of carved secrets
+
+Prerequisite: another local account can traverse the selected output location.
+Read a `0644` carved file containing a private key or configuration secret.
+Defensive breakpoint: `0700` directories and `0600` files.
+
+No practical chain to unauthenticated remote code execution was identified.
+
+## 9. Denial-of-Service Review
+
+Fixed in this audit:
+
+- Reconnect secret listeners no longer grow with historical prompt count.
+- Cancelled reconnect prompts stop immediately instead of waiting up to 60
+  seconds.
+- Session close/reconnect and application shutdown drain streaming uploads.
+- Concurrent streaming uploads are capped at 16.
+- Runtime listeners and prompt waiters are released at shutdown.
+- IPv6 literals are joined with ports correctly, preventing connection failure
+  and misleading repeated retry behaviour.
+
+Previously hardened and rechecked:
+
+- SFTP inline/chunk/total upload size caps.
+- VNC WebSocket frame limits.
+- GitHub archive and update-response size limits.
+- SSH configuration and public-key input caps.
+- Recording and Leviathan file-size limits in exposed paths.
+- Session timers, latency pings, frontend intervals, and closed-tab lifecycle
+  cleanup covered by the current regression tests.
+
+Residual considerations:
+
+- Network protocols ultimately depend on remote peer responsiveness.
+- External Leviathan tools lack a shared timeout/output-budget wrapper, but
+  that path is not currently exposed by the active UI API.
+- Hostile binary parsers deserve continued fuzzing even where current bounds
+  checks reject malformed offsets.
+
+## 10. Dependency and Supply-Chain Review
+
+`npm audit --json` reported zero vulnerabilities across 33 frontend
+dependencies.
+
+Post-fix `govulncheck -show verbose` reported:
+
+- Zero vulnerabilities in symbols Nexus calls.
+- Zero vulnerabilities in imported package call paths.
+- Four advisories in required module versions that Nexus does not appear to
+  call:
+  - GO-2026-5970 in `golang.org/x/text@v0.37.0`.
+  - GO-2026-5942 in `golang.org/x/net@v0.55.0`.
+  - GO-2026-5932 for the unmaintained `x/crypto/openpgp` package.
+  - GO-2026-5841 in `github.com/klauspost/compress/s2@v1.17.11`.
+
+Those versions should be refreshed through normal dependency maintenance, but
+they were not forcibly upgraded in this fix because the scanner found no
+Nexus call path and broad transitive churn would require separate compatibility
+testing.
+
+The release workflow uses common GitHub Actions by major version and a
+write-capable release job. Pinning actions to immutable commit SHAs would
+further reduce supply-chain drift. Release permissions should remain scoped to
+the release job and tag/manual triggers.
+
+## 11. Secrets and Sensitive Data Review
+
+No hard-coded production credential, private key, token, or certificate was
+found. Test secrets were confined to test fixtures.
+
+Reviewed controls:
+
+- OS keychain integration.
+- Argon2id-derived AES-GCM vault and export encryption.
+- SSH host-key verification and known-host handling.
+- Bridge bearer token generation and comparison.
+- Secret prompt routing and cancellation.
+- Sensitive file permissions.
+- Logging and frontend error paths for obvious secret disclosure.
+
+Fixed:
+
+- Best-effort clearing of mutable export/import plaintext, password bytes, and
+  derived keys.
+- Private export and carve modes.
+- Prompt waiters and listeners released during shutdown.
+
+Residual:
+
+- Go strings and library copies cannot be reliably zeroed.
+- Users may explicitly choose plaintext Telnet, RAW TCP, or non-TLS VNC.
+- A user can explicitly select insecure SSH host-key behaviour; that choice
+  remains a visible compatibility option and should not be the default.
+
+## 12. Authentication and Authorisation Review
+
+Nexus is a single-user desktop client rather than a multi-tenant server. Its
+primary authorisation boundary is the logged-in OS account plus the Wails
+renderer/backend boundary.
+
+Checked:
+
+- Local bridge endpoints retain bearer-token authentication.
+- SSH host-key callbacks are required in the reviewed direct and tunnel paths.
+- GitHub and remote-session credentials are retrieved from configured secret
+  stores or interactive prompts.
+- Sensitive service methods validate session identifiers through the manager
+  and validate paths, sizes, or option allow-lists where applicable.
+
+No new authentication bypass or cross-user authorisation defect was confirmed.
+A future renderer compromise would still have substantial privileges because
+Wails-bound methods are designed for the trusted desktop UI; maintaining output
+encoding and a narrow method surface therefore remains important.
+
+## 13. Input Validation and Output Encoding Review
+
+Reviewed:
+
+- Profile fields, ports, hostnames, paths, filenames, import strategies,
+  archive/update URLs, SSH key options, recording files, binary offsets, and
+  base64 upload chunks.
+- HTML construction and text insertion in frontend modules.
+- Local subprocess arguments for shell, `ssh-keygen`, and Leviathan extraction.
+
+Fixed:
+
+- `net.JoinHostPort` now constructs IPv4, hostname, and IPv6 endpoints in VNC,
+  IRC SSH tunnels, and the connection tester.
+- Existing SFTP validation is now combined with a concurrency limit and
+  lifecycle cleanup.
+
+Scanner findings for MD5/SHA-1 in Leviathan are intentional forensic hash
+identifiers, not password or signature protection. Representative integer
+conversion and slice warnings in hostile-file parsers were manually traced to
+existing bounds checks; no concrete out-of-bounds path was confirmed. Parser
+fuzzing remains preferable to broad speculative casting changes.
+
+## 14. Frontend HTML/JavaScript Robustness Review
+
+The frontend contains numerous event listeners because each tab and modal owns
+interactive DOM. Reviewed tab/session paths attach handlers to ephemeral nodes
+that become collectable when their owning DOM is removed, while application
+listeners and intervals have explicit one-time or cleanup behaviour.
+
+Current regression coverage verifies session cleanup, active latency timer
+behaviour, closed-tab release, safe DOM patterns, upload constraints, build
+hardening, and other earlier fixes.
+
+The aggregate test harness still referenced VS Code files deleted in
+`4fc3b19` and a CGO flag removed by the same pure-Go migration. This caused
+`npm test` to fail before reaching its current assertions. The stale VS Code
+checks were removed, and the obsolete `-O2 -g0` assertion was replaced with a
+check that the current build retains `CGO_ENABLED=0`. Both frontend suites now
+pass.
+
+No confirmed exploitable current DOM injection was found. Some `innerHTML`
+usage remains and relies on escaping helpers or trusted static markup; future
+changes should prefer `textContent` and DOM construction for dynamic data.
+
+## 15. Infrastructure and Deployment Review
+
+Reviewed:
+
+- Shell, PowerShell, Makefile, and shared build helpers.
+- GitHub Actions release configuration.
+- Updater endpoint and PHP manifest delivery.
+- Cross-platform build flags and Go toolchain selection.
+
+Fixed:
+
+- Unix build scripts now reject Go versions older than 1.25.12.
+- `go.mod` requests Go 1.26.5 while keeping 1.25.12 as the minimum supported
+  language/toolchain floor.
+- Stale regression coverage now reflects the pure-Go build.
+
+The updater remains a high-value trust boundary. Production release validation
+should verify HTTPS, hashes/signatures where supported, expected artefact
+names, and least-privilege release credentials. No new command-injection or
+manifest-escaping defect was confirmed.
+
+## 16. Logging, Monitoring, and Error Handling Review
+
+The new cleanup paths do not log credentials or secret responses. Upload
+cleanup treats remote partial-file deletion as best-effort because the
+underlying session may already be broken.
+
+Useful future operational signals:
+
+- Active and rejected streaming-upload counts.
+- Reconnect attempt count and pending credential prompts.
+- Active runtime listener and session counts in a diagnostics view.
+- Resource snapshots during long-running open/close soak tests.
+
+These should expose counts and identifiers only, never passwords, tokens,
+private keys, terminal contents, or bridge bearer tokens.
+
+## 17. Test Coverage and Security Regression Gaps
+
+Added:
+
+- Credential response routing by request ID.
+- Reconnect cancellation releases its secret prompt immediately.
+- Frontend cancellation is honoured.
+- SFTP cleanup is scoped to the owning session.
+- Active streaming uploads are bounded.
+- Service shutdown releases uploads and prompt waiters.
+- Existing permissive export files are tightened to `0600`.
+- Leviathan carve directories/files use `0700`/`0600`.
+
+Passing:
+
+- Full Go test suite.
+- Focused Go race suite.
+- Go vet.
+- Complete frontend lifecycle and regression suite.
+- Frontend production build.
+- JavaScript, shell, and PHP syntax checks.
+- `npm audit`.
+- Reachable Go vulnerability scan.
+
+Remaining gaps:
+
+- No packaged Wails UI smoke or long-duration tab/reconnect soak test.
+- No real SFTP server test proves partial-file deletion after a broken
+  transport.
+- No live IPv6 protocol endpoint was used.
+- Hostile-file parser coverage is uneven; fuzzing should be expanded.
+- Windows ACL behaviour is not verified by POSIX permission tests.
+- External Leviathan extractors lack integration tests for time and output
+  limits.
+
+## 18. Prioritised Remediation Plan
+
+Immediate:
+
+- Soak-test a packaged app while repeatedly opening, reconnecting, and closing
+  local and remote tabs. Monitor process CPU, memory, goroutines, file
+  descriptors, and listener/upload counts.
+- Exercise interrupted SFTP uploads against a real server and verify local
+  handle cleanup plus remote partial-file behaviour.
+
+Short-term:
+
+- Add a packaged Wails lifecycle smoke test.
+- Add fuzz targets for the highest-complexity Leviathan parsers.
+- Refresh the four module versions with unreachable advisories and run protocol
+  compatibility tests.
+- Add metrics or a diagnostics screen for active sessions, reconnects,
+  uploads, prompts, and event subscriptions.
+
+Medium-term:
+
+- Wrap every external Leviathan extractor with context timeout, process-group
+  termination, and output-size/file-count budgets before exposing extraction
+  through the UI.
+- Replace remaining dynamic `innerHTML` paths with text nodes or narrowly
+  reviewed rendering helpers.
+- Add real IPv6 SSH/VNC/IRC tunnel integration coverage.
+
+Long-term:
+
+- Add release CI gates for full tests, race-focused tests, `govulncheck`,
+  frontend audit/build, packaged smoke checks, and signed artefact validation.
+- Pin third-party GitHub Actions to reviewed immutable revisions.
+
+## 19. False Positives / Needs Manual Verification
+
+- Gosec MD5 and SHA-1 reports in Leviathan are forensic digest features, not
+  security authentication or password hashing.
+- Gosec subprocess reports include user-selected local shells, allow-listed SSH
+  key generation options, and an external extraction path not exposed by the
+  current document API. The extraction path still needs limits before future
+  exposure.
+- File-parser integer-conversion and slice warnings were reviewed
+  representatively; existing range checks rejected the paths inspected.
+  Fuzzing is required for stronger assurance.
+- The four remaining Go module advisories are present in required versions,
+  but `govulncheck` found no called symbol or imported vulnerable package path.
+- The fixed TLS issue had a reachable standard-library path, but actual ECH
+  exposure was not reproduced.
+- Sensitive-buffer clearing is best-effort and must not be described as
+  guaranteed memory erasure in Go.
+
+## 20. Final Notes
+
+The confirmed issues and their regression tests are committed in `b5c7528`.
+The most important improvement for the reported long-running-process behaviour
+is that credential event listeners, prompt waiters, and unfinished upload
+writers now have explicit owners and terminal cleanup paths.
+
+Closing a session now cancels its reconnect work and SFTP uploads; closing all
+sessions drains all uploads; application or bridge shutdown also unregisters
+runtime listeners and releases pending prompts. This materially improves
+cleanup, but live soak testing is still required before claiming that every OS,
+third-party library, and remote-peer resource remains flat indefinitely.

build-all.sh

@@ -1,302 +0,0 @@
-#!/usr/bin/env bash
-# build-all.sh — Cross-build helper for Nexus Terminal (macOS/Linux hosts)
-# Builds all supported targets where the required toolchains are installed.
-# Usage: ./build-all.sh
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
-source "$SCRIPT_DIR/scripts/build-common.sh"
-
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-log()  { echo -e "${GREEN}[nexus]${NC} $1"; }
-warn() { echo -e "${YELLOW}[nexus]${NC} $1"; }
-err()  { echo -e "${RED}[nexus]${NC} $1" >&2; }
-
-MIN_GO_VERSION="1.25.0"
-WAILS_VERSION="$(awk '$1 == "github.com/wailsapp/wails/v2" { print $2; exit }' go.mod)"
-WAILS_BIN=""
-WAILS_USE_GO_RUN=0
-BUILT_TARGETS=0
-SKIPPED_TARGETS=0
-
-if [ -x "$SCRIPT_DIR/.tools/go/bin/go" ]; then
-    export PATH="$SCRIPT_DIR/.tools/go/bin:$PATH"
-fi
-export GOCACHE="${GOCACHE:-$SCRIPT_DIR/.cache/go-build}"
-export GOPATH="${GOPATH:-$SCRIPT_DIR/.cache/go}"
-mkdir -p "$GOCACHE" "$GOPATH"
-export PATH="$GOPATH/bin:$PATH"
-
-version_at_least() {
-    local have="${1#go}"
-    local want="$2"
-    local IFS=.
-    local have_parts want_parts
-    read -r -a have_parts <<< "$have"
-    read -r -a want_parts <<< "$want"
-    for i in 0 1 2; do
-        local h="${have_parts[$i]:-0}"
-        local w="${want_parts[$i]:-0}"
-        if (( h > w )); then return 0; fi
-        if (( h < w )); then return 1; fi
-    done
-    return 0
-}
-
-check_go() {
-    command -v go >/dev/null 2>&1 || { err "Go is not installed"; exit 1; }
-
-    local version
-    version="$(go env GOVERSION 2>/dev/null || go version | awk '{print $3}')"
-    if ! version_at_least "$version" "$MIN_GO_VERSION"; then
-        err "Go ${MIN_GO_VERSION}+ is required by go.mod; found ${version} at $(command -v go)"
-        err "Install a newer Go, or place it at .tools/go/bin/go for this project."
-        exit 1
-    fi
-}
-
-resolve_wails() {
-    if WAILS_BIN="$(command -v wails 2>/dev/null)"; then
-        WAILS_USE_GO_RUN=0
-        return
-    fi
-
-    local gopath
-    gopath="$(go env GOPATH 2>/dev/null || true)"
-    if [ -n "$gopath" ] && [ -x "$gopath/bin/wails" ]; then
-        WAILS_BIN="$gopath/bin/wails"
-        WAILS_USE_GO_RUN=0
-        return
-    fi
-
-    if [ -n "$WAILS_VERSION" ]; then
-        WAILS_BIN="github.com/wailsapp/wails/v2/cmd/wails@${WAILS_VERSION}"
-        WAILS_USE_GO_RUN=1
-        warn "Wails CLI not found; using pinned ${WAILS_BIN} via go run"
-        return
-    fi
-
-    err "Wails is not installed and no Wails version was found in go.mod"
-    exit 1
-}
-
-wails_cmd() {
-    if [ "$WAILS_USE_GO_RUN" -eq 1 ]; then
-        go run "$WAILS_BIN" "$@"
-    else
-        "$WAILS_BIN" "$@"
-    fi
-}
-
-ensure_upx() {
-    if ! nexus_bool_enabled "${NEXUS_COMPRESS:-0}"; then
-        return
-    fi
-    if command -v upx >/dev/null 2>&1; then
-        return
-    fi
-    warn "UPX is not installed; compressed targets will be skipped unless the target does not use UPX."
-}
-
-linux_deps_ok() {
-    command -v pkg-config >/dev/null 2>&1 || return 1
-    pkg-config --exists gtk+-3.0 || return 1
-    if ! pkg-config --exists webkit2gtk-4.1 && ! pkg-config --exists webkit2gtk-4.0; then
-        return 1
-    fi
-    if ! pkg-config --exists ayatana-appindicator3-0.1 && ! pkg-config --exists appindicator3-0.1; then
-        return 1
-    fi
-}
-
-build_tags() {
-    if command -v pkg-config >/dev/null 2>&1 \
-        && pkg-config --exists webkit2gtk-4.1 \
-        && ! pkg-config --exists webkit2gtk-4.0; then
-        echo "webkit2_41"
-    fi
-}
-
-build_version() {
-    local tag
-    local commit
-    tag="$(git describe --tags --abbrev=0 2>/dev/null || echo "dev")"
-    commit="$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")"
-    echo "${tag}-${commit}"
-}
-
-build_ldflags() {
-    local version="$1"
-    local flags="-s -w -X github.com/andydixon/nexus/internal/api.appVersion=${version}"
-    if [ -n "${NEXUS_UPDATE_URL:-}" ]; then
-        flags="${flags} -X github.com/andydixon/nexus/internal/api.appUpdateURL=${NEXUS_UPDATE_URL}"
-    fi
-    echo "${flags}"
-}
-
-check_deps() {
-    check_go
-    command -v node >/dev/null 2>&1 || { err "Node.js is not installed"; exit 1; }
-    command -v npm >/dev/null 2>&1 || { err "npm is not installed"; exit 1; }
-    resolve_wails
-    ensure_upx
-
-    log "Go:    $(go version)"
-    log "Node:  $(node --version)"
-    log "Wails: $(wails_cmd version 2>/dev/null | head -1)"
-}
-
-install_deps() {
-    log "Installing Go dependencies…"
-    go mod download
-
-    log "Installing frontend dependencies…"
-    if [ -f frontend/package-lock.json ]; then
-        (cd frontend && npm ci)
-    else
-        (cd frontend && npm install)
-    fi
-}
-
-host_os() {
-    case "$(uname -s)" in
-        Darwin) echo "darwin" ;;
-        Linux) echo "linux" ;;
-        *) echo "unknown" ;;
-    esac
-}
-
-host_arch() {
-    case "$(uname -m)" in
-        x86_64|amd64) echo "amd64" ;;
-        arm64|aarch64) echo "arm64" ;;
-        *) echo "unknown" ;;
-    esac
-}
-
-pick_cc() {
-    local target_os="$1"
-    local target_arch="$2"
-
-    if [ "$target_os" = "windows" ]; then
-        if [ "$target_arch" = "amd64" ]; then
-            echo "x86_64-w64-mingw32-gcc"
-        else
-            echo "aarch64-w64-mingw32-gcc"
-        fi
-        return
-    fi
-
-    if [ "$target_os" = "linux" ]; then
-        if [ "$target_arch" = "amd64" ]; then
-            echo "x86_64-linux-gnu-gcc"
-        else
-            echo "aarch64-linux-gnu-gcc"
-        fi
-        return
-    fi
-
-    echo ""
-}
-
-build_target() {
-    local target_os="$1"
-    local target_arch="$2"
-    local host="$3"
-    local host_arch_value="$4"
-    local version="$5"
-    local platform="${target_os}/${target_arch}"
-    nexus_configure_release_cgo
-    local ldflags
-    ldflags="$(build_ldflags "${version}")"
-    local tags
-    tags="$(build_tags)"
-    local build_args=("-platform" "$target_os/$target_arch" "-trimpath")
-    if nexus_use_upx_for_target "$target_os"; then
-        if ! command -v upx >/dev/null 2>&1; then
-            warn "Skipping ${platform} (NEXUS_COMPRESS=1 requires UPX)"
-            ((SKIPPED_TARGETS += 1))
-            return 0
-        fi
-        build_args+=("-upx")
-        if [ -n "${NEXUS_UPX_FLAGS:-}" ]; then
-            build_args+=("-upxflags" "$NEXUS_UPX_FLAGS")
-        fi
-    elif nexus_skips_upx_for_target "$target_os"; then
-        warn "Skipping UPX compression for ${platform}; distribute the zipped .app instead, or set NEXUS_FORCE_MACOS_UPX=1 with suitable NEXUS_UPX_FLAGS."
-    fi
-    if [ -n "$tags" ]; then
-        build_args+=("-tags" "$tags")
-    fi
-    build_args+=("-ldflags" "$ldflags")
-
-    local cc=""
-
-    if [ "$target_os" = "linux" ] && ! linux_deps_ok; then
-        warn "Skipping ${platform} (missing Linux GTK/WebKit build dependencies)"
-        ((SKIPPED_TARGETS += 1))
-        return 0
-    fi
-
-    if [ "$target_os" != "$host" ] || [ "$target_arch" != "$host_arch_value" ]; then
-        cc="$(pick_cc "$target_os" "$target_arch")"
-        if [ -n "$cc" ] && ! command -v "$cc" >/dev/null 2>&1; then
-            warn "Skipping ${platform} (missing C compiler: ${cc})"
-            ((SKIPPED_TARGETS += 1))
-            return 0
-        fi
-    fi
-
-    log "Building ${platform}…"
-    if [ -n "$cc" ]; then
-        CC="$cc" CGO_ENABLED=1 wails_cmd build "${build_args[@]}"
-    else
-        CGO_ENABLED=1 wails_cmd build "${build_args[@]}"
-    fi
-    ((BUILT_TARGETS += 1))
-}
-
-main() {
-    check_deps
-    install_deps
-
-    local version
-    version="$(build_version)"
-
-    local host
-    host="$(host_os)"
-    local arch
-    arch="$(host_arch)"
-    if [ "$host" = "unknown" ] || [ "$arch" = "unknown" ]; then
-        err "Unsupported host platform: $(uname -s)/$(uname -m)"
-        exit 1
-    fi
-
-    build_target "$host" "$arch" "$host" "$arch" "$version"
-
-    # Cross-build Linux and Windows targets where toolchains are available
-    if [ "$host" = "darwin" ] || [ "$host" = "linux" ]; then
-        for target in linux/amd64 linux/arm64 windows/amd64 windows/arm64; do
-            local target_os="${target%%/*}"
-            local target_arch="${target##*/}"
-            if [ "$target_os" = "$host" ] && [ "$target_arch" = "$arch" ]; then
-                continue
-            fi
-            build_target "$target_os" "$target_arch" "$host" "$arch" "$version"
-        done
-    fi
-
-    if [ "$BUILT_TARGETS" -eq 0 ]; then
-        err "No targets were built; ${SKIPPED_TARGETS} target(s) were skipped because required system toolchains are missing."
-        exit 1
-    fi
-
-    log "Builds complete (${BUILT_TARGETS} built, ${SKIPPED_TARGETS} skipped). Output: build/bin/"
-}
-
-main "$@"

build.ps1

@@ -1,143 +0,0 @@
-# build.ps1 — Windows build script for Nexus Terminal
-# Usage: .\build.ps1 [dev|build|test|clean|deps]
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-function Write-Info($Message) { Write-Host "[nexus] $Message" -ForegroundColor Green }
-function Write-Warn($Message) { Write-Host "[nexus] $Message" -ForegroundColor Yellow }
-function Write-Err($Message)  { Write-Host "[nexus] $Message" -ForegroundColor Red }
-
-function Test-BoolEnabled([string]$Value) {
-    return $Value -match '^(1|true|TRUE|yes|YES|on|ON)$'
-}
-
-function Get-WailsPath {
-    $wails = Get-Command wails -ErrorAction SilentlyContinue
-    if ($wails) { return $wails.Source }
-
-    $goPath = & go env GOPATH
-    $fallback = Join-Path $goPath 'bin\wails.exe'
-    if (Test-Path $fallback) { return $fallback }
-    return $null
-}
-
-function Check-Deps {
-    if (-not (Get-Command go -ErrorAction SilentlyContinue)) { throw 'Go is not installed.' }
-    if (-not (Get-Command node -ErrorAction SilentlyContinue)) { throw 'Node.js is not installed.' }
-    if (-not (Get-Command npm -ErrorAction SilentlyContinue)) { throw 'npm is not installed.' }
-
-    $wailsPath = Get-WailsPath
-    if (-not $wailsPath) {
-        throw 'Wails is not installed. Run: go install github.com/wailsapp/wails/v2/cmd/wails@latest'
-    }
-
-    Write-Info "Go:    $(& go version)"
-    Write-Info "Node:  $(& node --version)"
-    Write-Info "Wails: $(& $wailsPath version | Select-Object -First 1)"
-
-    if (-not (Get-Command gcc -ErrorAction SilentlyContinue)) {
-        Write-Warn 'gcc not found. SQLite requires cgo + a C compiler (e.g. MSYS2 mingw-w64).'
-    }
-
-    return $wailsPath
-}
-
-function Install-Deps {
-    Write-Info 'Installing Go dependencies...'
-    & go mod download
-
-    Write-Info 'Installing frontend dependencies...'
-    Push-Location 'frontend'
-    & npm install
-    Pop-Location
-}
-
-function Get-BuildVersion {
-    try {
-        $tag = & git describe --tags --abbrev=0 2>$null
-        if (-not $tag) { $tag = 'dev' }
-    } catch {
-        $tag = 'dev'
-    }
-
-    try {
-        $commit = & git rev-parse --short HEAD 2>$null
-        if (-not $commit) { $commit = 'unknown' }
-    } catch {
-        $commit = 'unknown'
-    }
-
-    return "$tag-$commit"
-}
-
-function Get-Ldflags([string]$Version) {
-    $flags = "-s -w -buildid= -X github.com/andydixon/nexus/internal/api.appVersion=$Version"
-    if ($env:NEXUS_UPDATE_URL) {
-        $flags += " -X github.com/andydixon/nexus/internal/api.appUpdateURL=$($env:NEXUS_UPDATE_URL)"
-    }
-    return $flags
-}
-
-function Dev {
-    $wailsPath = Check-Deps
-    Install-Deps
-    Write-Info 'Starting development mode...'
-    & $wailsPath dev
-}
-
-function Build {
-    $wailsPath = Check-Deps
-    Install-Deps
-    $version = Get-BuildVersion
-    $ldflags = Get-Ldflags $version
-
-    $env:CGO_ENABLED = '1'
-    if (-not $env:CGO_CFLAGS) { $env:CGO_CFLAGS = '-O2 -g0' }
-    if (-not $env:CGO_CXXFLAGS) { $env:CGO_CXXFLAGS = '-O2 -g0' }
-
-    $buildArgs = @('build', '-trimpath')
-    if (Test-BoolEnabled $env:NEXUS_COMPRESS) {
-        if (-not (Get-Command upx -ErrorAction SilentlyContinue)) {
-            throw 'NEXUS_COMPRESS=1 requires UPX. Install it first.'
-        }
-        $buildArgs += '-upx'
-        if ($env:NEXUS_UPX_FLAGS) {
-            $buildArgs += @('-upxflags', $env:NEXUS_UPX_FLAGS)
-        }
-    }
-    $buildArgs += @('-ldflags', $ldflags)
-
-    Write-Info 'Building production binary (CGO_ENABLED=1)...'
-    & $wailsPath @buildArgs
-    Write-Info 'Build complete: build\bin\'
-}
-
-function Run-Tests {
-    Write-Info 'Running tests...'
-    & go test ./... -v -count=1
-}
-
-function Clean {
-    Write-Info 'Cleaning build artefacts...'
-    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue build\bin
-    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\node_modules
-    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\src\js\lib
-    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\src\css\lib
-    & go clean -testcache
-    Write-Info 'Clean complete'
-}
-
-$task = $args[0]
-if (-not $task) { $task = 'build' }
-
-switch ($task) {
-    'dev'   { Dev }
-    'build' { Build }
-    'test'  { Run-Tests }
-    'clean' { Clean }
-    'deps'  { Check-Deps | Out-Null; Install-Deps }
-    default {
-        Write-Err 'Usage: .\\build.ps1 [dev|build|test|clean|deps]'
-        exit 1
-    }
-}

build.sh

@@ -1,267 +0,0 @@
-#!/usr/bin/env bash
-# build.sh — Build script for Nexus Terminal
-# Provides a reproducible build process for CI and local builds.
-# Usage: ./build.sh [dev|build|test|clean|deps]
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
-source "$SCRIPT_DIR/scripts/build-common.sh"
-
-# Colours for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-log()  { echo -e "${GREEN}[nexus]${NC} $1"; }
-warn() { echo -e "${YELLOW}[nexus]${NC} $1"; }
-err()  { echo -e "${RED}[nexus]${NC} $1" >&2; }
-
-MIN_GO_VERSION="1.25.0"
-WAILS_VERSION="$(nexus_wails_version go.mod)"
-WAILS_BIN=""
-WAILS_USE_GO_RUN=0
-
-if [ -x "$SCRIPT_DIR/.tools/go/bin/go" ]; then
-    export PATH="$SCRIPT_DIR/.tools/go/bin:$PATH"
-fi
-export GOCACHE="${GOCACHE:-$SCRIPT_DIR/.cache/go-build}"
-export GOPATH="${GOPATH:-$SCRIPT_DIR/.cache/go}"
-mkdir -p "$GOCACHE" "$GOPATH"
-export PATH="$GOPATH/bin:$PATH"
-
-version_at_least() {
-    local have="${1#go}"
-    local want="$2"
-    local IFS=.
-    local have_parts want_parts
-    read -r -a have_parts <<< "$have"
-    read -r -a want_parts <<< "$want"
-    for i in 0 1 2; do
-        local h="${have_parts[$i]:-0}"
-        local w="${want_parts[$i]:-0}"
-        if (( h > w )); then return 0; fi
-        if (( h < w )); then return 1; fi
-    done
-    return 0
-}
-
-check_go() {
-    command -v go >/dev/null 2>&1 || { err "Go is not installed"; exit 1; }
-
-    local version
-    version="$(go env GOVERSION 2>/dev/null || go version | awk '{print $3}')"
-    if ! version_at_least "$version" "$MIN_GO_VERSION"; then
-        err "Go ${MIN_GO_VERSION}+ is required by go.mod; found ${version} at $(command -v go)"
-        err "Install a newer Go, or place it at .tools/go/bin/go for this project."
-        exit 1
-    fi
-}
-
-resolve_wails() {
-    if WAILS_BIN="$(command -v wails 2>/dev/null)"; then
-        WAILS_USE_GO_RUN=0
-        return
-    fi
-
-    local gopath
-    gopath="$(go env GOPATH 2>/dev/null || true)"
-    if [ -n "$gopath" ] && [ -x "$gopath/bin/wails" ]; then
-        WAILS_BIN="$gopath/bin/wails"
-        WAILS_USE_GO_RUN=0
-        return
-    fi
-
-    if [ -n "$WAILS_VERSION" ]; then
-        WAILS_BIN="github.com/wailsapp/wails/v2/cmd/wails@${WAILS_VERSION}"
-        WAILS_USE_GO_RUN=1
-        warn "Wails CLI not found; using pinned ${WAILS_BIN} via go run"
-        return
-    fi
-
-    err "Wails is not installed and no Wails version was found in go.mod"
-    exit 1
-}
-
-wails_cmd() {
-    if [ "$WAILS_USE_GO_RUN" -eq 1 ]; then
-        go run "$WAILS_BIN" "$@"
-    else
-        "$WAILS_BIN" "$@"
-    fi
-}
-
-ensure_upx() {
-    if ! nexus_bool_enabled "${NEXUS_COMPRESS:-0}"; then
-        return
-    fi
-    if nexus_skips_upx_for_target "$(host_os)"; then
-        return
-    fi
-    if command -v upx >/dev/null 2>&1; then
-        return
-    fi
-    err "NEXUS_COMPRESS=1 requires UPX. Install it first, for example: brew install upx"
-    exit 1
-}
-
-check_linux_deps() {
-    if [ "$(uname -s)" != "Linux" ]; then
-        return
-    fi
-
-    command -v pkg-config >/dev/null 2>&1 || {
-        err "pkg-config is required for Linux Wails builds."
-        err "On Ubuntu/Pop!_OS install: sudo apt-get install -y build-essential pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev"
-        exit 1
-    }
-
-    local missing=()
-    pkg-config --exists gtk+-3.0 || missing+=("gtk+-3.0")
-    if ! pkg-config --exists webkit2gtk-4.1 && ! pkg-config --exists webkit2gtk-4.0; then
-        missing+=("webkit2gtk-4.1 or webkit2gtk-4.0")
-    fi
-    if ! pkg-config --exists ayatana-appindicator3-0.1 && ! pkg-config --exists appindicator3-0.1; then
-        missing+=("ayatana-appindicator3-0.1 or appindicator3-0.1")
-    fi
-
-    if [ "${#missing[@]}" -gt 0 ]; then
-        err "Missing Linux build dependencies: ${missing[*]}"
-        err "On Ubuntu/Pop!_OS install: sudo apt-get install -y build-essential pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev"
-        exit 1
-    fi
-}
-
-build_tags() {
-    nexus_build_tags
-}
-
-host_os() {
-    case "$(uname -s)" in
-        Darwin) echo "darwin" ;;
-        Linux) echo "linux" ;;
-        *) echo "unknown" ;;
-    esac
-}
-
-build_version() {
-    nexus_build_version
-}
-
-build_ldflags() {
-    nexus_build_ldflags "$1"
-}
-
-# Check prerequisites
-check_deps() {
-    check_go
-    command -v node >/dev/null 2>&1 || { err "Node.js is not installed"; exit 1; }
-    command -v npm >/dev/null 2>&1 || { err "npm is not installed"; exit 1; }
-    check_linux_deps
-    resolve_wails
-    ensure_upx
-
-    log "All prerequisites found"
-    log "Go:    $(go version)"
-    log "Node:  $(node --version)"
-    log "Wails: $(wails_cmd version 2>/dev/null | head -1)"
-}
-
-# Install dependencies
-install_deps() {
-    log "Installing Go dependencies…"
-    go mod download
-
-    log "Installing frontend dependencies…"
-    if [ -f frontend/package-lock.json ]; then
-        (cd frontend && npm ci)
-    else
-        (cd frontend && npm install)
-    fi
-
-    log "Dependencies installed"
-}
-
-# Development mode
-dev() {
-    check_deps
-    install_deps
-    log "Starting development mode…"
-    wails_cmd dev
-}
-
-# Production build
-build() {
-    check_deps
-    install_deps
-    log "Building production binary…"
-    local version
-    version="$(build_version)"
-    local tags
-    tags="$(build_tags)"
-    nexus_configure_release_cgo
-    local build_args=("-trimpath")
-    if nexus_bool_enabled "${NEXUS_COMPRESS:-0}"; then
-        if nexus_skips_upx_for_target "$(host_os)"; then
-            warn "Skipping UPX compression on macOS; distribute the zipped .app instead, or set NEXUS_FORCE_MACOS_UPX=1 with suitable NEXUS_UPX_FLAGS."
-        else
-            log "Using UPX compression"
-            build_args+=("-upx")
-            if [ -n "${NEXUS_UPX_FLAGS:-}" ]; then
-                build_args+=("-upxflags" "$NEXUS_UPX_FLAGS")
-            fi
-        fi
-    fi
-    if [ -n "$tags" ]; then
-        log "Using Wails build tags: ${tags}"
-        wails_cmd build "${build_args[@]}" -tags "$tags" -ldflags "$(build_ldflags "${version}")"
-    else
-        wails_cmd build "${build_args[@]}" -ldflags "$(build_ldflags "${version}")"
-    fi
-
-    # Replace Wails-generated icon with custom app icon on macOS.
-    if [[ "$OSTYPE" == darwin* ]]; then
-        local app_bundle="build/bin/nexus-terminal.app"
-        local custom_icns="build/darwin/AppIcon.icns"
-        if [ -d "$app_bundle" ] && [ -f "$custom_icns" ]; then
-            cp "$custom_icns" "$app_bundle/Contents/Resources/iconfile.icns"
-            log "Replaced app icon with custom AppIcon.icns"
-        fi
-    fi
-
-    log "Build complete: build/bin/"
-}
-
-# Run tests
-run_tests() {
-    check_go
-    log "Running tests…"
-    go test ./... -v -count=1
-    (cd frontend && npm test)
-}
-
-# Clean build artefacts
-clean() {
-    log "Cleaning build artefacts…"
-    rm -rf build/bin
-    rm -rf frontend/node_modules
-    rm -rf frontend/src/js/lib
-    if command -v go >/dev/null 2>&1; then
-        go clean -testcache
-    fi
-    log "Clean complete"
-}
-
-# Main
-case "${1:-build}" in
-    dev)     dev ;;
-    build)   build ;;
-    test)    run_tests ;;
-    clean)   clean ;;
-    deps)    check_deps && install_deps ;;
-    *)
-        echo "Usage: $0 [dev|build|test|clean|deps]"
-        exit 1
-        ;;
-esac

build/darwin/Info.plist

@@ -1,69 +0,0 @@
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-    <dict>
-        <key>CFBundlePackageType</key>
-        <string>APPL</string>
-        <key>CFBundleName</key>
-        <string>{{.Info.ProductName}}</string>
-        <key>CFBundleExecutable</key>
-        <string>{{.OutputFilename}}</string>
-        <key>CFBundleIdentifier</key>
-        <string>com.andydixon.nexusterminal</string>
-        <key>CFBundleVersion</key>
-        <string>{{.Info.ProductVersion}}</string>
-        <key>CFBundleGetInfoString</key>
-        <string>{{.Info.Comments}}</string>
-        <key>CFBundleShortVersionString</key>
-        <string>{{.Info.ProductVersion}}</string>
-        <key>CFBundleIconFile</key>
-        <string>iconfile</string>
-        <key>LSMinimumSystemVersion</key>
-        <string>10.13.0</string>
-        <key>LSApplicationCategoryType</key>
-        <string>public.app-category.developer-tools</string>
-        <key>NSHighResolutionCapable</key>
-        <string>true</string>
-        <key>NSSupportsAutomaticTermination</key>
-        <false/>
-        <key>NSSupportsSuddenTermination</key>
-        <false/>
-        <key>NSHumanReadableCopyright</key>
-        <string>{{.Info.Copyright}}</string>
-        {{if .Info.FileAssociations}}
-        <key>CFBundleDocumentTypes</key>
-        <array>
-          {{range .Info.FileAssociations}}
-          <dict>
-            <key>CFBundleTypeExtensions</key>
-            <array>
-              <string>{{.Ext}}</string>
-            </array>
-            <key>CFBundleTypeName</key>
-            <string>{{.Name}}</string>
-            <key>CFBundleTypeRole</key>
-            <string>{{.Role}}</string>
-            <key>CFBundleTypeIconFile</key>
-            <string>{{.IconName}}</string>
-          </dict>
-          {{end}}
-        </array>
-        {{end}}
-        {{if .Info.Protocols}}
-        <key>CFBundleURLTypes</key>
-        <array>
-          {{range .Info.Protocols}}
-            <dict>
-                <key>CFBundleURLName</key>
-                <string>com.wails.{{.Scheme}}</string>
-                <key>CFBundleURLSchemes</key>
-                <array>
-                    <string>{{.Scheme}}</string>
-                </array>
-                <key>CFBundleTypeRole</key>
-                <string>{{.Role}}</string>
-            </dict>
-          {{end}}
-        </array>
-        {{end}}
-    </dict>
-</plist>

build/windows/info.json

@@ -1,15 +0,0 @@
-{
-	"fixed": {
-		"file_version": "{{.Info.ProductVersion}}"
-	},
-	"info": {
-		"0000": {
-			"ProductVersion": "{{.Info.ProductVersion}}",
-			"CompanyName": "{{.Info.CompanyName}}",
-			"FileDescription": "{{.Info.ProductName}}",
-			"LegalCopyright": "{{.Info.Copyright}}",
-			"ProductName": "{{.Info.ProductName}}",
-			"Comments": "{{.Info.Comments}}"
-		}
-	}
-}

build/windows/wails.exe.manifest

@@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
-    <assemblyIdentity type="win32" name="com.wails.{{.Name}}" version="{{.Info.ProductVersion}}.0" processorArchitecture="*"/>
-    <dependency>
-        <dependentAssembly>
-            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
-        </dependentAssembly>
-    </dependency>
-    <asmv3:application>
-        <asmv3:windowsSettings>
-            <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <!-- fallback for Windows 7 and 8 -->
-            <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">permonitorv2,permonitor</dpiAwareness> <!-- falls back to per-monitor if per-monitor v2 is not supported -->
-        </asmv3:windowsSettings>
-    </asmv3:application>
-</assembly>

docs/build-and-release.md

@@ -1,77 +1,74 @@
 # Build and Release
 
-This project uses [Wails](https://wails.io/) for desktop packaging.
+Nexus Terminal is a Rust workspace in `rust/`:
 
-## Ubuntu 24.04 prerequisites
-
-Install the Linux build toolchain and Wails runtime headers with:
-
-```bash
-sudo apt-get update
-sudo apt-get install -y \
-  build-essential \
-  libgtk-3-dev \
-  libwebkit2gtk-4.1-dev \
-  libayatana-appindicator3-dev \
-  pkg-config \
-  zip
+```
+rust/
+├── core/   nexus-core: storage, secrets, protocol clients, session manager, Service. No GUI.
+└── app/    nexus: the egui desktop app (binary `nexus-terminal`)
 ```
 
-Notes:
+The toolchain is pinned in `rust/rust-toolchain.toml`; `rustup` installs it on first build.
 
-- Ubuntu 24.04 does not ship `libwebkit2gtk-4.0-dev`.
-- Wails `v2.12.0` supports Ubuntu 24.04 by building with the `webkit2_41` tag.
-- The local build scripts detect that package layout automatically and add the tag when needed.
+## Prerequisites
 
-You will also need these tools available in `PATH`:
+- **All platforms:** [rustup](https://rustup.rs).
+- **Linux:** the X11/Wayland/GL headers eframe links against, and GTK for native file dialogs:
 
-- `go`
-- `node`
-- `npm`
-- `wails`
+  ```bash
+  sudo apt-get install -y build-essential pkg-config libxkbcommon-dev libgl1-mesa-dev \
+    libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
+  ```
 
-Install the Wails CLI with:
+- **macOS:** Xcode command-line tools (`xcode-select --install`).
+- **Windows:** the MSVC build tools (Visual Studio Build Tools, "Desktop development with C++").
+
+There are no runtime C libraries to install: SQLite is compiled in and TLS uses rustls.
+
+## Build and run
 
 ```bash
-go install github.com/wailsapp/wails/v2/cmd/wails@latest
-export PATH="$PATH:$(go env GOPATH)/bin"
+cd rust
+cargo run --release                 # the app
+cargo test --workspace              # unit and integration tests
+cargo clippy --workspace -- -D warnings
 ```
 
-## Build commands
+Useful flags (also handy for testing): `nexus-terminal [--theme pro|midnight|light]
+[--data-dir DIR] [--screenshot out.png] [--size WxH] [--run-local CMD]`. `--data-dir` points at
+another data directory; `--screenshot` renders the window, saves a PNG and exits (works under
+`xvfb-run`); `--run-local` opens a local terminal and types `CMD` into it.
 
-Build the app binary for the current host:
-
-```bash
-./build.sh
-```
-
-Build a packaged release for the current host platform:
-
-```bash
-./release.sh
-```
-
-By default, `./release.sh` now builds only the current host OS/architecture. On this Ubuntu 24.04 `amd64` host that means `linux/amd64`.
-
-## Optional cross-compilers
-
-If you want to add extra Linux/Windows targets from Ubuntu, install the relevant cross-compiler packages first:
-
-```bash
-sudo apt-get install -y \
-  gcc-aarch64-linux-gnu \
-  gcc-mingw-w64-x86-64
-```
-
-Then request explicit targets:
+The SSH integration tests start a throwaway `sshd` as the current user on a random port; they
+skip themselves when OpenSSH isn't installed.
+
+## Release packages
 
 ```bash
+cd rust
+./release.sh                                            # this machine's platform
 NEXUS_RELEASE_TARGETS=linux/amd64,windows/amd64 ./release.sh
 ```
 
-## Platform caveats
+Artefacts land in `build/releases/<version>/` at the repo root:
 
-- macOS targets cannot be cross-built from Linux with Wails. Build those on macOS.
-- `windows/arm64` is not covered by the default Ubuntu toolchain here.
-- `linux/arm64` needs more than `gcc-aarch64-linux-gnu`; it also needs an `arm64` sysroot and target GTK/WebKit development libraries for CGO to link cleanly.
-- Tested on Ubuntu 24.04 `amd64`: `linux/amd64` and `windows/amd64` build successfully; `linux/arm64` does not in the default host setup above.
+- `NexusTerminal-<os>-<arch>.zip` — on macOS a universal-capable `.app` bundle
+  (`rust/packaging/macos/build-app.sh`), on Windows the `.exe` (icon and version info embedded,
+  GUI subsystem), on Linux the binary plus `install.sh` and a `.desktop` entry
+  (`rust/packaging/linux/install.sh` installs into `~/.local`).
+- `manifest-<os>-<arch>.json` and `version-<os>-<arch>.txt` for the update server
+  (`updates/index.php`), in the same format as before.
+
+The version is `<latest tag>-<short commit>` unless `NEXUS_VERSION` is set. The update manifest
+URL is compiled in from `NEXUS_UPDATE_URL` (default in `release.sh`); `{platform}` and `{arch}` use
+the old Go names (`darwin`/`linux`/`windows`, `amd64`/`arm64`).
+
+Cross-building `windows/amd64` from Linux works with `x86_64-pc-windows-gnu` and mingw-w64.
+macOS bundles must be built on a Mac. CI (`.github/workflows/release-builds.yml`) builds every
+platform natively on GitHub runners and attaches the zips to tagged releases;
+`.github/workflows/ci.yml` runs tests and clippy on Linux, macOS and Windows.
+
+## Signing
+
+macOS bundles are ad-hoc signed. For distribution, sign with a Developer ID and notarize (see the
+comments in `build-app.sh`). Windows binaries are unsigned.

docs/guide/Makefile

@@ -0,0 +1,11 @@
+# Builds nexus-guide.pdf with LuaLaTeX (three passes: contents, page references, then page overlays settle).
+# Needs LuaLaTeX with luaotfload (Debian/Ubuntu: texlive-luatex texlive-latex-extra).
+# Screenshots: tools/screenshots.sh (needs xvfb-run, sshd, python3).
+OUT ?= build
+nexus-guide.pdf: nexus-guide.tex nexus-guide.sty chapters/*.tex img/*
+	mkdir -p $(OUT)
+	lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null || (grep -A8 '^!' $(OUT)/nexus-guide.log; false)
+	for i in 1 2; do lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null; done
+	cp $(OUT)/nexus-guide.pdf .
+clean:
+	rm -rf $(OUT)

docs/guide/chapters/appendix.tex

@@ -0,0 +1,111 @@
+\guidepart{slate}{Extras}{The extras}
+  {The cheat sheet, the command line, and words you might trip over.}
+  {\partitem{\iKeyboard}{Keyboard cheat sheet}
+   \partitem{\iTerminal}{Command-line options}
+   \partitem{\iBrain}{Glossary}}
+
+% =========================================================================================
+\chapter{Keyboard cheat sheet}\label{app:keys}
+\chapmeta{print it}{Stick this page next to your monitor}
+
+\newcommand\shortcut[2]{#1 & #2\\}
+\newcommand\sheet[3]{%
+  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=10pt, right=10pt, top=8pt, bottom=8pt,
+    before skip=0pt, after skip=10pt, fontupper=\small]
+  {\heavy\large\color{#1!85!black}#2}\par\vspace{4pt}
+  \renewcommand\arraystretch{1.5}\begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{36mm}@{}}#3\end{tabularx}
+  \end{tcolorbox}}
+
+\begin{multicols}{2}
+\sheet{accent}{\iRocket\enspace Everywhere}{%
+  \shortcut{Command palette}{\keys{\mod+K}}
+  \shortcut{New connection}{\keys{\mod+N}}
+  \shortcut{Quick Connect}{\keys{\mod+Shift+Q}}
+  \shortcut{Settings}{\keys{\mod+,}}
+  \shortcut{Full screen}{\kbd{F11}}}
+
+\sheet{violet}{\iSplit\enspace Tabs \& panes}{%
+  \shortcut{Close tab}{\keys{\mod+W}}
+  \shortcut{Next tab}{\keys{\mod+Tab}}
+  \shortcut{Previous tab}{\keys{\mod+Shift+Tab}}
+  \shortcut{Go to tab 1–9}{\keys{\mod+1}…\kbd{9}}
+  \shortcut{Split right}{\keys{\mod+Shift+D}}
+  \shortcut{Split down}{\keys{\mod+Shift+E}}}
+
+\sheet{teal}{\iWand\enspace Power tools}{%
+  \shortcut{Broadcast on/off}{\keys{\mod+Shift+B}}
+  \shortcut{Snippets}{\keys{\mod+Shift+S}}
+  \shortcut{Record on/off}{\keys{\mod+Shift+R}}}
+
+\sheet{amber}{\iTerminal\enspace In the terminal}{%
+  \shortcut{Copy selection}{\keys{\mod+C}}
+  \shortcut{Paste}{\keys{\mod+V}}
+  \shortcut{Find}{\keys{\mod+F}}
+  \shortcut{Next / previous match}{\kbd{Enter} / \keys{Shift+Enter}}
+  \shortcut{Scroll a page}{\keys{Shift+PageUp}}
+  \shortcut{Top / bottom}{\keys{Shift+Home} / \kbd{End}}
+  \shortcut{Open link}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}}
+
+\sheet{pink}{\iMap\enspace Mouse moves}{%
+  \shortcut{Select word / line}{double / triple-click}
+  \shortcut{Extend selection}{\kbd{Shift} + click}
+  \shortcut{Select several profiles}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}
+  \shortcut{Everything else}{right-click it}}
+\end{multicols}
+
+% =========================================================================================
+\chapter{Command-line options}\label{app:cli}
+\chapmeta{1 minute}{You'll script, demo and test with a few handy flags}
+
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\ttfamily\color{ink}}p{52mm}X@{}}
+  \toprule
+  --data-dir DIR        & Use another data folder (portable installs, demos, testing).\\
+  --theme pro|midnight|light & Start with this theme.\\
+  --connect NAME        & Connect to a saved profile by name at startup. Repeat it for several.\\
+  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security}, \code{snippets},
+                          \code{keys}, \code{recordings}, \code{palette}, \code{quick}…\\
+  --version             & Print the version and exit.\\
+  \bottomrule
+\end{tabularx}
+
+\begin{sidequest}[How the screenshots in this guide were made]
+Every screenshot here is the real app, driven by \code{docs/guide/tools/screenshots.sh}: it starts throwaway
+SSH, IRC, VNC and GitHub-ish servers, fills a demo data folder, and runs Nexus Terminal headless with
+\code{--screenshot}, \code{--do} (run a palette command) and \code{--answer} (fill a password prompt). Change the app,
+rerun the script, rebuild the guide.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Glossary}\label{app:glossary}
+\chapmeta{dip in}{Words you might trip over, in one line each}
+
+\begin{multicols}{2}\small
+\begin{description}[leftmargin=0pt, itemsep=5pt]
+  \item[Agent] A background program holding your unlocked SSH keys, so you type the passphrase once.
+  \item[Asciicast] The file format for terminal recordings. Plays in Nexus Terminal and \code{asciinema}.
+  \item[Bastion / jump host] A server you go \emph{through} to reach the ones behind it.
+  \item[Baud rate] How fast a serial line talks. Both ends must agree.
+  \item[Broadcast] Typing into several sessions at once.
+  \item[DTR / RTS] Serial control lines. Some boards use them for reset or flashing.
+  \item[Fingerprint] A short summary of a server's host key, used to spot imposters.
+  \item[Host key] A server's identity. Changes when it's rebuilt, or when someone's pretending.
+  \item[Keychain] Your operating system's password store.
+  \item[Port forward] A tunnel carrying one TCP port through SSH.
+  \item[Profile] A saved connection.
+  \item[RAW TCP] A plain socket: bytes in, bytes out, no terminal rules.
+  \item[SFTP] File transfer over SSH.
+  \item[Snippet] A saved command, optionally with blanks to fill in.
+  \item[TOTP] Time-based one-time passwords: the six digits from your authenticator app.
+  \item[Trigger] A rule that watches output and reacts to a pattern.
+  \item[Vault] Nexus Terminal's encrypted password store, for when there's no keychain.
+  \item[VNC] A way of seeing and controlling another computer's desktop.
+\end{description}
+\end{multicols}
+
+\vfill
+\begin{center}
+\includegraphics[width=16mm]{img/logo.pdf}\par\vspace{6pt}
+{\heavy\color{ink}That's the lot.}\par
+{\small\color{muted}Go and connect to something. \iRocket}
+\end{center}

docs/guide/chapters/part1-start.tex

@@ -0,0 +1,248 @@
+\guidepart{accent}{Get going}{Get going}
+  {From zero to connected before your tea goes cold.}
+  {\partitem{\iRocket}{Five-minute start}
+   \partitem{\iMap}{The grand tour}
+   \partitem{\iList}{Profiles: your address book}}
+
+% =========================================================================================
+\chapter{Five-minute start}\label{ch:start}
+\chapmeta{5 minutes}{You'll be connected to something and know the one shortcut that matters}
+
+\begin{tldr}
+Install it, open it, press \keys{\mod+N}, fill in a host, hit \ui{Create \& Connect}. Done.
+Lost? Press \keys{\mod+K} and type what you want.
+\end{tldr}
+
+\section{Install it}
+
+Grab the zip for your machine from \code{dixon.cx/downloads/nexus}. They're named
+\code{NexusTerminal-<os>-<arch>.zip}, so a modern Mac wants \code{darwin-arm64} and most PCs want \code{amd64}.
+
+\begin{description}
+  \item[\iDesktop\enspace Windows] Unzip it and run \code{NexusTerminal-windows-amd64.exe}. No installer, no admin rights,
+    nothing in the registry. Pop it somewhere sensible like \code{C:\textbackslash Tools} and pin it to the taskbar.
+  \item[\iDesktop\enspace macOS] Unzip it and drag \code{NexusTerminal-darwin-arm64.app} into \ui{Applications}. If macOS
+    grumbles that it can't check the developer, right-click the app, choose \ui{Open}, then \ui{Open} again. You only
+    have to do that once.
+  \item[\iDesktop\enspace Linux] Unzip it and run \code{./install.sh}. It copies \code{nexus-terminal} into
+    \code{~/.local/bin} and adds a launcher entry with the icon, so it turns up in your app menu.
+    (Make sure \code{~/.local/bin} is on your \code{PATH}.)
+\end{description}
+
+\begin{sidequest}[Build it yourself]
+It's a single Rust program. With Rust installed: \code{cd rust \&\& cargo run --release}. The finished binary lands in
+\code{rust/target/release/nexus-terminal}. The build guide in \code{docs/build-and-release.md} has the full story.
+\end{sidequest}
+
+\section{Open it}
+
+The first time you open Nexus Terminal you get a calm, empty welcome screen. Three buttons, four shortcuts. That's it.
+
+\shot{welcome.png}{The welcome screen. Your saved connections will live down the left; here there are a few already.}
+
+\begin{headsup}[Coming from Alchementary Link?]
+Nexus Terminal spots your old data on first run and copies your profiles, vault and recordings across
+automatically. You'll see a little toast saying so. Your old data is left exactly where it was.
+The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
+\end{headsup}
+
+\section{Make your first connection}
+
+\begin{enumerate}
+  \item Click \ui{New Connection}, or press \keys{\mod+N}.
+  \item Pick the protocol along the top: \proto[teal]{SSH}, \proto[amber]{Telnet}, \proto[violet]{RAW TCP},
+        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[amber]{IRC} or \proto[accent]{Serial}.
+  \item Fill in the \ui{General} bit: a \ui{Display Name} you'll recognise, the \ui{Host}, the \ui{Port}
+        and your \ui{Username}.
+  \item Click \ui{Create \& Connect}.
+\end{enumerate}
+
+That's genuinely it. A tab opens, you log in, and next time it's one click in the sidebar.
+
+\crop{editor-new.png}{1515}{40}{0}{70}{0.52\linewidth}{A brand-new SSH profile. Only the top few fields are needed to get going.}
+
+\begin{quickwin}
+Click \ui{Test} before you save. Nexus Terminal checks the host and port are reachable and tells you the
+round-trip time. If that fails, no amount of password-fiddling will help, so it's a great first check.
+\end{quickwin}
+
+\section{Two shortcuts for impatient people}
+
+\subsection{Quick Connect}
+Press \keys{\mod+Shift+Q}.
+For a one-off session you don't want to save. Pick SSH, Telnet, RAW, IRC or Serial, type the host (or serial
+device), hit \kbd{Enter}. Nothing gets saved.
+
+\crop{quick.png}{951}{620}{946}{481}{0.5\linewidth}{Quick Connect. In, out, nobody gets hurt.}
+
+\subsection{Local terminal}
+Click \ui{Local Machine} at the top of the sidebar (or \ui{Local} on the welcome screen) for a shell on
+\emph{this} computer. When you type \code{exit}, the tab says \code{[Exited - press enter to restart]}.
+Press \kbd{Enter} and you've got a fresh shell in the same tab.
+
+\section{The one shortcut to rule them all}
+
+\begin{center}
+\begin{tcolorbox}[enhanced, width=0.8\linewidth, arc=10pt, boxrule=0pt, colback=ink, fontupper=\color{white},
+  halign=center, top=10pt, bottom=10pt, drop fuzzy shadow]
+{\scalebox{2.4}{\keys{\mod+K}}}\par\vspace{6pt}\par\vspace{4pt}
+{\color{white!70!ink} The command palette. If you remember nothing else, remember this.}
+\end{tcolorbox}
+\end{center}
+
+Type a few letters of \emph{anything}: a connection name, a tab, ``theme'', ``split'', ``lock'', ``snippets''. Use
+\kbd{↑}\kbd{↓} to pick, \kbd{Enter} to go, \kbd{Esc} to bail. It's fuzzy, so ``atl'' finds \emph{atlas} and
+``sft'' finds the \emph{SFTP Browser}.
+
+\crop{palette.png}{755}{732}{733}{154}{0.72\linewidth}{The command palette: every connection, tab and action in one searchable list.}
+
+\begin{quickwin}[Your five-minute checklist]
+\begin{checklist}
+  \item Installed and opened Nexus Terminal
+  \item Opened a \ui{Local Machine} tab and typed \code{exit}, then \kbd{Enter} to get it back
+  \item Made a profile with \keys{\mod+N} and clicked \ui{Test}
+  \item Connected to it
+  \item Opened the palette with \keys{\mod+K} and found something by typing three letters
+\end{checklist}
+All ticked? You're officially more productive than you were five minutes ago. \iConfetti
+\end{quickwin}
+
+% =========================================================================================
+\chapter{The grand tour}\label{ch:tour}
+\chapmeta{4 minutes}{You'll know what every bit of the window is for}
+
+\begin{tldr}
+Connections on the left. Sessions in tabs across the top. The terminal in the middle. Status along the bottom.
+Everything else is one \keys{\mod+K} away.
+\end{tldr}
+
+\begin{annotated}{ssh.png}
+  \callout{1}{0.124}{0.022}
+  \callout{2}{0.66}{0.022}
+  \callout{3}{0.888}{0.022}
+  \callout{4}{0.22}{0.067}
+  \callout{5}{0.03}{0.152}
+  \callout{6}{0.53}{0.063}
+  \callout{7}{0.966}{0.063}
+  \callout{8}{0.62}{0.42}
+  \callout{9}{0.16}{0.945}
+  \callout{10}{0.26}{0.985}
+  \callout{11}{0.86}{0.985}
+\end{annotated}
+
+\begin{multicols}{2}\small
+\begin{description}[leftmargin=0pt, labelsep=0.4em]
+  \item[\num{1} Menus] \menu{File}, \menu{Session}, \menu{View} and \menu{Help}. Drag the title bar to move the
+        window; double-click it to maximise.
+  \item[\num{2} Palette] The search box is the command palette. Click it or press \keys{\mod+K}.
+  \item[\num{3} Light/dark] Flip between the dark and light themes in one click.
+  \item[\num{4} Search] Fuzzy-search your connections by name, host, tag or protocol.
+  \item[\num{5} Sections] \ui{Local Machine}, \ui{Favourites} \iStar, \ui{Recent} (your last five), then one section
+        per group. Click a header to fold it away.
+  \item[\num{6} Tabs] One per session, with a coloured state dot, protocol badge and close button. SSH tabs get a
+        little \iFolder{} for files. A blue dot means ``new output while you weren't looking''.
+  \item[\num{7} New \& broadcast] \ui{+} opens a new connection; \iBroadcast{} toggles broadcast mode.
+  \item[\num{8} Workspace] Your terminal (or IRC chat, VNC desktop, GitHub list…). Split it into panes, too.
+  \item[\num{9} Footer] New connection, palette, import, export, recordings and settings.
+  \item[\num{10} Status] State, protocol and live latency for SSH. Shows \ui{REC} while recording and
+        \ui{BROADCAST} when broadcasting.
+  \item[\num{11} Sessions \& vault] How many sessions are connected and whether the vault is locked. Click the vault to
+        open security settings.
+\end{description}
+\end{multicols}
+
+\begin{protip}
+Drag the right-hand edge of the sidebar to make it wider or narrower. Toasts (the little pop-up messages in the
+top-right) tidy themselves away after a few seconds; click \ui{×} if you're impatient.
+\end{protip}
+
+\section{Three looks}
+
+Nexus Terminal comes in \ui{Pro} (the default, a soft charcoal), \ui{Midnight} (darker, bluer, for 2\,a.m.
+deploys) and \ui{Light} (for sunny days and projectors). Switch with the \iBulb{} button in the title bar, the
+\menu{View} menu, or type ``theme'' into the palette.
+
+\shotpair{welcome-midnight.png}{Midnight}{ssh-light.png}{Light, with a session open}
+
+The \emph{terminal} has its own colour schemes too: eleven of them, including \ui{Dracula}, \ui{Nord},
+\ui{Tokyo Night}, \ui{Catppuccin Mocha} and \ui{Rosé Pine}. Those live in \menu{Settings\then Terminal} and the \menu{View} menu.
+
+% =========================================================================================
+\chapter{Profiles: your address book}\label{ch:profiles}
+\chapmeta{6 minutes}{You'll keep dozens of connections tidy without thinking about it}
+
+\begin{tldr}
+A \emph{profile} is a saved connection. Give it a name and a group, star the ones you use daily, and
+right-click for everything else. Ctrl-click to select lots at once.
+\end{tldr}
+
+\section{Create, edit, copy}
+
+\begin{itemize}
+  \item \textbf{New:} \ui{+} in the sidebar footer or tab strip, \keys{\mod+N}, or right-click a group header and choose
+        \ui{New connection in …} (it lands in that group automatically).
+  \item \textbf{Edit:} double-click a profile, or right-click\then\ui{Edit}. The editor slides in on the right.
+  \item \textbf{Copy:} right-click\then\ui{Duplicate}. Great for ``same as web-01 but web-02''.
+  \item \textbf{Delete:} right-click\then\ui{Delete}. This also deletes the saved passwords for that profile.
+\end{itemize}
+
+\crop{editor-ssh.png}{1515}{40}{0}{70}{0.52\linewidth}{Editing an existing SSH profile. The editor scrolls; sections are grouped so you can ignore most of them.}
+
+\subsection{What goes in a profile}
+
+Every profile has the same \ui{General} section, then sections specific to its protocol (Part 2 covers each
+one). The common bits are:
+
+\renewcommand\arraystretch{1.4}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{32mm}X@{}}
+  \toprule
+  Display Name & What you'll see in the sidebar. Make it obvious: ``db-primary'', not ``server 3''.\\
+  Host / Port  & Where to connect. Serial profiles have a \ui{Device} instead.\\
+  Group        & Pick an existing group or type a new name to create one.\\
+  Description  & One line shown on hover.\\
+  Terminal     & Font, size (8–36), scrollback (0–100\,000 lines) and cursor style, just for this profile.\\
+  Tags \& Notes & Comma-separated tags (searchable!) and free-form notes for future-you.\\
+  \bottomrule
+\end{tabularx}
+
+Each protocol adds its own sections underneath. Here are four of them side by side; Part~2 goes through each one.
+
+\begin{center}
+\newcommand\mini[2]{\begin{minipage}[t]{0.24\linewidth}\centering\includegraphics[width=\linewidth, trim=1515 600 0 70, clip]{img/#1}\par\vspace{2pt}{\scriptsize\color{muted}#2}\end{minipage}}
+\mini{editor-telnet.png}{Telnet}\hfill\mini{editor-raw.png}{RAW TCP}\hfill\mini{editor-vnc.png}{VNC}\hfill\mini{editor-irc.png}{IRC}
+\end{center}
+
+\begin{protip}[Tags are secretly brilliant]
+Tag things by where they live and what they do (\code{eu-west}, \code{db}, \code{customer-x}). The sidebar search
+matches tags, so typing ``db'' instantly narrows hundreds of profiles to the database servers.
+\end{protip}
+
+\section{Favourites, groups and Recent}
+
+\begin{itemize}
+  \item Right-click\then\ui{Add to Favourites} pins a profile into the \ui{\iStar\ Favourites} section at the top.
+  \item \ui{Recent} always shows the last five things you connected to. You don't have to do anything.
+  \item Groups are just the \ui{Group} field. No group? It goes in \ui{Ungrouped}.
+\end{itemize}
+
+\section{Do lots at once}
+
+Hold \kbd{Ctrl} (\kbd{\ph{E1C4}} on a Mac) and click several profiles. A bar appears at the bottom of the sidebar:
+
+\begin{center}\small
+\begin{tabular}{@{}ll@{\qquad}ll@{}}
+  \ui{Connect all} & opens them all in tabs & \ui{Move group} & moves them (blank = Ungrouped)\\
+  \ui{Disconnect}  & closes their sessions & \ui{Delete} & deletes them (asks first)\\
+  \ui{Tags}        & add or replace tags & \ui{Clear} & forget the selection\\
+\end{tabular}
+\end{center}
+
+\begin{quickwin}
+Select every web server, choose \ui{Connect all}, then turn on broadcast (\keys{\mod+Shift+B}). You're now typing into
+all of them at once. Chapter~\ref{ch:repeat} has the details, and the safety advice.
+\end{quickwin}
+
+\section{``It's already open…''}
+
+Click a profile that already has a live session and Nexus Terminal asks whether to \ui{Use Existing} (jump to that
+tab), open a \ui{New Connection} alongside it, or \ui{Cancel}. No more accidental duplicate sessions.

docs/guide/chapters/part2-connect.tex

@@ -0,0 +1,273 @@
+\guidepart{teal}{Connect}{Connect to all the things}
+  {Eight ways in. Pick the one you need; skip the rest.}
+  {\partitem{\iTerminal}{SSH: the big one}
+   \partitem{\iUsb}{Serial: cables and consoles}
+   \partitem{\iPlug}{Telnet and RAW TCP}
+   \partitem{\iDesktop}{VNC remote desktops}
+   \partitem{\iChat}{IRC}
+   \partitem{\iGithub}{GitHub}}
+
+% =========================================================================================
+\chapter{SSH: the big one}\label{ch:ssh}
+\chapmeta{10 minutes (or 2 for the basics)}{You'll log in with keys, hop through bastions and never type a 2FA code again}
+
+\begin{tldr}
+Host, username, key, done. Everything else (jump hosts, proxies, forwards, 2FA, login scripts) is optional and
+lives in its own fold-away section of the editor. Open only the ones you need.
+\end{tldr}
+
+\begin{glance}{teal}{SSH}
+  Default port & 22\\
+  Logs in with & Password, public key, keyboard-interactive, SSH agent\\
+  Extras       & SFTP file browser, port forwards, live latency, agent forwarding, TOTP 2FA\\
+  Good for     & Servers, VMs, Raspberry Pis, anything with \code{sshd}\\
+\end{glance}
+
+\section{The two-minute version}
+
+\begin{enumerate}
+  \item \keys{\mod+N}, leave the protocol on \proto[teal]{SSH}.
+  \item \ui{Host}, \ui{Username}. Leave the port on 22 unless you know otherwise.
+  \item Under \ui{Key \& Passphrase}, pick your key from the suggestions (Nexus Terminal lists the keys in your
+        \code{\textasciitilde/.ssh} folder) and check for a little green \ui{Key verified}.
+  \item \ui{Create \& Connect}. The first time, you'll be asked to trust the server's host key. Say yes if you
+        were expecting it.
+\end{enumerate}
+
+\crop{hostkey.png}{842}{720}{845}{589}{0.66\linewidth}{First time connecting? You'll be shown the server's fingerprint. \ui{Accept \& Save} if it's the server you meant.}
+
+\begin{headsup}
+Type the full path to a key if you're not using the suggestions. Nexus Terminal doesn't expand \code{\textasciitilde}
+in that box, so write \code{/home/you/.ssh/id\_ed25519} (or \code{C:\textbackslash Users\textbackslash you\textbackslash .ssh\textbackslash id\_ed25519}).
+\end{headsup}
+
+\section{How it logs in}
+
+Under \ui{Authentication}, tick which \ui{Auth Methods} to try: \ui{Public key}, \ui{Password} and
+\ui{Keyboard-interactive}. Under \ui{SSH Agent}, tick \ui{Use SSH Agent for Authentication} to use keys already
+loaded into \code{ssh-agent} (or Pageant, or the Windows OpenSSH agent).
+
+Every password and passphrase has a \emph{mode}: save it securely, remember it until you quit, or ask every time.
+That's all explained in \hyperref[ch:secrets]{Passwords \& the vault} (p.\,\pageref{ch:secrets}).
+
+\begin{protip}[Agent forwarding]
+Tick \ui{Forward Agent to Remote} (it's \code{ssh -A}) and you can \code{git pull} or hop onwards from the server using
+the keys on \emph{your} machine. Only do it on servers you trust: anyone with root there can use your agent while
+you're connected.
+\end{protip}
+
+\section{Jump hosts: getting through the bastion}
+
+Lots of servers hide behind a bastion. Add one or more hops under \ui{Jump Hosts}, each with its own user, host,
+port and optional key. Nexus Terminal tunnels through them in order, so the chain
+\textit{you\then bastion\then internal-box\then db-primary} is just three rows.
+
+\section{Proxies}
+
+Stuck behind a corporate proxy? Under \ui{Proxy}, choose \ui{SOCKS5} or \ui{HTTP CONNECT} and fill in the host,
+port and (optional) username and password. The proxy is used to reach the SSH server, or the first jump host if
+you have some.
+
+\section{2FA without the phone faff}\label{sec:totp}
+
+If your server asks for a one-time code, paste the Base32 TOTP secret (the text version of the QR code) into
+\ui{TOTP Secret} and hit \ui{Save}. From then on, Nexus Terminal answers the ``Verification code:'' prompt itself.
+\ui{Test} shows today's code so you can check it matches your phone.
+
+\begin{headsup}
+Save the profile first, then save the TOTP secret. And make sure your computer's clock is right: TOTP codes are
+time-based, so a clock that's a minute out will produce wrong codes.
+\end{headsup}
+
+\section{Do things automatically on login}
+
+\begin{description}
+  \item[Startup] A \ui{Startup Command} to run once you're in (say, \code{tmux attach}), plus
+        \ui{Environment Variables} as \code{KEY=VALUE}, one per line.
+  \item[Login Script] For old-school boxes that ask questions. Add steps: \ui{Wait for} some text, then
+        \ui{Send} a reply. Repeat as needed.
+\end{description}
+
+\section{Keeping it alive}
+
+Under \ui{Advanced}: the \ui{Terminal Type}, the \ui{Keepalive Interval} and \ui{Max Missed Keepalives}, compression,
+and \ui{Auto-Reconnect} with a maximum number of attempts (1–20). Reconnection backs off politely: 1\,s, 2\,s,
+4\,s… up to 30\,s.
+
+\begin{sidequest}[What's that number in the status bar?]
+For SSH sessions the status bar shows live latency, the round trip to the server. Green is snappy. If it's
+in the hundreds and your typing feels sticky, it's the network, not you.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Serial: cables and consoles}\label{ch:serial}
+\chapmeta{4 minutes}{You'll be talking to a switch, router or microcontroller over USB}
+
+\begin{tldr}
+Plug in the adapter, pick the device, match the baud rate. 115200 8N1 is the default and usually right.
+Right-click the tab to send a break or wiggle DTR/RTS.
+\end{tldr}
+
+\begin{glance}{accent}{Serial}
+  Device       & \code{/dev/ttyUSB0}, \code{/dev/cu.usbserial-…} or \code{COM3}\\
+  Defaults     & 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, DTR and RTS on\\
+  Extras       & Send Break, toggle DTR/RTS, auto-reconnect when the cable comes back\\
+  Good for     & Network gear consoles, Arduinos, ESP32s, Raspberry Pi UARTs, 3D printers\\
+\end{glance}
+
+\crop{editor-serial.png}{1515}{40}{0}{70}{0.52\linewidth}{A serial profile for a switch console at 9600 baud. Click refresh after plugging in an adapter.}
+
+\section{Setting it up}
+
+\begin{description}
+  \item[Device] Pick it from the list (hit refresh after plugging in) or type the path.
+  \item[Line Settings] \ui{Baud Rate} (a preset from 300 to 1\,000\,000, or \ui{Custom}), \ui{Data Bits} (5–8),
+        \ui{Parity} (none, odd, even), \ui{Stop Bits} (1 or 2) and \ui{Flow Control} (none, XON/XOFF, RTS/CTS).
+  \item[Behaviour] \ui{Line Ending}, \ui{Encoding}, \ui{Local Echo} (for devices that don't echo what you type),
+        \ui{Assert DTR on connect}, \ui{Assert RTS on connect} and \ui{Auto-reconnect}.
+\end{description}
+
+\section{While you're connected}
+
+Right-click the tab for \ui{Send Break} (handy for getting into a router's ROMMON) and to toggle \ui{DTR} and
+\ui{RTS} (handy for resetting boards that wire those to reset). Pull the cable out and the session disconnects; with
+auto-reconnect on, it picks up again when you plug it back in.
+
+Serial tabs are proper terminals, so recording, triggers, broadcast, snippets, find and split panes all work.
+
+\begin{headsup}[Gibberish on screen?]
+Garbled characters nearly always mean the baud rate, parity or stop bits don't match the device. Check the
+device's manual. 9600 and 115200 are the usual suspects.
+\end{headsup}
+
+\begin{protip}[Linux and macOS quirks]
+On Linux, add yourself to the \code{dialout} group (\code{uucp} on some distributions) and log out and in again.
+On a Mac, use the \code{/dev/cu.*} device, not \code{/dev/tty.*}.
+\end{protip}
+
+% =========================================================================================
+\chapter{Telnet and RAW TCP}\label{ch:raw}
+\chapmeta{4 minutes}{You'll poke at old kit and raw sockets without reaching for netcat}
+
+\begin{tldr}
+Telnet is a terminal for old devices. RAW is a packet-level conversation with any TCP port, with a hex view.
+\end{tldr}
+
+\section{Telnet}
+
+\begin{glance}{amber}{Telnet}
+  Default port & 23\\
+  Options      & Local echo, line mode, terminal type, encoding (UTF-8, ASCII, ISO 8859-1), line endings, login script\\
+  Extras       & Send Break from the tab menu, \ui{Debug Negotiation} for when options go wrong\\
+\end{glance}
+
+\begin{danger}[Telnet is plain text]
+Everything, including your password, crosses the network unencrypted. Fine on a lab bench, not fine over the
+internet or café Wi-Fi.
+\end{danger}
+
+\section{RAW TCP}
+
+RAW connects to any TCP port and shows you exactly what goes back and forth. Instead of a terminal you get a
+traffic log with \ui{Text}, \ui{Hex} and \ui{Split} views.
+
+\shot{raw.png}{A RAW session to a chatty sensor, with timestamps and direction markers turned on.}
+
+\begin{itemize}
+  \item \textbf{Send bar:} pick \ui{Text}, \ui{Hex} or \ui{Escaped} (\code{\textbackslash r\textbackslash n} and friends),
+        type, press \kbd{Enter}. One-click buttons send \ui{NUL}, \ui{CR}, \ui{LF}, \ui{ETX} and \ui{EOT}.
+  \item \textbf{Presets:} save payloads you send often in the profile under \ui{Payload Presets}, then pick them from
+        \ui{Presets…}.
+  \item \textbf{Capture:} \ui{Pause}, \ui{Clear}, and \ui{Save} (writes the whole conversation as JSON).
+  \item \textbf{Profile options:} encoding (UTF-8, ASCII, Hex), line ending, timestamps, direction, timeouts and
+        auto-reconnect.
+\end{itemize}
+
+\begin{quickwin}
+Point a RAW profile at a web server on port 80 and send \code{HEAD / HTTP/1.0\textbackslash r\textbackslash n\textbackslash r\textbackslash n}
+in \ui{Escaped} mode. Instant HTTP headers, no browser required.
+\end{quickwin}
+
+% =========================================================================================
+\chapter{VNC remote desktops}\label{ch:vnc}
+\chapmeta{4 minutes}{You'll see and drive a remote desktop, safely}
+
+\begin{tldr}
+VNC shows you another computer's screen. Tunnel it through SSH (tick a box), because plain VNC isn't encrypted.
+\end{tldr}
+
+\begin{glance}{rose}{VNC}
+  Default port & 5900 (plus the display number: display \code{:1} is 5901)\\
+  Display      & \ui{View Only}, \ui{Scale to Fit}, \ui{Shared Session}, \ui{Quality (0-9)}\\
+  Security     & Optional SSH tunnel with password, key or agent login\\
+\end{glance}
+
+\shot{vnc.png}{A remote desktop, scaled to fit the tab.}
+
+\section{The toolbar}
+
+Connection state and desktop size on the left. On the right: switch between scaled and 1:1, refresh,
+\ui{Paste Clipboard} (sends your clipboard to the remote machine) and \ui{Ctrl+Alt+Del}. Click the desktop to give
+it your keyboard. Anything the remote machine copies lands on your clipboard automatically.
+
+\section{Tunnel it}
+
+Tick \ui{Enable SSH Tunnel} and fill in the SSH host, port, username and login method. The VNC traffic then
+travels inside an encrypted SSH connection. If you connect to a VNC profile \emph{without} a tunnel, Nexus Terminal
+warns you and offers \ui{Connect Anyway}, \ui{Edit Profile} or \ui{Cancel}.
+
+\begin{headsup}[Connecting to a Mac?]
+Turn on \ui{VNC viewers may control screen with password} in macOS Screen Sharing settings. Nexus Terminal uses
+standard VNC password authentication, not Apple's own login method.
+\end{headsup}
+
+% =========================================================================================
+\chapter{IRC}\label{ch:irc}
+\chapmeta{3 minutes}{You'll be chatting in your project's channels from the same window as your servers}
+
+\begin{tldr}
+Nick, server, rooms to join. Tabs for each room, \code{/commands} as you'd expect, \kbd{Tab} completes nicks.
+\end{tldr}
+
+\begin{glance}{amber}{IRC}
+  Default port & 6667, or 6697 with \ui{Use TLS} (use TLS!)\\
+  Extras       & NickServ identify on connect, auto-join rooms, room browser, SSH tunnel\\
+\end{glance}
+
+\shot{irc.png}{Chatting in \#nexus. Rooms down the right, users in the room below them.}
+
+\begin{itemize}
+  \item A \ui{Server} tab plus one per room or private conversation. A dot means unread messages.
+  \item Commands: \code{/join}, \code{/part}, \code{/msg}, \code{/me}, \code{/notice}, \code{/nick}, \code{/topic},
+        \code{/list}, \code{/names}, \code{/whois}, \code{/who}, \code{/raw}, \code{/quit} and \code{/help}.
+  \item \kbd{Tab} completes a nick; click a nick to mention them.
+  \item The side panel lists your rooms, a room browser with a filter (click to join) and who's in the current room.
+\end{itemize}
+
+% =========================================================================================
+\chapter{GitHub}\label{ch:github}
+\chapmeta{2 minutes}{You'll see all your repositories, freshest first}
+
+\crop{editor-github.png}{1515}{780}{0}{70}{0.5\linewidth}{A GitHub profile: just the API address and a token.}
+
+\begin{tldr}
+Paste a personal access token with the \code{repo} scope. Get a tidy, filterable list of every repository you can see.
+\end{tldr}
+
+\shot{github.png}{Repositories grouped by owner, with the latest commit and who made it.}
+
+\begin{itemize}
+  \item Grouped by owner or organisation, sorted by most recent activity.
+  \item Badges for \proto[rose]{Private}, \proto[violet]{Fork} and \proto[amber]{Archived}, plus language and stars.
+  \item Filter box, \ui{Refresh now}, \ui{Visit} (opens in your browser) and \ui{ZIP} (downloads an archive).
+  \item Works with GitHub Enterprise: set \ui{API Base URL} to your server's API address. Refreshes every 60–3600 seconds.
+\end{itemize}
+
+% =========================================================================================
+\chapter{Your own computer}\label{ch:local}
+\chapmeta{1 minute}{You'll stop alt-tabbing to a separate terminal app}
+
+Click \ui{Local Machine} for a shell on this computer. It uses your system's default shell unless you choose
+another in \menu{Settings\then General\then Local shell} (\code{pwsh}, \code{zsh}, \code{fish}, whatever you fancy).
+
+\shot[0.86\linewidth]{local.png}{A local shell, with all the same terminal powers as SSH.}

docs/guide/chapters/part3-faster.tex

@@ -0,0 +1,234 @@
+\guidepart{violet}{Work faster}{Work faster}
+  {Fewer clicks, less typing, more getting on with it.}
+  {\partitem{\iSplit}{Tabs and split panes}
+   \partitem{\iKeyboard}{Terminal superpowers}
+   \partitem{\iWand}{Never type it twice}
+   \partitem{\iFolder}{Files: SFTP and drag-and-drop}
+   \partitem{\iArrows}{Port forwards}
+   \partitem{\iFilm}{Recordings}}
+
+% =========================================================================================
+\chapter{Tabs and split panes}\label{ch:tabs}
+\chapmeta{4 minutes}{You'll juggle a dozen sessions without losing any of them}
+
+\begin{tldr}
+Right-click a tab for everything. \keys{\mod+Shift+D} splits right, \keys{\mod+Shift+E} splits down.
+\keys{\mod+1} to \keys{\mod+9} jump straight to a tab.
+\end{tldr}
+
+\section{Tabs}
+
+\begin{description}
+  \item[Move] Drag tabs about, or right-click\then\ui{Move Left} / \ui{Move Right}.
+  \item[Pin] Right-click\then\ui{Pin}. Pinned tabs stay at the front.
+  \item[Rename] Right-click\then\ui{Rename}. ``prod DB, DON'T TOUCH'' is a perfectly valid tab name.
+  \item[Duplicate] Opens another session to the same profile.
+  \item[Reconnect] Does what it says.
+  \item[Peek] Hover a tab for its name, host, state and when it connected.
+  \item[Close] The \ui{×}, \keys{\mod+W}, or right-click\then\ui{Close}. Connected tabs ask first (you can turn that
+        off in Settings).
+  \item[Switch] \keys{\mod+Tab} and \keys{\mod+Shift+Tab}, or \keys{\mod+1} to \keys{\mod+9}.
+\end{description}
+
+Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad.
+
+\section{Split panes}
+
+Want two sessions side by side? Split the focused pane right with \keys{\mod+Shift+D} or down with
+\keys{\mod+Shift+E} (also in the \menu{Session} menu, the right-click menu and the palette). The new pane asks
+what to open: \ui{Local Machine} or any of your terminal profiles.
+
+\shot{split.png}{A fresh split. Pick what goes in the new pane.}
+
+Drag a divider to resize. Click \ui{×} on a pane's header to close it and its neighbour takes the space. Closing
+the tab closes every pane in it.
+
+\begin{quickwin}
+Split right, open \code{htop} on one side and tail a log on the other. Now you look like a hacker in a film.
+\end{quickwin}
+
+% =========================================================================================
+\chapter{Terminal superpowers}\label{ch:terminal}
+\chapmeta{4 minutes}{You'll copy, search and scroll like you've used it for years}
+
+\begin{tldr}
+Select to copy, \keys{\mod+F} to search, Ctrl/\ph{E1C4}-click links. Right-click for the rest.
+\end{tldr}
+
+\section{Keyboard and mouse}
+
+\renewcommand\arraystretch{1.45}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{24mm}X@{}}
+  \toprule
+  Copy   & Select text, then \keys{\mod+C}. Nothing selected? \keys{Ctrl+C} interrupts the program as usual.\\
+  Paste  & \keys{\mod+V}. Pastes are bracketed when the program asks for it, so editors won't auto-indent your paste
+           into a staircase.\\
+  Select & Drag for a range, double-click a word, triple-click a line, \kbd{Shift}-click to extend.\\
+  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser.\\
+  Scroll & Mouse wheel, or \keys{Shift+PageUp}, \keys{Shift+PageDown}, \keys{Shift+Home}, \keys{Shift+End}.\\
+  \bottomrule
+\end{tabularx}
+
+\begin{sidequest}[Why does the scroll wheel move the cursor in less?]
+Full-screen programs (\code{less}, \code{vim}, \code{tmux}, \code{byobu}) use the terminal's ``alternate screen'', where the
+wheel sends arrow keys instead of scrolling. Programs with mouse support (\code{htop}, \code{vim} with
+\code{mouse=a}, \code{tmux} mouse mode) get your clicks directly. That's normal terminal behaviour, not a bug.
+\end{sidequest}
+
+\section{The right-click menu}
+
+\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right},
+\ui{Split Down}, \ui{Export Output} (saves the whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+
+\section{Find}
+
+\keys{\mod+F} opens the find bar. Toggle \ui{Aa} for case-sensitive and \ui{.*} for regular expressions.
+\kbd{Enter} for the next match, \keys{Shift+Enter} for the previous one, \kbd{Esc} to close. It shows
+``3 of 17'' so you know where you are.
+
+\section{When the connection drops}
+
+The pane dims and shows a \ui{Disconnected} card with \ui{Reconnect} and \ui{Close}. If auto-reconnect is on,
+it says \ui{Reconnecting…} with a \ui{Cancel} button, and a toast tells you which attempt it's on.
+
+If the problem was a password or host key, you get a friendly dialog explaining what happened, with
+\ui{Retry}, \ui{Edit Profile}, \ui{Known Hosts} (for host-key trouble) and \ui{Close}.
+
+% =========================================================================================
+\chapter{Never type it twice}\label{ch:repeat}
+\chapmeta{6 minutes}{You'll stop retyping the same commands, and let Nexus Terminal watch the logs for you}
+
+\begin{tldr}
+\textbf{Snippets} store commands. \textbf{Broadcast} types into many sessions at once. \textbf{Triggers} watch output and
+tap you on the shoulder.
+\end{tldr}
+
+\section{Snippets: \keys{\mod+Shift+S}}
+
+Save commands you use a lot, with a name, description and folder. Search them, click
+\ui{Send to Session}, and the command is typed into the active session followed by \kbd{Enter}.
+
+\crop{snippets.png}{633}{384}{611}{402}{0.8\linewidth}{The snippet library, organised into folders.}
+
+Snippets can have blanks to fill in:
+
+\begin{itemize}
+  \item \code{\{\{hostname\}\}}, \code{\{\{date\}\}}, \code{\{\{time\}\}} and \code{\{\{timestamp\}\}} are filled in for you.
+  \item Anything else, like \code{\{\{service\}\}}, is asked for when you send it.
+\end{itemize}
+
+So \code{journalctl -fu \{\{service\}\}} asks ``service?'' and tails whichever one you type.
+
+\section{Broadcast: \keys{\mod+Shift+B}}
+
+Turn broadcast on and everything you type goes to \emph{every} connected terminal. The status bar shows
+\ui{BROADCAST} so you can't forget it's on.
+
+\shot{broadcast.png}{Broadcast is on: the status bar says so in no uncertain terms.}
+
+To broadcast to only some sessions, right-click the \iBroadcast{} button (or \menu{Session\then Broadcast
+targets…}), tick the ones you want and click \ui{Apply \& Enable}.
+
+\begin{danger}[With great power…]
+Broadcast doesn't care which tab you \emph{meant}. Double-check the target list before you type anything
+destructive. \code{sudo reboot} into twenty servers is very efficient and very memorable.
+\end{danger}
+
+\section{Triggers: let it watch for you}
+
+\menu{Session\then Trigger Rules} (or the palette). Each rule has a pattern (plain text or a regular
+expression), a case-sensitivity switch, an on/off switch, and an action:
+
+\begin{center}\small
+\begin{tabular}{@{}ll@{}}
+  \ui{Notify} & shows a toast\\
+  \ui{Highlight tab} & briefly outlines the pane\\
+  \ui{Notify + Highlight} & both\\
+  \ui{Sound} & asks your OS for attention (a bouncing dock icon or flashing taskbar button) and shows a toast\\
+\end{tabular}
+\end{center}
+
+\crop{triggers.png}{725}{610}{725}{625}{0.75\linewidth}{Three rules: shout about errors, ping when a build finishes, and one switched off for now.}
+
+Rules check each complete line of output, with colours stripped out first.
+
+\begin{quickwin}
+Add a rule for \code{BUILD SUCCESSFUL} with the \ui{Sound} action, start a long build, and go and make a cup of tea.
+Nexus Terminal will tell you when it's done. (Or \code{(?i)error|fatal} for the opposite.)
+\end{quickwin}
+
+% =========================================================================================
+\chapter{Files: SFTP and drag-and-drop}\label{ch:files}
+\chapmeta{4 minutes}{You'll move files to and from servers without leaving the terminal}
+
+\begin{tldr}
+Click the \iFolder{} on an SSH tab. Or drop a file onto the terminal and choose \ui{Upload}.
+\end{tldr}
+
+\section{The SFTP browser}
+
+Click the \iFolder{} folder icon on an SSH tab, \menu{Session\then SFTP browser}, or type ``sftp'' in the palette.
+It opens in the side dock next to your terminal.
+
+\shot{sftp.png}{Browsing the server's files next to the terminal.}
+
+\begin{itemize}
+  \item Move around with the breadcrumb trail, the \code{..} entry or \ui{Go to path}.
+  \item Upload files; download one or many to a folder you choose.
+  \item Rename, delete (it asks first), make folders, refresh.
+  \item \iStar{} bookmarks the current folder, per profile.
+  \item Ctrl-click (\ph{E1C4}-click) or Shift-click to select several things. Transfers show progress as they go.
+\end{itemize}
+
+\section{Drag and drop}
+
+Drop files onto a terminal and choose:
+
+\begin{description}
+  \item[Upload to current directory] Pick the remote folder (SSH only).
+  \item[Paste contents] Types the file's contents into the terminal, as if you'd typed it.
+\end{description}
+
+The upload picker looks like the SFTP browser but shows folders only, labelled \proto[amber]{READ ONLY} if you can't
+write there and \proto[rose]{NO READ} if you can't look inside. Keyboard fans: \kbd{↑}\kbd{↓} to move, \kbd{Enter} to
+choose, \kbd{Backspace} to go up, \kbd{Esc} to cancel. If the SFTP browser is open, the picker starts in the same folder.
+
+% =========================================================================================
+\chapter{Port forwards}\label{ch:forwards}
+\chapmeta{3 minutes}{You'll reach a database or web app that only listens on the server}
+
+\begin{tldr}
+\emph{Local} forwards bring a remote port to your machine. \emph{Remote} forwards do the opposite.
+\end{tldr}
+
+Forwards saved in an SSH profile (under \ui{Port Forwarding}, with \ui{Active} ticked) start when you connect.
+To manage them on a live session, right-click the terminal\then\ui{Port Forwards}, or \menu{Session\then Port forwards}.
+
+\begin{description}
+  \item[Local \iArrow] Listen on your computer, forward to somewhere the server can reach.
+        Example: \code{127.0.0.1:15432}\then\code{127.0.0.1:5432} lets your desktop database app talk to Postgres on
+        the server as if it were local.
+  \item[Remote \ph{E058}] Ask the server to listen and send connections back to somewhere \emph{your} computer can reach.
+        Great for showing a colleague the dev server running on your laptop.
+\end{description}
+
+Active forwards are listed with an \proto[accent]{L} or \proto[violet]{R} badge and a stop button. Toasts tell you when one
+starts, stops or fails.
+
+% =========================================================================================
+\chapter{Recordings}\label{ch:recordings}
+\chapmeta{2 minutes}{You'll have a replayable record of exactly what happened}
+
+\keys{\mod+Shift+R} starts and stops recording the active session. A red dot appears on the tab and \ui{REC} in
+the status bar. Recordings are standard asciicast v2 files, so other tools (like \code{asciinema}) can play them too.
+
+\crop{recordings.png}{712}{392}{690}{415}{0.75\linewidth}{The recordings browser. Play, delete, or tidy up in bulk.}
+
+The browser (sidebar footer, \menu{Session} menu or palette) shows how many recordings you have and how much space
+they take. Play or delete each one, or use \ui{Clean up} to remove recordings older than 7, 30 or 90 days, or to keep
+the total under 1\,GB or 5\,GB. Playback has play/pause, restart, a seek bar and speed control.
+
+\begin{protip}
+Record the next time you do something fiddly and rare (a database failover, a certificate rotation). Six months
+later, ``how did we do that again?'' has an answer you can literally watch.
+\end{protip}

docs/guide/chapters/part4-safe.tex

@@ -0,0 +1,123 @@
+\guidepart{amber}{Stay safe}{Stay safe}
+  {Passwords, keys and host checks, minus the jargon headache.}
+  {\partitem{\iLock}{Passwords and the vault}
+   \partitem{\iShield}{Host keys: is it really that server?}
+   \partitem{\iKey}{SSH keys}}
+
+% =========================================================================================
+\chapter{Passwords and the vault}\label{ch:secrets}
+\chapmeta{5 minutes}{You'll know exactly where your passwords live and who can read them}
+
+\begin{tldr}
+Passwords go in your OS keychain. If there isn't one, they go in an encrypted vault protected by a master password.
+For each password you choose: save it, remember it until you quit, or ask every time.
+\end{tldr}
+
+\section{Where secrets live}
+
+\begin{center}
+\begin{tikzpicture}[
+  box/.style={rounded corners=6pt, fill=#1!12, draw=#1!60, line width=0.6pt, minimum height=13mm, text width=40mm,
+    align=center, font=\small},
+  arr/.style={-latex, line width=0.8pt, color=muted}]
+  \node[box=accent] (need) {\heavy A session needs\\a password};
+  \node[box=green, right=12mm of need] (kc) {\heavy OS keychain\\{\footnotesize Keychain · Credential Manager · Secret Service}};
+  \node[box=amber, right=12mm of kc] (vault) {\heavy Encrypted vault\\{\footnotesize AES-256-GCM, Argon2id}};
+  \node[box=rose, below=9mm of kc] (ask) {\heavy Ask you\\{\footnotesize then carry on}};
+  \draw[arr] (need) -- (kc);
+  \draw[arr] (kc) -- node[above, font=\scriptsize]{not there?} (vault);
+  \draw[arr] (vault) |- node[pos=0.25, right, font=\scriptsize]{still not there?} (ask);
+\end{tikzpicture}
+\end{center}
+
+\begin{description}
+  \item[OS keychain first] macOS Keychain, Windows Credential Manager, or the Linux Secret Service (GNOME Keyring,
+        KWallet and friends).
+  \item[Encrypted vault as backup] If there's no keychain, or it refuses, secrets go into Nexus Terminal's own
+        vault: AES-256-GCM with a key derived from your master password by Argon2id using 128\,MiB of memory. In
+        plain English: very, very expensive to brute-force.
+\end{description}
+
+\section{Setting up the vault}
+
+\menu{Settings\then Security\then Initialise Secret Store}. Choose a master password; the strength meter goes from
+\proto[rose]{Weak} through \proto[amber]{Fair} and \proto[accent]{Good} to \proto[green]{Strong}. Unlock and lock it
+from the same page, from the palette, or by clicking the vault badge in the status bar. It locks itself when you quit.
+
+\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Security settings on a machine without an OS keychain: the vault does the job instead.}
+
+\begin{danger}[There's no ``forgot password'' link]
+Lose the master password and the secrets in the vault are gone for good. That's the point of encryption. Put it in
+your password manager.
+\end{danger}
+
+\section{Three ways to handle each password}
+
+Every password, passphrase, token or TOTP secret has its own setting:
+
+\begin{center}
+\begin{tabular}{@{}p{0.3\linewidth}p{0.3\linewidth}p{0.3\linewidth}@{}}
+  \begin{tcolorbox}[colback=green!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{green!60!black}\iLock\ Save securely}\par\smallskip Stored in the keychain or vault and used automatically. Most convenient.
+  \end{tcolorbox} &
+  \begin{tcolorbox}[colback=accent!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{accent!80!black}\iClock\ Remember for this session}\par\smallskip Asked once, kept in memory, never written to disk.
+  \end{tcolorbox} &
+  \begin{tcolorbox}[colback=amber!10, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
+    {\heavy\color{amber!75!black}\iDetective\ Ask every time}\par\smallskip Asked on every single connection. Most paranoid.
+  \end{tcolorbox}
+\end{tabular}
+\end{center}
+
+When Nexus Terminal needs a secret it doesn't have, it asks. Press \kbd{Esc} or \ui{Cancel} to give up on that
+connection.
+
+\begin{sidequest}[What gets written down?]
+Connections, disconnections, profile changes, credential access, imports and exports go into an audit log in the
+database. Secrets themselves never do. TOTP secrets live in the keychain or vault too, never in the profile.
+\end{sidequest}
+
+% =========================================================================================
+\chapter{Host keys: is it really that server?}\label{ch:hostkeys}
+\chapmeta{3 minutes}{You'll understand the scary fingerprint dialog and what to do about it}
+
+\begin{tldr}
+Every SSH server has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
+A changed fingerprint means a reinstalled server, or someone in the middle. Find out which before carrying on.
+\end{tldr}
+
+Pick a policy per SSH profile under \ui{Host Verification}:
+
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{48mm}X@{}}
+  \toprule
+  Strict (known hosts only)   & Only connects to servers you've already trusted.\\
+  Ask on new or changed keys  & Shows the fingerprint and asks. \ui{Accept \& Save} or \ui{Reject}. The default.\\
+  Accept new, reject changed  & Trusts first-time servers silently, still refuses changed keys.\\
+  Insecure (accept anything)  & Exactly what it says. Lab use only.\\
+  \bottomrule
+\end{tabularx}
+
+Under every policy except \emph{Insecure}, a key that differs from the saved one is rejected.
+
+\crop{settings-knownhosts.png}{581}{253}{576}{285}{0.8\linewidth}{Known hosts. Click a fingerprint to copy it; \ui{Remove} to forget a server.}
+
+\begin{headsup}
+Nexus Terminal keeps its own list of known hosts. It doesn't read \code{\textasciitilde/.ssh/known\_hosts}, so the
+first connection to each server asks once, even if your command-line \code{ssh} already knows it.
+\end{headsup}
+
+% =========================================================================================
+\chapter{SSH keys}\label{ch:keys}
+\chapmeta{2 minutes}{You'll have a key pair without memorising ssh-keygen flags}
+
+\menu{Session\then SSH key manager} (or the palette) lists the key pairs in \code{\textasciitilde/.ssh} with their type. Copy a
+public key to the clipboard (ready to paste into GitHub or \code{authorized\_keys}), delete a pair, or generate a new
+\proto[teal]{Ed25519}, \proto[accent]{RSA} (2048 or 4096 bits) or \proto[violet]{ECDSA} key with an optional passphrase.
+
+\crop{keys.png}{725}{523}{725}{546}{0.75\linewidth}{The SSH key manager.}
+
+\begin{protip}
+Not sure which type? Pick Ed25519. It's small, fast and secure. Key generation uses your system's
+\code{ssh-keygen}, which comes with macOS, Linux and Windows 10 and later.
+\end{protip}

docs/guide/chapters/part5-yours.tex

@@ -0,0 +1,107 @@
+\guidepart{pink}{Make it yours}{Make it yours}
+  {Settings, backups, and moving in from Alchementary Link.}
+  {\partitem{\iGear}{Settings}
+   \partitem{\iUpload}{Import and export}
+   \partitem{\iPlane}{Moving house}}
+
+% =========================================================================================
+\chapter{Settings}\label{ch:settings}
+\chapmeta{3 minutes}{You'll know where every setting lives}
+
+\keys{\mod+,} opens settings (also the \iGear{} in the sidebar footer and \menu{File\then Settings}). Change things,
+then click \ui{Save}.
+
+\begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
+
+\begin{description}
+  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, whether to ask before closing or
+        disconnecting, status bar on or off, sidebar width, and the local shell (leave it empty for the system default,
+        or \ui{Browse…} for one).
+  \item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
+        each profile can override them.
+  \item[Security] Keychain and vault status; set up, unlock or lock the vault.
+  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times.
+  \item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
+  \item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
+\end{description}
+
+\crop{settings-help.png}{581}{253}{576}{285}{0.8\linewidth}{The built-in help, for when this guide isn't to hand.}
+
+\section{Updates}
+
+Nexus Terminal checks once at launch. If there's a newer version the status bar says \ui{Update available}; click it to
+see the release notes and a \ui{View release} button. Nothing downloads or installs behind your back.
+
+% =========================================================================================
+\chapter{Import and export}\label{ch:transfer}
+\chapmeta{3 minutes}{You'll back up your profiles, or copy them to another computer}
+
+\begin{tldr}
+\menu{File\then Export profiles…} makes a password-protected \code{.nexus} file. \menu{File\then Import profiles…}
+reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that too.
+\end{tldr}
+
+\begin{description}
+  \item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
+        included, so the file is safe to email to yourself.
+  \item[Encrypted import] Pick a \code{.nexus} (or an old \code{.link}) file, enter its password and decide what happens to
+        profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
+  \item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
+        \ui{Include secrets} to keep proxy passwords and TOTP secrets, which are otherwise left out.
+  \item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
+        with host names, users, ports, identity files and jump hosts.
+\end{description}
+
+\crop{export.png}{894}{357}{872}{380}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
+
+\begin{danger}[JSON with secrets is not encrypted]
+A JSON export with \ui{Include secrets} ticked has those secrets in plain text. Use the encrypted \code{.nexus} export to
+move things between machines.
+\end{danger}
+
+% =========================================================================================
+\chapter{Moving house}\label{ch:move}
+\chapmeta{2 minutes}{You'll know what came over from Alchementary Link and what didn't}
+
+\begin{tldr}
+It's automatic. First run copies your Alchementary Link profiles, vault and recordings. Your old folder is left
+alone. Recreate trigger rules and SFTP bookmarks by hand.
+\end{tldr}
+
+When Nexus Terminal starts for the first time and finds an \code{AlchementaryLink} folder next to where its own data
+goes, it \emph{copies} \code{link.db} to \code{nexus.db}, along with the \code{vault/} and \code{recordings/} folders,
+and shows a toast saying where they came from.
+
+\begin{checklist}
+  \item[\color{green}\iCheck] Profiles, groups, favourites, known hosts, snippets and preferences
+  \item[\color{green}\iCheck] Vault (same master password as before)
+  \item[\color{green}\iCheck] Recordings
+  \item[\color{green}\iCheck] Keychain passwords: picked up the first time each one is needed, then copied across
+  \item[\color{green}\iCheck] Old \code{.link} export files still import
+  \item[\color{rose}\ph{E4F6}] Trigger rules and SFTP bookmarks (they lived in the old app's web storage)
+\end{checklist}
+
+\begin{headsup}
+If a \code{NexusTerminal/nexus.db} already exists (say, from before the Alchementary Link rebrand), it's used as it is
+and nothing is copied.
+\end{headsup}
+
+\section{Where everything lives}
+
+\renewcommand\arraystretch{1.45}
+\begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{20mm}X@{}}
+  \toprule
+  macOS   & \code{\textasciitilde/Library/Application Support/NexusTerminal}\\
+  Windows & \code{\%APPDATA\%\textbackslash NexusTerminal}\\
+  Linux   & \code{\$XDG\_CONFIG\_HOME/NexusTerminal}, usually \code{\textasciitilde/.config/NexusTerminal}\\
+  \bottomrule
+\end{tabularx}
+
+Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
+\code{vault/vault.json}, \code{recordings/}, \code{triggers.json} and \code{sftp-bookmarks.json}. Keychain entries are
+stored under the service name \code{NexusTerminal}.
+
+\begin{protip}[Try things without touching your real data]
+Start Nexus Terminal with \code{--data-dir /some/other/folder} and it uses that folder instead. Brilliant for
+experiments, demos and a portable install on a USB stick.
+\end{protip}

docs/guide/chapters/part6-fix.tex

@@ -0,0 +1,88 @@
+\guidepart{rose}{Fix it}{When things go wrong}
+  {Symptom first, fix second. No essays.}
+  {\partitem{\iLifebuoy}{Troubleshooting, by symptom}}
+\label{part:fix}
+
+% =========================================================================================
+\chapter{Troubleshooting, by symptom}\label{ch:trouble}
+\chapmeta{as long as it takes}{You'll find your symptom and the fix in one place}
+
+\begin{tldr}
+Find the heading that matches what you're seeing. Try the fixes in order. Most problems are the network, the
+password, or the baud rate.
+\end{tldr}
+
+\section{Connecting}
+
+\fix{``Authentication failed''}{%
+\begin{itemize}
+  \item Check the username, password, key path and the ticked \ui{Auth Methods}.
+  \item If the key has a passphrase, check how the passphrase is stored (\ui{Passphrase Mode}).
+  \item Two-factor server? Click \ui{Test} next to the TOTP secret and compare with your phone. Check your clock.
+  \item Saved password not being used? The vault might be locked: click \ui{Vault locked} in the status bar.
+\end{itemize}}
+
+\fix{``Host key verification failed''}{%
+The server's fingerprint changed since you last connected. That happens when a server is rebuilt, but it's also exactly
+what an attack looks like. \textbf{Check with whoever runs the server.} If it's legitimate:
+\menu{Settings\then Known Hosts}, \ui{Remove} the entry, reconnect and accept the new key.}
+
+\fix{It just says ``Connecting…'' forever}{%
+\begin{itemize}
+  \item Click \ui{Test} in the profile editor. If that fails too, it's the network, a firewall or the wrong port.
+  \item Behind a corporate proxy? Set one up under \ui{Proxy} (SSH profiles).
+  \item Going through a bastion? Check each jump host on its own first.
+\end{itemize}}
+
+\fix{The session keeps reconnecting}{%
+Check the network and the credentials, then the profile's auto-reconnect settings. Reconnection backs off (1\,s, 2\,s,
+4\,s… up to 30\,s) and stops after the maximum number of attempts.}
+
+\section{Serial}
+
+\fix{The port won't open}{%
+\begin{itemize}
+  \item Is the adapter plugged in? Hit refresh in the device list.
+  \item \textbf{Permission denied} on Linux: add yourself to \code{dialout} (or \code{uucp}), then log out and back in.
+  \item On a Mac, use \code{/dev/cu.*}, not \code{/dev/tty.*}.
+  \item \textbf{Port is in use by another program}: close \code{screen}, \code{minicom}, the Arduino IDE serial monitor or
+        whatever else has it open.
+\end{itemize}}
+
+\fix{Gibberish on screen}{The baud rate, parity or stop bits don't match the device. Check its manual.}
+
+\section{Remote desktops}
+
+\fix{VNC won't connect}{%
+\begin{itemize}
+  \item VNC ports are 5900 plus the display number: \code{:0} is 5900, \code{:1} is 5901.
+  \item Check the password and how it's stored.
+  \item Using an SSH tunnel? Check the tunnel's host, user, login method and key, and the host key policy.
+  \item Connecting to a Mac? Turn on password access in macOS Screen Sharing settings (see p.\,\pageref{ch:vnc}).
+\end{itemize}}
+
+\section{Files}
+
+\fix{Upload is greyed out or fails}{%
+The folder is probably \proto[amber]{READ ONLY} for your user. Pick another, or check permissions on the server. Uploads
+need an SSH session; other protocols can't do it.}
+
+\fix{``NO READ'' on a folder}{You don't have permission to look inside. Try the parent folder, or ask the server's admin.}
+
+\section{The terminal itself}
+
+\fix{The terminal is the wrong size}{%
+Resize the window or nudge a split divider; the terminal re-fits itself. Still wrong? Reconnect. Very old servers may
+prefer a different \ui{Terminal Type} in the profile (try \code{vt100}).}
+
+\fix{The scroll wheel moves the cursor instead of scrolling}{%
+You're in a full-screen program (\code{less}, \code{vim}, \code{tmux}). That's how terminals work: the wheel sends arrow keys
+there. Quit the program, or use its own scrolling (in \code{tmux}: \keys{Ctrl+B} then \kbd{[}).}
+
+\fix{Emoji are in black and white}{Known limitation: colour emoji show as monochrome glyphs. Everything else renders
+normally.}
+
+\begin{quickwin}[Still stuck?]
+Start Nexus Terminal with \code{--data-dir} pointing at an empty folder and try the same connection there. If it
+works, something in your profile is off; duplicate the working one and compare.
+\end{quickwin}

docs/guide/fonts/Phosphor-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Romet Tagobert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

docs/guide/nexus-guide.sty

@@ -0,0 +1,286 @@
+% Nexus Terminal user guide — look and feel. Build with lualatex (see Makefile).
+\NeedsTeXFormat{LaTeX2e}
+\ProvidesPackage{nexus-guide}
+
+\RequirePackage[a4paper,top=24mm,bottom=26mm,inner=22mm,outer=26mm,headsep=8mm,footskip=12mm]{geometry}
+% Latin Modern OpenType isn't always installed, and the kernel selects it once before the guide's own
+% fonts take over. Point that one use at Inter so the build only needs fonts from the repo.
+\DeclareFontShape{TU}{lmr}{m}{n}{<->"[../../rust/app/assets/fonts/Inter-Regular.ttf]:mode=node;"}{}
+\RequirePackage{fontspec}
+\RequirePackage[dvipsnames]{xcolor}
+\RequirePackage{graphicx}
+\RequirePackage[most]{tcolorbox}
+\RequirePackage{tikz}
+\usetikzlibrary{calc,positioning,shadows.blur,fadings}
+\RequirePackage{titlesec}
+\RequirePackage{fancyhdr}
+\RequirePackage{enumitem}
+\RequirePackage{tabularx}
+\RequirePackage{booktabs}
+\RequirePackage{multicol}
+\RequirePackage{eso-pic}
+\RequirePackage{etoolbox}
+\RequirePackage{needspace}
+\RequirePackage{microtype}
+\RequirePackage[hidelinks]{hyperref}
+\RequirePackage{bookmark}
+
+% --- Fonts: the app's own Inter + JetBrains Mono, and its Phosphor icons ----------------
+\defaultfontfeatures{Ligatures=TeX}
+\setmainfont{Inter-Regular.ttf}[
+  Path=../../rust/app/assets/fonts/,
+  BoldFont=Inter-SemiBold.ttf,
+  ItalicFont=Inter-Regular.ttf, ItalicFeatures={FakeSlant=0.18},
+  BoldItalicFont=Inter-SemiBold.ttf, BoldItalicFeatures={FakeSlant=0.18}]
+\setsansfont{Inter-Regular.ttf}[Path=../../rust/app/assets/fonts/, BoldFont=Inter-SemiBold.ttf]
+\setmonofont{JetBrainsMono-Regular.ttf}[Path=../../rust/app/assets/fonts/, Scale=0.92]
+\newfontfamily\heavy{Inter-SemiBold.ttf}[Path=../../rust/app/assets/fonts/]
+\newfontfamily\phfont{Phosphor.ttf}[Path=fonts/]
+\newfontfamily\phfill{Phosphor-Fill.ttf}[Path=fonts/]
+\linespread{1.18}
+\setlength{\parindent}{0pt}
+\setlength{\parskip}{0.62em}
+\raggedbottom
+\sloppy
+
+% --- Palette (mirrors the app's Pro theme) ---------------------------------------------
+\definecolor{ink}{HTML}{1B1B1F}
+\definecolor{ink2}{HTML}{26262C}
+\definecolor{body}{HTML}{2A2A33}
+\definecolor{muted}{HTML}{6B6B78}
+\definecolor{rule}{HTML}{E4E4EA}
+\definecolor{paper}{HTML}{F7F7FA}
+\definecolor{accent}{HTML}{3B82F6}
+\definecolor{teal}{HTML}{14B8A6}
+\definecolor{violet}{HTML}{8B5CF6}
+\definecolor{amber}{HTML}{F59E0B}
+\definecolor{rose}{HTML}{F43F5E}
+\definecolor{pink}{HTML}{EC4899}
+\definecolor{green}{HTML}{22C55E}
+\definecolor{slate}{HTML}{64748B}
+\color{body}
+
+% Page-level drawing. Everything that paints relative to the page goes through here, drawn at shipout
+% from the page's lower-left corner, so it never depends on remember-picture positions settling.
+% Inside, the node (pg) is the whole page: use pg.north west, pg.south east and so on.
+\newcommand\pgnode{\node[inner sep=0pt, minimum width=\paperwidth, minimum height=\paperheight, anchor=south west] (pg) at (0,0) {};}
+\newcommand\pagecanvas[1]{\AddToShipoutPictureBG*{\AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode#1\end{tikzpicture}}}}
+
+% Current part colour (set by \guidepart).
+\colorlet{partcol}{accent}
+\newcounter{guidepart}
+\newcommand\partshort{}
+
+% --- Icons ------------------------------------------------------------------------------
+\newcommand\ph[1]{{\phfont\symbol{"#1}}}
+\newcommand\phf[1]{{\phfill\symbol{"#1}}}
+\newcommand\iTerminal{\ph{EAE8}}  \newcommand\iBolt{\ph{E2DE}}     \newcommand\iBrain{\ph{E74E}}
+\newcommand\iWarn{\ph{E4E0}}      \newcommand\iBulb{\ph{E2DC}}     \newcommand\iCoffee{\ph{E1C2}}
+\newcommand\iRocket{\ph{E3FE}}    \newcommand\iCheck{\ph{E184}}    \newcommand\iTimer{\ph{E492}}
+\newcommand\iKeyboard{\ph{E2D8}}  \newcommand\iSparkle{\ph{E6A2}}  \newcommand\iShield{\ph{E40C}}
+\newcommand\iWand{\ph{E6B6}}      \newcommand\iBug{\ph{E5F4}}      \newcommand\iStar{\phf{E46A}}
+\newcommand\iSiren{\ph{E9B8}}     \newcommand\iWave{\ph{E580}}     \newcommand\iTarget{\ph{E47C}}
+\newcommand\iMap{\ph{E31A}}       \newcommand\iList{\ph{EADC}}     \newcommand\iBox{\ph{E45E}}
+\newcommand\iKey{\ph{E2D6}}       \newcommand\iPlugs{\ph{EB5A}}    \newcommand\iFolder{\ph{E256}}
+\newcommand\iBroadcast{\ph{E0F2}} \newcommand\iFilm{\ph{E792}}     \newcommand\iCode{\ph{E1BC}}
+\newcommand\iGear{\ph{E270}}      \newcommand\iLock{\ph{E2FA}}     \newcommand\iGithub{\ph{E576}}
+\newcommand\iChat{\ph{E16C}}      \newcommand\iDesktop{\ph{E560}}  \newcommand\iUsb{\ph{E956}}
+\newcommand\iTree{\ph{E67C}}      \newcommand\iArrows{\ph{E0A0}}   \newcommand\iCmd{\ph{E1C4}}
+\newcommand\iSearch{\ph{E30C}}    \newcommand\iSplit{\ph{E870}}    \newcommand\iLifebuoy{\ph{E63A}}
+\newcommand\iInfo{\ph{E2CE}}      \newcommand\iPin{\ph{E3E2}}      \newcommand\iConfetti{\ph{E81A}}
+\newcommand\iDetective{\ph{E83E}} \newcommand\iCompass{\ph{E1C8}}  \newcommand\iBinary{\ph{EE60}}
+\newcommand\iPalette{\ph{E6C8}}   \newcommand\iRecord{\ph{E3EE}}   \newcommand\iArrow{\ph{E06C}}
+\newcommand\iClock{\ph{E19A}}     \newcommand\iFlag{\ph{EA38}}     \newcommand\iPlug{\ph{E946}}
+\newcommand\iGhost{\ph{E62A}}     \newcommand\iBell{\ph{E5E8}}     \newcommand\iHourglass{\ph{E2B2}}
+\newcommand\iDownload{\ph{E20C}}  \newcommand\iUpload{\ph{E4C0}}   \newcommand\iPlane{\ph{E398}}
+
+% --- Inline bits --------------------------------------------------------------------------
+% \kbd{Ctrl} — a keycap. \keys{Ctrl+Shift+K} — keycaps joined with thin pluses.
+\newtcbox{\kbd}{on line, boxrule=0.4pt, arc=2.2pt, colback=paper, colframe=rule!70!slate,
+  boxsep=0pt, left=3.2pt, right=3.2pt, top=1.6pt, bottom=1.2pt, fontupper=\ttfamily\footnotesize\color{ink}}
+% \mod is "Ctrl, or ⌘ on a Mac": every shortcut in the guide is written \keys{\mod+K}.
+\renewcommand\mod{\kbd{Ctrl\,/\,\ph{E1C4}}}
+\def\keystop{\relax}\def\modtok{\mod}
+\DeclareRobustCommand\keys[1]{\keysplit#1+\relax+}
+\def\keysplit#1+{\def\kk{#1}\ifx\kk\keystop\else\keycap{#1}\expandafter\keysplitnext\fi}
+\def\keysplitnext#1+{\def\kk{#1}\ifx\kk\keystop\else{\kern0.15em\scriptsize\color{muted}+\kern0.15em}\keycap{#1}\expandafter\keysplitnext\fi}
+\newcommand\keycap[1]{\def\kc{#1}\ifx\kc\modtok\mod\else\kbd{#1}\fi}
+
+\newcommand\ui[1]{{\heavy\color{ink}#1}}               % on-screen labels
+\newcommand\code[1]{{\ttfamily\color{ink}#1}}           % file paths and commands
+\newcommand\menu[1]{{\heavy\color{ink}#1}}              % File → Thing
+\newcommand\then{\,{\color{muted}\iArrow}\,}
+\newcommand\proto[2][accent]{\tcbox[on line, arc=6pt, boxrule=0pt, colback=#1!14, boxsep=0pt,
+  left=4pt, right=4pt, top=1.2pt, bottom=1.2pt]{\scriptsize\heavy\color{#1!80!black}#2}}
+
+% --- Callout boxes ----------------------------------------------------------------------
+\tcbset{guidebox/.style={enhanced, breakable, arc=7pt, boxrule=0pt, left=12pt, right=12pt,
+  top=8pt, bottom=8pt, before skip=10pt, after skip=12pt, fontupper=\small,
+  parbox=false, before upper={\setlength{\parskip}{0.5em}}}}
+\newcommand\boxhead[3]{{\heavy\color{#1}\large#2\enspace\normalsize#3}\par\vspace{2pt}}
+
+\newtcolorbox{tldr}{guidebox, colback=partcol!8, borderline west={3pt}{0pt}{partcol},
+  before upper={\boxhead{partcol}{\iBolt}{TL;DR}\setlength{\parskip}{0.4em}}}
+\newtcolorbox{quickwin}[1][Quick win]{guidebox, colback=green!8, borderline west={3pt}{0pt}{green},
+  before upper={\boxhead{green!65!black}{\iTarget}{#1}}}
+\newtcolorbox{headsup}[1][Heads up]{guidebox, colback=amber!10, borderline west={3pt}{0pt}{amber},
+  before upper={\boxhead{amber!75!black}{\iWarn}{#1}}}
+\newtcolorbox{protip}[1][Pro tip]{guidebox, colback=accent!7, borderline west={3pt}{0pt}{accent},
+  before upper={\boxhead{accent!80!black}{\iBulb}{#1}}}
+\newtcolorbox{sidequest}[1][Side quest]{guidebox, colback=violet!7,
+  borderline west={3pt}{0pt}{violet}, borderline={0.5pt}{0pt}{violet!35,dashed},
+  before upper={\boxhead{violet}{\iCompass}{#1 {\normalfont\footnotesize\color{muted}\enspace·\enspace optional, skip it if you're in a hurry}}}}
+\newtcolorbox{danger}[1][Careful]{guidebox, colback=rose!8, borderline west={3pt}{0pt}{rose},
+  before upper={\boxhead{rose!85!black}{\iSiren}{#1}}}
+
+% "You are here": a one-line chapter header strip with reading time.
+\newcommand\chapmeta[2]{%
+  \begin{tcolorbox}[enhanced, arc=6pt, boxrule=0pt, colback=paper, left=10pt, right=10pt,
+    top=5pt, bottom=5pt, before skip=0pt, after skip=10pt, fontupper=\small\color{muted}]
+  {\color{partcol}\iTimer}\enspace about \textbf{#1}\hfill{\color{partcol}\iTarget}\enspace #2
+  \end{tcolorbox}}
+
+% Checklists.
+\newlist{checklist}{itemize}{1}
+\setlist[checklist]{label={\color{partcol}\large\iBox}, leftmargin=1.9em, itemsep=2pt, topsep=4pt}
+\setlist[itemize]{label={\color{partcol}\small\textbullet}, leftmargin=1.4em, itemsep=1pt, topsep=3pt}
+\setlist[enumerate]{label={\heavy\color{partcol}\arabic*}, leftmargin=1.6em, itemsep=2pt, topsep=4pt}
+\setlist[description]{font=\heavy\color{ink}, leftmargin=1.2em, itemsep=2pt}
+
+% --- Screenshots --------------------------------------------------------------------------
+% \shot[width]{file}{caption}
+\newcommand\shot[3][\linewidth]{%
+  \par\needspace{0.3\textheight}\begin{center}
+  \begin{tikzpicture}
+    \node[inner sep=0pt, rounded corners=6pt, blur shadow={shadow blur steps=8, shadow xshift=0pt,
+      shadow yshift=-2pt, shadow opacity=25}] (img) {\includegraphics[width=#1]{img/#2}};
+    \draw[rule!60!slate, line width=0.4pt, rounded corners=3pt] (img.south west) rectangle (img.north east);
+  \end{tikzpicture}\par\vspace{4pt}
+  {\footnotesize\color{muted}#3}\end{center}\vspace{-4pt}}
+
+% Two screenshots side by side.
+\newcommand\shotpair[4]{%
+  \par\needspace{0.22\textheight}\begin{center}
+  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#1}\par\vspace{3pt}{\footnotesize\color{muted}#2}\end{minipage}\hfill
+  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#3}\par\vspace{3pt}{\footnotesize\color{muted}#4}\end{minipage}
+  \end{center}}
+
+% A crop of a screenshot: \crop{file}{left}{bottom}{right}{top}{width}{caption}, trims in px of the 2720x1720 image.
+\newcommand\crop[7]{%
+  \par\needspace{0.2\textheight}\begin{center}
+  \begin{tikzpicture}
+    \node[inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
+      {\includegraphics[width=#6, trim=#2 #3 #4 #5, clip]{img/#1}};
+    \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
+  \end{tikzpicture}\par\vspace{4pt}{\footnotesize\color{muted}#7}\end{center}\vspace{-4pt}}
+
+% Annotated screenshot: \begin{annotated}{file} \callout{1}{x}{y} … \end{annotated}, x/y in 0–1 from top left.
+\newenvironment{annotated}[1]{%
+  \par\begin{center}\begin{tikzpicture}
+  \node[anchor=north west, inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
+    {\includegraphics[width=\linewidth]{img/#1}};
+  \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
+  \begin{scope}[x={(img.north east)}, y={($(img.north west)-(img.south west)$)}, shift={(img.north west)}]}
+  {\end{scope}\end{tikzpicture}\end{center}}
+\newcommand\callout[3]{%
+  \node[circle, fill=partcol, text=white, font=\heavy\footnotesize, inner sep=0pt, minimum size=15pt,
+    draw=white, line width=1.4pt, blur shadow={shadow blur steps=5, shadow opacity=40}] at (#2,-#3) {#1};}
+\newcommand\num[1]{\tikz[baseline=(n.base)]\node[circle, fill=partcol, text=white, font=\heavy\scriptsize,
+  inner sep=0pt, minimum size=13pt] (n) {#1};}
+
+% "At a glance" fact card for each connection type.
+\newenvironment{glance}[2]{%
+  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=12pt, right=12pt, top=9pt, bottom=9pt,
+    before skip=6pt, after skip=12pt, fontupper=\small,
+    overlay={\node[anchor=north east, font=\heavy\tiny, text=#1!80!black, inner sep=8pt] at (frame.north east) {AT A GLANCE};}]
+  {\heavy\Large\color{#1!85!black}#2}\par\vspace{4pt}
+  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}p{0.72\linewidth}@{}}}
+  {\end{tabular}\end{tcolorbox}}
+
+% --- Headings --------------------------------------------------------------------------
+\titleformat{\chapter}[display]{\normalfont}{%
+  \pagecanvas{\fill[partcol] (pg.north west) rectangle ([yshift=-9mm]pg.north east);
+    \fill[partcol!12] ([yshift=-9mm]pg.north west) rectangle ([yshift=-11mm]pg.north east);}%
+  {\heavy\small\color{partcol}\MakeUppercase{\partshort}\enspace·\enspace CHAPTER \thechapter}}{2pt}
+  {\heavy\fontsize{30}{34}\selectfont\color{ink}}
+\titlespacing*{\chapter}{0pt}{0pt}{14pt}
+\titleformat{\section}{\heavy\Large\color{ink}}{%
+  \tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white, font=\heavy\small, inner sep=3pt, minimum width=18pt] (n) {\thesection};}{8pt}{}
+\titlespacing*{\section}{0pt}{18pt}{4pt}
+\titleformat{\subsection}{\heavy\large\color{ink}}{}{0pt}{{\color{partcol}\iArrow}\enspace}
+\titlespacing*{\subsection}{0pt}{12pt}{2pt}
+\renewcommand\thesection{\arabic{chapter}.\arabic{section}}
+\setcounter{secnumdepth}{1}
+\setcounter{tocdepth}{1}
+
+% --- Running heads + thumb tabs ---------------------------------------------------------
+\pagestyle{fancy}
+\fancyhf{}
+\renewcommand{\headrulewidth}{0pt}
+\renewcommand\chaptermark[1]{\markboth{#1}{}}
+\fancyhead[LE]{\footnotesize\color{muted}\heavy Nexus Terminal\enspace\normalfont·\enspace User Guide}
+\fancyhead[RO]{\footnotesize\color{muted}\leftmark}
+\fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white,
+  font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}
+\fancyfoot[RE,LO]{\footnotesize\color{muted}\partshort}
+\fancypagestyle{plain}{\fancyhf{}\fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt,
+  text=white, font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}}
+
+% Thumb tabs on the page edge, one slot per part, so you can flick to a part in print.
+\newif\ifthumbs
+\AddToShipoutPictureBG{%
+  \ifthumbs\ifnum\value{guidepart}>0
+  \AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode
+    \pgfmathsetmacro\slot{28 + (\value{guidepart}-1)*30}
+    \ifodd\value{page}
+      \fill[partcol, rounded corners=4pt] ([xshift=-7mm, yshift=-\slot mm]pg.north east) rectangle ++(9mm,-26mm);
+      \node[rotate=-90, text=white, font=\heavy\tiny] at ([xshift=-3.6mm, yshift=-\slot mm - 13mm]pg.north east) {\MakeUppercase{\partshort}};
+    \else
+      \fill[partcol, rounded corners=4pt] ([xshift=7mm, yshift=-\slot mm]pg.north west) rectangle ++(-9mm,-26mm);
+      \node[rotate=90, text=white, font=\heavy\tiny] at ([xshift=3.6mm, yshift=-\slot mm - 13mm]pg.north west) {\MakeUppercase{\partshort}};
+    \fi
+  \end{tikzpicture}}\fi\fi}
+
+% \guidepart{colour}{short name}{Title}{tagline}{list of chapters}
+\newcommand\guidepart[5]{%
+  \clearpage
+  \stepcounter{guidepart}\colorlet{partcol}{#1}\renewcommand\partshort{#2}
+  \phantomsection\addcontentsline{toc}{part}{\protect\textcolor{#1}{\arabic{guidepart}}\quad #3}
+  \thispagestyle{empty}\thumbsfalse
+  \pagecanvas{
+    \fill[ink] (pg.south west) rectangle (pg.north east);
+    \fill[#1, opacity=0.9] (pg.north west) rectangle ([yshift=-95mm]pg.north east);
+    \fill[#1!70!black, opacity=0.35] ([yshift=-95mm]pg.north west) -- ++(0,-18mm) -- ([yshift=-95mm]pg.north east) -- cycle;
+    \node[anchor=north west, text=white, font=\heavy\fontsize{150}{150}\selectfont, opacity=0.25]
+      at ([xshift=14mm, yshift=-4mm]pg.north west) {\arabic{guidepart}};
+    \node[anchor=south west, text=white, font=\heavy\small] at ([xshift=24mm, yshift=-72mm]pg.north west) {PART \arabic{guidepart}};
+    \node[anchor=north west, text=white, font=\heavy\fontsize{38}{42}\selectfont, text width=160mm]
+      at ([xshift=24mm, yshift=-73mm]pg.north west) {#3};
+    \node[anchor=north west, text=white!80!#1, font=\large, text width=150mm]
+      at ([xshift=24mm, yshift=-125mm]pg.north west) {#4};
+    \node[anchor=north west, text=white, font=\normalsize, text width=150mm]
+      at ([xshift=24mm, yshift=-145mm]pg.north west) {#5};
+  }\null\clearpage\thumbstrue}
+\newcommand\partitem[2]{{\color{partcol}\large#1}\enspace #2\par\vspace{5pt}}
+
+% Table of contents.
+\RequirePackage{tocloft}
+\renewcommand\cftpartfont{\heavy\large\color{ink}}
+\renewcommand\cftpartpagefont{\heavy\color{ink}}
+\renewcommand\cftchapfont{\color{body}}
+\renewcommand\cftchappagefont{\color{muted}}
+\renewcommand\cftchapleader{\cftdotfill{\cftdotsep}}
+\setlength\cftbeforepartskip{14pt}
+\setlength\cftbeforechapskip{3pt}
+\renewcommand\cfttoctitlefont{\heavy\fontsize{30}{34}\selectfont\color{ink}}
+
+% Symptom → fix cards for troubleshooting.
+\newcommand\fix[2]{%
+  \begin{tcolorbox}[enhanced, breakable, arc=7pt, boxrule=0.5pt, colframe=rule, colback=white, left=11pt, right=11pt,
+    top=8pt, bottom=8pt, before skip=6pt, after skip=8pt, fontupper=\small, parbox=false,
+    title={\heavy\color{ink}\normalsize{\color{partcol}\iBug}\enspace #1}, coltitle=ink, colbacktitle=paper,
+    titlerule=0pt, toptitle=5pt, bottomtitle=5pt, attach title to upper={}, detach title, before upper={\tcbtitle\par\vspace{4pt}}]
+  #2\end{tcolorbox}}
+
+% Big pull-quote line used to break up long stretches.
+\newcommand\breather[1]{\par\vspace{6pt}{\centering\heavy\large\color{partcol}#1\par}\vspace{6pt}}

docs/guide/nexus-guide.tex

@@ -0,0 +1,100 @@
+% Nexus Terminal — User Guide. Build: make (in docs/guide), or: lualatex nexus-guide && lualatex nexus-guide
+\documentclass[10pt,twoside,openany]{book}
+\usepackage{nexus-guide}
+
+\hypersetup{pdftitle={Nexus Terminal: The User Guide}, pdfauthor={Andy Dixon},
+  pdfsubject={SSH, Telnet, RAW, Serial, VNC, IRC and GitHub in one native app}}
+
+\begin{document}
+\frontmatter
+\pagestyle{empty}
+
+% --- Cover ------------------------------------------------------------------------------
+\pagecanvas{
+  \fill[ink] (pg.south west) rectangle (pg.north east);
+  \shade[left color=accent, right color=violet, opacity=0.55]
+    ([yshift=-60mm]pg.north west) -- ([yshift=-20mm]pg.north east) --
+    ([yshift=-130mm]pg.north east) -- ([yshift=-170mm]pg.north west) -- cycle;
+  \shade[left color=teal, right color=accent, opacity=0.35]
+    ([yshift=-150mm]pg.north west) -- ([yshift=-120mm]pg.north east) --
+    ([yshift=-150mm]pg.north east) -- ([yshift=-185mm]pg.north west) -- cycle;
+  \node[anchor=north east, inner sep=0pt] at ([xshift=-22mm, yshift=-24mm]pg.north east)
+    {\includegraphics[width=34mm]{img/logo.pdf}};
+  \node[anchor=north west, text=white!70!ink, font=\heavy\small] at ([xshift=22mm, yshift=-30mm]pg.north west)
+    {THE USER GUIDE};
+  \node[anchor=north west, text=white, font=\heavy\fontsize{58}{60}\selectfont, text width=170mm]
+    at ([xshift=22mm, yshift=-36mm]pg.north west) {Nexus\\[-2pt]Terminal};
+  \node[anchor=north west, text=white, font=\Large, text width=150mm]
+    at ([xshift=22mm, yshift=-88mm]pg.north west)
+    {Every terminal you need. One window.\\Zero faff.};
+  \node[anchor=north west, text=white!65!ink, font=\normalsize, text width=150mm]
+    at ([xshift=22mm, yshift=-110mm]pg.north west)
+    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
+  \node[anchor=south west, inner sep=0pt] at ([xshift=22mm, yshift=22mm]pg.south west)
+    {\begin{tikzpicture}
+      \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}};
+    \end{tikzpicture}};
+  \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right]
+    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 0.1\\October 2026\\dixon.cx};
+}\null
+\cleardoublepage
+
+% --- How to use this guide ----------------------------------------------------------------
+\colorlet{partcol}{accent}
+{\heavy\fontsize{30}{34}\selectfont\color{ink} Start here.\par}
+\vspace{2pt}{\large\color{muted} (Yes, even if you never read manuals. \emph{Especially} then.)\par}
+\vspace{10pt}
+
+This guide is built for skimming. You do \textbf{not} have to read it in order, cover to cover, like it's
+homework. Find the bit you need, grab it, get back to work. Every chapter opens with the time it takes and
+what you'll be able to do afterwards, and a \textbf{TL;DR} if you only want the gist.
+
+\vspace{4pt}
+{\heavy\large\color{ink}\iMap\enspace I just want to…}\par\vspace{2pt}
+\renewcommand\arraystretch{1.5}
+\begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{52mm}@{}}
+  \toprule
+  …get connected to something \emph{right now} & \hyperref[ch:start]{Five-minute start}, p.\,\pageref{ch:start}\\
+  …work out what all the buttons do & \hyperref[ch:tour]{The grand tour}, p.\,\pageref{ch:tour}\\
+  …SSH into a server (keys, jump hosts, 2FA) & \hyperref[ch:ssh]{SSH}, p.\,\pageref{ch:ssh}\\
+  …talk to a router or Arduino over a USB cable & \hyperref[ch:serial]{Serial}, p.\,\pageref{ch:serial}\\
+  …copy files to and from a server & \hyperref[ch:files]{Files}, p.\,\pageref{ch:files}\\
+  …type the same thing into ten servers at once & \hyperref[ch:repeat]{Never type it twice}, p.\,\pageref{ch:repeat}\\
+  …keep my passwords safe & \hyperref[ch:secrets]{Passwords \& the vault}, p.\,\pageref{ch:secrets}\\
+  …move over from Alchementary Link & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
+  …fix something that's broken & \hyperref[part:fix]{When things go wrong}, p.\,\pageref{ch:trouble}\\
+  …just see the keyboard shortcuts & \hyperref[app:keys]{The cheat sheet}, p.\,\pageref{app:keys}\\
+  \bottomrule
+\end{tabularx}
+
+\vspace{8pt}
+{\heavy\large\color{ink}\iSparkle\enspace The little boxes}\par\vspace{-2pt}
+\begin{multicols}{2}\small
+\begin{tldr}The whole chapter in three lines.\end{tldr}
+\begin{quickwin}Something you can try in under a minute.\end{quickwin}
+\begin{protip}A trick that saves you time later.\end{protip}
+\columnbreak
+\begin{headsup}A thing that might trip you up.\end{headsup}
+\begin{danger}Could lose data or weaken security. Read it.\end{danger}
+\begin{sidequest}Interesting, but not needed to get the job done.\end{sidequest}
+\end{multicols}
+
+\vspace{-6pt}
+{\small\color{muted}\textbf{Shortcuts:} \mod{} means \kbd{Ctrl} on Windows and Linux, \kbd{\ph{E1C4}} (Command) on a Mac. So
+\keys{\mod+K} is \kbd{Ctrl}+\kbd{K} or \kbd{\ph{E1C4}}+\kbd{K} depending on your machine.}
+
+\clearpage
+\pagestyle{plain}
+{\hypersetup{linkcolor=body}\tableofcontents}
+\clearpage
+
+\mainmatter
+\pagestyle{fancy}
+\input{chapters/part1-start}
+\input{chapters/part2-connect}
+\input{chapters/part3-faster}
+\input{chapters/part4-safe}
+\input{chapters/part5-yours}
+\input{chapters/part6-fix}
+\input{chapters/appendix}
+\end{document}

docs/guide/tools/demo-shell.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# ForceCommand for the throwaway screenshot sshd: never a login shell (no ~/.profile, no byobu).
+DEMO_HOME=$1 SFTP_SERVER=$2
+export LC_ALL=C.UTF-8
+case "$SSH_ORIGINAL_COMMAND" in
+  *sftp*) exec "$SFTP_SERVER" -d "$DEMO_HOME" ;;
+  ?*) cd "$DEMO_HOME" && HOME="$DEMO_HOME" exec bash --norc --noprofile -c "$SSH_ORIGINAL_COMMAND" ;;
+esac
+cd "$DEMO_HOME" || exit 1
+export HOME="$DEMO_HOME" PS1='\[\e[1;32m\]andy@atlas\[\e[0m\]:\[\e[1;34m\]\w\[\e[0m\]\$ '
+row() { # boxed line, padded on visible width
+  local plain; plain=$(printf '%b' "$1" | sed 's/\x1b\[[0-9;]*m//g')
+  printf '\e[1;36m│\e[0m  %b%*s\e[1;36m│\e[0m\n' "$1" $((44 - ${#plain})) ''
+}
+printf '\e[1;36m╭──────────────────────────────────────────────╮\e[0m\n'
+row 'Welcome to \e[1matlas\e[0m · Debian 13 · kernel 6.12'
+row 'Load \e[32m0.42\e[0m   Memory \e[33m61%\e[0m   Disk \e[32m38%\e[0m'
+row 'Last deploy: \e[1m2 hours ago\e[0m by andy'
+printf '\e[1;36m╰──────────────────────────────────────────────╯\e[0m\n\n'
+printf '\e[1;32m$\e[0m ls -l --color\n'; ls -l --color=always
+printf '\n\e[1;32m$\e[0m ./deploy.sh --dry-run\n'
+for s in "Resolving build" "Uploading artefacts" "Rolling out to 4 nodes" "Health checks"; do
+  printf '  \e[32m✔\e[0m %-26s \e[2m%s\e[0m\n' "$s" "$((RANDOM % 900 + 100))ms"
+done
+printf '  \e[33m⚠\e[0m 1 warning: \e[1mnginx.conf\e[0m has a deprecated directive\n'
+printf '  \e[1;32mDone.\e[0m Nothing was actually deployed (dry run).\n\n'
+exec bash --norc --noprofile -i

docs/guide/tools/fakes.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Tiny fake servers for the user-guide screenshots: RAW sensor feed (42023), IRC (42667),
+GitHub API (42080) and a VNC desktop (42900). Stdlib only. Runs until killed."""
+
+import json, math, random, socket, socketserver, struct, threading, time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+
+class Threaded(socketserver.ThreadingMixIn, socketserver.TCPServer):
+    allow_reuse_address = True
+    daemon_threads = True
+
+
+# --- RAW: a chatty sensor --------------------------------------------------------------
+
+class Raw(socketserver.BaseRequestHandler):
+    def handle(self):
+        s = self.request
+        s.sendall(b"SENSOR-7 ready. Commands: STATUS, RESET\n")
+        t = 20.5
+        s.settimeout(0.25)
+        for i in range(400):
+            t += random.uniform(-0.3, 0.3)
+            s.sendall(f"temp={t:.2f}C hum={48 + 4 * math.sin(i / 3):.1f}% seq={i}\n".encode())
+            try:
+                if (cmd := s.recv(256)):
+                    s.sendall(b"OK " + cmd.strip() + b"\n")
+            except socket.timeout:
+                pass
+
+
+# --- IRC: a small, friendly network ----------------------------------------------------
+
+CHAT = [
+    ("ferris", "anyone tried the new Nexus build yet?"),
+    ("crabby", "yep, the split panes are lovely"),
+    ("ferris", "the serial console support saved my afternoon tbh"),
+    ("lin", "does it do jump hosts?"),
+    ("crabby", "lin: multiple hops, plus SOCKS5/HTTP proxies"),
+    ("ferris", "and it's Rust all the way down now :)"),
+]
+
+
+class Irc(socketserver.StreamRequestHandler):
+    def send(self, line):
+        self.wfile.write((line + "\r\n").encode())
+
+    def handle(self):
+        nick = "andy"
+        for raw in self.rfile:
+            line = raw.decode(errors="replace").strip()
+            cmd, _, rest = line.partition(" ")
+            if cmd == "NICK":
+                nick = rest.strip()
+            elif cmd == "USER":
+                self.send(f":irc.demo 001 {nick} :Welcome to the Demo IRC Network, {nick}")
+                self.send(f":irc.demo 375 {nick} :- irc.demo Message of the Day -")
+                self.send(f":irc.demo 372 {nick} :- Be excellent to each other.")
+                self.send(f":irc.demo 376 {nick} :End of /MOTD command.")
+            elif cmd == "JOIN":
+                for room in rest.split()[0].split(","):
+                    self.send(f":{nick}!u@demo JOIN {room}")
+                    self.send(f":irc.demo 332 {nick} {room} :Nexus Terminal chat · be kind · no pasting walls of logs")
+                    self.send(f":irc.demo 353 {nick} = {room} :@ferris +crabby lin {nick} octo rustacean")
+                    self.send(f":irc.demo 366 {nick} {room} :End of /NAMES list.")
+                    if room == "#nexus":
+                        for who, msg in CHAT:
+                            self.send(f":{who}!u@demo PRIVMSG #nexus :{msg}")
+                    else:
+                        self.send(f":octo!u@demo PRIVMSG {room} :borrow checker 1, me 0")
+            elif cmd == "LIST":
+                for room, n, topic in [("#nexus", 42, "Nexus Terminal"), ("#rust", 3110, "Rust"), ("#linux", 905, "Linux"), ("#homelab", 77, "Racks & routers")]:
+                    self.send(f":irc.demo 322 {nick} {room} {n} :{topic}")
+                self.send(f":irc.demo 323 {nick} :End of /LIST")
+            elif cmd == "PING":
+                self.send(f":irc.demo PONG irc.demo {rest}")
+            elif cmd == "QUIT":
+                return
+
+
+# --- GitHub API --------------------------------------------------------------------------
+
+REPOS = [
+    ("andydixon", "nexus-terminal", "SSH, Telnet, Serial, IRC and VNC in one tidy native app", "Rust", 128, False, False, False, 1),
+    ("andydixon", "leviathan", "The egui design system Nexus borrows its looks from", "Rust", 64, False, False, False, 3),
+    ("andydixon", "dotfiles", "Shell, editor and terminal config", "Shell", 12, False, False, False, 6),
+    ("andydixon", "homelab-ansible", "Playbooks for the rack under the stairs", "Jinja", 7, True, False, False, 9),
+    ("andydixon", "alchementary-link", "The Wails/Go predecessor to Nexus Terminal", "Go", 31, False, False, True, 40),
+    ("alchementary", "website", "Marketing site", "TypeScript", 3, True, False, False, 2),
+    ("alchementary", "infra", "Terraform for everything", "HCL", 2, True, False, False, 5),
+    ("alchementary", "russh", "Fork with a jump-host fix", "Rust", 0, False, True, False, 15),
+]
+WHO = ["Andy Dixon", "ferris", "crabby", "dependabot[bot]"]
+
+
+def iso(days):
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(time.time() - days * 86400 - 3600 * 5))
+
+
+class Github(BaseHTTPRequestHandler):
+    def log_message(self, *a):
+        pass
+
+    def reply(self, obj):
+        body = json.dumps(obj).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        if self.path == "/user":
+            return self.reply({"login": "andydixon"})
+        if self.path.startswith("/user/repos"):
+            page = 1 if "page=1" in self.path else 2
+            if page != 1:
+                return self.reply([])
+            return self.reply([
+                {"full_name": f"{o}/{n}", "name": n, "description": d, "html_url": f"https://github.com/{o}/{n}",
+                 "default_branch": "main", "private": p, "fork": f, "archived": a, "language": l,
+                 "stargazers_count": s, "pushed_at": iso(age), "updated_at": iso(age), "owner": {"login": o}}
+                for o, n, d, l, s, p, f, a, age in REPOS])
+        if "/commits/" in self.path:
+            i = sum(map(ord, self.path)) % len(WHO)
+            age = next((r[8] for r in REPOS if f"/{r[1]}/" in self.path), 1)
+            return self.reply({"commit": {"committer": {"name": WHO[i], "date": iso(age)}, "author": {"name": WHO[i], "date": iso(age)}}})
+        self.send_error(404)
+
+
+# --- VNC: a static "desktop" ---------------------------------------------------------------
+
+W, H = 1280, 800
+
+
+def desktop():
+    px = bytearray(W * H * 4)
+    wins = [(90, 90, 620, 420, (40, 44, 52)), (560, 260, 1180, 700, (250, 250, 252)), (140, 560, 460, 740, (32, 140, 120))]
+    for y in range(H):
+        for x in range(W):
+            # Diagonal violet → teal wallpaper.
+            k = (x + y) / (W + H)
+            r, g, b = int(88 * (1 - k) + 20 * k), int(40 * (1 - k) + 150 * k), int(160 * (1 - k) + 170 * k)
+            for x0, y0, x1, y1, c in wins:
+                if x0 <= x < x1 and y0 <= y < y1:
+                    r, g, b = (200, 70, 90) if y < y0 + 28 else c
+                    if y >= y0 + 28 and c == (40, 44, 52) and (y - y0) % 22 < 9 and x0 + 20 < x < x0 + 20 + ((y * 37) % 400):
+                        r, g, b = (120, 220, 140) if (y // 22) % 3 else (230, 200, 120)
+            if y >= H - 40:
+                r, g, b = 24, 24, 30
+            i = (y * W + x) * 4
+            px[i:i + 4] = bytes((r, g, b, 0))
+    return bytes(px)
+
+
+PIXELS = None
+
+
+class Vnc(socketserver.BaseRequestHandler):
+    def recv(self, n):
+        b = b""
+        while len(b) < n:
+            c = self.request.recv(n - len(b))
+            if not c:
+                raise EOFError
+            b += c
+        return b
+
+    def handle(self):
+        s = self.request
+        s.sendall(b"RFB 003.008\n")
+        self.recv(12)
+        s.sendall(bytes([1, 1]))  # one security type: None
+        self.recv(1)
+        s.sendall(struct.pack(">I", 0))
+        self.recv(1)  # ClientInit
+        name = b"studio:0 (demo)"
+        s.sendall(struct.pack(">HH", W, H) + bytes([32, 24, 0, 1, 0, 255, 0, 255, 0, 255, 0, 8, 16, 0, 0, 0]) + struct.pack(">I", len(name)) + name)
+        sent = False
+        try:
+            while True:
+                t = self.recv(1)[0]
+                if t == 0:
+                    self.recv(19)
+                elif t == 2:
+                    n = struct.unpack(">xH", self.recv(3))[0]
+                    self.recv(4 * n)
+                elif t == 3:
+                    self.recv(9)
+                    if not sent:
+                        s.sendall(struct.pack(">BxH", 0, 1) + struct.pack(">HHHHi", 0, 0, W, H, 0) + PIXELS)
+                        sent = True
+                    else:
+                        time.sleep(0.5)
+                        s.sendall(struct.pack(">BxH", 0, 0))
+                elif t == 4:
+                    self.recv(7)
+                elif t == 5:
+                    self.recv(5)
+                elif t == 6:
+                    n = struct.unpack(">3xI", self.recv(7))[0]
+                    self.recv(n)
+                else:
+                    return
+        except (EOFError, ConnectionError):
+            pass
+
+
+if __name__ == "__main__":
+    PIXELS = desktop()
+    for port, handler in [(42023, Raw), (42667, Irc), (42900, Vnc)]:
+        threading.Thread(target=Threaded(("127.0.0.1", port), handler).serve_forever, daemon=True).start()
+    print("fakes ready", flush=True)
+    ThreadingHTTPServer(("127.0.0.1", 42080), Github).serve_forever()

docs/guide/tools/screenshots.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Regenerates docs/guide/img/*.png: a throwaway sshd (ForceCommand, never a login shell),
+# fake RAW/IRC/GitHub/VNC servers, a demo data directory, then one headless app run per shot.
+# Needs: xvfb-run, sshd, ssh-keygen, python3, ImageMagick. Usage: docs/guide/tools/screenshots.sh [shot...]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+GUIDE=$PWD
+B=${NEXUS_GUIDE_TMP:-/tmp/nexus-guide}
+IMG=$GUIDE/img
+APP=$GUIDE/../../rust/target/debug/nexus-terminal
+SCALE=${SCALE:-2}
+mkdir -p "$IMG"
+rm -rf "$B" && mkdir -p "$B/home/.ssh" "$B/sshd"
+
+(cd ../../rust && cargo build -q -p nexus && cargo build -q -p nexus-core --example demo_data)
+
+# Demo home: what the SFTP browser, the shell and the SSH key manager see.
+H=$B/home
+mkdir -p "$H"/{projects/nexus,backups,logs,www/static}
+printf 'server {\n  listen 443 ssl;\n}\n' > "$H/nginx.conf"
+echo '#!/bin/sh' > "$H/deploy.sh"; chmod +x "$H/deploy.sh"
+head -c 180000 /dev/urandom > "$H/backups/db-2026-10-10.sql.gz"
+head -c 52000 /dev/urandom > "$H/logs/access.log"
+echo "# Notes" > "$H/README.md"
+ssh-keygen -q -t ed25519 -N '' -C 'andy@laptop' -f "$H/.ssh/id_ed25519"
+ssh-keygen -q -t rsa -b 2048 -N '' -C 'andy@work' -f "$H/.ssh/work_rsa"
+ssh-keygen -q -t ecdsa -N '' -C 'deploy-bot' -f "$H/.ssh/deploy_ecdsa"
+
+# sshd on 42022 (ForceCommand keeps it away from ~/.profile).
+S=$B/sshd
+ssh-keygen -q -t ed25519 -N '' -f "$S/host"
+cp "$H/.ssh/id_ed25519.pub" "$S/authorized_keys"
+SFTP=$(ls /usr/lib/openssh/sftp-server /usr/libexec/openssh/sftp-server /usr/libexec/sftp-server 2>/dev/null | head -1 || true)
+cat > "$S/config" <<CFG
+Port 42022
+ListenAddress 127.0.0.1
+HostKey $S/host
+AuthorizedKeysFile $S/authorized_keys
+PidFile $S/pid
+StrictModes no
+UsePAM no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+PrintMotd no
+PrintLastLog no
+Subsystem sftp $SFTP
+ForceCommand $GUIDE/tools/demo-shell.sh $H $SFTP
+CFG
+"$(command -v sshd)" -f "$S/config" -E "$S/log"
+python3 -I "$GUIDE/tools/fakes.py" > "$B/fakes.log" 2>&1 &
+FAKES=$!
+trap 'kill $FAKES 2>/dev/null; kill "$(cat "$S/pid" 2>/dev/null)" 2>/dev/null || true' EXIT
+until grep -q ready "$B/fakes.log"; do sleep 0.2; done
+
+"$(dirname "$APP")/examples/demo_data" "$B/data" "$H/.ssh/id_ed25519" > /dev/null
+cp -r "$B/data" "$B/data.clean"
+
+shot() { # name, then app args
+  local name=$1; shift
+  if [ ${#ONLY[@]} -gt 0 ] && [[ ! " ${ONLY[*]} " =~ " $name " ]]; then return 0; fi
+  rm -rf "$B/data" && cp -r "$B/data.clean" "$B/data"
+  HOME=$H WINIT_X11_SCALE_FACTOR=$SCALE timeout 60 xvfb-run -a -s "-screen 0 3200x2000x24" \
+    "$APP" --data-dir "$B/data" --size 1360x860 --screenshot "$IMG/$name.png" "$@" 2>> "$B/app.log" || echo "  ! $name failed"
+  # 256-colour PNGs are a quarter of the size and look identical for UI shots.
+  [ -f "$IMG/$name.png" ] && magick "$IMG/$name.png" -colors 256 "PNG8:$IMG/$name.png"
+  echo "  $name"
+}
+ONLY=("$@")
+
+shot welcome
+shot welcome-midnight --theme midnight
+shot welcome-light    --theme light
+shot ssh              --connect "Sensor feed" --connect "Libera Chat" --connect atlas --shot-delay 5500
+shot ssh-light        --theme light --connect atlas --shot-delay 5500
+shot hostkey          --connect hello-ssh --shot-delay 5000
+shot split            --connect atlas --do "Split Pane Right" --shot-delay 5500
+shot sftp             --connect atlas --do "SFTP Browser" --shot-delay 6000
+shot broadcast        --connect build-runner --connect atlas --do "Toggle Broadcast Mode" --shot-delay 5500
+shot raw              --connect "Sensor feed" --shot-delay 5500
+shot irc              --connect "Libera Chat" --shot-delay 5500
+shot github           --connect GitHub --answer ghp_demo --shot-delay 6000
+shot vnc              --connect "Studio desktop" --answer demo --shot-delay 6000
+shot local            --run-local 'printf "\e[1;35mhello from the local shell\e[0m\n"; ls -la --color=always' --shot-delay 5000
+shot palette          --open palette
+shot quick            --open quick
+shot editor-ssh       --open editor:ssh
+shot editor-new       --open editor:new
+shot editor-serial    --open editor:serial
+shot editor-telnet    --open editor:telnet
+shot editor-raw       --open editor:raw
+shot editor-vnc       --open editor:vnc
+shot editor-irc       --open editor:irc
+shot editor-github    --open editor:github
+for t in general terminal security knownhosts help about; do shot "settings-$t" --open "settings:$t"; done
+shot keys             --open keys
+shot snippets         --open snippets
+shot triggers         --open triggers
+shot recordings       --open recordings
+shot export           --open export

docs/overview.md

@@ -1,19 +1,21 @@
 # Nexus Terminal Overview
 
-Nexus Terminal is a desktop connection and analysis workspace for people who manage servers, network services, remote desktops, repositories, and binary artefacts every day. It brings SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis workflows into one focused app with secure credential handling, multi-session organisation, file transfer, automation, recording, and inspection tooling built in.
+Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
+
+It is a single Rust application drawn with egui: there is no webview, no bundled browser engine and no runtime to install. Terminal output goes straight from the network into the terminal emulator, so large outputs stay responsive.
 
 ## Product positioning
 
-Nexus is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, GitHub repository visibility, binary triage, and repeatable operational workflows.
+Nexus Terminal is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, serial consoles, IRC, GitHub repository visibility and repeatable operational workflows.
 
-Use Nexus when you need to:
+Use Nexus Terminal when you need to:
 
 - Connect quickly to many systems without re-entering credentials.
-- Keep multiple live sessions organised with tabs, pinned tabs, split panes, and status indicators.
+- Keep multiple live sessions organised with tabs, pinned tabs, split panes and status indicators.
 - Move files over SSH without leaving the terminal workspace.
-- Work safely with host key verification, encrypted secrets, TOTP support, and audit logging.
-- Reuse commands, automate login flows, record sessions, and react to terminal output.
-- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, VNC desktops, GitHub repositories, local shells, firmware images, binaries, archives, and other artefacts.
+- Work safely with host key verification, encrypted secrets, TOTP support and audit logging.
+- Reuse commands, automate login flows, record sessions and react to terminal output.
+- Support mixed estates that include SSH servers, Telnet devices, raw TCP services, serial consoles, VNC desktops, IRC networks, GitHub repositories and local shells.
 
 ## Main feature groups
 
@@ -21,287 +23,238 @@ Use Nexus when you need to:
 
 - **SSH** for secure remote terminal access.
 - **Telnet** for legacy devices and services.
-- **RAW TCP** for direct socket interaction, protocol testing, and device troubleshooting.
-- **VNC** for remote desktop access.
+- **RAW TCP** for direct socket interaction, protocol testing and device troubleshooting.
+- **Serial** for USB-serial adapters, console cables, development boards and network gear.
+- **VNC** for remote desktop access, with a native viewer.
+- **IRC** for chat networks, with rooms, users and an optional SSH tunnel.
 - **GitHub** for repository browsing and download workflows.
 - **Local terminal** for opening a shell on the local machine.
-- **Leviathan** for binary inspection, editing, carving, transforms, and spectrogram workflows.
-- **Quick connect** for one-off sessions without saving a profile.
+- **Quick connect** for one-off SSH, Telnet, RAW, IRC or Serial sessions without saving a profile.
 - **Saved profiles** for repeat connections.
 
 ### Profile management
 
-- Create, edit, duplicate, and delete connection profiles.
-- Store display names, descriptions, notes, groups, tags, environment labels, and favourites.
-- Search profiles by name, host, or tag.
-- Filter profiles by protocol, group, tag, and favourite status.
+- Create, edit, duplicate and delete connection profiles.
+- Store display names, descriptions, notes, groups, tags and favourites.
+- Fuzzy search across name, host, tags and protocol.
+- Sidebar sections for Local Machine, Favourites, Recent (last five), groups and Ungrouped.
+- Multi-select profiles with Ctrl/Cmd-click for bulk connect, disconnect, tagging, moving between groups and deleting.
 - Test basic host and port reachability before connecting.
-- Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files, and jump hosts.
-- Export and import profiles using encrypted `.nexus` bundles.
-- Choose import behaviour for duplicates: skip, overwrite, or duplicate.
+- Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files and jump hosts.
+- Export and import profiles using encrypted `.nexus` bundles; older `.link` bundles from Alchementary Link import too.
+- Plain JSON export and import, with secrets redacted unless you choose to include them.
+- Choose import behaviour for duplicates: skip, overwrite or duplicate.
 
 ### Multi-session workspace
 
-- Tabbed sessions with connection state indicators.
-- Pin tabs to keep important systems visible.
-- Rename sessions.
-- Reorder tabs.
-- Scroll overflowing tabs and hover them to see full names and connection start times.
-- Close one session or all sessions.
-- Split panes vertically or horizontally.
-- Resize split panes.
+- Custom title bar with File, Session, View and Help menus, a command palette launcher and a light/dark toggle.
+- Tabbed sessions with protocol badges, connection state dots and activity markers.
+- Pin tabs to keep important systems at the front.
+- Rename, duplicate, reconnect and reorder tabs (drag, or Move Left/Right).
+- Scroll overflowing tabs and hover them to see the host, state and connection start time.
+- Split the active tab right or down, as many times as you like, with draggable dividers.
 - Switch tabs by keyboard shortcut.
-- Broadcast input to multiple connected sessions.
-- Show disconnected overlays with a one-click reconnect action.
-- Auto-reconnect support for SSH, Telnet, and RAW TCP profiles.
-- Command palette for fast access to connections, settings, terminal actions, security tools, import/export, snippets, triggers, and local terminal.
+- Broadcast input to all connected terminal sessions, or to a chosen set.
+- Disconnected and error overlays with one-click reconnect.
+- Auto-reconnect with exponential backoff for SSH, Telnet, RAW TCP, Serial and IRC profiles.
+- Guided error dialogs for authentication and host-key failures, with shortcuts to edit the profile or open Known Hosts.
+- Command palette for connections, tabs, new profiles, settings, import/export, themes, the secret store, SSH keys, snippets, triggers, recordings and terminal actions.
+- Status bar with session state, protocol, recording indicator, SSH latency, broadcast state, vault state, session count and update notices.
 
 ### Terminal experience
 
-- xterm.js-powered terminal rendering.
-- Configurable terminal font family, font size, scrollback, cursor style, and colour theme.
-- Search within terminal output.
-- Search options for case sensitivity, regular expressions, and whole-word matching.
-- Copy, paste, select all, clear, and reset from the terminal context menu.
-- Clipboard-aware paste behaviour.
-- Clickable web links where supported.
-- Alternate-screen scroll handling for tools such as `tmux`, `screen`, and `byobu`.
-- Export terminal scrollback as plain text.
-- Send break signals where supported.
-- Ping active sessions to check responsiveness.
+- Native terminal emulation (alacritty_terminal) with full colour, mouse reporting, bracketed paste and IME input.
+- Eleven terminal colour schemes, applied to every open terminal at once.
+- Configurable font family, font size, scrollback and cursor style, per profile or as defaults.
+- Find in terminal output, with case-sensitive and regular-expression options and a match counter.
+- Copy with Ctrl/Cmd+C when text is selected (otherwise it sends an interrupt), paste with Ctrl/Cmd+V.
+- Double-click selects a word, triple-click selects a line, Shift-click extends a selection.
+- Ctrl/Cmd-click a web link to open it in your browser.
+- Shift+PageUp/PageDown/Home/End and the mouse wheel scroll the scrollback; on the alternate screen the wheel sends arrow keys, so `tmux`, `screen` and `byobu` scroll naturally.
+- Context menu with Copy, Paste, Select All, Find, Send Snippet, Port Forwards, Split Right, Split Down, Export Output, Clear and Reset.
+- Export the whole scrollback as plain text.
+- Status-bar latency for the active SSH session.
 
 ### SSH capabilities
 
-- Password authentication.
-- Public key authentication.
-- Keyboard-interactive authentication.
-- SSH agent authentication.
+- Password, public key, keyboard-interactive and SSH agent authentication.
 - SSH agent forwarding.
-- Private key path discovery from `~/.ssh`.
-- SSH key manager for listing, generating, copying, and deleting key pairs.
-- Ed25519, RSA, and ECDSA key generation.
-- Optional private key passphrase handling.
-- TOTP / 2FA secret storage and code generation for keyboard-interactive login flows.
-- Host key verification policies per profile: Strict, Ask, Accept new, and Insecure.
+- Private key suggestions from `~/.ssh`, with a key file check.
+- SSH key manager for listing, generating, copying and deleting key pairs (Ed25519, RSA 2048/4096 and ECDSA, optional passphrase).
+- TOTP / 2FA secret storage and automatic code entry for keyboard-interactive logins.
+- Host key verification policies per profile: Strict, Ask, Accept new and Insecure.
 - Known hosts storage and management.
-- Jump host support for bastion and multi-hop access.
-- SOCKS5 proxy support.
-- HTTP CONNECT proxy support.
-- Local and remote port forwarding.
-- Runtime port forward management for active SSH sessions.
-- Startup commands.
-- Custom environment variables.
-- Terminal type configuration.
-- Keepalive interval and missed-keepalive settings.
-- Compression option.
+- Jump hosts for bastion and multi-hop access.
+- SOCKS5 and HTTP CONNECT proxies.
+- Local and remote port forwarding, started on connect or managed at runtime.
+- Startup commands, custom environment variables and terminal type.
+- Keepalive interval and missed-keepalive settings, and compression.
 - Expect-style login scripts with wait and send steps.
 - Built-in SFTP browser for file transfer.
 
 ### SFTP file browser
 
-- Open a side panel for SSH file browsing.
-- Navigate remote folders with breadcrumbs.
-- Go directly to a remote path.
-- Bookmark remote locations.
-- Refresh remote listings.
-- Create folders.
-- Upload files.
-- Download single files or multiple selected files.
-- Rename files and folders.
-- Delete files and folders.
-- Multi-select support for batch actions.
-- Resizable SFTP panel alongside the terminal.
-- Drag and drop files into an SSH terminal.
-- Choose whether dropped files are uploaded or pasted into the terminal as text.
-- Upload directory picker with folder filtering, breadcrumbs, keyboard navigation, and permission badges.
-- Permission labels for read-only and inaccessible folders.
+- Opens in a resizable dock beside the terminal.
+- Navigate remote folders with breadcrumbs, or go directly to a path.
+- Bookmark remote locations (kept per profile).
+- Refresh listings and create folders.
+- Upload files, and download single or multiple selected files.
+- Rename and delete files and folders.
+- Multi-select for batch actions.
+- Transfer queue with progress.
+- Drag and drop files onto an SSH terminal, then upload them or paste their contents.
+- Upload directory picker with folder filtering, breadcrumbs, keyboard navigation and READ ONLY / NO READ badges.
 
 ### Telnet capabilities
 
-- Telnet option negotiation.
-- Terminal type negotiation.
-- NAWS window-size updates.
-- Local echo option.
-- Line mode option.
-- Configurable line endings: LF, CR, CRLF, or none.
-- Configurable encoding: UTF-8, ASCII, and ISO 8859-1.
+- Telnet option negotiation, including echo, terminal type and NAWS window-size updates.
+- Local echo and line mode options.
+- Configurable line endings: LF, CR, CRLF or none.
+- Configurable encoding: UTF-8, ASCII and ISO 8859-1.
 - Negotiation debug mode.
 - Expect-style login scripts.
-- Auto-reconnect with configurable retry count.
-- Break signal support.
+- Auto-reconnect with a configurable retry count.
 
 ### RAW TCP capabilities
 
 - Direct TCP socket sessions.
-- Text, hex, and split data views.
-- Send data as text, hex, or escaped bytes.
-- Quick insert controls for common bytes such as NUL, CR, LF, ETX, and EOT.
+- Text, hex and split data views.
+- Send data as text, hex or escaped bytes.
+- Quick insert buttons for NUL, CR, LF, ETX and EOT.
 - Payload presets for reusable test messages.
-- Optional timestamps.
-- Optional send/receive direction labels.
-- Pause and resume display updates.
-- Clear the capture buffer.
-- Save RAW session captures.
+- Optional timestamps and send/receive direction labels.
+- Pause and resume display updates, and clear the capture buffer.
+- Save RAW session captures as JSON.
 - Configurable encoding and line endings.
 - Connect and read timeouts.
 - Auto-reconnect option.
 
+### Serial capabilities
+
+- Pick a device from the detected port list, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- Baud rate from common presets or any custom value, 5–8 data bits, none/odd/even parity, 1 or 2 stop bits.
+- Flow control: none, XON/XOFF (software) or RTS/CTS (hardware).
+- Line ending, encoding and local echo.
+- Assert DTR and RTS on connect (both on by default).
+- Auto-reconnect: unplugging the adapter disconnects the session, and the port is reopened when it comes back.
+- Clear hints for permission-denied and busy ports.
+- Works with everything a terminal session supports: recording, triggers, broadcast, snippets, find and split panes.
+
 ### VNC capabilities
 
-- VNC remote desktop sessions.
-- noVNC-based viewer inside the Nexus workspace.
+- Native VNC viewer inside the Nexus Terminal workspace (RFB 3.3–3.8; Raw, CopyRect, Hextile, ZRLE and Tight encodings).
 - Password prompt and password storage modes.
 - View-only mode.
-- Scale-to-fit display.
-- Shared-session option.
-- Quality setting.
-- SSH tunnel option for VNC traffic.
-- SSH tunnel authentication by password, public key, or SSH agent.
+- Scale-to-fit or 1:1 display, switchable from the toolbar.
+- Shared-session option and a quality setting.
+- Send the local clipboard to the remote desktop, send Ctrl+Alt+Del, and request a full refresh.
+- SSH tunnel option for VNC traffic, with password, public key or SSH agent authentication.
+- A warning before connecting without a tunnel, because classic VNC traffic is not encrypted.
+
+### IRC capabilities
+
+- Nick, real name, TLS and an optional server password.
+- NickServ identification on connect.
+- Auto-join rooms.
+- A Server tab plus one tab per room or private conversation, with unread markers.
+- Slash commands such as `/join`, `/part`, `/msg`, `/me`, `/nick`, `/topic`, `/list`, `/names`, `/whois` and `/raw`.
+- Tab nick completion, and click a nick to mention it.
+- Room browser with a filter, and a users list for the current room.
+- mIRC colour and formatting codes rendered in the conversation.
+- Optional SSH tunnel and auto-reconnect.
 
 ### GitHub capabilities
 
 - GitHub profile type using a personal access token.
 - GitHub.com and GitHub Enterprise API base URL support.
 - Repository viewer grouped by owner or organisation.
-- Repository filtering by name, description, or language.
+- Repository filtering.
 - Repositories sorted by latest commit activity.
-- Shows repository metadata such as language, stars, private/fork/archived state, latest committer, and latest commit time.
-- Manual refresh.
-- Configurable refresh interval.
+- Repository metadata such as language, stars, private/fork/archived state, latest committer and latest commit time.
+- Manual refresh and a configurable refresh interval.
 - Open repositories in the browser.
 - Download repository ZIP archives.
 
-### Leviathan binary workbench
-
-- Switch from **Nexus Terminal** to **Leviathan** from the sidebar header.
-- Load a local file into a working document, inspect it with multiple tools, then save the patched working copy.
-- Tools open as normal tabs beside connection sessions.
-- Leviathan tabs close immediately without connection-disconnect confirmation.
-- Shared undo, redo, and revert actions for byte-level edits.
-- File-backed document model for large local files, with chunked save/export where supported.
-- Clear limits for tools that require bounded in-memory buffers, such as image/audio spectrogram conversion and some parsers.
-
-### Leviathan editor and triage tools
-
-- **Hex Editor** with editable byte cells, live ASCII preview, 16-byte and 32-byte rows, byte search, string/hex search, previous/next match navigation, and range opening from analysis views.
-- **Overview** for first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
-- **Hashes** for CRC32, MD5, SHA-1, SHA-256, and SHA-512.
-- **Entropy** graph over the whole file, with selectable ranges that can open a new hex editor tab.
-- **Strings** extraction for ASCII and UTF-16 text.
-- **IOCs** for URLs, domains, paths, hashes, and other indicators.
-- **Search** and **Multi-search** for text, hex, and regular-expression matching.
-- Exportable results from tools that find files, ranges, or structured artefacts.
-
-### Leviathan structure, recovery, and transform tools
-
-- **Structures** parser for common binary formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
-- **Disasm** heuristic disassembly for common CPU families, with raw byte fallback for unsupported architectures.
-- **PDF** object, stream, xref, and suspicious-surface inspection.
-- **SquashFS** superblock and filesystem metadata inspection with human-readable bad-magic errors.
-- **Carve**, **Keys**, **Timestamps**, **Stego**, and **Metadata** tools for embedded artefacts and recovery workflows.
-- **BinSnoop** deep signature scanning across the whole file, with export for discovered files and ranges.
-- **Rules** for YARA-like rule scans.
-- **Patch Plan** and **Patch Apply** for validating and applying patch scripts.
-- **Transforms** for hex, Base64, URL, XOR, inflate, and cipher pipelines.
-- **Case Export** for bundling useful artefacts from a working investigation.
-
-### Leviathan spectrogram tools
-
-- Convert an image into WAV audio so the image appears in a spectrogram.
-- Insert an encoded image into an existing WAV or MP3 carrier.
-- Visualise WAV or MP3 audio as a spectrogram image.
-- Control FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
-
 ### Automation and reusable workflows
 
-- Snippet library for saved commands.
-- Snippet folders, descriptions, and tags.
-- Send snippets to active sessions.
-- Snippet variables before sending commands.
+- Snippet library for saved commands, with names, descriptions and folders.
+- Send snippets to the active session.
+- Built-in snippet variables (`{{hostname}}`, `{{date}}`, `{{time}}`, `{{timestamp}}`) and prompted custom variables.
 - Broadcast input mode for running the same command across connected sessions.
-- Trigger rules that watch terminal output.
-- Trigger matching by text or regular expression.
-- Trigger actions for notifications, tab highlighting, sound, or combined notify/highlight behaviour.
+- Trigger rules that watch terminal output, matching plain text or regular expressions.
+- Trigger actions for notifications, tab highlighting, both, or a sound (attention request).
 - Expect-style login scripts for SSH and Telnet.
 - Startup commands for SSH sessions.
 
 ### Session recording
 
 - Start and stop terminal recording per session.
-- Recording indicator on active tabs.
-- Recordings saved in asciicast v2-compatible format.
-- Recording browser for listing saved recordings.
-- Playback controls.
+- Recording indicator on the tab and in the status bar.
+- Recordings saved in asciicast v2 format.
+- Recording browser with storage usage and clean-up by age or total size.
+- Playback with play/pause, restart, a seek bar and speed control.
 - Delete saved recordings.
-- Recording metadata includes title, dimensions, duration, size, creation time, and file path.
 
 ### Security and credential handling
 
-- OS keychain first where available, including macOS Keychain, Linux Secret Service, and Windows Credential Manager.
-- Encrypted vault fallback.
-- Vault encryption with AES-256-GCM and Argon2id-derived keys.
-- Secret store lock and unlock workflow.
-- Per-profile secret modes: Saved, Session only, and Ask every time.
+- OS keychain first where available: macOS Keychain, Linux Secret Service and Windows Credential Manager.
+- Encrypted vault fallback, using AES-256-GCM with an Argon2id-derived key.
+- Secret store lock and unlock workflow, with a master-password strength meter.
+- Per-credential secret modes: Save securely, Remember for this session, and Ask every time.
 - Encrypted storage for TOTP secrets.
 - Known host verification and known host management.
-- Audit log for security-relevant operations.
-- Audit entries for connections, disconnections, profile changes, secret access, imports, and exports.
-- Secrets are not written into audit entries.
+- Audit log of connections, disconnections, profile changes, credential access, imports and exports. Secrets are never written to it.
 - Encrypted profile exports with password-based AES-256-GCM encryption and Argon2id key derivation.
-- Plain profile export can redact inline secrets.
 
 ### Settings and maintenance
 
-- Application theme setting.
-- Terminal theme selection.
+- App theme (Pro, Midnight or Light) and terminal colour scheme.
 - Default protocol preference.
-- Default terminal font, size, scrollback, and cursor settings.
+- Default terminal font, size, scrollback and cursor settings.
 - Confirm-on-close and confirm-on-disconnect preferences.
-- Status bar visibility setting.
-- Sidebar width preference.
-- Native paste preference.
+- Status bar visibility and sidebar width.
 - Local shell selection.
 - Secret store settings.
 - Known hosts management.
-- Help and troubleshooting content inside settings.
-- Background and manual update checks.
-- Update checks report availability, current version, latest version, release notes, release URL, and publish date.
+- Help topics and troubleshooting inside Settings.
+- A background update check at launch, and a manual check in Settings → About.
 
 ## Website-ready summary
 
 ### Suggested headline
 
-Nexus Terminal: one desktop workspace for SSH, files, sockets, remote desktops, repositories, and binary artefacts.
+Nexus Terminal: one native desktop workspace for SSH, files, sockets, serial consoles, remote desktops, chat and repositories.
 
 ### Suggested subheadline
 
-Manage SSH, Telnet, RAW TCP, VNC, GitHub, local shell, and Leviathan binary-analysis sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings, automation, and artefact-inspection tools built in.
+Manage SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
 
 ### Short product description
 
-Nexus Terminal helps developers, operators, support engineers, reverse engineers, firmware analysts, and homelab users manage many connections and artefacts without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, open VNC desktops, browse GitHub repositories, triage binaries with Leviathan, and keep credentials protected with keychain and encrypted-vault storage.
+Nexus Terminal helps developers, operators, support engineers, network and hardware engineers, and homelab users manage many connections without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, talk to serial devices, open VNC desktops, join IRC networks, browse GitHub repositories, and keep credentials protected with keychain and encrypted-vault storage.
 
 ### Product page feature bullets
 
-- All-in-one connection and analysis workspace for SSH, Telnet, RAW TCP, VNC, GitHub, local shells, and Leviathan tools.
-- Fast multi-session interface with tabs, pinned sessions, split panes, reconnect, and broadcast input.
-- Rich SSH support including agent auth, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts, and host key policies.
-- Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload, and permission-aware directory picking.
-- RAW TCP tooling with text, hex, split views, payload presets, captures, timestamps, and byte-level sending.
-- VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions, and optional SSH tunnelling.
-- GitHub repository browser with organisation grouping, filtering, activity sorting, metadata, ZIP downloads, and GitHub Enterprise support.
-- Leviathan binary workbench with hex editing, hashes, entropy, strings, IOCs, carving, BinSnoop, structures, PDF/SquashFS inspection, transforms, rules, patching, case export, and spectrogram image/audio tools.
-- Secure credential model using OS keychain first, encrypted vault fallback, per-profile secret modes, known hosts, encrypted exports, and audit logging.
-- Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export, and local terminal.
+- All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shells.
+- Native and fast: no webview, with a terminal that stays responsive under heavy output.
+- Multi-session interface with tabs, pinned sessions, split panes, reconnect and broadcast input.
+- Rich SSH support including agent auth and forwarding, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts and host key policies.
+- Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload and permission-aware directory picking.
+- RAW TCP tooling with text, hex and split views, payload presets, captures, timestamps and byte-level sending.
+- Serial consoles with full line settings, flow control, DTR/RTS control and auto-reconnect on replug.
+- Native VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions and optional SSH tunnelling.
+- IRC client with rooms, nick completion, NickServ and mIRC formatting.
+- GitHub repository browser with organisation grouping, filtering, activity sorting, ZIP downloads and GitHub Enterprise support.
+- Secure credential model using the OS keychain first, encrypted vault fallback, per-credential secret modes, known hosts, encrypted exports and audit logging.
+- Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export and local terminal.
 
 ## Who it is for
 
-- Developers who connect to many application servers, staging environments, and production hosts.
+- Developers who connect to many application servers, staging environments and production hosts.
 - Platform and DevOps teams who need organised, secure access across infrastructure.
-- Support teams who troubleshoot customer systems, network appliances, and legacy Telnet devices.
-- Network and hardware engineers who need RAW TCP and Telnet tools beside normal SSH workflows.
-- Homelab users who want SSH, VNC, file transfer, and repo access in one desktop app.
-- Reverse engineers, firmware analysts, and security researchers who want binary triage beside their live operational sessions.
+- Support teams who troubleshoot customer systems, network appliances and legacy Telnet devices.
+- Network and hardware engineers who need RAW TCP, Telnet and serial tools beside normal SSH workflows.
+- Homelab users who want SSH, VNC, file transfer, serial consoles and repo access in one desktop app.
 
 ## Learn more
 

docs/quick-start.md

@@ -1,42 +1,46 @@
 # Nexus Terminal Quick Start
 
-Nexus Terminal is a desktop client for SSH, Telnet, RAW TCP, VNC, GitHub, local terminal sessions, and Leviathan binary analysis. This page is a shareable quick start for everyday use.
+Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
 
 ## Get connected in minutes
 
 1. Open Nexus Terminal.
-2. Click **New** in the sidebar.
-3. Choose a protocol and enter the connection details.
-4. Click **Connect** to open the session in a new tab.
+2. Click **+** at the bottom of the sidebar, or press **Cmd+N** (macOS) / **Ctrl+N** (Windows/Linux).
+3. Choose a protocol at the top of the editor and enter the connection details.
+4. Click **Create & Connect** to save the profile and open the session in a new tab.
 
-One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect.
+Next time, just click the profile in the sidebar.
+
+One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect. Need a local shell? Click **Local Machine** at the top of the sidebar.
 
 ## Daily workflow
 
-- **Tabs and splits**: Drag tabs to reorder, and split the workspace to view multiple sessions at once.
-- **Scrollable tabs**: Use the tab bar scrollbar or mouse wheel/trackpad over the tab strip when many tabs are open. Hover a tab to see its full name and connection start time.
-- **Broadcast input**: Toggle with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux) to send the same command to all connected sessions.
-- **Snippets**: Save common commands and run them with one click.
-- **Search**: Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search within the active terminal.
+- **Command palette**: Press **Cmd+K** / **Ctrl+K** to connect, switch tabs or run any command by typing a few letters.
+- **Tabs and splits**: Drag tabs to reorder them, right-click a tab to pin, rename, duplicate or reconnect it, and split the workspace with **Cmd+Shift+D** / **Ctrl+Shift+D** (right) or **Cmd+Shift+E** / **Ctrl+Shift+E** (down).
+- **Scrollable tabs**: Use the mouse wheel or trackpad over the tab strip when many tabs are open. Hover a tab to see its host, state and connection start time.
+- **Broadcast input**: Toggle with **Cmd+Shift+B** / **Ctrl+Shift+B** to send the same keystrokes to every connected terminal. Right-click the broadcast button on the tab strip to pick targets.
+- **Snippets**: Save common commands with **Cmd+Shift+S** / **Ctrl+Shift+S** and send them with one click.
+- **Search**: Press **Cmd+F** / **Ctrl+F** to search within the active terminal.
+- **Copy, paste and links**: Select text and press **Cmd+C** / **Ctrl+C** to copy (with nothing selected, Ctrl+C interrupts as usual). **Cmd+V** / **Ctrl+V** pastes. **Cmd-click** / **Ctrl-click** a URL to open it.
 - **Reconnect quickly**: If a session drops, click **Reconnect** on the disconnected overlay.
 
+## Serial consoles
+
+Create a **Serial** profile, pick the device from the list (click refresh after plugging in an adapter) and set the baud rate and line settings to match the device — 115200 8N1 with no flow control is the default. On Linux your user needs to be in the `dialout` (or `uucp`) group; on macOS use the `/dev/cu.*` device.
+
 ## VNC remote desktops
 
-Create a **VNC** profile for remote desktop sessions. Use SSH tunnelling when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic may not be encrypted.
-
-## Leviathan binary tools
-
-Click **Leviathan** beside **Nexus Terminal** in the sidebar header to switch from connection profiles to binary-analysis tools. Use **Load** to choose a file, then open tools such as Hex Editor, Overview, Hashes, Entropy, Strings, Carve, BinSnoop, Structures, PDF, SquashFS, Transforms, and Spectrogram tools. Tools open in normal tabs and can be closed without a disconnect confirmation.
+Create a **VNC** profile for remote desktop sessions. Use the SSH tunnel option when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic is not encrypted, so Nexus Terminal asks before connecting without a tunnel.
 
 ## File transfers on SSH
 
-Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename, and delete files.
+Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename and delete files, create folders and bookmark locations.
 
 ### Drag and drop files
 
-Drop file(s) into the terminal and choose to:
+Drop file(s) onto a terminal and choose to:
 
-- **Upload** to a selected remote folder, or
+- **Upload to current directory** — pick a remote folder (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 
 The upload picker lists folders only and marks permissions:
@@ -47,9 +51,14 @@ The upload picker lists folders only and marks permissions:
 ## Security basics
 
 - Credentials are stored in the OS keychain where available.
-- An encrypted vault is used as a fallback.
+- An encrypted vault (AES-256-GCM, Argon2id) is used as a fallback; set it up in **Settings → Security**.
+- Each password, passphrase or token can be saved, remembered for the session only, or asked for every time.
 - SSH host key checks can be set per profile (Strict, Ask, Accept new, Insecure).
 
+## Coming from Alchementary Link
+
+Your profiles, vault and recordings are copied across automatically on first run, and keychain entries are picked up the first time they are needed. Your old Alchementary Link data is left untouched.
+
 ## Common shortcuts
 
 | macOS Shortcut  | Windows/Linux Shortcut | Action                   |
@@ -62,8 +71,8 @@ The upload picker lists folders only and marks permissions:
 | Cmd + Shift + B | Ctrl + Shift + B       | Broadcast input          |
 | Cmd + Shift + Q | Ctrl + Shift + Q       | Quick connect            |
 | Cmd + Shift + R | Ctrl + Shift + R       | Toggle session recording |
-| Cmd + Shift + D | Ctrl + Shift + D       | Split pane vertically    |
-| Cmd + Shift + E | Ctrl + Shift + E       | Split pane horizontally  |
+| Cmd + Shift + D | Ctrl + Shift + D       | Split pane right         |
+| Cmd + Shift + E | Ctrl + Shift + E       | Split pane down          |
 
 ## Need more detail?
 

docs/rust-port-plan.md

@@ -0,0 +1,481 @@
+# Rust port plan: Nexus Terminal, a native egui app with no Go and no webview
+
+> **Status (11 October 2026): converted.** Every phase below has been carried out on the
+> `rust-port` branch; Go, Node and Wails are gone. What was verified and what wasn't:
+>
+> - **Verified here (Linux):** the Go-generated fixtures (database, vault, `.link` export,
+>   recording) load; SSH against a real OpenSSH server (key and agent auth, PTY shell, exec,
+>   local/remote forwards, SFTP, jump host, agent forwarding, host-key rejection), including
+>   through the GUI with the host-key prompt and login scripts; local shell, RAW, Telnet/RAW/serial
+>   client tests (serial on a pty pair); the session manager (events, reconnect backoff, restart of
+>   an exited local shell); the terminal renderer (colours, 256/true colour, CJK fallback); every
+>   window rendered headlessly; `cargo clippy` clean; the Windows target builds and links.
+> - **Not verified:** macOS builds (need Apple's C toolchain), running on Windows or macOS, the OS
+>   keychain on a real desktop session (none was available, so the go-keyring compatibility in §3
+>   is untested), IRC, GitHub and VNC against real servers (tested against fakes), serial hardware.
+> - **Update URLs:** moved to `https://dixon.cx/downloads/nexus` (§7).
+
+Goal: rebuild Alchementary Link in Rust as **Nexus Terminal**, a single Rust application in the
+style of Leviathan Desktop (`../leviathan/rust`).
+- **UI:** the Wails webview (HTML/CSS/JS, xterm.js) is replaced by an **eframe/egui 0.36** shell with
+  Leviathan's design system: `Tokens` themes, Inter and JetBrains Mono, Phosphor icons, a custom title
+  bar, a navigator rail, document tabs, a dock, a status bar, and the Ctrl/Cmd+K palette over one `Cmd`
+  enum. Full functional parity is required.
+- **Backend:** the Go core is ported to Rust. At the end, Go, Node and Wails are gone from the repo.
+- **Rename:** back to **Nexus Terminal** (§7). Existing Alchementary Link data is migrated on first
+  run.
+- **Removed:**
+  - the hidden **Leviathan** mode (`internal/leviathan/*`, `leviathan.js`, the Konami toggle). It now lives in Leviathan Desktop.
+  - the **VS Code bridge** (`cmd/vscode-bridge`).
+- **New:** a Serial protocol (§4).
+- **VNC is included, not deferred.** Rust has a usable RFB client crate (§6a).
+
+### Crates
+
+| Need | Crate | Notes |
+|---|---|---|
+| UI | `eframe`/`egui` 0.36, `egui-phosphor`, `rfd`, `image` | Same versions and features as Leviathan (`glow`, `wayland`, `x11`, `accesskit`, `persistence`) |
+| Async runtime | `tokio` (multi-thread, 2 workers) | Network sessions only. The UI thread never blocks on it |
+| SSH, SFTP | `russh`, `russh-sftp`, `ssh-key` | Strict-kex (Terrapin) support; client-side **agent forwarding** (`server_channel_open_agent_forward`); `direct-tcpip` for jump hosts; `tcpip-forward` for remote forwards |
+| Terminal emulation | `alacritty_terminal` | VT parser, grid, scrollback, selection and regex search (the same engine Zed uses). We draw it with egui's painter (§6) |
+| Local shell | `portable-pty` | `forkpty` on Unix, ConPTY on Windows |
+| Serial | `serialport` | Baud/bits/parity/stop, RTS/CTS and XON/XOFF, DTR/RTS, break, port enumeration |
+| IRC | none (our own client over std TCP, `rustls` for TLS) | Registration, PING, CTCP, NickServ via PRIVMSG; reconnect and channel-state persistence are ours |
+| VNC | none (our own RFB client; `des`, `flate2`, `image` for Tight JPEG) | RFB 3.3–3.8, VNC auth, Raw/CopyRect/Hextile/ZRLE/Tight → egui texture |
+| HTTP (GitHub, updater) | `ureq` 3 | Blocking calls on `spawn_blocking` |
+| SQLite | `rusqlite` (`bundled`) | SQLite compiled in, so no system library is needed |
+| Vault, export | `argon2`, `aes-gcm`, `rand` | Native Argon2id at 128 MiB takes about 0.3 s |
+| Keychain | `keyring` 3 (pure-Rust D-Bus via zbus on Linux) | Must read entries written by go-keyring (§3) |
+| TOTP | none (`hmac` + `sha1`, ~30 lines) | RFC 6238, normalised like pquerna/otp |
+| JSON | `serde`, `serde_json` | Protocol configs stay JSON columns |
+| Telnet, RAW, recordings | none (tokio `TcpStream`, serde) | Small ports of the Go code |
+
+There are **no system C libraries**. SQLite is compiled in, and TLS uses rustls. The Linux binary needs
+only the X11/Wayland/GL libraries that eframe loads, as Leviathan does.
+
+## 1. Architecture
+
+Like Leviathan, the project is engine-first: a UI-free core crate, and the egui app is one client of it.
+
+```
+rust/
+├── core/    nexus-core: storage, secrets, models, protocol clients, SessionManager, Service. No egui.
+└── app/     nexus: the egui shell
+```
+
+- **`Service`** keeps the **same method names** as today's `api.Service` (`connect_session`,
+  `sftp_list`, …), and **`Event`** is one enum whose variants match today's event names
+  (`SessionData`, `SessionState`, `SecretPrompt`, `HostKeyVerify`, …). The checklist in §10 refers to
+  these names. They are now plain Rust calls with no serialisation.
+- **The UI thread** runs egui and owns all UI state. Each frame it drains a
+  `crossbeam_channel::Receiver<Event>`. `Service` methods that touch SQLite are fast and run inline
+  (rusqlite behind a `Mutex<Connection>`, in WAL mode).
+- **One tokio task per session** (SSH, Telnet, RAW, IRC, GitHub refresh, VNC). Serial and local-shell
+  sessions each get a blocking thread (`serialport` and `portable-pty` have blocking APIs). Each session
+  has an `mpsc` outbound queue (keystrokes, resize, break, DTR/RTS). Inbound bytes are batched per read
+  and sent as one `Event::SessionData`, followed by `ctx.request_repaint()`. Sending raw bytes instead
+  of base64 JSON is the main performance gain over the Wails app.
+- **Credential prompts:** when a session task needs a secret or a host-key decision while connecting,
+  it sends `Event::SecretPrompt { reply: oneshot::Sender }` and awaits the answer. Closing the session
+  drops the receiver, which cancels the prompt. This is the same contract as the Go channel.
+- **Long jobs** (SFTP transfers, archive download, `test_connection`, key generation) are tokio tasks
+  or `spawn_blocking`, and report progress through events.
+
+## 2. SSH (russh)
+
+| Feature | Approach |
+|---|---|
+| Interactive shell | `channel.request_pty(term type from the profile)`, env vars, `request_shell`, `window_change` |
+| Auth | password, public key (files, with passphrase), agent (`SSH_AUTH_SOCK`; Pageant and the Windows OpenSSH pipe through russh's agent client), keyboard-interactive, with TOTP answering the prompts |
+| Host keys | `Handler::check_server_key` against **our** SQLite known-hosts table (strict/ask/accept-new/insecure). Never `~/.ssh/known_hosts` |
+| Keepalive | russh `keepalive_interval`/`keepalive_max` from the profile |
+| Jump hosts | Hop N opens `channel_open_direct_tcpip`, and its stream is passed to hop N+1 as the transport (`connect_stream`). No loopback socket is needed |
+| SOCKS5 and HTTP proxies | `tokio-socks` for SOCKS5; HTTP CONNECT is about 40 lines. The resulting stream goes to `connect_stream` |
+| Local forwards | A `TcpListener` per forward → `channel_open_direct_tcpip` → `copy_bidirectional` |
+| Remote forwards | `tcpip_forward`, plus `Handler::server_channel_open_forwarded_tcpip` |
+| Agent forwarding | `agent_forward` request plus `server_channel_open_agent_forward`, bridged to the local agent. ⚠ Prove this in the phase 0 spike |
+| SFTP | `russh-sftp` on a second channel: list/stat/mkdir/rename/remove/upload/download, with progress events |
+| Key manager | `ssh-key`: generate ed25519, RSA 2048/4096 and ECDSA; write OpenSSH private keys (encrypted with bcrypt-pbkdf + aes256-ctr); public-key export; `file_is_private_key`. The key comment becomes `name@nexus-terminal` |
+| `~/.ssh/config` import | Port of `sshconfig` (~300 lines of Go) |
+| Compression | russh `zlib@openssh.com` when the profile enables it |
+
+The fallback, if a russh gap blocks the spike, is `ssh2` (libssh2 with vendored OpenSSL). It has no
+API for accepting agent-forwarding channels, and it brings C back into the build.
+
+## 3. Porting the Go backend
+
+Sizes are Go lines, excluding tests. The Go tree is 41k lines. Leviathan (25.5k), VNC's Go side and the bridge are not
+ported, which leaves about 15k lines to port.
+
+| Go package | Lines | Rust replacement |
+|---|---|---|
+| `storage` + `migrations/*.sql` | 949 | rusqlite. **Embed the same `.sql` files** with `include_str!` and keep the same migrations table, so existing databases open unchanged |
+| `models`, `validation`, `preferences`, `audit`, `knownhosts`, `config` | ~1.5k | Plain modules. Protocol configs stay JSON columns, read as `serde_json::Value` or, where the UI edits them, as `#[derive(Deserialize)]` structs with `#[serde(default)]`. Leviathan preferences (`leviathanEnabled`, …) are ignored on read |
+| `secrets` (vault + keychain) | 460 | Vault: `argon2` + `aes-gcm`. Keychain: `keyring`, with explicit target names to match go-keyring (see below) |
+| `exportimport` | 209 | Same envelope and the same crypto; `.nexus` extension (§7) |
+| `sessions` + `api` | ~6k | `SessionManager` + `Service` (§1): reconnect with attempts and backoff, login scripts, broadcast, recording hooks, secret resolution (saved / session-only / ask every time). The Leviathan methods are dropped |
+| `sshclient`, `sftpclient`, `sshconfig`, `terminalenv` | ~1.7k | §2 |
+| `telnetclient` | 603 | tokio `TcpStream` and the option state machine (echo, SGA, NAWS, TTYPE, BRK) |
+| `rawclient` | 561 | tokio; history, capture, and hex/escaped encoders |
+| `ircclient` (on `girc`) | 833 | `irc` crate plus our own state: rooms, NAMES, LIST, topic, reconnect, channel-state persistence (migration 006) |
+| `githubclient` | 408 | `ureq` + serde; periodic refresh; archive download |
+| `localshell` | 294 | `portable-pty` |
+| `recording` | 538 | asciicast v2 writer and reader; the files are the same |
+| `updater` | 303 | `ureq`; same manifest format; URLs per §7 |
+| `vncclient` | 340 | §6a |
+| `leviathan/*` | 25.5k | **Deleted.** |
+| `cmd/vscode-bridge` | 357 | **Deleted.** |
+
+### Data compatibility (hard requirement)
+
+Existing users upgrade in place. **Before any Go is deleted**, generate fixtures from the Go code and
+commit them under `rust/core/tests/fixtures/`:
+- a database with every protocol, snippets and known hosts, migrated through 006
+- a vault file with a known password
+- `.link` exports
+- recordings
+- keychain entries written by go-keyring, on each OS in CI
+
+Rust must read every fixture byte for byte. The formats are:
+- **Vault:** JSON `{version, salt(b64, 32 bytes), secrets: key → b64(nonce12 ‖ ciphertext ‖ tag)}`;
+  Argon2id with t=3, m=128 MiB, lanes=4, and a 32-byte key.
+- **Export:** `[1 byte version][32 bytes salt][12 bytes nonce][ciphertext]`, with the Argon2 parameters
+  from `exportimport.go`. Only the extension changes (`.link` → `.nexus`).
+- **Keychain:** ⚠ go-keyring and `keyring` don't store entries the same way by default:
+  - **macOS:** both use a generic password stored under service and account, so they match.
+  - **Windows:** go-keyring's target is `service:user`, but `keyring` defaults to `user.service`. Use `Entry::new_with_target`.
+  - **Linux:** both use the Secret Service, but with different attribute sets. Search by `service` + `username`.
+
+  The phase 0 spike proves all three against the fixtures.
+
+## 4. New protocol: Serial
+
+- **Library:** `serialport`.
+- **Migration:** `007_serial_protocol.sql` adds `serial` to the protocol CHECK, plus a `serial_config` JSON column.
+- **Config fields and defaults:** `baudRate 115200, dataBits 8, parity none|odd|even, stopBits 1|2,
+  flowControl none|xonxoff|rtscts, lineEnding cr|lf|crlf, localEcho false, dtrOnConnect true,
+  rtsOnConnect true, encoding, autoReconnect true, maxReconnectTries 5`.
+  Mark/space parity and 1.5 stop bits are left out because `serialport` doesn't support them. If they're needed, add them
+  through `termios`/`DCB` on the raw handle (about 30 lines per OS).
+- **Device path:** stored in `host`, with `port` 0, so the sidebar, search and palette work unchanged.
+- **Session:** a terminal session through `TermView`, so recording, triggers, broadcast, find, snippets
+  and split panes all work. Unplugging the adapter sets the session to disconnected, and auto-reconnect re-opens the path.
+  New service methods: `list_serial_ports`, `set_serial_lines(dtr, rts)`, `send_break`.
+- **UI:**
+  - an editor page (device combo with refresh, line settings, behaviour settings)
+  - a Quick Connect entry
+  - Send Break and DTR/RTS toggles on the tab
+  - a badge colour
+  - error hints: the `dialout`/`uucp` group on Linux, `/dev/cu.*` on macOS, and busy ports
+  - a Help topic
+
+## 5. Toolchain and platforms
+
+- **Toolchain:** pin the same `rust-toolchain.toml` as Leviathan (`1.99.0`), edition 2024.
+- **Targets:** keep the current release matrix in full: darwin amd64 and arm64 (one universal `.app`),
+  linux amd64 and arm64, and windows amd64 and arm64.
+- **UI code from Leviathan:** copy these files into `app/src/` once, then let them evolve
+  independently. There is no dependency on the Leviathan repo:
+  - `theme.rs` (Tokens, fonts; 278 lines)
+  - `widgets.rs` (198 lines)
+  - the title bar, command palette and frame layout from `app.rs`
+  - `hexview.rs`, for the RAW hex view
+  - bundled fonts
+  - the `packaging/` layout
+
+## 5a. UI mapping: webview module → egui
+
+egui is immediate mode. Lists are virtualised with `ScrollArea::show_rows`, so the 1000/200/5000-row caps go away.
+Terminal views are repainted only when their session receives data, and for input and cursor blink.
+
+| Current (JS) | egui replacement |
+|---|---|
+| `index.html` grid layout | Leviathan's frame: custom title bar (Nexus mark, menus, active-session title, ⌘K launcher, window controls); a **navigator rail** holding the connection sidebar (resizable 180–500); a central **tab strip + workspace** with an empty state; a right **dock** for SFTP and the profile editor; a **status bar** |
+| Shortcuts (`app.js`) | The `Cmd` enum plus a shortcut table. `Modifiers::COMMAND` maps to ⌘ on macOS and Ctrl elsewhere. The palette enumerates every `Cmd` |
+| `tabs.js` | A painted tab strip (Leviathan's tab style) with a protocol badge, status dot, activity marker, pin and 📁; pinned tabs first; drag to reorder; scroll with edge fades; context menu; tooltip with "Connected since"; close confirmation |
+| `terminal.js` + xterm.js | `TermView` (§6) |
+| `splitpane.js` | A binary tree of `Pane::{Leaf(session), Split{dir, ratio, a, b}}` laid out by rect, with draggable dividers (minimum 100 px). A placeholder leaf shows the connection picker. Child sessions get no tab |
+| `sidebar.js` | Collapsing sections (Local Machine, ★ Favourites, Recent 5, folders, Ungrouped), a protocol dot and ★, Ctrl/Cmd-click multi-select, a context menu, a bulk-action bar, and fuzzy search |
+| `profiles.js` drawer | A dock panel: protocol selector plus one section per protocol. List editors (jump hosts, forwards, RAW presets, login script) are `egui::Grid` rows with ▲▼✕ |
+| `settings.js` | Settings window with tabs: General, Terminal, Security, Known Hosts, Help, About |
+| `secrets.js` | Modal windows: secret prompt, master password (strength meter using the same formula), host-key dialog |
+| `sshkeys.js` | SSH Keys window: list, generate, copy public key, delete |
+| `sftp.js` | A dock panel per session: breadcrumb, table, bookmarks, and a transfer queue with progress bars. Dialogs via `rfd` |
+| Drop files on terminal | `ctx.input(\|i\| i.raw.dropped_files)` gives real paths. The File Drop dialog stays. Upload by path, so the 768 KiB base64 chunking goes away |
+| `raw.js` | Text view, hex view (the copied `hexview`, read-only), or split; a send bar (format combo, input, quick-byte buttons, presets); Save via `rfd` |
+| `irc.js` | Room tabs + a read-only `TermView` fed by the ported mIRC→ANSI formatter + a composer + side lists (rooms, room list, users) |
+| `github.js` | Painted repo cards under group headers; a filter; Refresh; ZIP and Visit buttons |
+| `vnc.js` | `VncView` (§6a) |
+| `commands.js` | The copied palette widget, with Nexus's sections and a port of `fuzzyMatch` |
+| `snippets.js`, `triggers.js`, `recordings.js` | Windows. Playback uses its own `TermView`, with a scrubber, speed control and autoplay |
+| `notifications.js` | A toast stack painted top-right in an `egui::Area`, auto-dismissed after 4 s (6 s for errors). About 60 lines; no crate needed |
+| `themes.js` | App chrome uses `Tokens` (Pro/Midnight/Light). `terminal_themes.rs` is a const table of the 11 terminal palettes (charcoal … rose-pine) |
+| Help tab HTML | The help topics minus Leviathan, as `include_str!` text with simple heading and paragraph styling |
+| `BrowserOpenURL`, clipboard, fullscreen | `ctx.open_url`, `ctx.copy_text` and egui paste events, `ViewportCommand::Fullscreen` |
+
+**App theme:** every widget is drawn by egui, so the theme applies everywhere.
+
+## 6. TermView (the critical path)
+
+- **Model:** one `alacritty_terminal::Term` per view, behind a `FairMutex`, fed by
+  `vte::ansi::Processor`. Session data events are fed straight in as bytes; UTF-8 is the parser's job.
+- **Drawing:** for each visible row, group cells into runs with the same attributes, then draw one
+  `painter.text` call per run, plus background rectangles, cursor, selection and search highlights.
+  Cache each row's layout by a hash of its content. Use the profile's font, falling back to the
+  preferences (JetBrains Mono is bundled). Wide and emoji cells take the terminal's cell width.
+- **Scrollback:** `Config.scrolling_history`, from the profile, falling back to `defaultScrollback`
+  (0–100000).
+- **Input:**
+  - egui `Key` events map to escape sequences, respecting the terminal mode (application cursor keys, keypad).
+  - `Event::Text` and `Event::Ime(Commit)` send the text, so IME input works.
+  - Paste is bracketed when the application enables it.
+  - Output goes to `write_session` and to the broadcast targets.
+- **Mouse:**
+  - When the application enables mouse reporting, send SGR/X10 reports.
+  - Otherwise: drag selects, double-click selects a word, triple-click selects a line.
+  - The wheel scrolls the scrollback. On the alternate screen it sends ↑/↓ once per notch (the existing tmux behaviour).
+  - Ctrl/Cmd-click on a URL opens it.
+- **Behaviours to keep:**
+  - **Clipboard:** Ctrl/Cmd+C copies when there is a selection and otherwise sends SIGINT; Ctrl/Cmd+V pastes.
+  - **Resize:** debounced; recompute columns and rows, then `term.resize` and `resize_session`.
+  - **Right-click menu:** all 11 items.
+  - **Find bar:** alacritty `RegexSearch`, with case and regex options, "i of N", Enter and Shift+Enter.
+  - **Overlays:** the disconnect overlay with Reconnect, and the local shell's "[Exited - press enter to restart]".
+  - **Cursor:** style (block, underline or bar) and blink.
+- **Performance target:** `cat` of a 50 MB file stays responsive, at parity with or better than xterm.js.
+  Parsing runs on the UI thread inside the event drain. If profiling shows that's too slow, feed `Term` on the session
+  thread and keep only drawing on the UI thread (the `FairMutex` already allows this).
+- **Reference:** `egui_term` (alacritty_terminal + egui) is prior art. Read it, but don't depend on it,
+  because it lags egui releases.
+
+## 6a. VNC
+
+**As built:** `vnc-rs` was not used; the fallback below (our own RFB client) is what shipped.
+
+- `vnc-rs` on a tokio task, with an optional SSH tunnel through §2's `direct-tcpip`.
+- Decoded rectangles are applied to an RGBA buffer, and dirty frames update a `TextureHandle`, scaled to fit.
+- Input: pointer → `PointerEvent`; keys → X11 keysyms (port the keysym map from `vnc.js`).
+- If `vnc-rs` doesn't work with the servers users run, the fallback is our own RFB client: Raw, CopyRect and ZRLE
+  in about 600 lines, plus Tight's JPEG via the `image` crate.
+
+## 7. Rename to Nexus Terminal and migrate data
+
+The rebrand to Alchementary Link (commit `1a380a0`) renamed every path and **migrated nothing**. This rename
+undoes it and migrates the data.
+
+| Item | Alchementary Link (now) | Nexus Terminal |
+|---|---|---|
+| Product and window title | Alchementary Link | Nexus Terminal |
+| Binary, bundle and app id | `AlchementaryLink` | `NexusTerminal` / `nexus-terminal` |
+| Config dir | `…/AlchementaryLink` | `…/NexusTerminal` |
+| Database and log | `link.db`, `link.log` | `nexus.db`, `nexus.log` |
+| Keychain service | `AlchementaryLink` | `NexusTerminal` |
+| Export file | `.link`, "Link Export" | `.nexus`, "Nexus Export" (import accepts both) |
+| Updater User-Agent and GitHub fallback | `AlchementaryLink-UpdateChecker`, `alchementary-link` | `NexusTerminal-UpdateChecker`, `nexus-terminal` |
+| Update and release URLs | `alchementary.co.uk/download/link/…` | `dixon.cx/downloads/nexus/…` |
+| Icons and brand mark | `alchementary-link-*.png`, ">_ AlchementaryLink" | Restore the `nexus-terminal-*` icons from git history (pre-`1a380a0`), redrawn for the egui title bar |
+
+**First-run migration** (in `nexus-core`, before the database is opened):
+1. If `NexusTerminal/nexus.db` exists, use it. This covers users from before the rebrand, whose data was never moved.
+2. Otherwise, if `AlchementaryLink/link.db` exists, **copy** (don't move) `link.db` → `nexus.db`, plus the
+   `vault/` directory and the recordings, into `NexusTerminal/`. Write a `migrated-from` marker.
+   The old directory is left untouched, so the Wails build still works if a user rolls back.
+3. **Keychain:** when a read under `NexusTerminal` misses, try `AlchementaryLink`. If it's found there, write it under
+   `NexusTerminal`. Old entries are not deleted.
+4. If both directories hold a database (a user who ran both builds), Nexus wins, and the toast says so.
+
+The old update channel must point existing Alchementary Link installs at the first Nexus release. That's one
+manifest entry on the update server, so existing users get the Rust build.
+
+## 8. Phases and milestones
+
+Each phase ends with a runnable build and its slice of the §10 checklist ticked off. **The Wails app keeps
+shipping until phase 7**, and Go is deleted only then.
+
+| # | Phase | Delivers | Milestone |
+|---|---|---|---|
+| 0 | Fixtures and spikes | The Go-generated fixtures (§3). Spikes, each answering one question: (a) a russh PTY shell against OpenSSH with an ed25519 key, strict-kex, a jump host and **agent forwarding**; (b) `TermView` on alacritty_terminal with vim, tmux, htop, IME input, and `cat` of 50 MB; (c) `keyring` reads go-keyring entries on all three OSes; (d) `vnc-rs` against TigerVNC and macOS Screen Sharing | Go/no-go on each risk in §2, §3 and §6a |
+| 1 | Core foundation | `nexus-core`: storage and migrations, models, validation, preferences, audit, known hosts, vault, keychain, export/import, `Service`/`Event`, and the **§7 migration**. App skeleton in Leviathan's frame: rail, sidebar, tabs, status bar, toasts, and the secret, master-password and host-key modals | Opens an existing Alchementary Link user's data as Nexus; profiles listed; lock and unlock |
+| 2 | Terminal | `TermView` (§6), terminal themes, local shell, Telnet, **Serial**, state handling (reconnect toast, error classifier, "Connection Already Open") | A usable local, Telnet and serial terminal |
+| 3 | SSH | §2 in full, plus SFTP and the key manager | Usable as a daily SSH client |
+| 4 | Forms | Profile editor (every field in §10.3), Quick Connect, Settings, Known Hosts, SSH Keys, encrypted export/import, update check | All profile CRUD and settings |
+| 5 | Power features | Split panes, broadcast, snippets, triggers, recording and playback, port-forward dialog, SFTP dock and file drop, palette, shortcuts, fullscreen | Every terminal-session feature |
+| 6 | RAW, IRC, GitHub, VNC | Rust clients and their views | Every protocol |
+| 7 | Ship; delete Go | Packaging and CI (§9). Delete `go.mod`, `go.sum`, `main.go`, `internal/`, `cmd/`, `frontend/`, `wails.json`, the Wails `build/` assets, and the Go build scripts (`build*.sh`, `build.ps1`, `Makefile`, `build-all.sh`). Rewrite the docs, README and `.github/copilot-instructions.md` as Nexus Terminal. Publish the update-server entry that moves users across (§7) | Nexus Terminal released from a tag; no Go or JS left |
+
+## 9. Build and release
+
+- **Build:** `cargo build --release --target …`.
+  - Version: `CARGO_PKG_VERSION`, set by `release.sh` in `Cargo.toml`.
+  - Update URL: `option_env!("NEXUS_UPDATE_URL")`, defaulting to the URL decided in §7. This replaces Go's `-ldflags -X`.
+- **Packaging:** Leviathan's `packaging/` layout, renamed:
+  - **macOS:** a universal `NexusTerminal.app` via `build-app.sh`, with Developer ID signing and notarisation.
+  - **Windows:** an `.exe` with an icon and version info from `build.rs`/`winresource`, using the GUI subsystem.
+  - **Linux:** a tarball, plus `install.sh` and a `.desktop` file.
+- **CI:** rewrite `release-builds.yml` with `dtolnay/rust-toolchain` and a native runner per OS and arch.
+  Drop Go, Node, Wails and `libwebkit2gtk`. Run `cargo test` on every platform.
+- **Unchanged:** the update server (`updates/index.php`) and the manifest format. `release.sh` gets the new names.
+
+## 10. Parity checklist
+
+This is the acceptance list, built from a full read of `frontend/src/js/*`. A feature is done when it works in the native build.
+
+### 10.1 Shell, tabs, sessions
+- [ ] Layout: sidebar, tab strip (+ New, Broadcast: left-click toggles, right-click picks targets), workspace empty state (New Connection, Quick Connect), status bar
+- [ ] Sidebar footer: New, ⌘K, Import, Export, Recordings, Settings
+- [ ] Shortcuts: ⌘K, ⌘N, ⌘W, ⌘Tab/⇧⌘Tab (wrap), ⌘1–9, ⌘, (Settings), ⌘F, ⇧⌘D, ⇧⌘E, ⇧⌘R, ⇧⌘B, ⇧⌘S, ⇧⌘Q, F11; Esc closes palette and exits fullscreen
+- [ ] Events handled: `session:data`, `session:state` (with attempt/maxRetries/delaySec toast), `session:closed`, `session:raw:data`, `session:github:*`, `session:irc:event`, `session:forward:started/stopped/error` toasts, `session:recording:started/stopped`, `session:sftp:progress`, `session:secret:prompt`, `session:hostkey:verify`, `app:open-about`
+- [ ] Connect flow: "Connection Already Open" (Cancel / New Connection / Use Existing), "Connecting to X…" toast, refit and resize at 50/300/800 ms after connect
+- [ ] Error classifier: auth errors → Close / Edit Profile / Retry; host-key errors also offer Known Hosts
+- [ ] Tabs:
+  - [ ] Visuals: protocol badge, status dot, activity marker cleared on activate, pinned-first order
+  - [ ] Interaction: drag reorder; wheel scroll with overflow fades; scroll the active tab into view; hover hint (name + "Connected since"); close activates the nearest neighbour
+  - [ ] Context menu: Rename, Duplicate, Pin/Unpin, Move Left/Right, Reconnect, Close
+  - [ ] Close confirm when the pref is on (not for GitHub tabs)
+- [ ] Session close is idempotent and cleans up splits, SFTP, triggers, recordings and viewers
+- [ ] Local shell: `ConnectLocal`, exit and restart-on-Enter
+- [ ] Quick Connect: SSH/Telnet/RAW/IRC/Serial, default ports, username (SSH/IRC), nick (IRC), Enter/Esc
+- [ ] Broadcast: toggle toast, target picker with Select All (all selected means null, i.e. all sessions)
+- [ ] Status bar latency: <100 good, <250 warn, else bad; stops on error
+- [ ] Toasts: 4 types, × dismiss, 4 s / 6 s auto-dismiss
+
+### 10.2 Terminal
+- [ ] §6 in full; 11 themes; switching theme updates every open terminal
+- [ ] Find bar (case, regex, count, next/prev, clear highlights)
+- [ ] Context menu: all 11 items, with the shortcut labels for the platform
+- [ ] File drop: Paste contents / Upload to current directory (SSH only) via the directory picker (breadcrumb, filter, Up, Refresh, READ ONLY / NO READ badges, "Use this folder" disabled when the directory isn't writable, keyboard navigation)
+- [ ] Port Forwards dialog: list, Stop, add (L/R, bind, dest, label)
+- [ ] Split panes: split the focused pane right/down, placeholder picker (Local Machine + profiles), divider drag with live refit, per-pane ✕ promotes the sibling, late connects to a closed pane are disconnected, closing the tab closes child sessions
+- [ ] Recording toggle and a visible tab indicator
+
+### 10.3 Profiles, sidebar, settings, security
+- [ ] Sidebar:
+  - [ ] Sections: Local Machine, Favourites, Recent 5, folders (sorted), Ungrouped / "All Connections"; collapsible
+  - [ ] Search: fuzzy over name, host, tags and protocol; empty states
+  - [ ] Mouse: click connects; Ctrl/Cmd-click multi-selects; double-click edits
+  - [ ] Context menu: Connect, Edit, Duplicate, Favourite toggle, Delete (confirm)
+  - [ ] Bulk bar: Connect all, Disconnect (confirm), Tags add/replace, Move Group, Clear
+- [ ] Profile editor, common:
+  - [ ] Protocol switch keeps common fields
+  - [ ] Validation: host, port, IRC nick and rooms, IRC SSH tunnel
+  - [ ] Buttons: Test (Reachable — N ms), Delete (confirm), Create/Save, Save & Connect
+  - [ ] General fields: Display Name, Host, Port, Username, Group (autocomplete), Description
+  - [ ] Terminal fields: font, size 8–36, scrollback 0–100000, cursor style
+  - [ ] Tags and Notes
+- [ ] SSH fields:
+  - [ ] Password mode, auth methods
+  - [ ] Key path with `ListSSHKeys` autocomplete, Browse, and checks (reject `~`, `FileExists`, `FileIsPrivateKey`); passphrase mode
+  - [ ] Host key policy (strict/ask/accept-new/insecure)
+  - [ ] Jump hosts list, port forwards list
+  - [ ] Startup command, env KEY=VALUE, login script (wait/send, timeout 1–120, reorder)
+  - [ ] Agent auth and forwarding
+  - [ ] TOTP: show/hide, Test (code shown 5 s), Save/Delete, placeholder when a secret is saved
+  - [ ] Proxy (none/socks5/http, host, port 1080, user, password)
+  - [ ] Advanced: terminalType, keepalive interval/count, compression, autoReconnect, maxReconnectTries 1–20
+- [ ] Telnet fields: localEcho, lineMode, terminalType, encoding, line ending, negotiationDebug, login script, reconnect
+- [ ] RAW fields: encoding, line ending, showTimestamps, showDirection, payload presets (name/payload/format), timeouts, autoReconnect
+- [ ] GitHub fields: API base URL, token storage, refresh interval 60–3600
+- [ ] IRC fields: nick, realName, TLS, server password and mode, NickServ, auto-join rooms, SSH tunnel, reconnect
+- [ ] VNC fields: every current field, saved round-trip
+- [ ] Settings:
+  - [ ] General: theme, default protocol, confirm on close/disconnect, status bar, sidebar width, local shell (Browse)
+  - [ ] Terminal: theme, font, size, scrollback, cursor
+  - [ ] Security: init/unlock/lock
+  - [ ] Known Hosts: table, Remove
+  - [ ] Help: 13 topics
+  - [ ] About: version, Check for Updates, View release, Import ~/.ssh/config
+- [ ] Master password dialog: strength meter (Weak/Fair/Good/Strong), confirm match
+- [ ] Secret prompt (Esc cancels → `cancelled:true`)
+- [ ] Host key dialog (Reject / Accept & Save)
+- [ ] SSH Key Manager: list (name, type, bits), copy public key, delete, generate (ed25519/rsa 2048|4096/ecdsa, passphrase)
+- [ ] Encrypted export (`.nexus`; import also accepts `.link`) (profile checkboxes, password + confirm) and import (password, skip/overwrite/duplicate)
+- [ ] Command palette:
+  - [ ] Sections: Connections, Actions, Tabs, Application, Security (lock/unlock), Terminal (Trigger Rules; split/clear/reset when a session is active)
+  - [ ] Fuzzy ranking, ↑↓ Enter Esc
+- [ ] Snippets: search, CRUD (name, description, command, folder), send to the active connected session, `{{hostname|date|time|timestamp}}` built-ins plus prompted variables
+- [ ] Triggers: CRUD; name, pattern, regex, case-sensitive, enabled; actions notify/highlight/both/sound; line-buffered matching with CSI stripped
+- [ ] Recordings:
+  - [ ] Browser: list, storage info, delete, cleanup by age (7/30/90) and size (1 GB / 5 GB)
+  - [ ] Playback: play/pause, restart, scrubber seek (replay to the target), m:ss, speed 0.5–10×, autoplay
+
+### 10.4 SFTP, RAW, IRC, GitHub, VNC
+- [ ] SFTP panel:
+  - [ ] Layout: toggle, resizable, breadcrumb, Go to path, New folder, Upload, Refresh, Close
+  - [ ] File list: folders first, `..` entry, extension icons, size with modified-time hint, loading/empty/error + Retry
+  - [ ] Actions: multi-select, Download (files), Rename (single), Delete (confirm)
+  - [ ] Bookmarks
+  - [ ] Transfer queue with progress; refresh when an upload is done; toast when the panel is closed
+- [ ] RAW:
+  - [ ] Views: Text/Hex/Split, Pause/Resume, Clear, Save capture, byte counter, 5000-entry buffer
+  - [ ] Prefixes: timestamps and direction per the profile
+  - [ ] Send: Text/Hex/Escaped formats, NUL/CR/LF/ETX/EOT, presets, Enter sends, local echo of the sent entry
+- [ ] IRC:
+  - [ ] Room tabs: Server tab, unread markers, 2000-line buffers
+  - [ ] Composer: /commands via `IRCHandleInput`, Tab nick completion, click a nick to insert `@nick`
+  - [ ] Room lists: join box, joined rooms with topic hint, room list (filter, click to join)
+  - [ ] Users list with prefixes stripped
+  - [ ] Formatting: all event types formatted as today, nick colour hash, full mIRC formatting (^B ^] ^^ ^_ ^V ^O ^C fg,bg ^D hex)
+- [ ] GitHub:
+  - [ ] Status line, filter, Refresh
+  - [ ] Ordering: owner groups ordered by newest repo (own login first on ties)
+  - [ ] Card contents: Private/Fork/Archived badges, last commit and committer, description, language colour, stars, relative pushed time
+  - [ ] Actions: ZIP (save dialog → `DownloadGitHubRepoArchiveToPath`), Visit
+- [ ] VNC: connect (direct or SSH-tunnelled), scaled framebuffer, mouse and keyboard, clipboard, disconnect overlay
+
+### 10.4a Serial
+- [ ] Profiles: create, edit and duplicate, and export/import round-trip including `serialConfig`
+- [ ] Editor: device list and refresh
+- [ ] Line settings: all baud, data-bit, parity, stop-bit and flow-control options applied
+- [ ] Session behaviour:
+  - [ ] data in the terminal
+  - [ ] local echo, line ending and encoding
+  - [ ] DTR/RTS on connect and as toggles
+  - [ ] Send Break
+  - [ ] XON/XOFF and RTS/CTS flow control honoured
+  - [ ] unplug → disconnected overlay; auto-reconnect when the device returns
+- [ ] Quick Connect Serial; recording, triggers, broadcast, snippets, find and split panes all work on serial sessions
+- [ ] Permission-denied and busy-port hints
+
+### 10.5 Rename and migration
+- [ ] Every user-visible string, window title, bundle, binary and icon says Nexus Terminal
+- [ ] First run migrates `AlchementaryLink/` → `NexusTerminal/`, copying the database, vault and recordings, and leaves the old directory intact
+- [ ] Pre-rebrand `NexusTerminal/nexus.db` is used as-is
+- [ ] Keychain entries under `AlchementaryLink` are found and re-saved under `NexusTerminal`
+- [ ] Import accepts `.link` and `.nexus`; export writes `.nexus`
+- [ ] An existing Alchementary Link install updates to Nexus through the update server
+
+
+## 11. Existing quirks: default is to fix during the port
+
+| Quirk | Native default |
+|---|---|
+| RAW Save passes the capture content as a file path (`raw.js:217` → `SaveSessionCapture(sid, path)`) | Save dialog, pass the path (fixes the bug) |
+| Rename prompt's OK button says "Connect" | "Rename" |
+| Recording tab dot never shows (wrong selectors) | Indicator drawn by the tab strip |
+| `#status-protocol` never filled | Show the active session's protocol |
+| Adding or removing a jump host, forward or preset discards unsaved edits | Grid editing keeps them |
+| `folder` dropped when switching protocol | Keep it |
+| RAW decodes received data as Latin-1 | Decode as UTF-8 in text view (hex view unchanged) |
+| SFTP bookmarks keyed by session id (lost on disconnect) | Key by profile id |
+| Help says sidebar supports drag between groups (it doesn't) | Fix the Help text; use "Move Group" |
+| Trigger "sound" uses a WebAudio 880 Hz beep | the system bell |
+
+Client-side state that is **not migrated**: trigger rules and SFTP bookmarks live in WebKit localStorage. Users recreate them; everything else is in the SQLite DB, the vault and the keychain, which are read as-is (§3).
+
+## 12. Tests
+
+- **Before Go is deleted:** the §3 fixtures.
+- **`cargo test` in `nexus-core`:**
+  - **Compatibility:** every §3 fixture read and round-tripped: database, vault, `.link` exports, recordings, and the keychain on each OS.
+  - **Migration (§7):** old dir only → copied; new dir only → untouched; both → Nexus wins; keychain fallback.
+  - **Ported Go test tables:** `validation`, `secrets`, `storage`, `exportimport`, `sshconfig`, `knownhosts`,
+    `terminalenv`, `rawclient` encoding and history, `models` defaults, and `updater` manifest parsing.
+  - **Ported JS tests:** IRC mIRC→ANSI (`test-irc.js`), and split-tree lifecycle with late-connect
+    rejection (`test-session-lifecycle.js`).
+  - **Pure logic:** fuzzy match, snippet variables, trigger line buffering, and password strength.
+  - **Serial:** a pty pair on Linux, covering data, echo, line endings and XON/XOFF.
+- **SSH integration:** a CI job against an `openssh-server` container, covering password, key,
+  keyboard-interactive with TOTP, jump host, local and remote forwards, agent forwarding, an SFTP round trip,
+  and a host-key mismatch.
+- **Screenshots:** copy Leviathan's `--screenshot out.png` flag, and check each view under `xvfb-run` in CI.
+- `test-regressions.js` is retired; §10 replaces it.

docs/user-manual.md

@@ -8,14 +8,16 @@
 4. Connection types
 5. Tabs and split panes
 6. Terminal actions and search
-7. Snippets and broadcast input
+7. Snippets, broadcast input and triggers
 8. SFTP file browser
 9. Drag-and-drop uploads and paste
-10. Session recordings
-11. Leviathan binary workbench
+10. Port forwards
+11. Session recordings
 12. Security and credentials
-13. Settings
-14. Troubleshooting
+13. Import and export
+14. Settings and updates
+15. Data locations and migration from Alchementary Link
+16. Troubleshooting
 
 ---
 
@@ -24,25 +26,34 @@
 ### Launch and connect
 
 - Start Nexus Terminal.
-- Click **New** in the sidebar, choose a protocol, and fill in the profile details.
-- Click **Connect** to open a session in a new tab.
+- Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**), choose a protocol, and fill in the profile details.
+- Click **Create & Connect** to save the profile and open a session in a new tab, or **Create** to save it for later.
+- Click a profile in the sidebar to connect to it.
 
 ### Quick connect
 
-Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. This starts a one-off session without saving a profile.
+Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. Choose SSH, Telnet, RAW, IRC or Serial, enter the host (or serial device), port, and username or nick where relevant, then press **Enter**. This starts a one-off session without saving a profile.
+
+### Local terminal
+
+Click **Local Machine** at the top of the sidebar, choose **File → Local terminal**, or click **Local** on the welcome screen to open a shell on this computer. When the shell exits, the tab shows `[Exited - press enter to restart]`; press **Enter** to start a new shell in the same tab.
+
+### Command palette
+
+Press **Cmd+K** / **Ctrl+K**, or click the search box in the title bar, to open the command palette. Type a few letters to find a connection, switch to a tab, create a profile, open a window, change theme, lock or unlock the secret store, or run a terminal action. Use **Up/Down** to move, **Enter** to run, and **Esc** to close.
 
 ---
 
 ## 2. The interface at a glance
 
-- **Sidebar**: Profiles grouped by folders or tags, with search at the top.
-- **Tab bar**: One tab per session with status indicators, badges, and quick actions.
-- **Workspace**: The active terminal or viewer; split panes appear here.
-- **Status bar**: Connection state and session details.
+- **Title bar**: the File, Session, View and Help menus, the active session's name and host, the command palette launcher, a light/dark toggle, and the window controls. Drag the title bar to move the window; double-click it to maximise.
+- **Sidebar**: a search box, then **Local Machine**, **★ Favourites**, **Recent** (the last five connections), one section per group, and **Ungrouped** (or **All Connections** when you have no groups). Sections collapse when you click their headers. The footer has buttons for New connection, Command palette, Import, Export, Recordings and Settings. Drag the sidebar edge to resize it.
+- **Tab strip**: one tab per session, with a state dot, protocol badge, pin marker, activity dot and close button. SSH tabs also have a folder icon for SFTP. On the right are **+** (new connection) and the broadcast button.
+- **Workspace**: the active terminal or viewer; split panes appear here. With no tabs open it shows a welcome screen with **New Connection**, **Quick Connect** and **Local** buttons.
+- **Right dock**: the profile editor or the SFTP browser, resizable.
+- **Status bar**: the active session's state and protocol, a **REC** marker while recording, latency for SSH sessions, a **BROADCAST** marker, the vault state (click it to open Security settings), the number of connected sessions, and an update notice when a new version is available.
 
-Screenshot: Main window with sidebar, tab bar, and active terminal.
-
-Tip: You can drag the divider between split panes to rebalance space.
+Notifications appear as toasts in the top-right corner and dismiss themselves after a few seconds; click **×** to dismiss one early.
 
 ---
 
@@ -50,22 +61,39 @@ Tip: You can drag the divider between split panes to rebalance space.
 
 ### Create a new profile
 
-1. Click **New** in the sidebar.
-2. Choose the protocol (SSH, Telnet, RAW, VNC, or GitHub).
-3. Fill in the required fields and optional settings.
-4. Save and connect.
+1. Click **+** in the sidebar footer or on the tab strip, press **Cmd+N** / **Ctrl+N**, or right-click a group header and choose **New connection in …**.
+2. Choose the protocol (SSH, Telnet, RAW TCP, GitHub, VNC, IRC or Serial) at the top of the editor. Switching protocol keeps the common fields.
+3. Fill in the **General** section: Display Name, Host (or Device for serial), Port, Username, Group and Description.
+4. Fill in the protocol sections and, for terminal protocols, the **Terminal** section (font family, font size 8–36, scrollback 0–100000 lines, cursor style).
+5. Optionally add **Tags** (comma-separated) and **Notes**.
+6. Click **Create & Connect**, or **Create** to save without connecting.
 
-Screenshot: New profile form with protocol selector and connection fields.
+Click **Test** to check that the host and port are reachable; a toast reports the round-trip time. Fields with problems are highlighted when you save.
 
-### Edit, duplicate, or delete
+The **Group** field suggests existing groups; type a new name to create one.
 
-Right-click a profile in the sidebar to edit, duplicate, or delete it. You can also click the pencil icon on hover, or double-click the item to edit.
+### Edit, duplicate, favourite, export or delete
 
-### Folders, tags, and favourites
+Right-click a profile in the sidebar for **Connect**, **Edit**, **Duplicate**, **Add to Favourites** / **Remove from Favourites**, **Export…** and **Delete**. Double-click a profile to edit it. Deleting a profile also removes its saved credentials.
 
-Use folders and tags to organise profiles. Mark profiles as favourites for quick access.
+### Bulk actions
 
-Tip: Use the search box to filter profiles by name, host, or tag.
+Ctrl-click (Cmd-click on macOS) profiles to select several. A bar appears at the bottom of the sidebar with:
+
+- **Connect all**
+- **Disconnect** (asks first when **Confirm on disconnect** is on)
+- **Tags** → **Add tags…** or **Replace tags…**
+- **Move group** (leave the name empty to move to Ungrouped)
+- **Delete**
+- **Clear** (clear the selection)
+
+### Search
+
+Type in the sidebar search box to fuzzy-search profiles by name, host, tag and protocol.
+
+### Already open?
+
+If you connect to a profile that already has a live session, Nexus Terminal asks whether to **Use Existing**, open a **New Connection**, or **Cancel**.
 
 ---
 
@@ -73,105 +101,192 @@ Tip: Use the search box to filter profiles by name, host, or tag.
 
 ### SSH
 
-- Password, public key, keyboard-interactive, SSH agent, and TOTP/2FA.
-- Jump hosts, port forwarding, proxy support, and auto-reconnect.
-- Built-in SFTP browser and session recording.
+- **Authentication**: password, public key, keyboard-interactive and SSH agent. Choose which methods to try under **Auth Methods**, and tick **Use SSH Agent for Authentication** to use `ssh-agent` (Pageant or the OpenSSH agent on Windows).
+- **Key & Passphrase**: choose a key from the suggestions (keys in `~/.ssh`), click **Browse**, or type a full path (`~` is not expanded). The editor checks that the file exists and is a private key.
+- **Host Verification**: the host key policy (see section 12).
+- **Jump Hosts**: one or more bastions, each with user, host, port and an optional key. Nexus Terminal tunnels through each hop in order.
+- **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect.
+- **Startup**: a startup command and environment variables (`KEY=VALUE`, one per line).
+- **Login Script**: expect-style steps (see below).
+- **SSH Agent**: agent authentication and **Forward Agent to Remote** (like `ssh -A`).
+- **TOTP / 2FA**: store a Base32 TOTP secret to answer two-factor prompts automatically. Click **Test** to show the current code, **Save** to store the secret, and **Delete** to remove it. Save the profile first.
+- **Proxy**: none, SOCKS5 or HTTP CONNECT, with host, port and optional username and password. The proxy is used to reach the SSH server, or the first jump host.
+- **Advanced**: terminal type, keepalive interval, max missed keepalives, compression, auto-reconnect and the maximum number of reconnect attempts (1–20).
+
+The SFTP browser, port forwards and status-bar latency are available on SSH sessions.
 
 ### Telnet
 
-- Option negotiation, encoding, local echo, and line endings.
-- Auto-login scripts and auto-reconnect.
+- **Login**: local echo and line mode.
+- **Terminal & Encoding**: terminal type and encoding (UTF-8, ASCII or ISO 8859-1).
+- **Echo & Line Endings**: LF, CR, CRLF or none.
+- **Negotiation**: **Debug Negotiation** for troubleshooting option negotiation.
+- **Login Script** and **Reconnection** settings.
+
+Telnet sends everything in plain text. Avoid it for anything sensitive over an untrusted network.
 
 ### RAW TCP
 
-- Text, hex, and split views for binary-safe data.
-- Payload presets and configurable encoding and line endings.
+- **Encoding & Framing**: encoding (UTF-8, ASCII or Hex) and line ending.
+- **Display**: show timestamps and show direction.
+- **Payload Presets**: named payloads with a format (Text, Hex or Escaped) for quick sending.
+- **Timeouts & Reconnect**: connect and read timeouts, and auto-reconnect.
+
+A RAW session opens a viewer instead of a terminal:
+
+- **Text**, **Hex** and **Split** views of everything sent and received.
+- **Pause** / **Resume**, **Clear**, and **Save** (writes the capture as JSON).
+- A send bar with a format selector (Text, Hex or Escaped), a **Presets…** menu, and quick buttons for EOT, ETX, LF, CR and NUL. Press **Enter** to send.
+
+### Serial
+
+Serial profiles open a terminal on a local serial port.
+
+- **Device**: pick the port from the list and click refresh after plugging in an adapter, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
+- **Line Settings**: baud rate (a preset from 300 to 1000000, or a custom value), data bits (5–8), parity (none, odd or even), stop bits (1 or 2) and flow control (none, XON/XOFF or RTS/CTS).
+- **Behaviour**: line ending, encoding, local echo (for devices that don't echo), **Assert DTR on connect**, **Assert RTS on connect**, and auto-reconnect.
+
+The defaults are 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, and DTR and RTS asserted.
+
+While connected, right-click the tab to **Send Break** or toggle **DTR** and **RTS**. Telnet tabs also offer **Send Break**.
+
+When the adapter is unplugged the session disconnects; with auto-reconnect on, the port is reopened when the device returns. Serial sessions support everything other terminals do: recording, triggers, broadcast, snippets, find and split panes.
 
 ### VNC
 
-- Remote desktop viewer embedded in the Nexus workspace.
-- Password prompt and saved-password modes.
-- View-only mode, scale-to-fit, shared sessions, and quality controls.
-- Optional SSH tunnel for safer VNC transport.
+- **VNC Server**: VNC host (defaults to the profile's Host), port, and password storage mode.
+- **Display**: **View Only**, **Scale to Fit**, **Shared Session** and **Quality (0-9)**.
+- **SSH Tunnel**: carry VNC traffic through SSH, with host, port, username and password, public key or SSH agent authentication.
 
-Use SSH tunnelling for VNC whenever possible. Direct VNC is useful on trusted or isolated networks, but many classic VNC deployments do not provide strong transport encryption.
+The viewer's toolbar shows the connection state and desktop size, and has buttons to switch between scaled and 1:1 display, refresh the screen, **Paste Clipboard** (send your local clipboard to the remote desktop) and **Ctrl+Alt+Del**. Text the remote desktop copies arrives on your local clipboard. Click the desktop to give it keyboard focus.
+
+Use SSH tunnelling for VNC whenever possible. If a VNC profile has no tunnel, Nexus Terminal warns that the traffic is unencrypted and offers **Connect Anyway**, **Edit Profile** or **Cancel**.
+
+### IRC
+
+- **IRC**: nick, real name, **Use TLS** (port 6697 for most TLS networks) and an optional server password.
+- **NickServ**: identify on connect, with an optional account name and password.
+- **Rooms**: rooms to join automatically, one per line or comma-separated.
+- **SSH Tunnel** and **Reconnection** settings.
+
+The IRC view has a **Server** tab and a tab per room or conversation, with a dot on tabs that have unread messages. Type messages or `/commands` in the composer (`/join`, `/part`, `/msg`, `/me`, `/notice`, `/nick`, `/topic`, `/list`, `/names`, `/whois`, `/who`, `/raw`, `/quit`, `/help`). Press **Tab** to complete a nick, or click a nick to mention it. The side panel lists joined rooms, a room browser with a filter (click a room to join it), and the users in the current room.
 
 ### GitHub
 
-- Browse repositories by organisation.
-- Sorted by most recent activity.
+- **API**: API base URL (`https://api.github.com`, or your GitHub Enterprise API URL) and personal access token storage. The token needs the `repo` scope.
+- **Refresh**: refresh interval, 60–3600 seconds.
+
+Repositories are grouped by owner or organisation and sorted by most recent activity. Each card shows Private, Fork and Archived badges, language, stars, description, and the last commit and committer. Use the filter box to narrow the list, **Refresh now** to update it, **Visit** to open a repository in your browser, and **ZIP** to download an archive.
 
 ---
 
 ## 5. Tabs and split panes
 
-- **Reorder** tabs by dragging them.
-- **Pin** important sessions to keep them at the front.
-- **Scroll** the tab bar with the scrollbar or mouse wheel/trackpad when many tabs are open.
-- **Hover** a tab to see the full name and, for connected sessions, the connection start time.
-- **Close** tabs with the close button on the left side of each tab. Leviathan tool tabs close without a disconnect confirmation.
-- **Split** the workspace vertically or horizontally to view multiple sessions at once.
-- **Broadcast** input to multiple connected sessions when needed.
+- **Reorder** tabs by dragging them, or right-click and choose **Move Left** / **Move Right**.
+- **Pin** important sessions from the tab's right-click menu; pinned tabs stay at the front.
+- **Rename**, **Duplicate** (open another session to the same profile) and **Reconnect** from the right-click menu.
+- **Scroll** the tab strip with the mouse wheel or trackpad when many tabs are open.
+- **Hover** a tab to see its name, host, state and, for connected sessions, the connection start time.
+- **Close** a tab with its **×**, **Cmd+W** / **Ctrl+W**, or **Close** in the right-click menu. When **Confirm on close** is on, closing a connected tab asks first (GitHub tabs close straight away).
+- **Switch** tabs with **Cmd+Tab** / **Ctrl+Tab**, **Cmd+Shift+Tab** / **Ctrl+Shift+Tab**, or **Cmd+1–9** / **Ctrl+1–9**.
+- A dot on a background tab means it has new output.
 
-Screenshot: Tab bar with pinned sessions and split panes.
+### Split panes
 
-Tip: Pinned tabs stay at the front so key systems never get buried.
+- **Cmd+Shift+D** / **Ctrl+Shift+D** splits the focused pane to the right (side by side).
+- **Cmd+Shift+E** / **Ctrl+Shift+E** splits it downwards (top and bottom).
+- Split Right and Split Down are also in the Session menu, the terminal's right-click menu and the command palette.
+
+A new pane offers **Local Machine** and your terminal profiles (SSH, Telnet and Serial); click one to open it in that pane. Drag a divider to resize panes. Click **×** on a pane's header to close it; its neighbour takes the space. Closing the tab closes every pane in it.
 
 ---
 
 ## 6. Terminal actions and search
 
+### Keyboard and mouse
+
+- **Copy**: select text and press **Cmd+C** / **Ctrl+C**. With nothing selected, **Ctrl+C** sends an interrupt as usual.
+- **Paste**: **Cmd+V** / **Ctrl+V**. Pastes are bracketed when the remote application asks for it.
+- **Select**: drag to select, double-click for a word, triple-click for a line, Shift-click to extend.
+- **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser.
+- **Scroll**: the mouse wheel, or **Shift+PageUp**, **Shift+PageDown**, **Shift+Home** and **Shift+End**. On the alternate screen (for example in `tmux`, `screen`, `byobu` or `less`) the wheel sends arrow keys instead.
+- Applications that use the mouse (such as `htop`, `vim` or `tmux` with mouse mode) receive mouse clicks and the wheel directly.
+
 ### Context menu
 
 Right-click in the terminal for:
 
-- Copy and paste
-- Select all
+- Copy and Paste
+- Select All
 - Find
-- Send snippet
-- Clear and reset
-
-Screenshot: Terminal context menu and search bar.
+- Send Snippet
+- Port Forwards (SSH)
+- Split Right and Split Down
+- Export Output (save the whole scrollback as a text file)
+- Clear and Reset
 
 ### Search
 
-Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle case sensitivity and regular expressions as needed.
+Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle **Aa** for case-sensitive matching and **.\*** for regular expressions. The bar shows "*n* of *total*"; press **Enter** for the next match, **Shift+Enter** for the previous one, and **Esc** to close.
+
+### Disconnects and errors
+
+When a session drops, the pane is dimmed and shows a **Disconnected** (or **Connection error**) card with **Reconnect** and **Close**. While auto-reconnect is running it shows **Reconnecting…** with a **Cancel** button, and a toast shows the attempt number and delay.
+
+If a connection fails because of authentication or a host key, a guided dialog explains what happened and offers **Retry**, **Edit Profile**, **Known Hosts** (for host-key errors) and **Close**.
 
 ---
 
-## 7. Snippets and broadcast input
+## 7. Snippets, broadcast input and triggers
 
 ### Snippets
 
-Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux) and save frequently-used commands. Send a snippet to the active session with one click.
+Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux), from the Session menu, or with **Send Snippet** in the terminal's right-click menu. Create snippets with a name, description, command and folder, search them, and click **Send to Session** to type the command into the active session followed by Enter.
 
-Screenshot: Snippet library with search and folder grouping.
+Snippets can use variables:
+
+- `{{hostname}}`, `{{date}}`, `{{time}}` and `{{timestamp}}` are filled in automatically.
+- Any other `{{name}}` is asked for when you send the snippet.
 
 ### Broadcast input
 
-Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux). While active, all input is sent to every connected session.
+Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux), the broadcast button on the tab strip, or the Session menu. While it is on, everything you type is also sent to every other connected terminal session, and the status bar shows **BROADCAST**.
+
+To broadcast to only some sessions, right-click the broadcast button (or choose **Session → Broadcast targets…**), tick the sessions you want, and click **Apply & Enable**.
+
+### Trigger rules
+
+Open **Trigger Rules** from the Session menu or the command palette. Each rule has a name, a pattern (plain text or regular expression), a case-sensitive option, an enabled switch and an action:
+
+- **Notify**: show a toast.
+- **Highlight tab**: briefly outline the pane.
+- **Notify + Highlight**: both.
+- **Sound**: ask the operating system for attention (for example, a bouncing dock icon or flashing taskbar button) and show a toast.
+
+Rules are checked against each complete line of terminal output, with colour codes removed.
 
 ---
 
 ## 8. SFTP file browser
 
-Open the file browser with the **folder** icon on an SSH tab. You can:
+Open the file browser with the **folder** icon on an SSH tab, or **Session → SFTP browser**. It opens in the right dock beside the terminal. You can:
 
-- Navigate folders using the breadcrumb trail.
-- Upload, download, rename, and delete files.
-- Refresh and create folders.
+- Navigate folders using the breadcrumb trail, the `..` entry, or **Go to path**.
+- Upload files, and download one or more selected files to a folder you choose.
+- Rename a single item, and delete one or more items (with confirmation).
+- Create folders and refresh the listing.
+- Bookmark the current folder with the star button; bookmarks are kept per profile.
+- Watch transfers and their progress in the transfer list.
 
-The browser runs inside the SSH session and shows remote contents in a side panel.
-
-Screenshot: SFTP browser open alongside the terminal.
+Ctrl-click (Cmd-click) or Shift-click to select several items. Drag the dock edge to resize it.
 
 ---
 
 ## 9. Drag-and-drop uploads and paste
 
-When you drop file(s) into an active terminal, Nexus Terminal asks whether to:
+When you drop file(s) onto an active terminal, Nexus Terminal asks whether to:
 
-- **Upload** to a chosen remote directory, or
+- **Upload to current directory** — choose a remote directory (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 
 ### Upload directory picker
@@ -181,163 +296,202 @@ The picker looks like the SFTP browser and lists remote folders only. It shows:
 - **READ ONLY** for folders you cannot write to.
 - **NO READ** for folders you cannot access.
 
-Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. You can also use the keyboard:
+Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. **Use this folder** is disabled when the folder is not writable. You can also use the keyboard:
 
 - **Up/Down**: move selection
 - **Enter**: choose the selected folder
+- **Backspace**: go up a folder (when the filter is empty)
 - **Escape**: cancel
 
 If the SFTP browser is already open, the picker starts in the same directory.
 
-Screenshot: Upload directory picker with permissions badges.
-
 Tip: Use the filter box to jump quickly to common folders.
 
 ---
 
-## 10. Session recordings
+## 10. Port forwards
 
-Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux). Recordings are saved as asciicast v2 files and can be replayed from the recordings panel.
+Forwards saved in an SSH profile start when the session connects. To manage forwards on a live SSH session, choose **Port Forwards** from the terminal's right-click menu or **Session → Port forwards**. The dialog lists active forwards (marked **L** for local or **R** for remote) with a stop button, and lets you start a new one:
 
-Screenshot: Recordings list with playback controls.
+- **Local →**: listen on a local bind address and port, and forward to a destination reachable from the server.
+- **Remote ←**: ask the server to listen, and forward connections back to a destination reachable from this computer.
+
+Toasts report when a forward starts, stops or fails.
 
 ---
 
-## 11. Leviathan binary workbench
+## 11. Session recordings
 
-Leviathan is the integrated binary-analysis and editing workspace inside Nexus Terminal. It is useful for firmware images, unknown binaries, archives, captures, embedded files, suspicious documents, and audio spectrogram experiments.
+Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux), or **Session → Toggle recording**. A red dot appears on the tab and **REC** in the status bar. Recordings are saved as asciicast v2 files.
 
-### Switching to Leviathan
+Open the recordings browser from the sidebar footer, the Session menu or the command palette. It shows how many recordings you have and how much space they use, lets you play or delete each one, and has **Clean up** for removing recordings older than 7, 30 or 90 days, or keeping the total under 1 GB or 5 GB.
 
-Click **Leviathan** in the top-left sidebar header. The normal connection list changes into a tool list. Click **Nexus Terminal** to return to saved servers and groups.
-
-Use **Load** to select a local file. The selected file becomes the current Leviathan working document. Use **Save** to write the patched working copy to a chosen destination.
-
-Leviathan tools open as regular tabs. You can open multiple tool tabs at once, switch between them, and close them without a connection-disconnect confirmation.
-
-### Hex Editor
-
-The Hex Editor is the primary byte-level view.
-
-- Choose 16 or 32 bytes per row.
-- Edit byte cells directly; typing two hex digits advances to the next byte.
-- The ASCII preview updates as bytes are edited.
-- Paste hex runs such as `de ad be ef` or `deadbeef` into consecutive cells.
-- Use Search to find strings or hex values, then move through matches with previous/next.
-- Undo, redo, or revert edits from the Leviathan panel header.
-
-### Triage tools
-
-- **Overview**: first-pass summary across hashes, entropy, strings, indicators, and carve candidates.
-- **Hashes**: CRC32, MD5, SHA-1, SHA-256, and SHA-512.
-- **Entropy**: graph entropy across the whole file; select a region to open that range in a new Hex Editor tab.
-- **Strings**: ASCII and UTF-16 string extraction.
-- **IOCs**: URLs, domains, paths, hashes, and other indicators.
-- **Search** and **Multi-search**: text, hex, and regular-expression matching.
-
-### Structure and recovery tools
-
-- **Structures** parses common formats such as PE, ELF, Mach-O, ZIP, images, RIFF, ASN.1, and certificates.
-- **Disasm** provides heuristic disassembly for common CPU families and raw byte fallback where decoding is not implemented.
-- **PDF** inspects objects, streams, xrefs, and suspicious surfaces.
-- **SquashFS** inspects filesystem superblocks and metadata; non-SquashFS input shows a human-readable bad-magic error.
-- **Carve** and **BinSnoop** scan for embedded files and signatures and can export discovered files or ranges.
-- **Keys**, **Timestamps**, **Stego**, and **Metadata** help recover common artefacts from binaries and containers.
-
-### Editing, transforms, and cases
-
-- **Patch Plan** validates patch scripts without modifying the working copy.
-- **Patch Apply** applies validated patch scripts.
-- **Transforms** runs pipelines such as hex, Base64, URL, XOR, inflate, and cipher transforms over selected data.
-- **Rules** runs YARA-like scans over the current document.
-- **Case Export** packages investigation artefacts from the working document.
-
-### Spectrogram tools
-
-- **Spectrogram Encode** converts an image into WAV audio so the image appears in a spectrogram.
-- It can also insert an encoded image into an existing WAV or MP3 carrier.
-- **Spectrogram View** renders WAV or MP3 audio as a spectrogram image.
-- Controls include FFT size, height, maximum width, aspect ratio, frequency range, brightness, and contrast.
-
-### Large file behaviour
-
-Leviathan keeps loaded files file-backed where possible and writes patched working copies in chunks. Some tools still need bounded in-memory buffers because the underlying parser or decoder works on complete byte slices; those tools reject oversized inputs with a clear message rather than trying to allocate unbounded memory.
+Playback starts automatically and has play/pause, restart, a seek bar with elapsed and total time, and speed control.
 
 ---
 
 ## 12. Security and credentials
 
-Nexus Terminal stores credentials securely:
+### Where credentials are stored
 
-- **OS keychain first** (Keychain, Secret Service, or Credential Manager).
-- **Encrypted vault** fallback using AES-256-GCM with Argon2id.
+- **OS keychain first** (macOS Keychain, Linux Secret Service or Windows Credential Manager).
+- **Encrypted vault** fallback, using AES-256-GCM with an Argon2id-derived key (128 MiB of memory, which makes brute-force attacks expensive).
+
+If the keychain is unavailable, or refuses to store a secret, credentials go to the vault. Set the vault up in **Settings → Security** with **Initialise Secret Store**; the master-password dialog shows a strength meter (Weak, Fair, Good, Strong) and asks you to confirm the password. Unlock and lock it from the same page, the command palette, or by clicking the vault state in the status bar. The vault is locked again when Nexus Terminal quits.
+
+Without the master password, credentials in the vault cannot be recovered.
+
+### Secret modes
+
+Each password, passphrase, token or TOTP secret has its own mode:
+
+- **Save securely**: stored in the keychain or vault and used automatically.
+- **Remember for this session**: asked for once, kept in memory for that session, never written to disk.
+- **Ask every time**: asked for on every connection.
+
+When a session needs a credential it doesn't have, a prompt appears; press **Esc** or **Cancel** to abandon the connection.
 
 ### Host key verification
 
 Choose one of the following policies per SSH profile:
 
-- **Strict**: only accept previously saved fingerprints.
-- **Ask**: prompt before trusting a new host key.
-- **Accept new**: trust first-time keys, reject changes.
-- **Insecure**: accept any key (not recommended).
+- **Strict (known hosts only)**: only accept previously saved host keys.
+- **Ask on new or changed keys**: prompt before trusting a new host key; the dialog shows the key type and fingerprint with **Accept & Save** and **Reject**.
+- **Accept new, reject changed**: trust first-time keys automatically.
+- **Insecure (accept anything)**: accept any key (not recommended).
+
+Under every policy except Insecure, a key that differs from the saved one is rejected. Nexus Terminal keeps its own known-hosts list and does not read `~/.ssh/known_hosts`. Review and remove entries in **Settings → Known Hosts**; click a fingerprint to copy it.
 
 ### TOTP / 2FA
 
-Store a TOTP secret in the profile editor to auto-fill verification codes during SSH authentication.
+Store a TOTP secret in the profile editor to answer verification-code prompts automatically during SSH keyboard-interactive authentication. Secrets are stored in the keychain or vault, never in the profile database.
 
-Screenshot: TOTP configuration in the profile editor.
+### SSH key manager
+
+Open **SSH key manager** from the Session menu or the command palette. It lists key pairs in `~/.ssh` with their type, lets you copy a public key to the clipboard or delete a pair, and generates new Ed25519, RSA (2048 or 4096 bits) or ECDSA keys with an optional passphrase. Key generation uses the `ssh-keygen` program.
+
+### Audit log
+
+Connections, disconnections, profile changes, credential access, imports and exports are recorded in an audit log in the database. Secrets are never written to it.
 
 ---
 
-## 13. Settings
+## 13. Import and export
 
-Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux) and configure:
-
-- Terminal themes and fonts
-- Default behaviours
-- Secrets and vault settings
-- Recording and shortcut preferences
-
-Screenshot: Settings panel with appearance and security options.
+- **Encrypted export**: **File → Export profiles…**, the sidebar footer, the command palette, or **Export…** on a profile's right-click menu. Choose the profiles, set a password and save a `.nexus` file. Credentials saved in the keychain or vault are not included.
+- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file (or a `.link` file from Alchementary Link), enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
+- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; tick **Include secrets** to keep inline proxy passwords and TOTP secrets, which are otherwise removed.
+- **OpenSSH config**: **File → Import ~/.ssh/config** or **Settings → About → Import ~/.ssh/config** creates profiles from your `Host` blocks, including hostnames, usernames, ports, identity files and jump hosts.
 
 ---
 
-## 14. Troubleshooting
+## 14. Settings and updates
+
+Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux), the sidebar footer, or **File → Settings**. Click **Save** to apply changes.
+
+- **General**: app theme (Pro, Midnight or Light), default protocol, confirm on close, confirm on disconnect, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
+- **Terminal**: colour scheme, font family, font size, scrollback lines and cursor style. These are the defaults for new profiles; profiles can override them.
+- **Security**: keychain and vault status; initialise, unlock or lock the secret store.
+- **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**.
+- **Help**: built-in help topics, including connection types, shortcuts and troubleshooting.
+- **About**: version, **Check for Updates**, and **Import ~/.ssh/config**.
+
+The app theme and terminal colour scheme can also be changed from the **View** menu, and the light/dark button in the title bar.
+
+### Updates
+
+Nexus Terminal checks for a new version once at launch. When one is available, the status bar shows **Update available**; click it to open **Settings → About**, which shows the current and latest versions, release notes and a **View release** button. Nothing is downloaded or installed automatically.
+
+---
+
+## 15. Data locations and migration from Alchementary Link
+
+### Data locations
+
+| OS      | Data directory                                     |
+| ------- | -------------------------------------------------- |
+| macOS   | `~/Library/Application Support/NexusTerminal`      |
+| Windows | `%APPDATA%\NexusTerminal`                          |
+| Linux   | `$XDG_CONFIG_HOME/NexusTerminal` (usually `~/.config/NexusTerminal`) |
+
+The directory holds:
+
+- `nexus.db` — profiles, known hosts, preferences, snippets, IRC channel state and the audit log (SQLite)
+- `vault/vault.json` — the encrypted vault
+- `recordings/` — session recordings
+- `triggers.json` — trigger rules
+- `sftp-bookmarks.json` — SFTP bookmarks
+
+Credentials saved in the OS keychain are stored under the service name `NexusTerminal`.
+
+### Migrating from Alchementary Link
+
+On first run, if Nexus Terminal has no database yet and an Alchementary Link data directory (`AlchementaryLink`, in the same parent folder) exists, Nexus Terminal **copies** `link.db` to `nexus.db`, along with the `vault/` and `recordings/` directories, and shows a toast saying where the data came from. The Alchementary Link directory is left untouched.
+
+- If a `NexusTerminal/nexus.db` already exists (for example from a version before the Alchementary Link rebrand), it is used as-is and nothing is copied.
+- Keychain entries saved under `AlchementaryLink` are found the first time they are needed and copied to `NexusTerminal`. The old entries are not deleted.
+- Your vault master password is unchanged.
+- Trigger rules and SFTP bookmarks from Alchementary Link are not migrated; recreate them in Nexus Terminal.
+
+---
+
+## 16. Troubleshooting
 
 ### Session shows as disconnected
 
-- The terminal is blurred and shows a **DISCONNECTED** overlay when the connection drops.
+- The pane is dimmed and shows a **Disconnected** overlay when the connection drops.
 - Click **Reconnect** to reopen the session with the same profile.
 
+### Authentication fails
+
+- Check the username, password, key path and the auth methods ticked in the profile.
+- If the key has a passphrase, check the passphrase mode.
+- If the server uses two-factor prompts, check the TOTP secret with **Test** and make sure your system clock is accurate.
+
+### "Host key verification failed"
+
+The server's key differs from the one saved earlier. This can happen when a server is reinstalled, but it can also indicate an attack. If you're certain it's safe, open **Settings → Known Hosts**, remove the entry, and reconnect.
+
 ### Upload fails or is greyed out
 
 - Check the folder is writable; **READ ONLY** indicates no write permission.
-- Confirm the SSH session is connected.
-
-### VNC will not connect
-
-- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
-- If using a password, check whether the profile is set to saved, session-only, or ask-every-time mode.
-- If using an SSH tunnel, verify the tunnel host, username, authentication method, and SSH host key policy.
-- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
-
-### Leviathan cannot load or save a file
-
-- Check that the file still exists and that your user account can read it.
-- When saving, choose a writable destination and avoid overwriting a file that another process has locked.
-- Some tools enforce explicit size limits for safety. If a tool rejects an oversized input, try selecting a smaller range or using a tool that works on the file-backed document.
+- Confirm the session is connected over SSH; upload isn't available for other protocols.
 
 ### Cannot read a folder
 
 - **NO READ** indicates insufficient permissions.
 - Try a parent folder or check remote access controls.
 
+### Serial port won't open
+
+- Check the device path and that the adapter is plugged in; refresh the device list in the editor.
+- **Permission denied** on Linux: add your user to the `dialout` group (`uucp` on some distributions), then log out and back in.
+- On macOS, use the `/dev/cu.*` device rather than `/dev/tty.*`.
+- **Port is in use by another program**: close any other program that has the port open, such as `screen`, `minicom` or an IDE serial monitor.
+- Garbled output usually means the baud rate, parity or stop bits don't match the device.
+
+### VNC will not connect
+
+- Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
+- If using a password, check whether it is set to save securely, remember for this session, or ask every time.
+- If using an SSH tunnel, verify the tunnel host, username, authentication method, private key and SSH host key policy.
+- If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
+
+### The secret store is locked
+
+If a saved credential isn't used, the vault may be locked. Click the vault state in the status bar, or open **Settings → Security**, and unlock it.
+
 ### Session keeps reconnecting
 
 - Check network stability and credentials.
-- Review auto-reconnect settings in the profile.
+- Review the auto-reconnect settings in the profile. Reconnection backs off exponentially (1 s, 2 s, 4 s … up to 30 s) and stops after the maximum number of attempts.
 
 ### Terminal size looks wrong
 
+- Resize the window or drag a split divider; the terminal re-fits automatically.
 - Try disconnecting and reconnecting the session.
-- Avoid heavy UI resizing during initial connection.
+- Some older servers don't support modern terminal features; try a different terminal type in the profile.
+
+### Trying things safely
+
+To try something without touching your real data, start Nexus Terminal with `--data-dir DIR` to use a different data directory.

frontend/embed.go

@@ -1,13 +0,0 @@
-// Package frontend provides the embedded frontend assets for the Wails application.
-package frontend
-
-import "embed"
-
-// Assets contains the frontend files served by the Wails asset server.
-// We embed the root index.html and the entire src/ tree (stylesheets,
-// scripts, vendor libs and static assets) so that `go build` works
-// without a separate npm build step.
-//
-//go:embed index.html
-//go:embed all:src
-var Assets embed.FS

frontend/index.html

@@ -1,351 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Nexus Terminal</title>
-
-    <!-- Vendor styles -->
-    <link rel="stylesheet" href="/src/css/lib/xterm.css" />
-
-    <!-- Design system -->
-    <link rel="stylesheet" href="/src/css/tokens.css" />
-    <link rel="stylesheet" href="/src/css/base.css" />
-    <link rel="stylesheet" href="/src/css/components.css" />
-    <link rel="stylesheet" href="/src/css/layout.css" />
-    <link rel="stylesheet" href="/src/css/sidebar.css" />
-    <link rel="stylesheet" href="/src/css/tabs.css" />
-    <link rel="stylesheet" href="/src/css/terminal.css" />
-    <link rel="stylesheet" href="/src/css/splitpane.css" />
-    <link rel="stylesheet" href="/src/css/recordings.css" />
-    <link rel="stylesheet" href="/src/css/sftp.css" />
-    <link rel="stylesheet" href="/src/css/forms.css" />
-    <link rel="stylesheet" href="/src/css/modals.css" />
-    <link rel="stylesheet" href="/src/css/github.css" />
-    <link rel="stylesheet" href="/src/css/vnc.css" />
-    <link rel="stylesheet" href="/src/css/irc.css" />
-    <link rel="stylesheet" href="/src/css/leviathan.css" />
-  </head>
-  <body>
-    <div id="app" class="app">
-      <!-- ============================================================
-             Sidebar — connection manager
-             ============================================================ -->
-      <aside class="sidebar" id="sidebar">
-        <div class="sidebar-header wails-drag">
-          <div class="sidebar-logo">
-            <!-- Terminal prompt icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="18"
-              height="18"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="2"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <polyline points="4 17 10 11 4 5"></polyline>
-              <line x1="12" y1="19" x2="20" y2="19"></line>
-            </svg>
-            <span class="sidebar-product-switch" aria-label="Application mode">
-              <button
-                class="sidebar-title sidebar-mode-toggle is-active"
-                id="mode-nexus"
-                type="button"
-              >
-                Nexus Terminal
-              </button>
-              <button
-                class="sidebar-title sidebar-mode-toggle"
-                id="mode-leviathan"
-                type="button"
-              >
-                Leviathan
-              </button>
-            </span>
-          </div>
-        </div>
-
-        <div class="sidebar-search">
-          <div class="search-wrapper">
-            <input
-              type="text"
-              class="search-input"
-              id="profile-search"
-              placeholder="Search connections…"
-              autocomplete="off"
-              spellcheck="false"
-            />
-          </div>
-        </div>
-
-        <nav class="sidebar-nav" id="sidebar-nav">
-          <!-- Dynamically managed by sidebar.js -->
-          <div id="sidebar-profiles" class="sidebar-profiles"></div>
-        </nav>
-
-        <div class="sidebar-footer">
-          <button
-            class="btn btn-ghost btn-sm"
-            id="btn-new-connection"
-            title="New Connection"
-          >
-            <span>+ New</span>
-          </button>
-          <button
-            class="btn btn-ghost btn-sm"
-            id="btn-command-palette"
-            title="Command Palette (⌘K)"
-          >
-            <span>⌘K</span>
-          </button>
-          <button
-            class="btn btn-ghost btn-icon btn-sm"
-            id="btn-import"
-            title="Import Profiles"
-          >
-            <!-- Upload icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="14"
-              height="14"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="2"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
-              <polyline points="17 8 12 3 7 8"></polyline>
-              <line x1="12" y1="3" x2="12" y2="15"></line>
-            </svg>
-          </button>
-          <button
-            class="btn btn-ghost btn-icon btn-sm"
-            id="btn-export"
-            title="Export Profiles"
-          >
-            <!-- Download icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="14"
-              height="14"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="2"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
-              <polyline points="7 10 12 15 17 10"></polyline>
-              <line x1="12" y1="15" x2="12" y2="3"></line>
-            </svg>
-          </button>
-          <button
-            class="btn btn-ghost btn-icon btn-sm"
-            id="btn-recordings"
-            title="Session Recordings"
-          >
-            <!-- Film icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="14"
-              height="14"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="2"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <circle cx="12" cy="12" r="10"></circle>
-              <circle cx="12" cy="12" r="3"></circle>
-            </svg>
-          </button>
-          <button
-            class="btn btn-ghost btn-icon btn-sm"
-            id="btn-settings"
-            title="Settings"
-          >
-            <!-- Cog icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="14"
-              height="14"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="2"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <circle cx="12" cy="12" r="3"></circle>
-              <path
-                d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0
-                                 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65
-                                 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0
-                                 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9
-                                 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0
-                                 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06A1.65 1.65 0
-                                 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0
-                                 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6
-                                 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0
-                                 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65
-                                 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2
-                                 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0
-                                 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2
-                                 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65
-                                 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51
-                                 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65
-                                 1.65 0 0 0-1.51 1z"
-              ></path>
-            </svg>
-          </button>
-        </div>
-      </aside>
-
-      <!-- ============================================================
-             Tab bar — session tabs
-             ============================================================ -->
-      <div class="tab-bar" id="tab-bar">
-        <div class="tab-list" id="tab-list">
-          <!-- Tabs are injected dynamically by JS -->
-        </div>
-        <button class="tab-new" id="btn-new-tab" title="New Tab">+</button>
-        <button
-          class="tab-broadcast"
-          id="btn-broadcast"
-          title="Toggle Broadcast Mode (Ctrl+Shift+B)"
-        >
-          <!-- Broadcast icon (loudspeaker) -->
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            width="12"
-            height="12"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-          >
-            <path d="M19.69 14a6.9 6.9 0 0 0 .31-2 6.9 6.9 0 0 0-.31-2"></path>
-            <path d="M22.82 16.18a10 10 0 0 0 0-8.36"></path>
-            <path d="M1 12s3-7 9-7 9 7 9 7-3 7-9 7-9-7-9-7z"></path>
-            <circle cx="12" cy="12" r="3"></circle>
-          </svg>
-        </button>
-      </div>
-
-      <!-- ============================================================
-             Workspace — terminal area
-             ============================================================ -->
-      <main class="workspace" id="workspace">
-        <!-- Empty state — shown when no sessions are active -->
-        <div class="empty-state" id="empty-state">
-          <div class="empty-state-icon">
-            <!-- Terminal icon -->
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="48"
-              height="48"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="1.5"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <polyline points="4 17 10 11 4 5"></polyline>
-              <line x1="12" y1="19" x2="20" y2="19"></line>
-            </svg>
-          </div>
-          <h2>No active sessions</h2>
-          <p>
-            Select a connection from the sidebar or create a new one to get
-            started.
-          </p>
-          <div class="empty-state-actions">
-            <button class="btn btn-primary" id="btn-empty-connect">
-              New Connection
-            </button>
-            <button class="btn btn-secondary" id="btn-empty-quick">
-              Quick Connect
-            </button>
-          </div>
-        </div>
-
-        <!-- Session panels are injected here dynamically by tabs.js -->
-        <div id="panel-container" class="panel-container"></div>
-      </main>
-
-      <!-- ============================================================
-             Status bar
-             ============================================================ -->
-      <footer class="status-bar" id="status-bar">
-        <span id="status-connection">
-          <span class="status-dot is-disconnected"></span>
-          Disconnected
-        </span>
-        <span id="status-protocol"></span>
-        <span id="status-latency"></span>
-        <span id="status-session-count">0 sessions</span>
-        <span class="status-spacer"></span>
-        <button
-          class="status-update is-hidden"
-          id="status-update"
-          type="button"
-        >
-          Update available
-        </button>
-        <span id="status-vault">🔒 Locked</span>
-      </footer>
-    </div>
-
-    <!-- Modal container (dynamically populated) -->
-    <div id="modals"></div>
-
-    <!-- Notification toasts -->
-    <div id="notifications" class="notifications-container"></div>
-
-    <!-- Vendor libraries -->
-    <script src="/src/js/lib/xterm.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-fit.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-search.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-unicode11.min.js"></script>
-    <script src="/src/js/lib/xterm-addon-web-links.min.js"></script>
-
-    <!-- Wails service bridge; loaded before application code. -->
-    <script src="/src/js/wails-service.js"></script>
-
-    <!-- Application scripts (loaded in dependency order) -->
-    <script src="/src/js/utils.js"></script>
-    <script src="/src/js/state.js"></script>
-    <script src="/src/js/notifications.js"></script>
-    <script src="/src/js/sidebar.js"></script>
-    <script src="/src/js/tabs.js"></script>
-    <script src="/src/js/themes.js"></script>
-    <script src="/src/js/terminal.js"></script>
-    <script src="/src/js/profiles.js"></script>
-    <script src="/src/js/raw.js"></script>
-    <script src="/src/js/github.js"></script>
-    <script src="/src/js/lib/novnc.min.js"></script>
-    <script src="/src/js/vnc.js"></script>
-    <script src="/src/js/irc.js"></script>
-    <script src="/src/js/settings.js"></script>
-    <script src="/src/js/commands.js"></script>
-    <script src="/src/js/secrets.js"></script>
-    <script src="/src/js/recordings.js"></script>
-    <script src="/src/js/sftp.js"></script>
-    <script src="/src/js/splitpane.js"></script>
-    <script src="/src/js/snippets.js"></script>
-    <script src="/src/js/sshkeys.js"></script>
-    <script src="/src/js/triggers.js"></script>
-    <script src="/src/js/leviathan.js"></script>
-    <script src="/src/js/app.js"></script>
-  </body>
-</html>

frontend/package-lock.json

@@ -1,547 +0,0 @@
-{
-  "name": "nexus-terminal-frontend",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "nexus-terminal-frontend",
-      "version": "0.1.0",
-      "hasInstallScript": true,
-      "dependencies": {
-        "@novnc/novnc": "^1.5.0",
-        "@xterm/addon-fit": "0.11.0",
-        "@xterm/addon-search": "0.16.0",
-        "@xterm/addon-unicode11": "0.9.0",
-        "@xterm/addon-web-links": "0.12.0",
-        "@xterm/xterm": "6.0.0"
-      },
-      "devDependencies": {
-        "esbuild": "^0.28.1"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@novnc/novnc": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/@novnc/novnc/-/novnc-1.7.0.tgz",
-      "integrity": "sha512-ucEJOx4T2avIRCleodk7YobZj5O2Ga2AeLfQ69A/yjG9HHba2+PDgwSkN3FttrmG+70ZGx21sElNFouK13RzyA==",
-      "license": "MPL-2.0"
-    },
-    "node_modules/@xterm/addon-fit": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.11.0.tgz",
-      "integrity": "sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g==",
-      "license": "MIT"
-    },
-    "node_modules/@xterm/addon-search": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-search/-/addon-search-0.16.0.tgz",
-      "integrity": "sha512-9OeuBFu0/uZJPu+9AHKY6g/w0Czyb/Ut0A5t79I4ULoU4IfU5BEpPFVGQxP4zTTMdfZEYkVIRYbHBX1xWwjeSA==",
-      "license": "MIT"
-    },
-    "node_modules/@xterm/addon-unicode11": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-unicode11/-/addon-unicode11-0.9.0.tgz",
-      "integrity": "sha512-FxDnYcyuXhNl+XSqGZL/t0U9eiNb/q3EWT5rYkQT/zuig8Gz/VagnQANKHdDWFM2lTMk9ly0EFQxxxtZUoRetw==",
-      "license": "MIT"
-    },
-    "node_modules/@xterm/addon-web-links": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-web-links/-/addon-web-links-0.12.0.tgz",
-      "integrity": "sha512-4Smom3RPyVp7ZMYOYDoC/9eGJJJqYhnPLGGqJ6wOBfB8VxPViJNSKdgRYb8NpaM6YSelEKbA2SStD7lGyqaobw==",
-      "license": "MIT"
-    },
-    "node_modules/@xterm/xterm": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz",
-      "integrity": "sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==",
-      "license": "MIT",
-      "workspaces": [
-        "addons/*"
-      ]
-    },
-    "node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
-      }
-    }
-  }
-}

frontend/package.json

@@ -1,25 +0,0 @@
-{
-  "name": "nexus-terminal-frontend",
-  "version": "0.1.0",
-  "private": true,
-  "description": "Frontend for Nexus Terminal desktop SSH client",
-  "scripts": {
-    "install:assets": "node scripts/copy-assets.js",
-    "bundle:novnc": "node scripts/bundle-novnc.js",
-    "build": "node scripts/build.js",
-    "dev": "node scripts/build.js --watch",
-    "test": "node scripts/test-regressions.js",
-    "postinstall": "npm run install:assets && npm run bundle:novnc"
-  },
-  "dependencies": {
-    "@novnc/novnc": "^1.5.0",
-    "@xterm/addon-fit": "0.11.0",
-    "@xterm/addon-search": "0.16.0",
-    "@xterm/addon-unicode11": "0.9.0",
-    "@xterm/addon-web-links": "0.12.0",
-    "@xterm/xterm": "6.0.0"
-  },
-  "devDependencies": {
-    "esbuild": "^0.28.1"
-  }
-}

frontend/package.json.md5

@@ -1 +0,0 @@
-2f3e27ceb2ed8494c242e0b06d9f4da3

frontend/scripts/build.js

@@ -1,233 +0,0 @@
-/**
- * build.js — Build script for the Nexus Terminal frontend.
- *
- * In production mode (no flags): copies vendor assets, assembles the
- * dist/ directory with all files needed by the Wails embed, and validates
- * that every required file is present.
- *
- * In watch mode (--watch): performs the same build, then watches for
- * source changes and prints a notification when files change.  Wails dev
- * mode handles the actual live-reload; this script simply keeps the
- * process alive so the frontend:dev:watcher contract is satisfied.
- */
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-const frontendDir = path.resolve(__dirname, '..');
-const distDir     = path.join(frontendDir, 'dist');
-const watchMode   = process.argv.includes('--watch');
-
-// Files that must exist after a successful build (relative to frontend/)
-const requiredFiles = [
-  'dist/index.html',
-  'dist/src/css/lib/xterm.css',
-  'dist/src/js/lib/xterm.min.js',
-  'dist/src/js/lib/xterm-addon-fit.min.js',
-  'dist/src/js/lib/xterm-addon-search.min.js',
-  'dist/src/js/lib/xterm-addon-web-links.min.js',
-  'dist/src/js/wails-service.js',
-];
-
-/**
- * Recursively copies a directory tree, creating parents as needed.
- */
-function copyDirSync(src, dest) {
-  fs.mkdirSync(dest, { recursive: true });
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const srcPath  = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
-    } else {
-      fs.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-
-/**
- * Copies one file and creates the parent directory if needed.
- */
-function copyFileSync(src, dest) {
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.copyFileSync(src, dest);
-}
-
-/**
- * Removes a directory tree if it exists.
- */
-function cleanDir(dir) {
-  if (fs.existsSync(dir)) {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-function copyWailsRuntimeBindings(srcRoot, destRoot) {
-  const runtimeFiles = [
-    'go/api/Service.js',
-    'runtime/runtime.js',
-  ];
-
-  for (const relPath of runtimeFiles) {
-    const src = path.join(srcRoot, relPath);
-    if (fs.existsSync(src)) {
-      copyFileSync(src, path.join(destRoot, relPath));
-    }
-  }
-}
-
-function walkFiles(dir, predicate, files = []) {
-  if (!fs.existsSync(dir)) return files;
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      walkFiles(full, predicate, files);
-    } else if (entry.isFile() && predicate(full)) {
-      files.push(full);
-    }
-  }
-  return files;
-}
-
-function cleanupDistAssets() {
-  console.log('[build] Cleaning production frontend assets...');
-  const sourceMapFiles = walkFiles(distDir, (file) => file.endsWith('.js') || file.endsWith('.css'));
-  let mapCommentCount = 0;
-  for (const file of sourceMapFiles) {
-    const input = fs.readFileSync(file, 'utf8');
-    const output = input
-      .replace(/(?:\r?\n)?\/\/# sourceMappingURL=.*?(?=\r?\n|$)/g, '')
-      .replace(/(?:\r?\n)?\/\*# sourceMappingURL=.*?\*\/(?=\r?\n|$)/g, '');
-    if (output !== input) {
-      fs.writeFileSync(file, output);
-      mapCommentCount += 1;
-    }
-  }
-
-  if (mapCommentCount > 0) {
-    console.log(`[build] Removed ${mapCommentCount} source-map reference(s).`);
-  }
-}
-
-/**
- * Runs the asset copy script to pull xterm files into src/js/lib/ and
- * src/css/lib/.
- */
-function copyAssets() {
-  console.log('[build] Copying vendor library assets…');
-  execSync('node scripts/copy-assets.js', {
-    cwd:   frontendDir,
-    stdio: 'inherit',
-  });
-  execSync('node scripts/bundle-novnc.js', {
-    cwd:   frontendDir,
-    stdio: 'inherit',
-  });
-}
-
-/**
- * Assembles the dist/ directory with everything the Wails embed needs:
- *   dist/index.html
- *   dist/src/css/  (application + lib stylesheets)
- *   dist/src/js/   (application + lib scripts)
- *   dist/wailsjs/  (generated backend bindings, if present)
- *   dist/src/components/  (if present)
- *   dist/src/assets/      (if present)
- */
-function buildDist() {
-  console.log('[build] Assembling dist/ directory…');
-
-  // Start fresh so stale files are removed
-  cleanDir(distDir);
-  fs.mkdirSync(distDir, { recursive: true });
-
-  // Copy the root index.html
-  fs.copyFileSync(
-    path.join(frontendDir, 'index.html'),
-    path.join(distDir, 'index.html'),
-  );
-
-  // Copy the entire src/ tree (CSS, JS, components, assets, lib files)
-  const srcDir = path.join(frontendDir, 'src');
-  if (fs.existsSync(srcDir)) {
-    copyDirSync(srcDir, path.join(distDir, 'src'));
-  }
-
-  // Copy only runtime Wails bindings so embedded production assets do not
-  // carry TypeScript declarations and model files.
-  const wailsjsDir = path.join(frontendDir, 'wailsjs');
-  if (fs.existsSync(wailsjsDir)) {
-    copyWailsRuntimeBindings(wailsjsDir, path.join(distDir, 'wailsjs'));
-  }
-
-  console.log('[build] dist/ assembled.');
-}
-
-/**
- * Validates that every required file exists.
- * Returns true if all files are present.
- */
-function validate() {
-  console.log('[build] Validating required files…');
-  let valid = true;
-  for (const relPath of requiredFiles) {
-    const full = path.join(frontendDir, relPath);
-    if (!fs.existsSync(full)) {
-      console.error(`  ✗ Missing: ${relPath}`);
-      valid = false;
-    } else {
-      console.log(`  ✓ ${relPath}`);
-    }
-  }
-  return valid;
-}
-
-/**
- * Watches the src/ directory for changes (development mode).
- * Wails dev mode picks up the changes; we just keep the process alive.
- */
-function watch() {
-  const srcDir = path.join(frontendDir, 'src');
-  console.log(`[build] Watching ${srcDir} for changes…`);
-
-  // Use fs.watch recursively where supported (macOS, Windows).
-  // On Linux this falls back to non-recursive — acceptable for dev use.
-  try {
-    fs.watch(srcDir, { recursive: true }, (_event, filename) => {
-      if (filename) {
-        const stamp = new Date().toLocaleTimeString('en-GB');
-        console.log(`[build] ${stamp} — changed: ${filename}`);
-      }
-    });
-  } catch (err) {
-    console.warn('[build] Recursive watch not supported; polling fallback.');
-  }
-
-  // Prevent the process from exiting
-  setInterval(() => {}, 60_000);
-}
-
-// --- Main ---
-
-try {
-  copyAssets();
-} catch (err) {
-  console.error('[build] Asset copy failed:', err.message);
-  process.exit(1);
-}
-
-buildDist();
-cleanupDistAssets();
-
-if (!validate()) {
-  console.error('[build] Validation failed — some required files are missing.');
-  process.exit(1);
-}
-
-console.log('[build] Frontend build complete.');
-
-if (watchMode) {
-  watch();
-}

frontend/scripts/bundle-novnc.js

@@ -1,43 +0,0 @@
-/**
- * bundle-novnc.js — Uses esbuild to bundle noVNC's RFB class into a single
- * script that exposes window.noVNC.RFB for use in the frontend.
- *
- * noVNC 1.5+ uses top-level await which is incompatible with IIFE format,
- * so we bundle as ESM then wrap in an async IIFE via banner/footer.
- */
-"use strict";
-
-const esbuild = require("esbuild");
-const path = require("path");
-
-const entryPoint = path.resolve(__dirname, "novnc-entry.js");
-const outFile = path.resolve(
-  __dirname,
-  "..",
-  "src",
-  "js",
-  "lib",
-  "novnc.min.js",
-);
-
-esbuild
-  .build({
-    entryPoints: [entryPoint],
-    bundle: true,
-    minify: true,
-    format: "esm",
-    outfile: outFile,
-    target: ["safari15"],
-    logLevel: "info",
-    banner: { js: ";(async function() {" },
-    footer: { js: "})();" },
-  })
-  .then(() => {
-    console.log(
-      "[bundle-novnc] noVNC bundled successfully → src/js/lib/novnc.min.js",
-    );
-  })
-  .catch((err) => {
-    console.error("[bundle-novnc] Failed:", err.message);
-    process.exit(1);
-  });

frontend/scripts/copy-assets.js

@@ -1,87 +0,0 @@
-/**
- * copy-assets.js — Copies xterm library assets from node_modules into
- * the frontend source tree so they can be served directly by Wails.
- *
- * Run automatically via the postinstall hook in package.json.
- */
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const frontendDir = path.resolve(__dirname, "..");
-
-// Mapping: source (relative to node_modules) → destination (relative to frontend/)
-const assets = [
-  {
-    src: "@xterm/xterm/css/xterm.css",
-    dest: "src/css/lib/xterm.css",
-  },
-  {
-    src: "@xterm/xterm/lib/xterm.js",
-    dest: "src/js/lib/xterm.min.js",
-  },
-  {
-    src: "@xterm/addon-fit/lib/addon-fit.js",
-    dest: "src/js/lib/xterm-addon-fit.min.js",
-  },
-  {
-    src: "@xterm/addon-search/lib/addon-search.js",
-    dest: "src/js/lib/xterm-addon-search.min.js",
-  },
-  {
-    src: "@xterm/addon-unicode11/lib/addon-unicode11.js",
-    dest: "src/js/lib/xterm-addon-unicode11.min.js",
-  },
-  {
-    src: "@xterm/addon-web-links/lib/addon-web-links.js",
-    dest: "src/js/lib/xterm-addon-web-links.min.js",
-  },
-];
-
-/**
- * Ensures the parent directory of the given file path exists.
- */
-function ensureDir(filePath) {
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-}
-
-/**
- * Copies a single asset, logging the result.
- */
-function copyAsset(entry) {
-  const srcPath = path.join(frontendDir, "node_modules", entry.src);
-  const destPath = path.join(frontendDir, entry.dest);
-
-  if (!fs.existsSync(srcPath)) {
-    console.error(`  ✗ Source not found: ${entry.src}`);
-    return false;
-  }
-
-  ensureDir(destPath);
-  fs.copyFileSync(srcPath, destPath);
-  console.log(`  ✓ ${entry.src} → ${entry.dest}`);
-  return true;
-}
-
-// --- Main ---
-
-console.log("[copy-assets] Copying xterm library files…");
-
-let failures = 0;
-for (const entry of assets) {
-  if (!copyAsset(entry)) {
-    failures++;
-  }
-}
-
-if (failures > 0) {
-  console.error(`\n[copy-assets] ${failures} file(s) could not be copied.`);
-  console.error('[copy-assets] Have you run "npm install" first?');
-  process.exit(1);
-}
-
-console.log("[copy-assets] All assets copied successfully.");

frontend/scripts/novnc-entry.js

@@ -1,7 +0,0 @@
-// Entry point for esbuild bundling of noVNC.
-// Assigns RFB to window.noVNC so it's available as a global in the frontend.
-import RFB from "@novnc/novnc";
-import { initLogging } from "../node_modules/@novnc/novnc/core/util/logging.js";
-
-initLogging("error");
-window.noVNC = { RFB: RFB };