docs: illustrated LaTeX user guide (docs/guide) with generated screenshots

Screenshot automation (--connect repeatable, --do, --answer, --shot-delay), SFTP Browser palette entry, centred dialogs, IRC opens the first joined room; demo_data example
Move update and release URLs to dixon.cx/downloads/nexus
2026-10-11 19:41:31 +01:00 · 2026-10-11 19:41:30 +01:00 · 2026-10-11 19:06:48 +01:00 · 2026-10-11 17:54:11 +01:00 · 2026-10-11 17:52:43 +01:00 · 2026-10-11 17:52:35 +01:00
287 changed files with 38832 additions and 39637 deletions
@@ -1,109 +1,86 @@
 # Copilot Instructions — Nexus Terminal
 Nexus Terminal is a native desktop client (SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub, local shell) written in Rust with an eframe/egui UI. All the code lives in the Cargo workspace under `rust/`.
 ## Build & Test
 ```bash
-make deps              # go mod download + npm install
+cd rust
-make build             # production build → build/bin/nexus-terminal.app
+cargo run --release                                     # the app (binary `nexus-terminal`)
-make dev               # wails dev with hot reload
+cargo test --workspace                                  # unit and integration tests
-make test              # go test ./... -v -count=1
+cargo clippy --workspace --all-targets -- -D warnings   # must be clean
-make lint              # golangci-lint run ./...
+cargo fmt --all --check                                 # must be clean
-# Single package test
+# Single test
-go test ./internal/storage/ -v -count=1 -run TestProfileCRUD
+cargo test -p nexus-core --lib storage::
 cargo test -p nexus-core --test ssh_integration
 ```
-The frontend has no separate build step — `npm run build` (called by Wails) copies xterm vendor libs from `node_modules` into `frontend/src/js/lib/` and `frontend/src/css/lib/`. All frontend assets are embedded at compile time via `frontend/embed.go`.
+CI (`.github/workflows/ci.yml`) runs `cargo test --locked`, `cargo fmt --check` and `cargo clippy --all-targets -D warnings` on Linux, macOS and Windows. The toolchain is pinned in `rust/rust-toolchain.toml`. Platform prerequisites and release packaging are in `docs/build-and-release.md`.
 ## Architecture
-Wails v2 desktop app: Go backend + HTML/CSS/JS frontend rendered in a native webview (WKWebView on macOS).
+The project is engine-first: a UI-free core crate, and the egui app is one client of it.
-**Go backend** (`internal/`):
+```
- `app/` — lifecycle bootstrap: opens SQLite, inits secret stores, wires everything together
+rust/
- `api/` — single `Service` struct bound to Wails; every public method is callable from JS as `window.go.api.Service.MethodName()`
+├── core/   nexus-core: storage, secrets, models, protocol clients, session Manager, Service. No egui.
- `sessions/` — manages concurrent protocol sessions; owns SSH/Telnet/RAW/GitHub client lifecycles; handles auto-reconnect, login scripts, broadcast
+│   ├── migrations/       numbered SQL migrations, embedded with include_str!
- `storage/` — SQLite repository (WAL mode) with embedded sequential migrations in `storage/migrations/`
+│   └── tests/            sessions.rs, ssh_integration.rs, fixtures/
- `secrets/` — two-tier credential storage: OS keychain (preferred) → AES-256-GCM encrypted file vault (fallback)
+└── app/    nexus: the egui shell (binary `nexus-terminal`)
- `models/` — shared domain types and defaults; protocol configs are JSON-encoded in the DB
+```
 - `sshclient/` — SSH client with agent, TOTP/2FA, and SOCKS5/HTTP proxy support
 - `telnetclient/`, `rawclient/`, `githubclient/` — protocol implementations
 - `sftpclient/` — SFTP file operations (browse, upload, download, rename, delete)
 - `sshconfig/` — OpenSSH `~/.ssh/config` parser and importer
 - `recording/` — asciicast v2 session recording and playback
 - `exportimport/` — encrypted profile bundles (.nexus format)
 - `updater/` — GitHub Releases update checker
 - `knownhosts/` — SSH host key management
 - `validation/` — profile and protocol validation
 - `audit/` — timestamped audit logging
-**Frontend** (`frontend/`):
+**Core (`rust/core/src/`):**
- Plain HTML/CSS/JS — no framework, no bundler, no ES modules
+- `service.rs` — `Service`, the app-facing API: profiles, connect/reconnect, credentials, known hosts, preferences, snippets, import/export, SSH keys, SFTP, updates. File dialogs live in the UI; methods here take paths.
- `index.html` is the app shell; loads CSS then JS in strict order
+- `sessions.rs` — `Manager`: concurrent sessions, auto-reconnect with backoff, login scripts, broadcast writes, recording hooks, secret resolution (saved / session-only / ask every time), host-key checks. It reports through one `Event` enum (`Data`, `State`, `Closed`, `RawData`, `Irc`, `Github*`, `Forward*`, `Recording*`, `SftpProgress`, `SecretPrompt`, `HostKeyVerify`, `Vnc*`).
- `src/js/` — 18 modules, each IIFE-wrapped, exporting to `window.NexusTerminal`
+- `clients/` — one module per protocol (`ssh`, `sftp`, `telnet`, `raw`, `serial`, `local`, `irc`, `github`, `vnc`). Read the conventions at the top of `clients/mod.rs` before touching one: `connect()` blocks its (worker) thread and returns once usable; the client then owns its reader thread(s) and reports through `Callbacks` (data, fatal error, close exactly once); `write`/`resize`/`close` are callable from any thread and `close` is idempotent. russh-based clients use the shared tokio runtime from `clients::rt()`; the rest use plain threads.
- `src/css/` — modular stylesheets; `tokens.css` defines all design tokens
+- `storage.rs` (SQLite via rusqlite, WAL), `secrets.rs` (keychain + vault), `config.rs` (data directories and Alchementary Link migration), `models.rs`, `validation.rs`, `exportimport.rs`, `recording.rs` (asciicast v2), `sshconfig.rs`, `updater.rs`, `ircformat.rs`, `terminalenv.rs`, `keyfiles.rs`.
 - Vendor libs (xterm.js, addons) live in `src/js/lib/` and `src/css/lib/` — auto-copied, gitignored
-**Go ↔ JS communication:**
+**App (`rust/app/src/`):**
- **Synchronous:** Frontend calls `window.go.api.Service.*()` (returns Promise)
+- `main.rs` parses flags, opens the `Service` and starts eframe. `app.rs` owns `App`: it installs an event sink that forwards `Event`s over a channel and calls `request_repaint`, drains them each frame (`on_event`), handles `Request`s, the keyboard shortcuts (`shortcuts()`), and lays out the frame.
- **Asynchronous:** Backend pushes events via `wailsRuntime.EventsEmit()`; frontend listens with `window.runtime.EventsOn()`
+- `state.rs` — `Shared` (service handle, cached profiles and preferences, tabs, panes, toasts) and the `Request` queue features use to ask the main window to act.
- **Bidirectional events** for secret prompts and host key verification: backend emits a request event with a `requestID`, frontend shows a modal, then emits a response event with the same ID. The Go side blocks on a channel keyed by that ID.
+- `views.rs` — `View::{Terminal, Raw, Irc, Github, Vnc}`, one per pane.
 - `terminal.rs` (`TermView`: alacritty_terminal drawn with egui's painter), `tabs.rs` (tab strip, workspace, find bar, overlays), `splits.rs` (split tree), `sidebar.rs`, `chrome.rs` (title bar, status bar, command palette `Cmd` enum, prompts, dialogs, toasts).
 - Feature windows: `profile_editor.rs`, `quick_connect.rs`, `settings.rs` (including the Help topics), `ssh_keys.rs`, `transfer.rs` (import/export), `sftp.rs`, `forwards.rs`, `snippets.rs`, `triggers.rs`, `recordings.rs`.
 - Protocol views: `raw_view.rs`, `irc_view.rs`, `github_view.rs`, `vnc_view.rs`.
-Key events: `session:data`, `session:state`, `session:closed`, `session:raw:data`, `session:github:repos`, `session:secret:prompt`/`session:secret:response`, `session:hostkey:verify`/`session:hostkey:response`.
+**Flow:** UI → `Service` / `Manager` method (plain Rust call) → protocol client on a worker thread → `Callbacks` → `Manager` emits `Event` → app channel → `App::on_event` on the next frame. Credential and host-key questions are `Event::SecretPrompt` / `Event::HostKeyVerify` carrying an `mpsc::Sender` reply; the connecting thread blocks on the receiver, and dropping the sender (closing the prompt or the session) cancels it.
 ## WKWebView Constraints (Critical)
 The macOS webview silently blocks or breaks several standard web APIs. These constraints affect every frontend change:
 1. **No `window.confirm()`, `window.prompt()`, `window.alert()`** — they either return false/null silently or do nothing. All user prompts must use the custom modal system (DOM-based backdrop + modal with `is-visible` class toggling).
 2. **No ES modules** — `<script type="module">` fails silently. All JS files use plain `<script>` tags and IIFE wrappers: `(function() { ... })();`
 3. **Click swallowing on text-selectable elements** — WKWebView initiates a text selection gesture on `mousedown` for `<div>` elements, which swallows the first `click` event (appears to require double-click). Fix: add `mousedown` handler with `e.preventDefault()` on any clickable non-input element (section headers, list items, etc.).
 4. **Modal visibility pattern** — both `.modal-backdrop` AND `.modal` elements start with `opacity: 0; visibility: hidden` in CSS. You must add the `is-visible` class to **both** elements, not just the backdrop.
 5. **Wails runtime injection** — `window.go` and `window.runtime` are injected by Wails before scripts execute. Do NOT add explicit script tags for Wails scripts. The frontend polls for their availability at startup (max 5s).
 ## Conventions
-**Language:** All code comments in British English (colour, initialise, behaviour, etc.).
+- **British English** in comments, docs and UI strings (colour, initialise, behaviour, favourite).
 - **Never block the UI thread.** Anything that touches the network, the keychain, `ssh-keygen` or slow disk work runs on a worker thread: `Shared::spawn` (errors become toasts), `settings::Job` (poll a result each frame), or a module's own inbox. Call `ctx.request_repaint()` when the work finishes. Quick SQLite calls through `Service` are fine inline.
 - **Colours come from `Tokens`** (`theme.rs`, `Tokens::get(ctx)`): `text`, `text_dim`, `text_faint`, `accent`, `success`, `warning`, `danger`, `field`, `card`, `dock`, … Don't hard-code colours; all three app themes (Pro, Midnight, Light) must work. Protocol colours and badges come from `views::protocol_color` / `protocol_badge`; terminal palettes from `terminal_themes.rs`.
 - **Icons are Phosphor** (`egui_phosphor::regular as icon`), usually as `format!("{}  Label", icon::X)`. Reuse the helpers in `widgets.rs` (`primary`, `button`, `icon_button`, `hint`, `empty`, `chip`, `section`, `kv`) and `chrome::modal` for modal dialogs.
 - **Shortcut labels** go through `state::keys("Mod+Shift+K")`, which renders ⌘ on macOS and Ctrl elsewhere. A new shortcut needs an entry in `App::shortcuts()`, the command palette (`chrome::commands`), the menu, the Help "Keyboard Shortcuts" topic and the README table.
 - **Formatting:** `rustfmt.toml` sets `max_width = 160` with `use_small_heuristics = "Max"`, so long single-line expressions are normal. Run `cargo fmt --all` rather than wrapping by hand.
 - Errors are `nexus_core::Result<T>` (`Box<dyn Error + Send + Sync>`); use `?` and `format!` messages that read well in a toast.
 - Protocol configs are `Option<…Config>` fields on `Profile` (`ssh`, `telnet`, `raw`, `github`, `vnc`, `irc`, `serial`), stored as JSON columns; `Profile::new(protocol)` fills the defaults, and the structs use `#[serde(default)]` so older rows still load.
 - A `ponytail:` comment marks a deliberate simplification and names its limit; keep them accurate when you change that code.
-**Go patterns:**
+**Adding a protocol** touches: `models.rs` (`Protocol`, config struct, defaults, labels), `validation.rs`, a new migration (CHECK constraint and config column) plus the column lists in `storage.rs`, a client in `clients/`, the `Manager` connect/close/write paths in `sessions.rs`, the profile editor section, Quick Connect if relevant, a view (or `TermView` for terminal protocols), `views::protocol_badge`/`protocol_color`, the palette, and a Help topic.
 - String-typed enums: `type Protocol string` with `const ProtocolSSH Protocol = "ssh"` etc.
 - Protocol configs are pointer fields on `Profile` (`SSH *SSHConfig`, `Telnet *TelnetConfig`, etc.) — nil when not applicable
 - `NewProfile(protocol)` factory in `defaults.go` populates sensible defaults per protocol
 - Storage uses `nullableJSON()` helper to write nil for unused config columns
 - Tests use `t.TempDir()` for isolation, `t.Fatalf()` for setup failures
-**Frontend patterns:**
+## Data compatibility (hard rules)
 - Every JS file is IIFE-wrapped and exports to `window.NexusTerminal` namespace
 - Script load order matters (defined in `index.html`) — utils → state → notifications → sidebar → tabs → themes → terminal → profiles → raw → github → settings → commands → secrets → recordings → sftp → splitpane → snippets → app
 - DOM helpers: `createElement(tag, className, attrs)` from utils.js (supports `textContent`, `innerHTML`, `dataset`, `on*` event handlers)
 - Profile editor uses `_renderSection(title, fields)` pattern with `_field(type, name, label, value, opts)` helper for form generation
 - Login script editor uses `_renderLoginScriptSection(prefix, steps)` for expect-style step lists
 - TOTP section uses `_renderTOTPSection(profile)` with encrypted vault storage
 - `protocolColour()` returns CSS class names like `proto-ssh`; tab badges use `badge-ssh` class naming (different pattern)
-**CSS patterns:**
+Existing users upgrade in place, and their data came from the Go app first. Nexus Terminal must keep reading it.
 - Design tokens in `tokens.css`: `--bg-base`, `--bg-surface`, `--bg-elevated`, `--text-primary`, `--accent`, `--protocol-ssh`, etc.
 - Dark charcoal palette — not Material Design literally, but Material-inspired layering
 - Protocol colours: SSH=teal `#4ecdc4`, Telnet=amber `#ffa726`, RAW=purple `#ab47bc`, GitHub=indigo `#7c8aff`
-**Adding a new protocol:**
+- **Never change the database, vault, export or recording formats incompatibly.** The vault (`vault/vault.json`: Argon2id t=3, m=128 MiB, 4 lanes; AES-256-GCM per secret), the export envelope (`[version][32-byte salt][12-byte nonce][ciphertext]`, `.nexus`; `.link` must still import) and asciicast v2 recordings are fixed.
-1. Add `Protocol` constant + config struct in `models/models.go`
+- **Fixtures** generated by the old Go app live in `rust/core/tests/fixtures/` (`link.db`, `vault/`, `profiles.link`, `recordings/`). Tests in `storage.rs`, `secrets.rs`, `exportimport.rs` and `recording.rs` read them. Don't regenerate or edit them to make a test pass.
-2. Add defaults in `models/defaults.go` `NewProfile()` switch
+- **Schema changes are new SQL files** in `rust/core/migrations/` (`008_….sql`, …), added to `MIGRATIONS` in `storage.rs`. Each ends with `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'));`. Never edit an applied migration. SQLite has no `ALTER COLUMN`; use the recreate-table pattern.
-3. Create client package in `internal/<proto>client/`
+- **Keychain** entries are stored under the service `NexusTerminal`; reads fall back to `AlchementaryLink` and copy forward. Don't change key names (`profile:<id>:<kind>`).
-4. Add `connect<Proto>()` in `sessions/manager.go` + case in `Connect()` switch
+- **Data directory** names (`NexusTerminal`, `nexus.db`, `vault/`, `recordings/`) and the first-run migration from `AlchementaryLink/` in `config.rs` are user-facing; keep them stable.
 5. Add API methods in `api/api.go` if needed
 6. Add DB migration in `storage/migrations/` (update CHECK constraint, add config column)
 7. Update `storage/store.go`: all SELECT/INSERT/UPDATE queries + both scan functions
 8. Frontend: add DEFAULTS in `profiles.js`, render sections, collect form values, protocol tab
 9. Frontend: add viewer in new JS file (IIFE-wrapped), include in `index.html`, wire in `app.js`
 10. Add CSS: protocol colour token, sidebar indicator, tab badge, viewer styles
-**Database migrations:**
+## Testing tips
- Numbered SQL files: `001_initial.sql`, `002_github_protocol.sql`, etc.
+
- Each must `INSERT INTO schema_version (version, applied_at) VALUES (N, datetime('now'))` at the end
+- **Never point a test or manual run at your real data.** Use `--data-dir DIR` (a temporary directory) for manual runs; tests create their own directory under `std::env::temp_dir()`, as the existing ones do.
- SQLite has no `ALTER COLUMN` — use the recreate-table pattern (CREATE new → INSERT INTO new SELECT FROM old → DROP old → ALTER TABLE RENAME)
+- **App flags** (`rust/app/src/main.rs`):
- Every query in `store.go` that touches the profiles table must be updated when columns change (there are ~8 SELECT column lists + 2 scan functions)
+  - `--data-dir DIR` — use another data directory.
  - `--screenshot out.png` — render, save a PNG and exit (works under `xvfb-run`); combine with `--size WxH` and `--theme pro|midnight|light`.
  - `--open WINDOW` — open a window at startup: `editor[:protocol|id]`, `quick`, `settings[:terminal|security|knownhosts|help|about]`, `keys`, `snippets`, `triggers`, `recordings`, `palette`, `export`, `import`.
  - `--connect NAME` — connect a saved profile by display name or id.
  - `--run-local CMD` — open a local terminal and type `CMD` into it once connected.
  For example: `cargo run -- --data-dir /tmp/nx --open settings:help --screenshot /tmp/help.png`.
 - **SSH integration tests** (`core/tests/ssh_integration.rs`) start a throwaway `sshd` as the current user on a random port and skip themselves when OpenSSH isn't installed. They **must never open an interactive login shell** — the user's shell profile can auto-attach tmux/byobu to a real session. Set the profile's startup command to `/bin/sh -i`, as the existing `profile()` helper does.
 - `core/tests/sessions.rs` drives the `Manager` end to end against local TCP listeners; follow its `manager()` and `wait()` helpers for event-driven tests.
 - UI logic that can be tested without a window (parsers, fuzzy matching, split trees, snippet variables, trigger matching) has `#[cfg(test)]` unit tests next to it; add one with any non-trivial change.
@@ -0,0 +1,29 @@
 name: CI
 on:
    push:
        branches: ["**"]
    pull_request:
 jobs:
    test:
        name: Test (${{ matrix.os }})
        runs-on: ${{ matrix.os }}
        strategy:
            fail-fast: false
            matrix:
                os: [ubuntu-22.04, macos-14, windows-latest]
        defaults:
            run:
                shell: bash
                working-directory: rust
        steps:
            - uses: actions/checkout@v4
            - name: Linux dependencies (GUI libs, and sshd for the SSH integration tests)
              if: runner.os == 'Linux'
              run: |
                  sudo apt-get update
                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev openssh-server
            - run: cargo test --locked --workspace
            - run: cargo fmt --all --check
            - run: cargo clippy --locked --workspace --all-targets -- -D warnings
@@ -17,121 +17,50 @@ jobs:
            fail-fast: false
            matrix:
                include:
-                    - platform: darwin/amd64
+                    - { platform: darwin/amd64, runner: macos-13 }
-                      runner: macos-13
+                    - { platform: darwin/arm64, runner: macos-14 }
-                      os: darwin
+                    - { platform: linux/amd64, runner: ubuntu-22.04 }
-                      arch: amd64
+                    - { platform: linux/arm64, runner: ubuntu-22.04-arm }
-                      archive_type: zip
+                    - { platform: windows/amd64, runner: windows-latest }
-                    - platform: darwin/arm64
+                    - { platform: windows/arm64, runner: windows-11-arm }
-                      runner: macos-14
+        defaults:
-                      os: darwin
+            run:
-                      arch: arm64
+                shell: bash
-                      archive_type: zip
+                working-directory: rust
                    - platform: linux/amd64
                      runner: ubuntu-latest
                      os: linux
                      arch: amd64
                      archive_type: tar
                    - platform: linux/arm64
                      runner: ubuntu-24.04-arm64
                      os: linux
                      arch: arm64
                      archive_type: tar
                    - platform: windows/amd64
                      runner: windows-latest
                      os: windows
                      arch: amd64
                      archive_type: zip
                    - platform: windows/arm64
                      runner: ubuntu-latest
                      os: windows
                      arch: arm64
                      archive_type: zip
                      cross: true
        steps:
-            - name: Checkout
+            - uses: actions/checkout@v4
              uses: actions/checkout@v4
            - name: Set up Go
              uses: actions/setup-go@v5
              with:
-                  go-version-file: go.mod
+                  fetch-depth: 0
-            - name: Set up Node
+            - name: Rust toolchain (pinned by rust-toolchain.toml)
-              uses: actions/setup-node@v4
+              run: rustup show active-toolchain || rustup toolchain install
              with:
                  node-version: "20"
-            - name: Install Wails
+            - name: Linux build dependencies
-              run: go install github.com/wailsapp/wails/v2/cmd/wails@latest
+              if: runner.os == 'Linux'
            - name: Install frontend dependencies
              run: npm install
              working-directory: frontend
            - name: Install Linux build dependencies
              if: matrix.os == 'linux'
              run: |
                  sudo apt-get update
-                  sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev
+                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
-            - name: Install Windows cross-compiler
+            - name: Test
-              if: matrix.os == 'windows' && matrix.cross
+              run: cargo test --locked --workspace
              run: |
                  sudo apt-get update
                  sudo apt-get install -y gcc-mingw-w64-x86-64 gcc-mingw-w64-aarch64 zip
-            - name: Build (non-Windows runners)
+            - name: Build and package
              if: matrix.runner != 'windows-latest'
              env:
-                  CGO_ENABLED: "1"
+                  NEXUS_RELEASE_TARGETS: ${{ matrix.platform }}
-              run: |
+                  NEXUS_RELEASE_ROOT: ${{ github.workspace }}/build/releases
-                  if [ "${{ matrix.os }}" = "windows" ] && [ "${{ matrix.cross }}" = "true" ]; then
+              run: ./release.sh
                    export CC=aarch64-w64-mingw32-gcc
                  fi
                  wails build -platform "${{ matrix.platform }}" -ldflags "-s -w"
-            - name: Build (Windows runner)
+            - name: Upload artefacts
              if: matrix.runner == 'windows-latest'
              shell: pwsh
              env:
                  CGO_ENABLED: "1"
              run: |
                  wails build -platform "${{ matrix.platform }}" -ldflags "-s -w"
            - name: Package (zip)
              if: matrix.archive_type == 'zip' && matrix.runner != 'windows-latest'
              run: |
                  archive="nexus-terminal-${{ matrix.platform }}.zip"
                  cd build/bin
                  zip -r "../../${archive}" .
            - name: Package (tar)
              if: matrix.archive_type == 'tar'
              run: |
                  archive="nexus-terminal-${{ matrix.platform }}.tar.gz"
                  tar -czf "${archive}" -C build/bin .
            - name: Package (Windows zip)
              if: matrix.archive_type == 'zip' && matrix.runner == 'windows-latest'
              shell: pwsh
              run: |
                  $archive = "nexus-terminal-${{ matrix.platform }}.zip"
                  Compress-Archive -Path "build/bin/*" -DestinationPath $archive
            - name: Upload artifact
              uses: actions/upload-artifact@v4
              with:
-                  name: nexus-terminal-${{ matrix.platform }}
+                  name: nexus-terminal-${{ matrix.runner }}
                  path: |
-                      nexus-terminal-${{ matrix.platform }}.zip
+                      build/releases/*/NexusTerminal-*.zip
-                      nexus-terminal-${{ matrix.platform }}.tar.gz
+                      build/releases/manifest-*.json
                      build/releases/version-*.txt
            - name: Attach to GitHub Release
              if: startsWith(github.ref, 'refs/tags/')
              uses: softprops/action-gh-release@v2
              with:
-                  files: |
+                  files: build/releases/*/NexusTerminal-*.zip
                      nexus-terminal-${{ matrix.platform }}.zip
                      nexus-terminal-${{ matrix.platform }}.tar.gz
@@ -3,31 +3,8 @@
 # ==========================================================================
 # ── Build output ──────────────────────────────────────────────────────────
-build/bin/
+rust/target/
-dist/
+build/releases/
 # ── Build platform resources (tracked — icons, plists, manifests) ─────────
 # build/darwin/, build/windows/, build/linux/ are tracked for icons & metadata
 # ── Go ────────────────────────────────────────────────────────────────────
 vendor/
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
 *.test
 *.out
 __debug_bin*
 coverage.out
 coverage.html
 # ── Frontend ──────────────────────────────────────────────────────────────
 frontend/node_modules/
 frontend/src/js/lib/
 # ── Wails auto-generated bindings (recreated on every build) ──────────────
 frontend/wailsjs/
 # ── IDE / editor ──────────────────────────────────────────────────────────
 .idea/
@@ -35,20 +12,12 @@ frontend/wailsjs/
 *.swp
 *.swo
 *~
 *.sublime-project
 *.sublime-workspace
 .project
 .classpath
 .settings/
 # ── OS metadata ───────────────────────────────────────────────────────────
 .DS_Store
 .DS_Store?
 ._*
 Thumbs.db
 ehthumbs.db
 Desktop.ini
 $RECYCLE.BIN/
 # ── Application data (never commit user data or secrets) ──────────────────
 *.db
@@ -57,9 +26,12 @@ $RECYCLE.BIN/
 vault.json
 *.pem
 *.key
 !build/appicon.png
 # Compatibility fixtures generated from the last Go build are deliberate test data.
 !rust/core/tests/fixtures/**
-# Builds
+# Agent worktrees
-build/releases/v*
+.claude/worktrees/
-build/releases/manifest*
+
 # User guide LaTeX output
 docs/guide/build/
@@ -0,0 +1,787 @@
 # Security Audit Report
 ## 1. Executive Summary
 This audit reviewed Nexus Terminal, a Wails desktop SSH/Telnet/RAW/VNC/SFTP client with a Go backend and JavaScript frontend. Fix mode was requested, so confirmed issues were patched, regression-tested, and prepared for commit.
 The highest-risk issues were SSH trust failures: regular SSH sessions were not wired to the existing known-host verification flow, jump-host SSH connections ignored host keys, and VNC SSH tunnels also ignored host keys. These could allow machine-in-the-middle attacks against SSH credentials and terminal/VNC traffic. This run wired all SSH paths to known-host verification and prompt handling.
 Other fixed issues include a local noVNC WebSocket proxy access-control weakness, SSH key-name path traversal in public-key reads, unsafe update-result DOM rendering, inline secret leakage in non-secret profile exports, and current vulnerable dependency versions in `golang.org/x/crypto` and `esbuild`.
 Residual risk remains in user-selected insecure modes such as direct unencrypted VNC, user-configured `HostKeyInsecure`, and large local file transfer workflows that still process complete files in memory.
 ## 2. Scope Reviewed
 Reviewed:
 - Go backend packages under `internal/`: API bindings, sessions, SSH, VNC, SFTP, storage, secrets, updater, raw/telnet clients, recording, validation, known hosts, config, app startup.
 - Frontend JavaScript under `frontend/src/js`: settings/update UI, host-key event handling, terminal and SFTP/VNC/GitHub surfaces, common DOM helpers.
 - Dependency manifests and lockfiles: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
 - Build and release scripts: `Makefile`, `build.sh`, `release.sh`, Wails config.
 - Tests under `internal/**/*_test.go`.
 Not in scope:
 - Live network penetration testing of remote hosts.
 - Reverse engineering packaged binaries.
 - Manual verification of Wails runtime origin values in a built app.
 ## 3. Methodology
 - Static source review of trust boundaries, file operations, SSH/VNC flows, Wails API bindings, frontend DOM sinks, update checks, storage, crypto, and secret handling.
 - Dependency review with `govulncheck` and `npm audit`.
 - Configuration review of Wails, build scripts, update manifests, and release paths.
 - Threat modelling of desktop renderer compromise, local web-origin attacks, remote SSH/VNC attackers, and malicious update metadata.
 - Denial-of-service review of network timeouts, WebSocket proxy behavior, transfer paths, and file ingestion.
 - Regression tests added for fixed Go issues.
 ## 4. Risk Rating Method
 Severity considered exploitability, attacker position, affected security property, and impact:
 - Critical: practical remote compromise or credential disclosure without meaningful preconditions.
 - High: credential/session compromise or machine-in-the-middle exposure on primary connection paths.
 - Medium: meaningful local, renderer, or network-assisted exploit with constraints.
 - Low: hardening issue, local DoS, or user-assisted exposure.
 - Informational: checked area or non-security note.
 Confidence reflects direct code evidence and verification coverage.
 ## 5. Findings Summary Table
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---:|---:|---|---|---|
 | SEC-001 | High | High | SSH sessions and jump hosts bypassed known-host verification | SSH sessions | Fixed |
 | SEC-002 | High | High | VNC SSH tunnels accepted any SSH host key | VNC over SSH | Fixed |
 | SEC-003 | Medium | High | Local noVNC WebSocket proxy used a guessable root endpoint | VNC WebSocket proxy | Fixed |
 | SEC-004 | Medium | High | SSH public-key read accepted traversal key names | SSH key API | Fixed |
 | SEC-005 | Medium | High | Update metadata rendered through dynamic HTML and inline handler | Settings/update UI | Fixed |
 | SEC-006 | Medium | High | Non-secret profile export leaked inline SSH secrets | Profile export | Fixed |
 | SEC-007 | High | High | `golang.org/x/crypto` vulnerable in reachable SSH code | Go dependencies | Fixed |
 | SEC-008 | Medium | High | `esbuild` dev dependency matched current npm advisory | Frontend dependency | Fixed |
 | SEC-009 | Low | Medium | Large local file upload paths remain memory-heavy | File transfer UX | Open |
 | SEC-010 | Low | Medium | Direct VNC remains unencrypted by protocol choice | VNC direct mode | Open |
 ## 6. Detailed Findings
 ### Finding ID: SEC-001
 #### Title
 SSH sessions and jump hosts bypassed known-host verification
 #### Severity
 High
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/sessions/manager.go`, SSH connection setup, now fixed at lines 657 and 1450-1502.
 - `internal/sshclient/sshclient.go`, jump-host config, now fixed at lines 599 and 646-652.
 - `frontend/src/js/app.js`, host-key response correlation, now fixed at lines 334-342.
 #### Description
 The project already contained known-host storage, a host-key verifier, and frontend prompt UI, but the main SSH session manager previously called the SSH client's default `Connect` path. That default path used `ssh.InsecureIgnoreHostKey()`. Jump hosts also built their own `ssh.ClientConfig` with `ssh.InsecureIgnoreHostKey()`.
 #### Evidence
 The fix now calls `ConnectWithHostKeyCallback(...)` for regular SSH sessions and propagates the final host-key callback into jump-host configs. A request ID is included in host-key prompt responses to prevent cross-session prompt confusion.
 #### Attack Scenario
 An attacker on the network path presents a fake SSH server or jump host. Without host-key verification, Nexus Terminal would accept the attacker's key, allowing credential capture, terminal tampering, or traffic interception.
 #### Impact
 Possible SSH credential theft, terminal command tampering, and loss of server authenticity.
 #### Recommendation
 Always use the known-host verifier for every SSH hop. Unknown host keys should follow the configured profile policy: strict, ask, accept-new, or explicit insecure.
 #### Safer Example
 Implemented: `Manager.hostKeyCallback` builds `sshclient.NewHostKeyVerifier(...)`, emits a prompt when needed, and `connectSSH` calls `ConnectWithHostKeyCallback(...)`.
 #### Suggested Tests
 Added regression coverage:
 - `TestHostKeyCallbackAcceptNewStoresHost`
 - `TestHostKeyCallbackStrictRejectsUnknownHost`
 - `TestJumpHostClientConfigUsesFinalHostKeyCallback`
 #### References
 - CWE-295: Improper Certificate Validation, analogous host-key trust failure.
 - OWASP ASVS 9.1.2: server certificate validation principles.
 #### Assumptions / Limitations
 Profiles may still explicitly choose `HostKeyInsecure`; that is a user-selected insecure mode and remains visible as residual risk.
 ### Finding ID: SEC-002
 #### Title
 VNC SSH tunnels accepted any SSH host key
 #### Severity
 High
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/vncclient/vncclient.go`, VNC SSH config, now fixed at lines 49 and 89-95.
 - `internal/sessions/manager.go`, VNC SSH callback wiring, now fixed at line 1016.
 #### Description
 VNC SSH tunnels established SSH connections with `ssh.InsecureIgnoreHostKey()`, allowing a network attacker to impersonate the SSH tunnel endpoint.
 #### Evidence
 The VNC client now requires `SSHHostKeyCallback` for tunneled SSH. The session manager supplies the same known-host/prompt path used by SSH sessions.
 #### Attack Scenario
 An attacker controlling DNS, Wi-Fi, or a gateway presents a fake SSH tunnel host for VNC traffic. The prior client accepted the key and tunneled VNC traffic through the attacker.
 #### Impact
 Possible VNC credential exposure, remote desktop traffic interception, and remote interaction tampering.
 #### Recommendation
 Require known-host verification for VNC SSH tunnels and reject tunnel setup if no callback is configured.
 #### Safer Example
 Implemented: `vncclient.Connect` returns an error if `cfg.SSHHostKeyCallback` is nil, and uses the provided callback in `ssh.ClientConfig`.
 #### Suggested Tests
 Covered indirectly by session host-key callback tests and VNC package tests.
 #### References
 - CWE-295.
 - OWASP ASVS 9.1.2.
 #### Assumptions / Limitations
 VNC tunnel host-key policy defaults to ask mode because VNC profiles do not currently expose a separate host-key policy field.
 ### Finding ID: SEC-003
 #### Title
 Local noVNC WebSocket proxy used a guessable root endpoint
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/vncclient/vncclient.go`, WebSocket proxy setup, now fixed at lines 171-183 and 255-260.
 #### Description
 The local VNC WebSocket proxy listened on `127.0.0.1` with a random port, but accepted upgrades on `/` and allowed any Origin. A malicious local web page could scan localhost ports and attempt to connect to an active proxy.
 #### Evidence
 The proxy now generates a 128-bit random token and exposes only `ws://127.0.0.1:<port>/<token>` to the Wails frontend.
 #### Attack Scenario
 A user visits a malicious web page while a VNC session is active. The page scans localhost WebSocket ports and connects to the proxy endpoint, potentially reading or injecting VNC traffic.
 #### Impact
 Possible local cross-origin access to VNC session traffic if the port is discovered.
 #### Recommendation
 Require an unguessable per-session URL token and continue binding only to loopback.
 #### Safer Example
 Implemented: `newProxyToken()` uses `crypto/rand` and the proxy route is registered only at the token path.
 #### Suggested Tests
 Added `TestNewProxyTokenIsRandomHex`.
 #### References
 - CWE-346: Origin Validation Error.
 - OWASP ASVS 14.4.3: cross-origin resource restrictions.
 #### Assumptions / Limitations
 `CheckOrigin` still returns true because Wails/noVNC origin behavior needs built-app verification. The unguessable path materially reduces exposure.
 ### Finding ID: SEC-004
 #### Title
 SSH public-key read accepted traversal key names
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`, SSH key API, now fixed at lines 1653-1708.
 #### Description
 `GetSSHPublicKey(name)` previously built `~/.ssh/<name>.pub` directly from a renderer-provided name. Unlike key generation, it did not restrict names to simple key basenames. Names such as `../somefile` could read `~/.ssh/../somefile.pub`.
 #### Evidence
 The fix centralizes key name validation through `sshKeyPairPaths(...)`, allowing only alphanumeric characters, hyphens, and underscores.
 #### Attack Scenario
 If renderer-side JavaScript is compromised or a malicious plugin/flow can invoke the Wails API, it can request public-key contents outside the intended `.ssh` key namespace if the target path ends in `.pub`.
 #### Impact
 Local file disclosure for matching `.pub` paths under paths reachable through traversal.
 #### Recommendation
 Treat key names as basenames, not paths. Apply the same validation to generate, read, and delete operations.
 #### Safer Example
 Implemented: `GetSSHPublicKey`, `GenerateSSHKey`, and `DeleteSSHKey` now all use `sshKeyPairPaths`.
 #### Suggested Tests
 Added:
 - `TestSSHKeyPairPathsAcceptsSafeName`
 - `TestSSHKeyPairPathsRejectsTraversal`
 - `TestSSHKeyPairPathsRejectsNestedPath`
 #### References
 - CWE-22: Path Traversal.
 #### Assumptions / Limitations
 The API still intentionally lists and reads legitimate SSH public keys in `~/.ssh`.
 ### Finding ID: SEC-005
 #### Title
 Update metadata rendered through dynamic HTML and inline handler
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `frontend/src/js/settings.js`, update-check UI, now fixed at lines 940-958.
 #### Description
 Update metadata from GitHub or a configured update manifest was inserted into `innerHTML`, including an inline `onclick` that interpolated `info.releaseURL`. A malicious or compromised update metadata source could inject script into the Wails renderer.
 #### Evidence
 The fix constructs DOM nodes, sets text via `textContent`, and attaches a click listener with `addEventListener`.
 #### Attack Scenario
 An attacker controlling a self-hosted update manifest returns a release URL containing a quote and JavaScript payload. The prior inline handler interpolation could execute renderer JavaScript.
 #### Impact
 Renderer code execution. In a Wails app, renderer execution can call exposed backend APIs, increasing impact.
 #### Recommendation
 Never render remote metadata through string-built HTML. Use `textContent` and event listeners.
 #### Safer Example
 Implemented in `settings.js` with `createElement`, `document.createTextNode`, and `addEventListener`.
 #### Suggested Tests
 No frontend unit harness exists. Verified with `npm run build`.
 #### References
 - CWE-79: Cross-Site Scripting.
 - OWASP ASVS 5.3: output encoding.
 #### Assumptions / Limitations
 Other static modal templates still use `innerHTML`; reviewed high-risk dynamic remote metadata paths first.
 ### Finding ID: SEC-006
 #### Title
 Non-secret profile export leaked inline SSH secrets
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`, Wails export wrapper, now fixed at lines 683-684.
 - `internal/storage/store.go`, storage export, now fixed at lines 356-358 and 726-738.
 #### Description
 The plain profile export path accepted `includeSecrets=false` but profiles can still contain inline `ssh.proxyPassword` and `ssh.totpSecret` fields. Those fields could be serialized despite a non-secret export request.
 #### Evidence
 The fix redacts `ProxyPassword` and `TOTPSecret` for non-secret exports in both API and storage layers.
 #### Attack Scenario
 A user creates a plain profile export believing secrets are excluded. The exported JSON contains proxy credentials or TOTP secrets that are then shared, backed up, or stored insecurely.
 #### Impact
 Credential leakage and potential 2FA bypass for affected profiles.
 #### Recommendation
 Redact inline secret fields whenever `includeSecrets=false`. Prefer encrypted export for any export that intentionally includes secrets.
 #### Safer Example
 Implemented `redactProfileSecrets(...)` in storage and API packages.
 #### Suggested Tests
 Added:
 - `TestExportProfilesRedactsInlineSSHSecrets`
 - `TestRedactProfileSecretsClearsInlineSSHSecrets`
 #### References
 - CWE-200: Exposure of Sensitive Information.
 - OWASP ASVS 8.3: sensitive data protection.
 #### Assumptions / Limitations
 The encrypted export path intentionally includes selected profile data and is password-protected.
 ### Finding ID: SEC-007
 #### Title
 `golang.org/x/crypto` vulnerable in reachable SSH code
 #### Severity
 High
 #### Confidence
 High
 #### Affected Files / Components
 - `go.mod`, `golang.org/x/crypto`, now fixed at line 14.
 - `go.mod`, indirect `golang.org/x/sys`, now updated at line 45.
 - Reachable SSH code in `internal/sshclient`, `internal/vncclient`, `internal/sftpclient`.
 #### Description
 `govulncheck` reported seven reachable vulnerabilities in `golang.org/x/crypto@v0.51.0`, including SSH DoS/panic issues, FIDO/U2F security-key interaction bypass risk, and SSH agent forwarding constraint handling issues.
 #### Evidence
 `govulncheck` identified GO-2026-5033, GO-2026-5020, GO-2026-5019, GO-2026-5018, GO-2026-5017, GO-2026-5013, and GO-2026-5006 as reachable before the update. The dependency is now `v0.52.0`, and rerun output reports: "No vulnerabilities found. Your code is affected by 0 vulnerabilities."
 #### Attack Scenario
 A malicious or compromised SSH server, SSH agent, key material, or protocol peer triggers vulnerable SSH library behavior during connection, channel use, key parsing, or agent forwarding.
 #### Impact
 Possible client panic, denial of service, weakened security-key interaction, or agent forwarding constraint mishandling depending on the CVE path.
 #### Recommendation
 Keep `golang.org/x/crypto` at or above `v0.52.0` and run `govulncheck` in CI.
 #### Safer Example
 Implemented: `go get golang.org/x/crypto@v0.52.0`.
 #### Suggested Tests
 Ran `govulncheck` and `go test ./...`.
 #### References
 - https://pkg.go.dev/vuln/GO-2026-5033
 - https://pkg.go.dev/vuln/GO-2026-5020
 - https://pkg.go.dev/vuln/GO-2026-5019
 - https://pkg.go.dev/vuln/GO-2026-5018
 - https://pkg.go.dev/vuln/GO-2026-5017
 - https://pkg.go.dev/vuln/GO-2026-5013
 - https://pkg.go.dev/vuln/GO-2026-5006
 #### Assumptions / Limitations
 `govulncheck` also noted vulnerabilities in required modules that are not called by this code.
 ### Finding ID: SEC-008
 #### Title
 `esbuild` dev dependency matched current npm advisory
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `frontend/package.json`, `esbuild`, now fixed at line 22.
 - `frontend/package-lock.json`.
 #### Description
 `npm audit` reported GHSA-67mh-4wv8-2f99 for `esbuild <=0.24.2`: any website could send requests to the dev server and read responses under affected versions.
 #### Evidence
 The frontend previously resolved `esbuild@0.24.2`. It now uses `^0.28.0`, and `npm audit --json` reports zero vulnerabilities.
 #### Attack Scenario
 During local development, a malicious website could interact with the esbuild dev server and read responses if a developer runs an affected dev server.
 #### Impact
 Possible local development data exposure.
 #### Recommendation
 Use a fixed esbuild release and keep npm audit in CI.
 #### Safer Example
 Implemented: `npm install esbuild@0.28.0`.
 #### Suggested Tests
 Ran `npm audit --json` and `npm run build`.
 #### References
 - https://github.com/advisories/GHSA-67mh-4wv8-2f99
 #### Assumptions / Limitations
 This is a devDependency, so production exploitability is lower than runtime dependencies.
 ### Finding ID: SEC-009
 #### Title
 Large local file upload paths remain memory-heavy
 #### Severity
 Low
 #### Confidence
 Medium
 #### Affected Files / Components
 - `frontend/src/js/terminal.js`, dropped-file paste/upload flows.
 - `internal/api/api.go`, `SFTPUploadData`.
 #### Description
 Some upload paths read whole files into memory and send base64 payloads to Go before uploading. This can be expensive for very large local files.
 #### Evidence
 `SFTPUploadData` decodes the entire base64 payload before calling session upload. The frontend drag/drop paste path also reads file contents into strings.
 #### Attack Scenario
 A local user or compromised renderer submits very large files, causing high memory use and potential application unresponsiveness.
 #### Impact
 Local denial of service.
 #### Recommendation
 Add size limits for paste-as-text, prefer path-based streaming upload for large files, and surface user-facing warnings for files above a threshold.
 #### Safer Example
 Use file path streaming upload where possible and reject in-memory uploads above a configured maximum.
 #### Suggested Tests
 Add boundary tests for maximum accepted in-memory upload size and UI tests for large-file warnings.
 #### References
 - CWE-400: Uncontrolled Resource Consumption.
 #### Assumptions / Limitations
 This is primarily local/user-assisted. It was left open to avoid changing UX and transfer semantics during the security fix pass.
 ### Finding ID: SEC-010
 #### Title
 Direct VNC remains unencrypted by protocol choice
 #### Severity
 Low
 #### Confidence
 Medium
 #### Affected Files / Components
 - `internal/vncclient/vncclient.go`, direct TCP VNC mode.
 - VNC profile settings.
 #### Description
 Direct VNC connections use raw TCP to the VNC server. VNC is commonly unencrypted unless tunneled or separately protected.
 #### Evidence
 The direct branch calls `net.DialTimeout` to the VNC endpoint. SSH tunnel mode is available and now host-key verified.
 #### Attack Scenario
 On an untrusted network, direct VNC traffic may expose screen contents or credentials depending on server configuration.
 #### Impact
 Sensitive remote desktop data exposure.
 #### Recommendation
 Warn users before direct VNC connections and prefer SSH tunnel mode by default.
 #### Safer Example
 Default new VNC profiles to SSH tunnel where feasible, or show an explicit "unencrypted direct VNC" warning.
 #### Suggested Tests
 Add UI tests that direct VNC profiles show a warning before connection.
 #### References
 - OWASP ASVS 9.1: communications security.
 #### Assumptions / Limitations
 Some VNC servers may provide their own encryption; this audit did not test remote server configurations.
 ## 7. Denial-of-Service Review
 Fixed:
 - Updated `golang.org/x/crypto` to resolve reachable SSH panic/deadlock/DoS vulnerabilities.
 - Added random-token access control to the local VNC WebSocket proxy, reducing local cross-origin abuse.
 Reviewed and not changed:
 - HTTP clients for GitHub and update checks use finite timeouts.
 - SSH/Telnet/RAW connection setup uses timeouts.
 - VNC WebSocket bridge is intentionally long-lived and uses no read/write timeout.
 - Large in-memory file upload/paste paths remain a local DoS risk; see SEC-009.
 ## 8. Dependency and Supply-Chain Review
 Checks run:
 - `govulncheck`: fixed reachable `golang.org/x/crypto` vulnerabilities by updating to `v0.52.0`; rerun found zero reachable vulnerabilities.
 - `npm audit --json`: fixed `esbuild` advisory by updating to `0.28.0`; rerun found zero vulnerabilities.
 - `npm run build`: passed after dependency update.
 Notes:
 - `xterm` packages are deprecated upstream in favor of `@xterm/*`, but no current audit advisory was reported in this run.
 - `go.mod` still has transitive modules with vulnerabilities that `govulncheck` reports as not called by this code.
 ## 9. Secrets and Sensitive Data Review
 Fixed:
 - Non-secret profile export now redacts inline `ProxyPassword` and `TOTPSecret`.
 - SSH host-key verification now protects credential submission from basic MITM paths.
 Reviewed:
 - Vault uses Argon2id and AES-256-GCM with random salts/nonces.
 - Vault file is written with `0600` permissions and store directories with `0700`.
 - OS keychain is preferred where available.
 Residual:
 - Secret values still exist in process memory while sessions need them.
 - Proxy password is still present in profile model state when entered inline.
 ## 10. Authentication and Authorisation Review
 Fixed:
 - SSH, jump host, and VNC-over-SSH authentication now has host authenticity checks before credential use.
 - SSH host-key prompt responses are request-correlated.
 Reviewed:
 - SSH/TOTP flows use profile-specific secret callbacks.
 - Agent forwarding is explicit profile configuration.
 - Known-host policies include strict, ask, accept-new, and insecure.
 Residual:
 - `HostKeyInsecure` remains available for user-selected insecure connections.
 ## 11. Input Validation and Output Encoding Review
 Fixed:
 - SSH key names now reject traversal and nested path separators.
 - Update metadata is rendered with DOM APIs instead of string-built HTML.
 - Non-secret export redacts inline secret fields.
 Reviewed:
 - SQL operations use parameterized queries.
 - Profile validation checks host, port, username, protocol-specific fields, and port-forwarding basics.
 - Frontend frequently uses `textContent` or `escapeHtml`; remaining `innerHTML` static templates should still be reviewed during future frontend hardening.
 ## 12. Infrastructure and Deployment Review
 Reviewed:
 - Wails app binds Go services directly to the renderer. This makes frontend XSS more impactful than in a browser-only app.
 - Build scripts use `set -euo pipefail`.
 - Update checking is opt-in and does not auto-install binaries.
 Residual:
 - No CI configuration was present in the reviewed file list, so dependency scanning is not currently enforced by repository automation.
 ## 13. Logging, Monitoring, and Error Handling Review
 Reviewed:
 - Audit logger records profile create/update/delete, connection events, secret access, import/export.
 - Errors are generally returned to the frontend with enough context for troubleshooting.
 Residual:
 - Some error messages include file paths, which is acceptable for a local desktop tool but should be considered if telemetry is later added.
 ## 14. Test Coverage and Security Regression Gaps
 Added tests:
 - API SSH key path validation and export redaction.
 - Session host-key callback storage and strict rejection behavior.
 - Jump-host host-key callback propagation.
 - Storage export redaction.
 - VNC proxy token generation.
 Remaining gaps:
 - No frontend unit test harness for DOM injection regressions.
 - No integration test for full Wails host-key prompt round trip.
 - No VNC WebSocket integration test verifying token-only connection behavior.
 - No large-file upload boundary tests.
 ## 15. Prioritised Remediation Plan
 Immediate:
 - Keep the fixes in this audit and ensure they are merged.
 - Add dependency scanning to CI: `govulncheck ./...` and `npm audit --audit-level=moderate`.
 Short-term:
 - Add a frontend test harness for update UI and other dynamic DOM surfaces.
 - Add direct VNC warning UX and default to SSH tunnel where possible.
 - Add explicit in-memory upload size limits.
 Medium-term:
 - Expose host-key policy for VNC SSH tunnels instead of always using ask mode.
 - Review all Wails-exposed methods under a compromised-renderer threat model.
 - Migrate deprecated `xterm` packages to maintained `@xterm/*` packages.
 Long-term:
 - Consider capability gating or confirmation for high-risk renderer-callable APIs such as file deletion, SSH key deletion, local shell selection, and profile import/export.
 - Add signed update metadata if self-hosted update manifests become a production channel.
 ## 16. False Positives / Needs Manual Verification
 - Wails/noVNC Origin behavior in a packaged app should be manually verified. Tokenized VNC WebSocket paths are in place, but Origin policy may still be tightened later.
 - Direct VNC encryption depends on remote VNC server configuration and network placement.
 - `HostKeyInsecure` is intentionally user-configurable; confirm UI wording makes the risk clear.
 - Large-file memory usage thresholds need product decisions before enforcement.
 ## 17. Final Notes
 Fix mode completed with code changes, tests, and dependency updates. The strongest residual concern is the general Wails threat model: a frontend XSS can call powerful local backend APIs. This audit fixed the confirmed dynamic update UI injection path and several backend trust-boundary issues, but future work should continue reducing string-built HTML and adding capability checks around sensitive local operations.
@@ -1,69 +0,0 @@
 .PHONY: all build dev clean test test-cover lint install deps frontend-deps run package release help
 # Resolve the Wails binary. Prefer wails on PATH; fall back to GOPATH/bin.
 WAILS := $(or $(shell which wails 2>/dev/null),$(shell go env GOPATH)/bin/wails)
 VERSION := $(shell git describe --tags --abbrev=0 2>/dev/null || echo dev)-$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 LD_UPDATE_URL := $(if $(NEXUS_UPDATE_URL),-X github.com/andydixon/nexus/internal/api.appUpdateURL=$(NEXUS_UPDATE_URL),)
 # Default target
 all: build
 # Install all dependencies
 deps: frontend-deps
 	go mod download
 # Install frontend dependencies
 frontend-deps:
 	cd frontend && npm install
 # Development mode with hot reload
 dev: deps
 	$(WAILS) dev
 # Production build
 build: deps
 	$(WAILS) build -ldflags "-s -w -X github.com/andydixon/nexus/internal/api.appVersion=$(VERSION) $(LD_UPDATE_URL)"
 # Run tests
 test:
 	go test ./... -v -count=1
 # Run tests with coverage
 test-cover:
 	go test ./... -v -count=1 -coverprofile=coverage.out
 	go tool cover -html=coverage.out -o coverage.html
 # Clean build artefacts
 clean:
 	rm -rf build/bin
 	rm -rf frontend/node_modules
 	rm -rf frontend/src/js/lib
 	rm -rf frontend/src/css/lib
 	go clean -testcache
 # Lint (requires golangci-lint)
 lint:
 	golangci-lint run ./...
 # Package for distribution
 package: build
 	@echo "Binary built at build/bin/"
 # Build and package release artefacts for all platforms
 release:
 	./release.sh
 # Help
 help:
 	@echo "Nexus Terminal — Build Targets"
 	@echo ""
 	@echo "  make deps          — Install all dependencies"
 	@echo "  make dev           — Run in development mode with hot reload"
 	@echo "  make build         — Production build"
 	@echo "  make test          — Run tests"
 	@echo "  make test-cover    — Run tests with coverage report"
 	@echo "  make clean         — Clean build artefacts"
 	@echo "  make lint          — Run linter (requires golangci-lint)"
 	@echo "  make package       — Build and package for distribution"
 	@echo "  make release       — Build multi-platform release artefacts"
 	@echo "  make help          — Show this help"
@@ -1,34 +1,42 @@
 # Nexus Terminal
-**A desktop client for SSH, Telnet, RAW TCP, and GitHub — with secure credential handling and a focused, multi-session workflow.**
+**A native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals — with secure credential handling and a focused, multi-session workflow.**
-Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence.
+Nexus Terminal helps you manage many connections at once, keep terminal work organised, and move files with confidence. It is a single Rust application with no webview, so it starts quickly and stays responsive under heavy terminal output.
 ## Highlights
- SSH, Telnet, RAW TCP, and GitHub sessions in one app
+- SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions in one app
- Tabbed sessions with split panes, pinning, and reordering
+- Tabbed sessions with split panes, pinning and drag-to-reorder
- SFTP browser with drag-and-drop uploads and a directory picker
+- SFTP browser with drag-and-drop uploads and a permission-aware directory picker
- Disconnected overlay with one-click reconnect
+- SSH jump hosts, SOCKS5/HTTP proxies, local and remote port forwards, agent forwarding and TOTP auto-fill
- Broadcast input, snippets, and terminal search
+- Serial consoles with full line settings (baud, data bits, parity, stop bits, flow control)
- Session recording and playback
+- Native VNC viewer, optionally tunnelled over SSH
- Secure credential storage with OS keychain and encrypted vault fallback
+- Disconnected overlay with one-click reconnect, and auto-reconnect with backoff
 - Broadcast input, snippets, trigger rules and terminal search
 - Session recording (asciicast v2) and playback
 - Secure credential storage with the OS keychain first and an encrypted vault fallback
 ## Quick start
 1. Launch Nexus Terminal.
-2. Click **New** in the sidebar and create a connection profile.
+2. Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**) and create a connection profile.
-3. Click **Connect** to open a session in a new tab.
+3. Click **Create & Connect** to save it and open a session in a new tab. Afterwards, click the profile in the sidebar to connect.
-Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect.
+Prefer a one-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** to quick connect, or click **Local Machine** in the sidebar for a local shell.
 If a session drops, use the **Reconnect** button in the disconnected overlay.
 ### Coming from Alchementary Link?
 On first run, Nexus Terminal copies your Alchementary Link profiles, encrypted vault and recordings into its own data directory, and picks up credentials saved in the OS keychain. The old data is left untouched. Older `.link` export files can still be imported.
 ## Documentation
 - Product overview: [docs/overview.md](docs/overview.md)
 - Quick start (shareable): [docs/quick-start.md](docs/quick-start.md)
 - User manual: [docs/user-manual.md](docs/user-manual.md)
 - Illustrated user guide (PDF): [docs/guide/nexus-guide.pdf](docs/guide/nexus-guide.pdf), built from LaTeX in [docs/guide](docs/guide) (`make` there; `tools/screenshots.sh` regenerates the screenshots)
 - Build and release: [docs/build-and-release.md](docs/build-and-release.md)
 ## Keyboard shortcuts
@@ -36,7 +44,7 @@ If a session drops, use the **Reconnect** button in the disconnected overlay.
 All shortcuts use **Cmd** on macOS and **Ctrl** on Windows/Linux.
 | macOS Shortcut    | Windows/Linux Shortcut | Action                           |
-| ----------------- | ---------------------- | --------------------------- |
+| ----------------- | ---------------------- | -------------------------------- |
 | Cmd + K           | Ctrl + K               | Open command palette             |
 | Cmd + N           | Ctrl + N               | New connection                   |
 | Cmd + W           | Ctrl + W               | Close current tab                |
@@ -45,10 +53,21 @@ All shortcuts use **Cmd** on macOS and **Ctrl** on Windows/Linux.
 | Cmd + 1–9         | Ctrl + 1–9             | Switch to tab by number          |
 | Cmd + ,           | Ctrl + ,               | Open settings                    |
 | Cmd + F           | Ctrl + F               | Find in terminal                 |
-| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane vertically       |
+| Cmd + Shift + D   | Ctrl + Shift + D       | Split pane right (side by side)  |
-| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane horizontally     |
+| Cmd + Shift + E   | Ctrl + Shift + E       | Split pane down (top and bottom) |
 | Cmd + Shift + R   | Ctrl + Shift + R       | Toggle session recording         |
 | Cmd + Shift + B   | Ctrl + Shift + B       | Toggle broadcast input mode      |
 | Cmd + Shift + S   | Ctrl + Shift + S       | Open snippet library             |
 | Cmd + Shift + Q   | Ctrl + Shift + Q       | Quick connect                    |
 | F11               | F11                    | Toggle fullscreen                |
 ## Building from source
 Nexus Terminal is a Rust workspace in `rust/`. With [rustup](https://rustup.rs) installed:
 ```bash
 cd rust
 cargo run --release
 ```
 See [docs/build-and-release.md](docs/build-and-release.md) for platform prerequisites, tests and release packaging.
@@ -0,0 +1,126 @@
 # Functionality and Next Steps Report
 ## 1. Executive Summary
 This fix-mode audit improved immediate security and robustness around profile validation, imports, drag-drop upload, frontend encoding, dependencies, and release reproducibility.
 The most useful next work is to turn these fixes into durable product quality: add frontend interaction tests, make large file upload streaming and consistent, warn users about intentionally insecure protocol choices, and strengthen release provenance.
 ## 2. Current Functional Risks
 Direct VNC can still be used without SSH tunnelling. That is valid for trusted networks, but the UI should make the risk visible when profiles are saved or connected.
 Drag-drop SFTP upload is now capped at 25 MiB because it still uses an in-memory browser-to-Go base64 path. Larger files should use the existing native SFTP upload flow or a future streaming drag-drop implementation.
 Profile import now rejects malformed or unsafe profiles before storage. That is safer, but older third-party exports with missing defaults may need a clearer import error UI or a migration/repair preview.
 RAW session history and recordings can still grow over long sessions. Users need limits, retention controls, and clear storage management.
 ## 3. Code Quality Improvements
 Profile validation is now centralized enough for create/update/import, but profile normalization is still split between frontend defaults, Go defaults, and import-time cleanup. A schema-versioned import normalizer would make future protocol additions safer.
 Frontend still has many `innerHTML` templates. Some are static or escaped, but a small helper pattern for safe modal construction would reduce future XSS mistakes.
 Release scripts and CI now use pinned Wails and `npm ci`; follow-up work should avoid duplicate release logic between `build.sh`, `release.sh`, and GitHub Actions.
 ## 4. Frontend Interaction and Error-Handling Improvements
 Add Wails/browser interaction tests for:
 - Dropping a file with HTML metacharacters in its filename.
 - Dropping a file over 25 MiB.
 - Importing malformed and oversized profile bundles.
 - Saving GitHub profiles with HTTP and HTTPS API base URLs.
 - Creating direct VNC profiles and seeing a warning.
 Improve import UX by showing which profile entry failed validation without exposing secret values.
 ## 5. Testing Roadmap
 Immediate tests to add:
 - Frontend DOM regression for file-drop title rendering.
 - API tests for successful valid GitHub Enterprise HTTPS profile creation.
 - Import tests for mixed valid/invalid profile arrays.
 Short-term tests:
 - End-to-end Wails smoke tests for create profile, connect prompt flow, import/export, SFTP upload, and VNC tunnel setup.
 - Load tests for large SFTP directories, RAW captures, and recordings.
 - CI security job with `npm audit`, govulncheck, and secret scanning.
 Longer-term tests:
 - Release workflow dry-run or artifact validation tests.
 - Migration tests for profile schema changes.
 ## 6. Recommended New Functionality
 Add a direct-VNC safety warning and a per-profile “prefer SSH tunnel” nudge.
 Add streaming drag-drop SFTP upload for larger files, or route drag-drop files above 25 MiB into the native upload flow.
 Add import preview: list profile names, protocols, validation warnings, and duplicate handling before writing.
 Add recording retention settings: max recording size, max age, and one-click cleanup.
 Add security diagnostics in settings: dependency check status, known-host summary, direct insecure profile count, and last audit-log events.
 ## 7. Next-Level Opportunities
 Release hardening:
 - Sign and notarize release artifacts where platform-appropriate.
 - Publish checksums and provenance.
 - Pin or cache dependency sources in CI.
 Observability:
 - Add structured non-sensitive debug logs for import rejection, update checks, VNC proxy lifecycle, and SFTP transfer failures.
 - Add audit entries for validation failures that indicate suspicious imports, without storing payload contents.
 Developer experience:
 - Consolidate release/build dependency resolution into one reusable script.
 - Add a frontend lint rule or custom check for unsafe `innerHTML` with dynamic values.
 Accessibility/product quality:
 - Ensure modal error states are keyboard reachable and announced.
 - Add clearer status messages for blocked uploads and import validation failures.
 ## 8. Prioritised Action Plan
 Immediate:
 - Add direct VNC warning copy and tests.
 - Add frontend file-drop XSS and oversize tests.
 - Add CI jobs for `go test ./...`, `npm run build`, `npm audit`, and govulncheck.
 Short-term:
 - Replace deprecated `xterm` packages with maintained `@xterm/*` packages.
 - Build import preview and validation repair UI.
 - Add recording and RAW capture storage limits.
 Medium-term:
 - Implement streaming drag-drop upload.
 - Add release signing, checksums, and provenance.
 - Add schema-versioned profile import/export.
 Long-term:
 - Build a security/settings dashboard for insecure profiles, known hosts, audit status, and update health.
 - Add comprehensive Wails end-to-end smoke coverage for core workflows.
 ## 9. Caveats and Validation Needed
 The fixes were verified with automated local checks, but not with live Wails UI automation.
 The new import validation may reject malformed legacy profiles that were previously accepted. That is intentional for safety, but the UX should help users repair old data.
 The 25 MiB drag-drop upload cap is a guardrail, not a final large-file strategy. Streaming support would be the better long-term user experience.
 Direct VNC was left open because some users need it on trusted networks; the next step is product warning and safer defaults, not silent removal.
@@ -0,0 +1,752 @@
 # Security Audit Report
 ## 1. Executive Summary
 This fix-mode audit reviewed Nexus Terminal, a Wails desktop client with a Go backend and JavaScript frontend for SSH, Telnet, RAW TCP, VNC, SFTP, GitHub, recordings, local shells, encrypted secrets, and profile import/export.
 The highest-risk issues fixed in this run were unsafe profile persistence/import validation, a local DOM XSS trigger in the file-drop modal, memory-exhaustion paths in import and drag-drop upload flows, vulnerable dependency versions, and release tooling that installed unpinned build dependencies. I also removed the stale insecure SSH connection helper so future code cannot silently bypass host-key verification.
 Post-fix verification passed: `go test ./...`, focused Go tests, `npm run build`, `npm audit --json`, `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`, `bash -n build.sh release.sh`, and `git diff --check`.
 Residual risk remains where users intentionally choose insecure protocols or workflows, especially direct VNC without SSH tunnelling. No high-confidence secrets or private keys were found in the repository search performed during this audit.
 ## 2. Scope Reviewed
 Reviewed code and configuration:
 - Go backend under `internal/`: API bindings, sessions, SSH, VNC, SFTP, storage, secrets, export/import, validation, updater, recordings, local shell, GitHub client, raw and telnet clients.
 - Frontend JavaScript under `frontend/src/js`, especially file drop, terminal, settings, GitHub, profile, SFTP, VNC, notification, and import/export flows.
 - Dependency manifests and lockfiles: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
 - Build/release configuration: `build.sh`, `release.sh`, `.github/workflows/release-builds.yml`, `wails.json`.
 - Existing tests under `internal/**/*_test.go`.
 Not reviewed with live external testing:
 - Real SSH/VNC/GitHub endpoints.
 - Packaged binaries and platform installers.
 - Manual UI testing inside a running Wails app.
 ## 3. Methodology
 I used a two-pass review:
 - Attack-surface mapping of Wails API methods, import/export paths, file handling, DOM sinks, dependency/build chain, protocol clients, local proxy behavior, and credential flows.
 - Defensive validation from source and tests, followed by smallest safe fixes with regression tests.
 Tools/checks used:
 - Static review with `rg`, direct source reads, and line evidence.
 - `go test ./...`.
 - Focused tests for API, storage, export/import, validation, SSH client, and sessions.
 - `npm audit --json`.
 - `npm run build`.
 - `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`.
 - `bash -n build.sh release.sh`.
 - `git diff --check`.
 ## 4. Risk Rating Method
 Severity considered attacker position, exploit preconditions, likely impact, and whether sensitive credentials or code execution could be affected.
 - Critical: practical remote compromise or credential disclosure with minimal preconditions.
 - High: credible dependency, credential, or supply-chain compromise.
 - Medium: user-assisted or renderer/local attack that can affect confidentiality, integrity, or availability.
 - Low: hardening, defense-in-depth, or intentionally insecure user-selected modes.
 - Informational: verified area, non-exploitable issue, or test gap.
 Confidence is High where source evidence and regression checks directly support the finding.
 ## 5. Attack Surface Map
 Entry points:
 - Wails-bound Go API methods in `internal/api/api.go`.
 - Profile create/update/import/export and encrypted `.nexus` imports.
 - Drag-and-drop file upload/paste in `frontend/src/js/terminal.js`.
 - SSH, Telnet, RAW TCP, VNC, SFTP, GitHub API, and local shell sessions.
 - Local VNC WebSocket proxy on loopback.
 - Build/release automation and dependency installation.
 Trust boundaries:
 - Frontend renderer to Wails API.
 - User-selected/imported local files to backend parsers.
 - Saved/imported profiles to outbound network clients.
 - Remote hosts and GitHub/GitHub Enterprise APIs to frontend rendering.
 - Local filesystem/keychain/vault to application process.
 - CI/release environment to dependency registries and Go module proxy.
 Attacker starting positions considered:
 - Malicious imported profile bundle.
 - Crafted local file or filename dropped into the terminal.
 - Compromised renderer or malicious frontend input reaching Wails APIs.
 - Network attacker on SSH/VNC/GitHub paths.
 - Dependency registry or release-time supply-chain manipulation.
 ## 6. Findings Summary Table
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---:|---:|---|---|---|
 | SEC-20260615-001 | Medium | High | Profile persistence and imports accepted unsafe or malformed profiles | API, validation, import | Fixed |
 | SEC-20260615-002 | Medium | High | Import and drag-drop upload paths allowed memory exhaustion | Import/export, SFTP upload | Fixed |
 | SEC-20260615-003 | Medium | High | Dropped filenames were rendered through `innerHTML` | Frontend terminal file-drop modal | Fixed |
 | SEC-20260615-004 | Medium | High | Unused SSH helper still defaulted to insecure host-key verification | SSH client | Fixed |
 | SEC-20260615-005 | High | High | Dependency advisories affected `esbuild` and required `x/net` module versions | Dependencies | Fixed |
 | SEC-20260615-006 | Medium | High | Release automation installed unpinned build dependencies | CI/release supply chain | Fixed |
 | SEC-20260615-007 | Low | High | Direct VNC remains unencrypted when SSH tunnelling is disabled | VNC client | Open |
 ## 7. Detailed Findings
 ### Finding ID: SEC-20260615-001
 #### Title
 Profile persistence and imports accepted unsafe or malformed profiles
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`, `CreateProfile`, `UpdateProfile`, `ImportProfiles`, `ImportProfilesEncrypted`, lines 94-131, 715-728, 1176-1189, 1754-1791.
 - `internal/validation/validation.go`, profile, GitHub, and VNC validation, lines 51-140 and 325-410.
 - `internal/storage/store.go`, `ImportProfiles`, lines 365-380.
 #### Description
 The API comment said profile creation validates input, but the Wails API previously persisted profiles without calling the validation package. Plain JSON import also decoded into `[]*models.Profile` and dereferenced entries without rejecting `null`. A malicious or corrupt import could therefore crash the app or store profiles with unsafe GitHub API base URLs that would later receive a saved or prompted token.
 #### Evidence
 The fixed code now calls `validation.ValidateProfile` before create/update and validates every imported profile before writing. GitHub API base URLs must be HTTPS unless loopback, must be absolute, and must not include URL credentials. Import strategy and null entries are rejected before persistence.
 Regression tests were added in `internal/api/api_test.go` and `internal/storage/storage_test.go`.
 #### Attack Scenario
 A user imports a profile JSON containing a GitHub profile with `http://evil.example/api/v3` as the API base URL, or a `null` profile entry. Before the fix, malformed data could be saved or crash import handling. If the malicious GitHub profile were later used, the app could send a token to an attacker-controlled endpoint.
 #### Impact
 Possible token exposure through malicious profile configuration, app crash during import, and fragile persisted state.
 #### Recommendation
 Validate all Wails-bound persistence inputs and imported profiles before storage. Reject non-HTTPS remote GitHub API URLs and malformed entries.
 #### Safer Example
 Implemented:
 - `CreateProfile` and `UpdateProfile` call `validation.ValidateProfile`.
 - `ValidateGitHubConfig` rejects remote HTTP and URL credentials.
 - Import helpers reject oversized, null, or invalid entries before writes.
 #### Suggested Tests
 Implemented:
 - Unsafe GitHub base URL rejection.
 - Null import entry rejection.
 - Oversized JSON import rejection.
 - Storage-level null import entry rejection.
 - GitHub and VNC validation cases.
 #### References
 - CWE-20: Improper Input Validation.
 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
 - OWASP API Security Top 10: API3 Broken Object Property Level Authorization / unsafe object properties.
 #### Assumptions / Limitations
 GitHub Enterprise over non-loopback HTTP is now rejected. If a legitimate deployment needs HTTP, it should be placed behind local loopback or HTTPS.
 ### Finding ID: SEC-20260615-002
 #### Title
 Import and drag-drop upload paths allowed memory exhaustion
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`, plain import and SFTP drag-drop upload, lines 715-718 and 1336-1350.
 - `internal/exportimport/exportimport.go`, encrypted import file read, lines 37 and 131-144.
 - `frontend/src/js/terminal.js`, drag-drop file upload cap, lines 10 and 829-849.
 #### Description
 Several local file paths loaded attacker-controlled or user-selected content fully into memory without a size cap. Plain profile JSON import accepted arbitrary string size from the renderer. Encrypted `.nexus` import used `os.ReadFile` on the selected path. Drag-drop SFTP upload read each browser `File` into an `ArrayBuffer`, converted it to base64, and sent it to the backend, where it was decoded into another byte slice.
 #### Evidence
 The fixed code adds:
 - 5 MiB cap for plain profile JSON import.
 - 10 MiB cap for encrypted `.nexus` import files.
 - 25 MiB frontend and backend caps for inline drag-drop SFTP uploads.
 Regression tests cover oversized plain import, encrypted import, and backend upload payload rejection.
 #### Attack Scenario
 A user drops or imports a very large crafted file. Before the fix, the renderer and backend could allocate multiple full copies, causing high memory pressure or an app crash.
 #### Impact
 Local denial of service against the desktop application.
 #### Recommendation
 Keep bounded inline payload paths and prefer streaming APIs for larger transfers. The existing native SFTP upload path streams local files and should remain the recommended path for large uploads.
 #### Safer Example
 Implemented size checks before decode/read where practical:
 - `base64.StdEncoding.DecodedLen` guard before decoding drag-drop upload payloads.
 - `os.Stat` size check before encrypted import `os.ReadFile`.
 #### Suggested Tests
 Implemented:
 - `TestImportProfilesRejectsOversizedJSON`.
 - `TestDecryptRejectsOversizedFile`.
 - `TestSFTPUploadDataRejectsOversizedPayloadBeforeSessionLookup`.
 #### References
 - CWE-400: Uncontrolled Resource Consumption.
 - OWASP ASVS 12.4: file and resource limits.
 #### Assumptions / Limitations
 The caps are conservative application-level limits. Larger profile bundles or drag-drop uploads now require a streaming implementation or the existing native SFTP upload flow.
 ### Finding ID: SEC-20260615-003
 #### Title
 Dropped filenames were rendered through `innerHTML`
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `frontend/src/js/terminal.js`, file-drop modal, lines 720-742.
 #### Description
 The file-drop modal interpolated the dropped filename into an `innerHTML` template. Local files can have names containing HTML metacharacters. In a Wails desktop app, DOM script execution is higher impact than a normal static page because the renderer can call privileged Wails APIs.
 #### Evidence
 The fixed modal escapes the file-drop title with `escapeHtml(title)` before injecting it into the template.
 #### Attack Scenario
 A user downloads or receives a file with a crafted name such as an HTML tag with an event handler, then drops it into a terminal. Before the fix, the modal could parse the filename as markup.
 #### Impact
 Potential renderer-side script execution and access to Wails-bound APIs from malicious DOM content.
 #### Recommendation
 Do not put user-controlled strings into `innerHTML`. Use `textContent` or escape before insertion.
 #### Safer Example
 Implemented `escapeHtml(title)` in the file-drop modal.
 #### Suggested Tests
 Add a frontend interaction test that drops a file named with `<img ...>`-style metacharacters and asserts the modal text is rendered literally. Manual Wails/browser verification was not run in this audit.
 #### References
 - CWE-79: Improper Neutralization of Input During Web Page Generation.
 - OWASP ASVS 5.3: output encoding.
 #### Assumptions / Limitations
 This fix covers the reviewed file-drop title sink. Other `innerHTML` templates were spot-checked; future work should add an automated DOM-sink lint or test pass.
 ### Finding ID: SEC-20260615-004
 #### Title
 Unused SSH helper still defaulted to insecure host-key verification
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/sshclient/sshclient.go`, `Connect`, lines 72-75.
 - `internal/sshclient/sshclient_test.go`, regression test, lines 12-19.
 #### Description
 Current production session code uses explicit host-key callbacks, and no remaining reviewed SSH/VNC path calls `ssh.InsecureIgnoreHostKey`. However, the internal `sshclient.Connect` helper still defaulted to an insecure host-key callback. That made future misuse easy.
 #### Evidence
 The helper now fails closed and instructs callers to use `ConnectWithHostKeyCallback`. `rg` found no remaining `InsecureIgnoreHostKey` references after the change.
 #### Attack Scenario
 A future feature calls the convenience method instead of `ConnectWithHostKeyCallback`. Before the fix, that new path would silently accept any SSH host key.
 #### Impact
 Potential SSH machine-in-the-middle exposure if the helper were reused.
 #### Recommendation
 Keep host-key policy explicit on every SSH path. Do not provide insecure convenience APIs in internal packages.
 #### Safer Example
 Implemented: `Connect` returns `sshclient: host key callback is required`.
 #### Suggested Tests
 Implemented `TestConnectRequiresHostKeyCallback`.
 #### References
 - CWE-295: Improper Certificate Validation, analogous to SSH host-key validation.
 - OWASP ASVS 9.1.2: server authenticity validation.
 #### Assumptions / Limitations
 This is a preventive fix. The reviewed production paths already used explicit callbacks.
 ### Finding ID: SEC-20260615-005
 #### Title
 Dependency advisories affected `esbuild` and required `x/net` module versions
 #### Severity
 High
 #### Confidence
 High
 #### Affected Files / Components
 - `frontend/package.json`, `esbuild`, line 22.
 - `frontend/package-lock.json`, `esbuild` and platform packages.
 - `go.mod`, `golang.org/x/net`, line 15.
 - `go.sum`.
 #### Description
 `npm audit` reported `esbuild 0.28.0` affected by a high-severity advisory and a low-severity advisory. `govulncheck -show verbose` reported six vulnerabilities in required `golang.org/x/net v0.54.0` modules, though no reachable symbols were called by this code.
 #### Evidence
 The fixed versions are:
 - `esbuild` bumped to `^0.28.1`.
 - `golang.org/x/net` bumped to `v0.55.0`.
 Post-fix `npm audit --json` reports zero vulnerabilities and `govulncheck` reports `No vulnerabilities found.`
 #### Attack Scenario
 For `esbuild`, a compromised or manipulated package installation environment could exploit known build-tool weaknesses. For `x/net`, future code changes could start calling vulnerable symbols if the module stayed on an affected version.
 #### Impact
 Supply-chain compromise risk during build/development and latent dependency risk.
 #### Recommendation
 Keep audited dependency patch versions current and include `npm audit` and `govulncheck` in regular release checks.
 #### Safer Example
 Implemented package/module upgrades and lockfile updates.
 #### Suggested Tests
 Implemented verification:
 - `npm audit --json`.
 - `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`.
 - `go test ./...`.
 - `npm run build`.
 #### References
 - CWE-494: Download of Code Without Integrity Check.
 - CWE-1104: Use of Unmaintained Third Party Components.
 - Go vulnerability database advisories for `golang.org/x/net`.
 - GitHub Advisory Database for `esbuild`.
 #### Assumptions / Limitations
 The `x/net` advisories were not reachable before the bump, according to govulncheck. The upgrade removes the latent module-level finding anyway.
 ### Finding ID: SEC-20260615-006
 #### Title
 Release automation installed unpinned build dependencies
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `.github/workflows/release-builds.yml`, Wails and npm install steps, lines 66-70.
 - `release.sh`, Wails and npm install logic, lines 76-99.
 #### Description
 The release workflow installed the Wails CLI with `@latest` and used `npm install` rather than the lockfile-enforcing `npm ci`. Local release scripting also instructed or performed unpinned dependency installation in some paths.
 #### Evidence
 The fixed workflow installs the Wails CLI at the version resolved from `go.mod` and uses `npm ci`. `release.sh` now installs the pinned Wails CLI version from `go.mod` when needed and uses `npm ci` when `frontend/package-lock.json` exists.
 #### Attack Scenario
 A release build runs after a compromised or breaking upstream release, or after lockfile drift. Before the fix, release outputs could include unreviewed dependency changes.
 #### Impact
 Build reproducibility loss and supply-chain risk in release artifacts.
 #### Recommendation
 Use pinned module versions and lockfile-enforced installs in CI/release paths.
 #### Safer Example
 Implemented:
 - `go install ...@$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v2)`.
 - `npm ci` in CI and release script.
 #### Suggested Tests
 Implemented:
 - `bash -n build.sh release.sh`.
 - Frontend build after `npm ci`.
 #### References
 - SLSA build integrity principles.
 - CWE-494.
 #### Assumptions / Limitations
 The workflow still allows network dependency retrieval during CI. Stronger controls would include dependency caching, provenance, and artifact signing.
 ### Finding ID: SEC-20260615-007
 #### Title
 Direct VNC remains unencrypted when SSH tunnelling is disabled
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/sessions/manager.go`, direct VNC branch, lines 1012-1062.
 - `internal/vncclient/vncclient.go`, direct TCP dial, lines 139-144.
 #### Description
 When VNC SSH tunnelling is disabled, the client makes a direct TCP VNC connection. Classic VNC deployments often provide weak or no transport encryption.
 #### Evidence
 The VNC client intentionally supports both SSH-tunnelled and direct modes. The direct branch uses `net.DialTimeout` to the VNC address.
 #### Attack Scenario
 A user connects directly to VNC over an untrusted network. A network attacker observes or tampers with remote desktop traffic, depending on the VNC server's negotiated security type.
 #### Impact
 Potential confidentiality and integrity loss for remote desktop sessions.
 #### Recommendation
 Keep direct VNC available for trusted networks, but clearly warn users when SSH tunnelling is disabled and consider requiring explicit confirmation for saved direct-VNC profiles.
 #### Safer Example
 Prefer enabling `vnc.sshTunnel` and verifying the SSH host key for the tunnel host.
 #### Suggested Tests
 Add a UI test that direct VNC profiles show a warning, and an integration test that tunnelled VNC requires a host-key callback.
 #### References
 - OWASP ASVS 9.1: secure channel requirements.
 #### Assumptions / Limitations
 This was not changed in this run because direct VNC can be a deliberate user choice for isolated networks.
 ## 8. Blackhat-Style Abuse Paths
 Path A: malicious profile import to token exfiltration, now blocked.
 1. Provide a profile bundle with a GitHub API base URL pointing to attacker infrastructure.
 2. User imports and connects.
 3. App prompts for or retrieves a token and sends it to the configured endpoint.
 4. Defensive breakpoints now added: profile validation, HTTPS requirement for remote GitHub APIs, import validation before storage.
 Path B: crafted dropped filename to renderer script execution, now blocked.
 1. User receives a file with HTML metacharacters in the filename.
 2. User drops it into a terminal.
 3. Filename is rendered in the file-drop modal.
 4. Defensive breakpoint now added: title is escaped before `innerHTML` insertion.
 Path C: oversized file to app memory exhaustion, now blocked for reviewed inline paths.
 1. User imports or drops an extremely large file.
 2. Renderer/backend allocate full file contents and base64 copies.
 3. App becomes slow or crashes.
 4. Defensive breakpoints now added: import and inline upload size caps.
 Path D: direct VNC over hostile network, still open by design.
 1. User disables SSH tunnel and connects to a VNC server over an untrusted network.
 2. Network attacker observes/tampers with VNC traffic if protocol security is weak.
 3. Defensive breakpoint: use SSH tunnel; future UI warning recommended.
 ## 9. Denial-of-Service Review
 Fixed DoS controls:
 - Plain profile import now rejects payloads over 5 MiB.
 - Encrypted profile import now rejects files over 10 MiB before `os.ReadFile`.
 - Drag-drop SFTP upload now rejects files over 25 MiB in the frontend and backend before base64 decode.
 - Null profile entries no longer panic import paths.
 Checked and not found:
 - SQL queries use parameters for profile and audit operations reviewed.
 - GitHub repo fetch has timeouts and caps repository listing at 5000 repos.
 - SSH/Telnet/RAW connection setup uses dial timeouts.
 - VNC local proxy binds to loopback and uses a per-session token in the current code.
 Residual DoS risks:
 - RAW session history and terminal recordings can grow with long sessions.
 - SFTP directory listing still depends on remote server behavior and could return very large directories.
 - Direct VNC proxy bridges long-lived streams by design.
 ## 10. Dependency and Supply-Chain Review
 Fixed:
 - `esbuild` upgraded to `^0.28.1`; `npm audit --json` now reports zero vulnerabilities.
 - `golang.org/x/net` upgraded to `v0.55.0`; govulncheck now reports no vulnerabilities.
 - Release workflow uses `npm ci` and pinned Wails CLI version.
 - `release.sh` uses `npm ci` when a lockfile exists and installs the Wails CLI at the version from `go.mod`.
 Checked:
 - `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`.
 - `.github/workflows/release-builds.yml`, `build.sh`, `release.sh`.
 Notes:
 - npm warns that `xterm` packages are deprecated in favor of the newer `@xterm/*` packages. That is not an active vulnerability from `npm audit`, but it is a maintenance risk.
 ## 11. Secrets and Sensitive Data Review
 Checked:
 - Repository search for private key markers, common cloud tokens, GitHub token prefixes, and obvious password assignments.
 - Secret store uses AES-GCM with Argon2id-derived keys and writes vault data with `0600`.
 - Profile export redacts inline SSH proxy/TOTP secrets when non-secret export mode is used.
 No high-confidence committed secrets or private keys were found.
 Residual notes:
 - GitHub and remote connection tokens are still available to the running app process by design.
 - Audit logging should continue to avoid logging raw secrets; reviewed audit messages do not include secret values.
 ## 12. Authentication and Authorisation Review
 This is a desktop app, so there are no multi-user server authz roles in the reviewed code.
 Checked/fixed:
 - SSH host-key bypass helper removed by making `sshclient.Connect` fail closed.
 - Current SSH and VNC tunnel paths use explicit host-key callbacks.
 - GitHub API base URL validation now reduces token leakage to remote HTTP endpoints.
 Residual:
 - Users can still choose insecure protocols/modes such as direct VNC or legacy Telnet/RAW TCP.
 ## 13. Input Validation and Output Encoding Review
 Fixed:
 - API create/update now validates profiles before persistence.
 - Plain and encrypted import validate every profile before storage.
 - GitHub API URLs now require HTTPS except loopback and reject URL credentials.
 - VNC validation supports VNC-specific host fallback and validates tunnel fields.
 - File-drop filename is escaped before template insertion.
 Checked:
 - SSH key management already rejects path traversal key names with alphanumeric, hyphen, and underscore constraints.
 - SFTP dropped filenames use `filepath.Base` before remote path construction.
 ## 14. Frontend HTML/JavaScript Robustness Review
 Fixed:
 - File-drop modal filename sink now uses `escapeHtml`.
 - Drag-drop upload rejects files over 25 MiB before FileReader allocation.
 Checked:
 - Notifications render messages with `textContent`.
 - GitHub repository card fields reviewed use `textContent` or escaping for remote metadata.
 Not fully exercised:
 - No live Wails UI/browser automation was run in this audit. Add frontend interaction tests for file-drop, import/export, and update UI in future work.
 ## 15. Infrastructure and Deployment Review
 Fixed:
 - GitHub Actions release workflow now uses pinned Wails CLI and `npm ci`.
 - Local `release.sh` now uses pinned Wails CLI and `npm ci`.
 Checked:
 - No Docker, Kubernetes, Terraform, or cloud deployment config was present in the reviewed file list.
 - Wails config was reviewed for frontend build/install commands.
 Residual:
 - Release artifacts are not signed/notarized in the reviewed workflow.
 - CI workflow has `contents: write`, required for release attachment, but should remain limited to release jobs.
 ## 16. Logging, Monitoring, and Error Handling Review
 Checked:
 - Audit log records profile changes, import/export counts, connects/disconnects, and secret access without raw secret values.
 - Fixed import validation returns actionable errors rather than panics.
 - Frontend upload errors now surface a user-safe oversized-file message.
 Residual:
 - Some protocol errors are emitted directly to the UI. Continue avoiding credentials in error strings from remote services.
 - Consider adding structured debug logs for rejected imports without dumping payloads.
 ## 17. Test Coverage and Security Regression Gaps
 Added/updated tests:
 - API rejects unsafe GitHub base URL.
 - API rejects null and oversized imports.
 - API rejects oversized inline SFTP upload before session lookup.
 - Export/import rejects oversized encrypted files.
 - Storage import rejects null profile entries and invalid strategy before looping.
 - Validation covers GitHub URL and VNC host/tunnel cases.
 - SSH client `Connect` requires explicit host-key callback.
 Remaining gaps:
 - Browser/Wails interaction tests for file-drop XSS and upload cap.
 - Load tests for very large SFTP directories, RAW history, and recordings.
 - End-to-end import/export tests through the actual Wails UI.
 - Release workflow provenance/signing tests.
 ## 18. Prioritised Remediation Plan
 Immediate:
 - Keep the fixed tests in CI.
 - Add `npm audit` and govulncheck to CI if not already present.
 - Warn users when saving or connecting direct VNC profiles without SSH tunnelling.
 Short-term:
 - Replace deprecated `xterm` packages with maintained `@xterm/*` packages.
 - Add frontend tests for DOM injection via filenames and imported profile metadata.
 - Add streaming drag-drop upload support or route large drops through the native file upload path.
 Medium-term:
 - Add release artifact signing/notarization and checksums with provenance.
 - Add application-level limits for RAW history, terminal recording size, SFTP listing size, and GitHub error body reads.
 Long-term:
 - Add a security-focused CI job: tests, `npm audit`, govulncheck, secret scanning, and static DOM-sink checks.
 - Introduce a profile schema version and migration/normalization layer for imports.
 ## 19. False Positives / Needs Manual Verification
 - `govulncheck -show verbose` initially reported module-level `x/net` advisories that were not reachable. The module was still upgraded to remove latent risk.
 - Direct VNC is intentionally supported; risk depends on network trust and VNC server security type.
 - File-drop XSS was fixed by code inspection; manual Wails UI verification should still be added.
 - No live external service testing was performed.
 ## 20. Final Notes
 The repo is in a materially better state after this run: profile data is validated before storage, local resource-consumption paths are bounded, the file-drop DOM sink is escaped, dependency scanners are clean, and release dependency installation is more reproducible.
 The main residual security posture issue is user-selected insecure connectivity: Telnet/RAW/direct VNC remain useful but should be presented with clear safety context.
@@ -0,0 +1,81 @@
 # Functionality and Next Steps Report
 ## 1. Executive Summary
 This fix pass moves Nexus closer to predictable large-file behavior: file-backed Leviathan documents stay file-backed for save/export, recordings parse incrementally, and unavoidable in-memory parsers now advertise and enforce clear limits.
 The most useful next work is to surface these limits in the Leviathan UI and add user-facing guidance when an operation needs a smaller selection or a streaming implementation.
 ## 2. Current Functional Risks
 Leviathan spectrogram conversion still uses bounded in-memory audio/image buffers because the current encoder/decoder APIs operate on byte slices. Very large images, MP3s, WAVs, or decoded MP3 output will now be rejected with an error rather than processed.
 PDF, certificate, and key scanners still operate on bounded whole-document buffers for structural parsing. The cap avoids memory denial of service, but users working with very large firmware or document corpora may need range-based scans in future.
 Recording playback is now line-streamed, but the returned API shape still collects parsed events before sending them to the frontend. Very long recordings are still protected by the playback cap; true progressive playback would require an API contract change.
 ## 3. Code Quality Improvements Completed
 Chunk-first behavior:
 - Leviathan working-copy save now writes with `Document.ForEachChunk`.
 - Leviathan case export now streams `working.bin` into the zip file on disk.
 - Recording playback parses line-by-line instead of reading and splitting the whole file.
 Bounded read behavior:
 - Spectrogram image/audio inputs reject oversize data before decode.
 - Image decode checks dimensions before allocating decoded pixels.
 - HTTP response helpers cap JSON and error bodies.
 - SSH key, VNC key, vault, public-key, PDF, and BinSnoop file reads have explicit limits.
 Responsiveness:
 - Heavy Leviathan spectrogram/export operations no longer hold the engine lock while processing or showing native save dialogs.
 ## 4. Frontend Interaction and Error Handling
 Recommended UI follow-up:
 - Show limit-aware messages for spectrogram tools, such as image max size, audio max size, and decoded image dimension limits.
 - For PDF/cert/key tools, show “scan a smaller file or selected range” guidance when caps are hit.
 - Add a small status line in Leviathan for whether an operation is streaming, bounded-buffer, or selection-based.
 - For recording playback, consider progressive playback loading so long recordings do not need all parsed events returned at once.
 ## 5. Testing Roadmap
 Completed in this pass:
 - Oversized spectrogram image dimensions are rejected before full decode.
 - Leviathan bounded document reads reject oversize documents.
 - Patched working-file writes preserve changed bytes.
 - Oversized GitHub/update responses are rejected.
 - Oversized SSH public keys, vault files, PDFs, and BinSnoop files are rejected.
 Recommended next tests:
 - Wails UI tests for Leviathan oversized image/audio/PDF error messages.
 - A case-export test that opens a sparse file-backed document and verifies the zip is produced without materializing `working.bin`.
 - A recording playback test with malformed lines and a long valid event stream.
 - Browser interaction tests for the Leviathan tab while a long analysis is running.
 ## 6. Recommended New Functionality
 Add range-based versions of whole-document Leviathan tools:
 - `keys.scanRange`
 - `certs.scanRange`
 - `pdf.quickScan` for headers/xref/trailer without full structural recovery
 - `spectrogram.renderRange` for selected audio windows
 Add streaming media support later:
 - Decode audio from file/range readers instead of complete byte slices.
 - Stream WAV output directly to disk for spectrogram generation.
 - Stream image insertion output to disk when carrier audio is large.
 ## 7. Caveats
 The new caps trade permissiveness for stability. Files above the limits now fail fast instead of attempting best-effort processing.
 The frontend build and regression checks passed, but I did not run a packaged Wails app manually in this pass.
@@ -0,0 +1,135 @@
 # Security Audit Report
 ## 1. Executive Summary
 This fix-mode audit focused on file-reading and response-reading paths that could allocate complete files or unbounded remote bodies in memory.
 The main risk fixed was local denial of service from large user-selected files, imported Leviathan artefacts, recordings, SSH key files, vault files, and remote update/GitHub API responses. Where the codebase already had a chunked document model, saves and exports now use it. Where a parser still requires a complete byte slice, the code now rejects oversized inputs before allocation.
 Verification passed with targeted package tests, `go test ./...`, frontend regression tests, frontend build, and `git diff --check`.
 ## 2. Scope Reviewed
 Reviewed and changed:
 - Leviathan file-backed document save, case export, spectrogram image/audio conversion, PDF parsing, and BinSnoop file helpers.
 - Wails API helpers that read SSH public keys and Leviathan image/audio inputs.
 - SSH and VNC tunnel private-key loading.
 - GitHub client and update-checker HTTP response handling.
 - Recording playback parsing.
 - Encrypted secrets vault loading.
 Not live-tested:
 - A packaged Wails desktop binary.
 - Real remote SSH/VNC/GitHub endpoints.
 - Very large real-world media corpora beyond automated guard tests.
 ## 3. Methodology
 I searched for `ReadFile`, `ReadAll`, and whole-document `Range(0, size)` patterns, then classified each as chunked, bounded, embedded/test-only, or unsafe. Fixes were kept to low-risk local changes:
 - Prefer `Document.ForEachChunk` for writing/exporting working file bytes.
 - Stream line-oriented recordings with `bufio.Scanner`.
 - Limit HTTP response reads with `io.LimitReader`.
 - Add `os.Stat` size checks before unavoidable bounded `os.ReadFile` calls.
 - Add parser-specific caps before whole-document reads.
 ## 4. Findings Summary
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---:|---:|---|---|---|
 | SEC-20260616-001 | Medium | High | Leviathan save/export and spectrogram tools could materialize large files | Leviathan API, spectrogram | Fixed |
 | SEC-20260616-002 | Medium | High | Remote API/update responses were read without size limits | GitHub client, updater | Fixed |
 | SEC-20260616-003 | Medium | High | Local app data/key reads lacked size caps | SSH keys, VNC keys, vault, BinSnoop | Fixed |
 | SEC-20260616-004 | Low | High | Recording playback loaded the whole capped recording file | Recording playback | Fixed |
 | SEC-20260616-005 | Low | Medium | Some parsers still require complete bounded buffers | PDF, cert/key scanners, media decoders | Accepted with caps |
 ## 5. Detailed Findings
 ### SEC-20260616-001: Leviathan full-file allocation paths
 Leviathan save/export and spectrogram operations could duplicate entire working files in memory. Case export also built the zip archive in memory before writing it.
 Fixed in:
 - `internal/api/leviathan.go`
 - `internal/leviathan/spectrogram/spectrogram.go`
 - `internal/leviathan/pdf/pdf.go`
 Changes:
 - Working-copy save writes via `Document.ForEachChunk`.
 - Case export streams `working.bin` directly into `zip.Writer` backed by the destination file.
 - Spectrogram encode/view/insert rejects oversized image/audio documents before bounded decode.
 - Image decoding checks compressed byte size and decoded pixel dimensions before full image decode.
 - PDF parsing rejects files above 128 MiB before whole-document structural parsing.
 - Long-running spectrogram/export tools no longer hold the Leviathan engine lock while doing heavy work or native save dialogs.
 ### SEC-20260616-002: Unbounded remote response reads
 GitHub and update-check response bodies could be read without an explicit maximum.
 Fixed in:
 - `internal/githubclient/githubclient.go`
 - `internal/updater/updater.go`
 Changes:
 - GitHub JSON responses are capped at 4 MiB.
 - GitHub error bodies are capped at 64 KiB.
 - Update release/manifest responses are capped at 1 MiB.
 - Repository archive downloads continue to stream to disk instead of memory.
 ### SEC-20260616-003: Local key/vault/helper reads lacked caps
 Several local helper paths read files directly even though the expected files are small.
 Fixed in:
 - `internal/api/api.go`
 - `internal/sshclient/sshclient.go`
 - `internal/sessions/manager.go`
 - `internal/secrets/secrets.go`
 - `internal/leviathan/binsnoop/common.go`
 - `internal/leviathan/binsnoop/binsnoop.go`
 Changes:
 - SSH public keys are capped at 64 KiB.
 - SSH private keys for SSH and VNC tunnel auth are capped at 1 MiB.
 - Secret vault files are capped at 10 MiB.
 - BinSnoop direct file helpers are capped at 64 MiB; the UI path already uses a bounded buffer.
 ### SEC-20260616-004: Recording playback whole-file read
 Recording playback had a 100 MiB file cap, but still read and split the full file in memory.
 Fixed in:
 - `internal/recording/recorder.go`
 Changes:
 - Playback now opens the recording and scans line-by-line.
 - Individual playback lines are capped at 8 MiB.
 - Existing malformed-event tolerance is preserved.
 ## 6. Residual Risk
 Some operations still need bounded complete buffers because downstream parsers or decoders require byte slices: image/audio spectrogram conversion, PDF structural parsing, certificate/key scanning, and small SSH/vault/public-key parsing. These now fail before allocation when inputs exceed explicit caps.
 Truly streaming versions of every binary parser would be a larger Leviathan architecture project. The current fixes remove the unbounded allocation behavior while preserving tool behavior for normal files.
 ## 7. Verification
 Passed:
 - `go test ./internal/api ./internal/leviathan/spectrogram ./internal/leviathan/pdf ./internal/leviathan/binsnoop ./internal/updater ./internal/githubclient ./internal/secrets ./internal/recording ./internal/sshclient ./internal/sessions -count=1`
 - `go test ./... -count=1`
 - `npm --prefix frontend test`
 - `npm --prefix frontend run build`
 - `git diff --check`
 New tests cover oversized GitHub/update bodies, oversized spectrogram images, bounded Leviathan document reads, chunked patched-file writes, oversized public keys, oversized vault files, oversized PDFs, and BinSnoop file caps.
@@ -0,0 +1,138 @@
 # Functionality and Next Steps Report
 ## 1. Executive Summary
 This fix pass improved robustness around local proxying, file imports, remote downloads, SSH key management, and frontend rendering. The app now fails earlier and more predictably when inputs are malformed or too large.
 Highest-impact next steps:
 - Manually verify packaged VNC connections after the new Origin allowlist.
 - Add UI copy for newly enforced limits.
 - Add CI coverage for the security checks run in this pass.
 - Continue frontend cleanup around dynamic `innerHTML`.
 ## 2. Current Functional Risks
 VNC runtime compatibility:
 - The backend now allows missing, `wails://`, and loopback HTTP(S) origins. This should work for Wails/noVNC, but packaged app validation is still needed.
 Large-file and large-download behavior:
 - GitHub archive downloads now stop at 2 GiB. Very large repositories will fail fast.
 - SSH config imports now reject files above 5 MiB or more than 5000 Host blocks.
 SSH key generation:
 - RSA key generation is limited to 2048, 3072, and 4096 bits and times out after 30 seconds.
 - Slow systems should be checked with RSA 4096 to ensure the timeout is not too tight.
 Frontend:
 - SSH key manager dynamic rendering is safer. Other static `innerHTML` templates remain and should be reviewed when they take dynamic data.
 ## 3. Code Quality Improvements
 Completed:
 - Added focused helper functions for VNC Origin validation.
 - Centralized GitHub endpoint construction and owner/repo parsing.
 - Added reusable archive stream limiting.
 - Added backend SSH key generation option validation.
 - Added import bounds to the SSH config parser.
 - Replaced SSH key manager dynamic modal HTML with DOM construction.
 Recommended refactors:
 - Move file-size and stream-size caps into named settings or a shared limits package if more subsystems need them.
 - Add a small frontend helper for safe modal construction so feature code stops hand-rolling modal `innerHTML`.
 - Consider a common backend "safe basename" helper for local and remote file operations.
 ## 4. Frontend Interaction and Error-Handling Improvements
 Recommended:
 - Show a specific VNC connection error if the proxy rejects an unexpected Origin in packaged builds.
 - Show clear messages for SSH config files that exceed size or Host-block limits.
 - Show clear messages for GitHub archives above the cap.
 - Add a hostile-filename E2E test for the SSH key delete confirmation modal.
 - Continue converting dynamic modal content to DOM nodes or `textContent`.
 ## 5. Testing Roadmap
 Added in this pass:
 - VNC Origin allowlist tests.
 - SFTP upload parent-directory rejection tests.
 - SSH config file and Host-block limit tests.
 - SSH key generation option validation tests.
 - GitHub path escaping and archive cap tests.
 - Frontend regression checks for SSH key manager text rendering.
 Next tests:
 - Packaged Wails VNC smoke test on macOS, Windows, and Linux.
 - Browser/E2E test for SSH key filenames containing `<`, `>`, quotes, and ampersands.
 - HTTP integration test for GitHub archive download caps and escaped branch refs.
 - UI tests for limit-aware error messages.
 - CI job that runs Go tests, frontend tests, frontend build, `npm audit --omit=dev`, `govulncheck`, and `git diff --check`.
 ## 6. Recommended New Functionality
 Useful additions:
 - Preferences for maximum GitHub archive download size.
 - A pre-download confirmation for large GitHub archives when Content-Length is known.
 - Import preview for OpenSSH config showing Host count before persistence.
 - A diagnostics panel for VNC proxy status, including local URL redaction, Origin decisions, and connection state.
 - A unified "Limits" help page that lists SFTP upload caps, GitHub archive cap, SSH config import cap, and Leviathan file caps.
 ## 7. Next-Level Opportunities
 Architecture:
 - Centralize resource limits and expose them to both Go and frontend UI copy.
 - Add a secure modal builder and migrate risky frontend dialogs gradually.
 - Add structured security regression tests for every Wails method that accepts file paths, filenames, URLs, or base64 payloads.
 Operations:
 - Generate checksums for release artifacts.
 - Generate an SBOM during release.
 - Publish a short security hardening checklist in `docs/build-and-release.md`.
 Developer experience:
 - Add a `make security-check` target that runs the same commands used in this audit.
 - Add pre-commit or CI checks for `gofmt`, `go test`, frontend regression tests, and `git diff --check`.
 ## 8. Prioritised Action Plan
 Immediate:
 - Manually test packaged VNC on all supported platforms.
 - Keep the security patch tests in CI before release.
 Short-term:
 - Add user-facing messages for the new SSH config, GitHub archive, and SSH keygen limits.
 - Add E2E coverage for hostile SSH key filenames.
 - Add an HTTP test around GitHub archive download behavior.
 Medium-term:
 - Centralize app resource limits and expose them to UI/help.
 - Migrate high-risk frontend dynamic HTML patterns to safe modal helpers.
 - Add release checksums and SBOM generation.
 Long-term:
 - Add progressive/streaming UX for large GitHub and SFTP transfers.
 - Build a cross-platform packaged-app smoke test suite for Wails integrations.
 ## 9. Caveats and Validation Needed
 - VNC Origin compatibility must be validated in packaged builds, not only unit tests.
 - The 2 GiB GitHub archive cap may need product tuning for users with very large repositories.
 - RSA 4096 key generation timeout should be checked on lower-powered machines.
 - The frontend build passed, but this pass did not interactively click through the SSH key modal in a real browser/WebView.
@@ -0,0 +1,641 @@
 # Security Audit Report
 ## 1. Executive Summary
 This fix-mode audit reviewed the Wails API surface, local proxy behavior, file import paths, SSH key management, GitHub integration, frontend DOM sinks, dependency manifests, tests, and release workflow.
 Six concrete issues were fixed:
 - The local VNC WebSocket proxy accepted any browser `Origin` and did not cap client-to-proxy WebSocket message size.
 - SFTP browser uploads accepted the special filename `..`, allowing a Wails caller to escape the selected remote directory when the name was joined.
 - SSH config import parsed line-by-line but had no total file or Host-block cap.
 - Backend SSH key generation trusted caller-supplied key type and RSA bit count and had no process timeout.
 - GitHub repo/ref values were interpolated into API paths without escaping, and archive downloads had no explicit stream cap.
 - SSH key manager UI interpolated backend errors and filesystem-derived key names into `innerHTML`.
 Verification passed with targeted Go tests, full Go tests, frontend regression checks, frontend build, `npm audit --omit=dev`, `govulncheck`, and `git diff --check`.
 ## 2. Scope Reviewed
 Reviewed:
 - Go backend packages under `internal/`: API bindings, VNC proxy, GitHub client, SSH config import, SSH key management, SFTP upload helpers, validation, sessions, storage, secrets, updater, recording, Leviathan parser bounds, and tests.
 - Browser-facing JavaScript under `frontend/src/js`, especially SSH key management, SFTP upload flows, VNC integration, and dynamic HTML usage.
 - Frontend package manifest, lockfile, build scripts, and regression script.
 - Go module dependencies and reachable vulnerability state.
 - GitHub Actions release workflow.
 Not fully live-tested:
 - A packaged Wails desktop binary.
 - Real noVNC connections inside the packaged WebView after the new Origin policy.
 - Real GitHub Enterprise archive downloads above normal repository sizes.
 ## 3. Methodology
 The review used static analysis, targeted source searches, dependency/advisory tooling, and focused regression tests. I mapped attacker-controlled inputs from the renderer and local files into Go methods, network clients, local HTTP/WebSocket services, subprocesses, remote SFTP paths, and DOM sinks. I prioritized issues that could be fixed with small behavior-preserving changes and backed by tests.
 Commands run:
 - `go test ./internal/vncclient ./internal/api ./internal/sshconfig ./internal/githubclient -count=1`
 - `npm --prefix frontend test`
 - `git diff --check`
 - `go test ./... -count=1`
 - `npm --prefix frontend run build`
 - `npm --prefix frontend audit --omit=dev`
 - `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`
 ## 4. Risk Rating Method
 Severity reflects exploit prerequisite, affected trust boundary, likely impact, and availability/confidentiality/integrity outcome:
 - Critical: remote unauthenticated compromise or secret disclosure.
 - High: practical compromise of credentials, host access, or arbitrary code execution.
 - Medium: meaningful local, renderer, remote service, or connected-server abuse with realistic prerequisites.
 - Low: local robustness issues, bounded DoS, or defense-in-depth gaps.
 - Informational: observations and hardening opportunities.
 Confidence reflects direct code evidence and testability. Findings fixed here are High confidence because they map to concrete files and new regression tests.
 ## 5. Attack Surface Map
 Entry points:
 - Wails-bound `api.Service` methods callable from the renderer.
 - Local VNC WebSocket proxy bound to `127.0.0.1` on a random port and random token path.
 - SSH, Telnet, RAW TCP, VNC, SFTP, GitHub, updater, and Leviathan binary-analysis workflows.
 - Profile import/export, encrypted `.nexus` import, OpenSSH config import, recording playback, SSH key generation/deletion, and drag/drop upload flows.
 Trust boundaries:
 - Renderer to Go backend.
 - Local browser/WebView to loopback VNC proxy.
 - Local filesystem files selected or scanned by the app.
 - Remote SSH/SFTP/VNC/GitHub/update endpoints.
 - OS keychain/encrypted vault to profile storage and session runtime.
 Attacker starting positions considered:
 - Malicious local webpage attempting loopback WebSocket access.
 - Malicious or compromised renderer script.
 - Malicious local filename or selected config/import file.
 - Malicious GitHub Enterprise/API endpoint or unusual repo/ref metadata.
 - Malicious connected SSH/SFTP/VNC host.
 ## 6. Findings Summary Table
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---|---|---|---|---|
 | SEC-20260616-1702-001 | Medium | High | VNC proxy allowed all origins and uncapped WebSocket frames | `internal/vncclient` | Fixed |
 | SEC-20260616-1702-002 | Medium | High | SFTP upload name `..` escaped selected remote directory | `internal/api` SFTP upload helpers | Fixed |
 | SEC-20260616-1702-003 | Low | High | SSH config import lacked total file and Host-block bounds | `internal/sshconfig` | Fixed |
 | SEC-20260616-1702-004 | Low | High | SSH key generation allowed expensive caller-controlled options without timeout | `internal/api` SSH key management | Fixed |
 | SEC-20260616-1702-005 | Medium | High | GitHub repo/ref path interpolation and uncapped archive stream | `internal/githubclient` | Fixed |
 | SEC-20260616-1702-006 | Medium | High | SSH key manager rendered key names/errors through dynamic `innerHTML` | `frontend/src/js/sshkeys.js` | Fixed |
 ## 7. Detailed Findings
 ### Finding ID: SEC-20260616-1702-001
 #### Title
 VNC proxy allowed all origins and uncapped WebSocket frames
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/vncclient/vncclient.go`
 - `internal/vncclient/vncclient_test.go`
 - Local noVNC WebSocket proxy
 #### Description
 The VNC proxy was bound to loopback and protected by a random token path, but its Gorilla WebSocket upgrader accepted every `Origin`. It also read WebSocket messages without an explicit message size limit. If a proxy URL token leaked through logs, UI state, injected renderer code, or another local channel, a non-local browser origin could attempt to drive the active VNC TCP connection or send oversized frames that force memory allocation.
 #### Evidence
 Before the fix, `websocket.Upgrader.CheckOrigin` returned `true` for every request, and the proxy called `ws.ReadMessage()` without `SetReadLimit`.
 #### Attack Scenario
 A malicious local webpage or injected renderer script obtains an active `ws://127.0.0.1:<port>/<token>` URL. Because all origins were accepted, it could connect from a non-app origin and send very large WebSocket messages or VNC protocol bytes into the bridged TCP connection.
 #### Impact
 Potential local cross-origin abuse of active VNC sessions if the token is exposed, and avoidable memory pressure from oversized client-to-proxy WebSocket frames.
 #### Recommendation
 Allow only Wails and loopback browser origins, keep accepting missing origins for non-browser clients, and cap inbound WebSocket message size.
 #### Safer Example
 Implemented `allowProxyOrigin`, `isLoopbackHost`, and `ws.SetReadLimit(maxWebSocketMessageBytes)`.
 #### Suggested Tests
 Added `TestAllowProxyOrigin` for missing, Wails, loopback, remote, lookalike, and malformed origins.
 #### References
 - CWE-346: Origin Validation Error
 - CWE-400: Uncontrolled Resource Consumption
 - OWASP ASVS 14.4: HTTP security configuration
 #### Assumptions / Limitations
 The packaged Wails WebView should be manually tested to confirm its runtime Origin is covered by the `wails://` allow rule.
 ### Finding ID: SEC-20260616-1702-002
 #### Title
 SFTP upload name `..` escaped selected remote directory
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`
 - `internal/api/api_test.go`
 - `SFTPUploadData`
 - `SFTPUploadStart`
 #### Description
 `safeSFTPUploadName` normalized slash variants and used `path.Base`, but did not reject the special basename `..`. `path.Join(remoteDir, "..")` resolves to the parent directory, so a Wails caller could escape the selected upload directory.
 #### Evidence
 The previous rejection covered empty, `.`, `/`, and NUL, but not `..`. The upload methods then used `path.Join(remoteDir, safeName)`.
 #### Attack Scenario
 A malicious renderer call invokes chunked upload with `remoteDir="/home/user/upload"` and `fileName=".."`. The destination path resolves to `/home/user`, outside the selected directory.
 #### Impact
 Unexpected remote writes/truncation attempts outside the user's selected SFTP directory, depending on server permissions and target type.
 #### Recommendation
 Reject `..` after basename normalization.
 #### Safer Example
 Implemented `safeName == ".."` rejection.
 #### Suggested Tests
 Added `TestSafeSFTPUploadNameRejectsParentDirectory`.
 #### References
 - CWE-22: Path Traversal
 - OWASP ASVS 12.3: File path control
 #### Assumptions / Limitations
 The browser `File.name` API normally does not produce `..`, but Wails API methods are still a trust boundary and should validate independently.
 ### Finding ID: SEC-20260616-1702-003
 #### Title
 SSH config import lacked total file and Host-block bounds
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/sshconfig/sshconfig.go`
 - `internal/sshconfig/sshconfig_test.go`
 - `ImportSSHConfig`
 #### Description
 The OpenSSH config parser scanned files line-by-line, but it did not cap total file size or the number of accumulated Host blocks. A very large selected config could allocate a large slice of parsed blocks and profiles.
 #### Evidence
 `ParseFile` opened the file and appended Host blocks to an in-memory slice until EOF.
 #### Attack Scenario
 A user imports a hostile or accidentally huge SSH config containing thousands of Host blocks. The app spends unnecessary CPU and memory parsing and converting entries.
 #### Impact
 Local denial of service or UI unresponsiveness during import.
 #### Recommendation
 Reject oversized config files, set a scanner line cap, and reject excessive Host-block counts.
 #### Safer Example
 Implemented `maxConfigFileBytes`, `maxConfigLineBytes`, and `maxHostBlocks`.
 #### Suggested Tests
 Added oversized-file and excessive-Host-block tests.
 #### References
 - CWE-400: Uncontrolled Resource Consumption
 #### Assumptions / Limitations
 The selected caps are conservative for normal OpenSSH config files. Extremely large enterprise configs may need batch import support later.
 ### Finding ID: SEC-20260616-1702-004
 #### Title
 SSH key generation allowed expensive caller-controlled options without timeout
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go`
 - `internal/api/api_test.go`
 - `GenerateSSHKey`
 #### Description
 The frontend exposes fixed key-type and bit-size choices, but the backend method accepted caller-supplied values directly and ran `ssh-keygen` without a context timeout. A malformed renderer call could request unsupported types or excessive RSA bit sizes, tying up the subprocess.
 #### Evidence
 `GenerateSSHKey` passed `keyType` to `ssh-keygen -t` and only checked `bits > 0` for RSA before adding `-b`.
 #### Attack Scenario
 A malicious renderer call requests a very large RSA key size. `ssh-keygen` consumes CPU for an extended period or fails slowly.
 #### Impact
 Local CPU denial of service and poor recovery if the subprocess hangs.
 #### Recommendation
 Validate allowed key types and RSA sizes server-side, and execute `ssh-keygen` with a timeout.
 #### Safer Example
 Implemented `validateSSHKeyGenerationOptions` and `exec.CommandContext` with a 30 second timeout.
 #### Suggested Tests
 Added validation tests for defaults, RSA defaults, oversized RSA sizes, and unsupported key types.
 #### References
 - CWE-400: Uncontrolled Resource Consumption
 - CWE-20: Improper Input Validation
 #### Assumptions / Limitations
 The timeout is a safety net, not a substitute for platform-level process controls. Real key generation should still be manually tested on slower hardware.
 ### Finding ID: SEC-20260616-1702-005
 #### Title
 GitHub repo/ref path interpolation and uncapped archive stream
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/githubclient/githubclient.go`
 - `internal/githubclient/githubclient_test.go`
 - `FetchLatestCommit`
 - `DownloadRepoArchive`
 #### Description
 Repository full names and refs were interpolated into REST API paths without escaping. The archive download also streamed response bodies to disk without an explicit maximum. A malformed renderer call, unusual branch name, or compromised GitHub Enterprise endpoint could create surprising request paths or consume disk.
 #### Evidence
 The client built paths with `fmt.Sprintf("%s/repos/%s/commits/%s", ...)` and copied archives with `io.Copy(file, resp.Body)`.
 #### Attack Scenario
 A renderer calls archive download with a malformed repo full name containing extra path segments, or a malicious GitHub Enterprise endpoint returns an unbounded archive response.
 #### Impact
 Potential confused API requests using the user's GitHub token and local disk exhaustion from unbounded archive streams.
 #### Recommendation
 Require `owner/repo` format, URL-escape each API path segment, and cap archive streams.
 #### Safer Example
 Implemented `splitRepoFullName`, `endpointURL`, `copyLimitedArchive`, and a 2 GiB archive cap.
 #### Suggested Tests
 Added tests for escaped refs, malformed repo names, archive limit rejection, and at-limit copies.
 #### References
 - CWE-20: Improper Input Validation
 - CWE-22: Path Traversal style path confusion
 - CWE-400: Uncontrolled Resource Consumption
 #### Assumptions / Limitations
 The 2 GiB archive cap may reject unusually large repositories. A future preferences setting could make this user-configurable.
 ### Finding ID: SEC-20260616-1702-006
 #### Title
 SSH key manager rendered key names/errors through dynamic `innerHTML`
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `frontend/src/js/sshkeys.js`
 - `frontend/scripts/test-regressions.js`
 - SSH key manager modal
 #### Description
 The SSH key manager interpolated backend error text and confirmation title/message/button text into `innerHTML`. Key names are derived from local `~/.ssh/*.pub` filenames, so a malicious local filename could inject HTML into the delete confirmation modal.
 #### Evidence
 The previous code used `list.innerHTML = `<div ...>${err}</div>`` and built confirmation modal HTML with `${title}`, `${message}`, and `${confirmLabel}`.
 #### Attack Scenario
 A local attacker creates an SSH public key file with an HTML-like filename. When the user opens the key manager and deletes it, the filename is interpolated into modal HTML.
 #### Impact
 DOM XSS in the Wails renderer, with possible access to app UI actions exposed to the renderer.
 #### Recommendation
 Render dynamic strings with `textContent` or DOM node construction.
 #### Safer Example
 Implemented text-node rendering for key load errors and confirmation modal dynamic text.
 #### Suggested Tests
 Added frontend regression checks to prevent the vulnerable interpolation pattern from returning.
 #### References
 - CWE-79: Cross-Site Scripting
 - OWASP ASVS 5.3: Output encoding
 #### Assumptions / Limitations
 Other static-template `innerHTML` use remains in the frontend and should continue to be reviewed when it accepts dynamic values.
 ## 8. Blackhat-Style Abuse Paths
 Path 1: Token leak to VNC abuse
 - Prerequisite: an active VNC proxy URL leaks to a non-app webpage or injected script.
 - Old path: any Origin could connect and send arbitrary WebSocket frames to the VNC TCP bridge.
 - Breakpoint added: Wails/loopback Origin allowlist plus message cap.
 Path 2: Renderer-to-remote path escape
 - Prerequisite: malicious renderer code or direct Wails call.
 - Old path: call SFTP upload with filename `..`, causing `path.Join(remoteDir, "..")`.
 - Breakpoint added: `..` is rejected after basename normalization.
 Path 3: Local filename to renderer script injection
 - Prerequisite: crafted key filename in `~/.ssh`.
 - Old path: key name appears in confirmation modal HTML.
 - Breakpoint added: key names and errors use `textContent`.
 Path 4: Malicious GitHub Enterprise response to disk pressure
 - Prerequisite: user connects to compromised or malicious API base URL allowed by profile validation.
 - Old path: archive stream was copied until EOF.
 - Breakpoint added: Content-Length precheck and streaming cap.
 ## 9. Denial-of-Service Review
 Fixed resource-control issues:
 - VNC inbound WebSocket message cap.
 - SSH config file size, line size, and Host-block caps.
 - SSH key generation input validation and subprocess timeout.
 - GitHub archive stream cap.
 Previously fixed and rechecked from recent audit context:
 - GitHub/update JSON response caps.
 - Leviathan bounded reads and chunked save/export paths.
 - SFTP inline/chunk upload caps.
 - Secret vault and SSH key file read caps.
 Residual DoS considerations:
 - SFTP directory listings depend on remote server behavior and can still return large lists.
 - GitHub repository enrichment intentionally caps total repositories but still performs concurrent commit lookups.
 - Very large legitimate GitHub archives above 2 GiB now fail fast.
 ## 10. Dependency and Supply-Chain Review
 Results:
 - `npm --prefix frontend audit --omit=dev`: 0 vulnerabilities.
 - `govulncheck ./...`: no vulnerabilities found.
 Reviewed manifests:
 - `go.mod`
 - `go.sum`
 - `frontend/package.json`
 - `frontend/package-lock.json`
 - `.github/workflows/release-builds.yml`
 No high-confidence dependency findings were found in this pass.
 ## 11. Secrets and Sensitive Data Review
 Checked:
 - No obvious private keys, GitHub tokens, cloud keys, or hardcoded credentials were found in source outside documentation/examples.
 - Non-secret profile export redaction was already covered by tests.
 - Secret access logging records secret type, not value.
 - GitHub Authorization headers are set only in HTTP requests and not logged by this code.
 Residual:
 - Plain exports without secrets are safer, but encrypted export remains the recommended path for portable backups.
 - Local audit logs should continue to avoid host/user secrets in future features.
 ## 12. Authentication and Authorisation Review
 This is a local desktop application, so there are no server-side user roles or tenant boundaries. Relevant controls reviewed:
 - SSH host-key callback requirement for VNC SSH tunnels.
 - Known-host storage and verification paths.
 - Secret retrieval via keychain/vault and prompt callbacks.
 - GitHub token validation before repo fetch.
 No missing multi-user authorization checks apply to the current architecture.
 ## 13. Input Validation and Output Encoding Review
 Fixed:
 - SFTP upload basename `..`.
 - SSH key generation key type and RSA bit sizes.
 - GitHub repo full-name format and path segment escaping.
 - SSH key manager dynamic output encoding.
 Previously present controls:
 - Profile validation rejects invalid hosts, ports, secret modes, GitHub HTTP non-loopback base URLs, and malformed protocol configs.
 - Import profiles are size-capped and validated before persistence.
 ## 14. Frontend HTML/JavaScript Robustness Review
 Fixed:
 - SSH key manager load errors now render via `textContent`.
 - SSH key deletion confirmation modal dynamic strings now render via DOM nodes/text.
 - Regression script now checks these patterns.
 Checked:
 - Wails service bridge ordering remains covered by regression checks.
 - SFTP drag/drop upload still uses chunked methods.
 - Direct VNC warning flow remains covered by regression checks.
 Residual:
 - Frontend still contains many static `innerHTML` templates. Future reviews should focus on any template that accepts local filesystem, remote host, profile, update, or GitHub data.
 ## 15. Infrastructure and Deployment Review
 Reviewed:
 - GitHub Actions release workflow.
 - Wails build config.
 - Frontend build scripts.
 No new high-confidence release workflow finding was fixed. The workflow uses pinned major versions for common actions and default GitHub token permissions scoped to release attachment needs.
 Residual:
 - Consider adding checksums/SBOM generation for release artifacts.
 - Consider a CI job for `go test ./...`, frontend regression tests, `npm audit --omit=dev`, and `govulncheck`.
 ## 16. Logging, Monitoring, and Error Handling Review
 Fixed:
 - SSH key manager no longer injects raw error strings into HTML.
 - GitHub malformed repo names now fail before request construction.
 - SSH keygen timeout returns a specific timeout error.
 Checked:
 - Error messages added in this pass do not include tokens, passwords, or key material.
 - Existing audit logger records profile/session actions and secret access metadata.
 ## 17. Test Coverage and Security Regression Gaps
 Added:
 - VNC Origin allowlist tests.
 - SFTP parent-directory upload name tests.
 - SSH key generation option validation tests.
 - SSH config oversized file and Host-block cap tests.
 - GitHub URL escaping, malformed full-name, and archive cap tests.
 - Frontend static regression checks for SSH key manager safe rendering.
 Remaining gaps:
 - No packaged Wails/noVNC integration test for Origin behavior.
 - No E2E browser test for SSH key modal rendering with hostile filenames.
 - No integration test for GitHub archive cap against an HTTP test server.
 ## 18. Prioritised Remediation Plan
 Immediate:
 - Manually test VNC connections in a packaged Wails app to verify the Origin allowlist.
 - Keep the new security tests in CI.
 Short-term:
 - Add an E2E test for SSH key manager hostile filenames.
 - Add an HTTP integration test for GitHub archive caps and escaped refs.
 - Surface user-friendly errors for new caps in the UI.
 Medium-term:
 - Add CI security checks for `govulncheck`, `npm audit --omit=dev`, and `git diff --check`.
 - Add release artifact checksums and an SBOM.
 Long-term:
 - Continue replacing dynamic frontend `innerHTML` where data provenance is mixed.
 - Add configurable large-download limits for GitHub archives and SFTP operations.
 ## 19. False Positives / Needs Manual Verification
 - VNC Origin policy should be validated in macOS, Windows, and Linux packaged Wails builds.
 - The 2 GiB GitHub archive cap should be validated against expected user repository sizes.
 - The SSH keygen 30 second timeout should be checked on slow hardware, especially for RSA 4096.
 ## 20. Final Notes
 This pass focused on concrete, testable hardening rather than broad speculative rewrites. The remaining risk is mostly runtime validation and UX around newly explicit limits. The repo still has an unrelated sidebar CSS spacing change in the working tree that was not part of this security audit.
@@ -0,0 +1,79 @@
 # Functionality and Next Steps Report
 ## 1. Executive Summary
 This fix-mode pass improved VS Code extension robustness by hardening the local bridge and webview CSP handling. The highest-impact next step is runtime validation in a real VS Code host: the source-level tests pass, but the extension panels and long-lived bridge event stream deserve manual smoke coverage after the HTTP timeout and nonce changes.
 The codebase already has useful regression coverage for prior security fixes. The main opportunity now is to reduce duplicated webview HTML patterns and add integration tests around the VS Code bridge, because that surface currently depends heavily on static checks.
 ## 2. Current Functional Risks
 - VS Code bridge `/events` uses a long-lived SSE stream. The new server has read/header/idle limits but intentionally no global write timeout, so a real VS Code smoke test should confirm events still flow correctly during SSH/SFTP/VNC/GitHub sessions.
 - VS Code webview HTML is duplicated across many panel classes. CSP, nonce generation, escaping, and message wiring are now correct in reviewed files, but duplication increases future regression risk.
 - The Node extension bridge client reads bridge responses without an explicit response-size cap or request timeout. The bridge is local and trusted, but a stuck bridge can still degrade the extension UX.
 - Frontend/webview coverage is mostly static regression assertions. It catches known bug patterns but does not prove that panels render and handlers fire inside VS Code.
 ## 3. Code Quality Improvements
 - Centralise webview scaffolding in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`: CSP generation, nonce creation, common style policy, and HTML shell construction should live in one helper per extension or a shared local module.
 - Wrap bridge HTTP requests in a small client helper with timeout, response-size cap, JSON decode error handling, and consistent error messages.
 - Consider replacing large inline template-string webviews with smaller render helpers that build trusted static shell plus escaped dynamic content. The current approach is workable, but it makes security review repetitive.
 - Keep the bridge handler helpers small and testable. `newBridgeHTTPServer` and `decodeLimitedJSON` are a useful pattern for future endpoints.
 ## 4. Frontend Interaction and Error-Handling Improvements
 - Add manual smoke steps for Nexus Connections, terminal, RAW, GitHub, IRC, VNC, Profile Editor, Settings, SFTP, Leviathan Tools, Leviathan Hex, and Leviathan tool panels.
 - Add non-sensitive `console.error` or visible status handling for JSON parse failures in VS Code webview message handlers where currently errors may be silent.
 - Validate that reconnect, resize, SFTP directory actions, GitHub refresh/download, and Leviathan tool execution still fire their expected events after panel reloads.
 - Confirm no webview logs secrets, bearer tokens, passwords, passphrases, private key material, or raw sensitive bridge responses.
 ## 5. Testing Roadmap
 - Unit tests: keep `cmd/vscode-bridge` tests for server settings and body caps; add request method/auth tests for all bridge routes.
 - Integration tests: add socket-level bridge tests for slow headers, oversized headers, and idle connection cleanup.
 - VS Code extension smoke tests: exercise webview creation, command registration, bridge startup, one RPC, and one event frame.
 - Frontend interaction tests: use a browser/DOM harness for key Wails UI flows where practical, especially SFTP upload, profile import, SSH key management, and Leviathan mode switching.
 - Abuse-case tests: retain oversized import/upload/config tests and add edge cases whenever new parsers or bridge endpoints are introduced.
 - Release smoke tests: package VSIX files and assert expected files, CSP strings, media resources, and bridge executable permissions.
 ## 6. Recommended New Functionality
 - Add an in-extension bridge diagnostics command that shows bridge status, version, last RPC error, and whether the event stream is connected, without exposing the bearer token.
 - Add a developer-only test command for the VS Code extension that opens each webview and posts a benign fixture state. This would make manual and automated smoke testing faster.
 - Add a small security status page or command that reports vault state, known-host policy, update-check source, and active local bridge address without sensitive values.
 ## 7. Next-Level Opportunities
 - Create a shared webview rendering module for both Nexus and Leviathan extension panels, with typed helpers for CSP, escaping, buttons, and event wiring.
 - Introduce structured bridge RPC method allow-list metadata rather than reflective method dispatch alone. Reflection is convenient, but a visible allow-list would make the trust boundary easier to review.
 - Add observability around bridge request counts, rejected oversized requests, active event clients, and session lifecycle errors.
 - Add accessibility checks for VS Code webview panels, especially keyboard focus, button labels, and status updates in terminal/disconnected flows.
 ## 8. Prioritised Action Plan
 Immediate:
 - Smoke-test the committed fix in a real VS Code host.
 - Confirm `/events` remains stable during session state changes.
 Short-term:
 - Add bridge client timeout and response-size caps in the Node extension code.
 - Add VS Code extension smoke tests for panel construction and bridge RPC.
 - Consolidate CSP nonce creation and webview HTML policy helpers.
 Medium-term:
 - Replace static-only regression assertions with executable DOM or VS Code integration tests for high-value panels.
 - Add bridge route coverage for auth failures, method errors, malformed JSON, and event subscription lifecycle.
 Long-term:
 - Build a release validation pipeline for desktop app, bridge binary, and VSIX packages.
 - Add structured diagnostics and observability for local bridge health and rejected requests.
 ## 9. Caveats and Validation Needed
 - Source and automated tests passed, but VS Code runtime behaviour was not manually exercised in this pass.
 - The CSP nonce change should be behaviour-preserving, but every webview panel should still be opened once in VS Code.
 - The bridge timeout settings are conservative for local RPC; long-running operations should continue reporting progress through events rather than blocking a single HTTP request indefinitely.
@@ -0,0 +1,361 @@
 # Security Audit Report
 ## 1. Executive Summary
 This fix-mode audit reviewed the Nexus desktop app, VS Code extensions, local bridge process, frontend regression harness, prior audit findings, dependency manifests, and build/test configuration. The codebase is in a materially better posture than the earlier June audits: major Wails, SFTP, VNC proxy, GitHub API, import-size, SSH key generation, and frontend DOM issues were already fixed and covered by tests.
 Two remaining issues were confirmed and fixed in commit `3a16a14`:
 - The VS Code bridge's localhost HTTP server had no explicit header/body read timeouts and decoded JSON request bodies without a hard cap.
 - VS Code webview CSP nonces were derived from `Date.now()`, which made a script allow-list nonce predictable rather than cryptographically random.
 Verification passed with targeted bridge tests, full Go tests, frontend regression checks, frontend build, `npm audit --omit=dev`, `govulncheck`, JavaScript syntax checks, and `git diff --check`.
 ## 2. Scope Reviewed
 Reviewed:
 - Go backend packages under `internal/` and the `cmd/vscode-bridge` localhost JSON-RPC/SSE bridge.
 - Browser-facing frontend JavaScript and regression checks under `frontend/`.
 - VS Code extension webviews in `vscode/nexus/extension.js` and `vscode/leviathan/extension.js`.
 - Dependency manifests: `go.mod`, `go.sum`, `frontend/package.json`, `frontend/package-lock.json`, VS Code extension package manifests.
 - Build, release, and CI files including shell scripts and `.github/workflows/release-builds.yml`.
 - Existing audit reports under `audits/` to avoid duplicate findings.
 Not fully live-tested:
 - Packaged VS Code extensions inside a real VS Code host after the CSP nonce change.
 - Long-lived bridge event streams under deliberate slow-client conditions.
 - Packaged Wails binaries on all target operating systems.
 ## 3. Methodology
 I used static review, adversarial attack-surface mapping, dependency review, configuration review, DoS review, frontend/webview review, and targeted regression tests. I traced attacker-controlled inputs from webviews, the VS Code extension host, local HTTP requests, imported files, remote services, and session events into filesystem, process, network, DOM, and parser boundaries.
 Commands run:
 - `node --check vscode/nexus/extension.js`
 - `node --check vscode/leviathan/extension.js`
 - `node --check frontend/scripts/test-regressions.js`
 - `go test ./cmd/vscode-bridge -count=1`
 - `npm --prefix frontend test`
 - `git diff --check`
 - `go test ./... -count=1`
 - `npm --prefix frontend run build`
 - `npm --prefix frontend audit --omit=dev`
 - `go run golang.org/x/vuln/cmd/govulncheck@latest ./...`
 ## 4. Risk Rating Method
 Severity reflects attacker position, exploit practicality, affected trust boundary, and confidentiality/integrity/availability impact. Confidence reflects direct source evidence and regression coverage.
 - Critical: unauthenticated remote compromise or credential disclosure.
 - High: practical credential theft, code execution, or privilege escalation.
 - Medium: meaningful local, renderer, or connected-service abuse with realistic prerequisites.
 - Low: defence-in-depth or bounded local robustness issue.
 - Informational: hardening or validation gaps without a direct exploit path.
 ## 5. Attack Surface Map
 Entry points:
 - Wails-bound API methods callable from the renderer.
 - VS Code extension webviews and their `postMessage` handlers.
 - `cmd/vscode-bridge` localhost HTTP endpoints: `/health`, `/rpc`, `/events`, and `/runtime/event`.
 - SSH, SFTP, Telnet, RAW TCP, VNC, GitHub, IRC, local shell, updater, recording, export/import, and Leviathan binary-analysis workflows.
 Trust boundaries:
 - Renderer/webview to Go backend.
 - Local browser or extension host to localhost bridge.
 - Local selected files and profile imports to parsers.
 - Remote GitHub, SSH/SFTP/VNC/IRC/Telnet/RAW endpoints to client code.
 - OS keychain/vault to profile/session runtime.
 Attacker starting positions considered:
 - Local unprivileged process attempting bridge resource exhaustion.
 - Malicious or compromised extension webview state.
 - Hostile remote service data rendered into webviews.
 - Malicious selected local file or imported profile/export.
 - Compromised connected host attempting terminal/session abuse.
 ## 6. Findings Summary Table
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---|---|---|---|---|
 | SEC-20260624-0945-001 | Low | High | VS Code bridge accepted unbounded HTTP parser work | `cmd/vscode-bridge` | Fixed in `3a16a14` |
 | SEC-20260624-0945-002 | Low | High | VS Code webview CSP nonces used predictable timestamps | `vscode/nexus`, `vscode/leviathan` | Fixed in `3a16a14` |
 ## 7. Detailed Findings
 ### Finding ID: SEC-20260624-0945-001
 #### Title
 VS Code bridge accepted unbounded HTTP parser work
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `cmd/vscode-bridge/main.go:120`
 - `cmd/vscode-bridge/main.go:212`
 - `cmd/vscode-bridge/main.go:230`
 - `cmd/vscode-bridge/main.go:336`
 - `cmd/vscode-bridge/main.go:346`
 - `cmd/vscode-bridge/main_test.go:11`
 - `cmd/vscode-bridge/main_test.go:28`
 - `cmd/vscode-bridge/main_test.go:48`
 #### Description
 The bridge listens only on localhost and requires a random bearer token, but the HTTP server previously used default server timeouts and decoded JSON bodies directly from `r.Body`. A local process, or a compromised component with bridge token access, could keep connections open or send oversized JSON to force unnecessary parser work and memory use.
 #### Evidence
 Before the fix, `server := &http.Server{Handler: mux}` used default timeout values, and `/rpc` plus `/runtime/event` called `json.NewDecoder(r.Body).Decode(...)` without `http.MaxBytesReader`.
 The fix adds explicit bridge limits at `cmd/vscode-bridge/main.go:50`, uses `newBridgeHTTPServer` at `cmd/vscode-bridge/main.go:126`, and applies `decodeLimitedJSON` in both POST handlers at `cmd/vscode-bridge/main.go:218` and `cmd/vscode-bridge/main.go:236`.
 #### Attack Scenario
 A local unprivileged process repeatedly connects to the bridge and sends slow headers or a large authenticated JSON body. Without timeouts and body caps, the bridge can spend disproportionate time and memory on unauthorised or oversized traffic.
 #### Impact
 Local denial of service against the VS Code extension bridge, causing sluggishness, failed RPCs, or event-stream disruption.
 #### Recommendation
 Set bounded HTTP server timeouts and header limits. Cap JSON request bodies before decoding. Keep long-lived SSE compatibility by avoiding a global `WriteTimeout` that would break event streams.
 #### Safer Example
 Implemented:
 ```go
 r.Body = http.MaxBytesReader(w, r.Body, bridgeMaxJSONBodyBytes)
 return json.NewDecoder(r.Body).Decode(dst)
 ```
 #### Suggested Tests
 Added tests that assert bridge timeout/header settings and oversized `/rpc` plus `/runtime/event` bodies are rejected before reflective service dispatch.
 #### References
 - CWE-400: Uncontrolled Resource Consumption
 - OWASP ASVS 12.1: File and resource handling
 - OWASP API Security Top 10 API4: Unrestricted Resource Consumption
 #### Assumptions / Limitations
 The practical attacker is local, because the bridge binds to `127.0.0.1`. The bearer token remains an important control, but it is not a substitute for parser and server resource limits.
 ### Finding ID: SEC-20260624-0945-002
 #### Title
 VS Code webview CSP nonces used predictable timestamps
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `vscode/nexus/extension.js:5`
 - `vscode/nexus/extension.js:10`
 - `vscode/nexus/extension.js:219`
 - `vscode/nexus/extension.js:554`
 - `vscode/nexus/extension.js:895`
 - `vscode/nexus/extension.js:1061`
 - `vscode/nexus/extension.js:1162`
 - `vscode/nexus/extension.js:1260`
 - `vscode/nexus/extension.js:1375`
 - `vscode/nexus/extension.js:1618`
 - `vscode/nexus/extension.js:1832`
 - `vscode/leviathan/extension.js:5`
 - `vscode/leviathan/extension.js:10`
 - `vscode/leviathan/extension.js:189`
 - `vscode/leviathan/extension.js:497`
 - `vscode/leviathan/extension.js:773`
 - `frontend/scripts/test-regressions.js:222`
 #### Description
 The VS Code webviews use CSP script nonces, but each nonce was previously `String(Date.now())`. CSP nonces are intended to be high-entropy, per-render allow-list values. A timestamp nonce is guessable and weakens CSP if an HTML injection primitive is introduced elsewhere.
 #### Evidence
 All `const nonce = String(Date.now());` occurrences in the VS Code extension files were replaced with `createCSPNonce()`, backed by `crypto.randomBytes(16).toString('base64')`.
 #### Attack Scenario
 An attacker finds or later introduces a webview HTML injection path that can emit a `<script nonce="...">` tag. A predictable timestamp nonce materially reduces the barrier to bypassing CSP, especially when the webview creation time is observable or inferable.
 #### Impact
 Defence-in-depth weakness for webview script execution controls. A full exploit still requires an injection path, but predictable nonces undermine the CSP layer that should contain that class of defect.
 #### Recommendation
 Generate CSP nonces with cryptographically secure random bytes for every webview render, and keep regression coverage preventing timestamp nonce reintroduction.
 #### Safer Example
 Implemented:
 ```js
 function createCSPNonce() {
  return crypto.randomBytes(16).toString('base64');
 }
 ```
 #### Suggested Tests
 Added regression assertions that both VS Code extension files use `crypto.randomBytes(16).toString('base64')` and that `const nonce = String(Date.now());` is absent under `vscode/`.
 #### References
 - CWE-345: Insufficient Verification of Data Authenticity
 - CWE-693: Protection Mechanism Failure
 - OWASP ASVS 14.4: Security headers
 #### Assumptions / Limitations
 I did not confirm a current exploitable webview injection path in these files during this pass. This fix preserves the CSP guarantee if a future DOM/HTML bug appears.
 ## 8. Blackhat-Style Abuse Paths
 Path 1: Local bridge exhaustion.
 Prerequisite: local code execution on the same machine. The attacker opens many slow or oversized bridge requests. Before the fix, default server settings and uncapped JSON decoding provided weaker resistance. Defensive breakpoint: `ReadHeaderTimeout`, `ReadTimeout`, `IdleTimeout`, `MaxHeaderBytes`, and `http.MaxBytesReader`.
 Path 2: Future webview injection to script execution.
 Prerequisite: an HTML injection sink in a VS Code webview. Predictable CSP nonces made it easier to craft a nonce-bearing script. Defensive breakpoint: cryptographic per-render nonces and continued escaping/text-node rendering.
 ## 9. Denial-of-Service Review
 Fixed:
 - Local bridge header/body parsing now has explicit limits.
 - Oversized bridge JSON bodies are rejected before reflective RPC dispatch.
 Previously fixed and still covered by tests:
 - VNC WebSocket frame read limits.
 - SFTP upload chunk and streaming size controls.
 - SSH config import file and Host-block caps.
 - GitHub archive stream cap.
 - Update response caps.
 - Leviathan and recording file-size limits in reviewed paths.
 Residual DoS considerations:
 - Long-lived `/events` streams intentionally remain open; they should be observed under slow-client conditions in VS Code.
 - Remote SFTP operations still rely on remote server responsiveness and transport-level behaviour.
 - Binary-analysis features should continue adding per-tool time and output caps as new parsers are added.
 ## 10. Dependency and Supply-Chain Review
 `npm --prefix frontend audit --omit=dev` reported zero production vulnerabilities. `govulncheck` reported no reachable Go vulnerabilities. The release workflow uses pinned major versions of common GitHub Actions but still installs Wails dynamically from the module version; that is acceptable but should be monitored in release hardening.
 ## 11. Secrets and Sensitive Data Review
 No new hard-coded credentials or private keys were found in the changed files. The bridge token remains generated with `crypto/rand` and is emitted to the extension process over stdout. Secret storage continues to use OS keychain and encrypted vault mechanisms reviewed in earlier audits.
 ## 12. Authentication and Authorisation Review
 The bridge still requires `Authorization: Bearer <token>`. The fix does not change bridge authorisation semantics. No new auth bypass was identified in this pass. Host key handling, SFTP path validation, GitHub URL validation, and profile validation had existing regression coverage from prior fixes.
 ## 13. Input Validation and Output Encoding Review
 Fixed:
 - Bridge JSON input is bounded to 1 MiB before decoding.
 Checked:
 - VS Code webviews continue escaping interpolated profile, repository, SFTP, and Leviathan state before `innerHTML` usage in reviewed areas.
 - Frontend regression tests include prior checks for SSH key manager error rendering and SFTP upload name handling.
 ## 14. Frontend HTML/JavaScript Robustness Review
 Fixed:
 - VS Code webview CSP nonces are now cryptographically random.
 Checked:
 - Existing frontend regression script still passes.
 - JavaScript syntax checks pass for both VS Code extension files and the regression script.
 Manual validation still needed:
 - Open the Nexus and Leviathan VS Code webviews in a real VS Code host and confirm all panels load under the stricter nonce generation.
 ## 15. Infrastructure and Deployment Review
 The GitHub Actions release workflow was reviewed for obvious command injection or secret leakage. No new finding was fixed here. It still uses broad `contents: write` permissions for release attachment, which is appropriate for the release job but should remain isolated to tag/manual workflows.
 ## 16. Logging, Monitoring, and Error Handling Review
 Bridge oversized-body failures return structured JSON errors through the existing RPC error path. No sensitive values are logged by the new code. The bridge still logs startup/server failures through `log`.
 ## 17. Test Coverage and Security Regression Gaps
 Added:
 - Bridge server resource-limit tests.
 - Oversized `/rpc` body test.
 - Oversized `/runtime/event` body test.
 - Regression assertions preventing timestamp CSP nonces in VS Code webviews.
 Remaining gaps:
 - No automated VS Code host integration test exercises all webview panels.
 - No slowloris-style integration test measures bridge timeout behaviour over real sockets.
 - No e2e test validates the long-lived SSE event stream after server timeout changes.
 ## 18. Prioritised Remediation Plan
 Immediate:
 - Manually smoke-test the packaged VS Code extension panels and bridge event stream.
 Short-term:
 - Add a small VS Code extension integration smoke test for webview creation and bridge RPC.
 - Add a socket-level bridge test for slow headers and idle connections.
 Medium-term:
 - Centralise VS Code webview HTML helpers so CSP, escaping, and nonce generation are not duplicated.
 - Add response-size caps and request timeouts in the Node extension bridge client.
 Long-term:
 - Add release-time security checks for packaged VSIX contents, binary hashes, and expected CSP coverage.
 ## 19. False Positives / Needs Manual Verification
 - The CSP nonce issue is a defence-in-depth finding, not evidence of a currently exploitable XSS.
 - Bridge DoS impact is local because the bridge binds to localhost.
 - VS Code runtime behaviour was not manually validated inside the actual editor during this audit.
 ## 20. Final Notes
 The confirmed issues were fixed and committed in `3a16a14`. The residual risk is mainly operational validation: verify the VS Code extension panels in a real host and keep expanding integration coverage for bridge and webview behaviour.
@@ -0,0 +1,197 @@
 # Functionality and Next Steps Report
 ## 1. Executive Summary
 This fix-mode pass makes long-running Nexus processes more predictable:
 reconnect prompts no longer accumulate runtime listeners, unfinished SFTP
 uploads are bounded and cancelled with their owning sessions, and application
 shutdown drains prompt, listener, session, and upload state. IPv6 literals now
 work in the reviewed VNC, IRC tunnel, and connection-test paths.
 The full backend, race, frontend, build, syntax, and dependency checks pass.
 The highest-value next step is a packaged long-duration soak test using real
 local and remote tabs. Unit tests prove the new ownership rules, but only a live
 test will show whether CPU, memory, goroutine, descriptor, and remote-session
 counts remain flat across thousands of open/close/reconnect cycles.
 ## 2. Current Functional Risks
 - Application-level cleanup is now explicit, but remote libraries and OS
  resources need live soak validation with real SSH, SFTP, VNC, IRC, Telnet,
  RAW, and local shell sessions.
 - SFTP partial-file removal is best-effort. If a transport is already dead,
  Nexus can close its local writer but may be unable to remove the remote
  partial file.
 - External Leviathan extractors can run subprocesses without a shared timeout,
  output-byte cap, or file-count cap. This path should remain unexposed until
  those controls exist.
 - Parser test coverage varies by format. Complex hostile files may still find
  correctness or performance edge cases not represented by current fixtures.
 - Several frontend areas still render trusted templates through `innerHTML`.
  Existing dynamic values are escaped in reviewed paths, but DOM-based
  construction would be less fragile for future edits.
 - Four Go module versions have advisories in code paths Nexus does not call.
  They are not current reachable vulnerabilities, but routine dependency
  refresh will reduce future uncertainty.
 - POSIX permission tests do not establish equivalent Windows ACL behaviour.
 ## 3. Code Quality Improvements
 - Make ownership visible in types and naming. Sessions should own reconnect
  contexts, uploads, protocol clients, terminal resources, and timers through a
  single idempotent close path.
 - Introduce a small lifecycle registry for application-level Wails listeners.
  The new stored unsubscribe functions are correct; a shared helper would make
  future listeners harder to leak.
 - Replace `time.After` in long-lived or high-frequency paths with owned timers
  when cancellation or reuse matters. The current reconnect prompt has bounded
  frequency, but an owned timer makes resource lifetime more explicit.
 - Return structured cleanup results for unfinished uploads: local writer
  closed, remote partial removed, or remote removal unavailable. This would
  improve diagnostics without turning cleanup failure into a tab-close
  blocker.
 - Centralise network endpoint formatting so every protocol consistently uses
  `net.JoinHostPort` and one port-validation helper.
 - Keep frontend regression assertions aligned with tracked source. The audit
  removed assertions for the intentionally deleted VS Code tree and replaced
  the obsolete CGO flag check with the current pure-Go invariant.
 ## 4. Frontend Interaction and Error-Handling Improvements
 - When a tab closes during an upload, display a brief non-blocking message that
  the upload was cancelled and whether a remote partial file may remain.
 - Make credential-prompt cancellation explicit in the UI so a reconnect
  cancellation is distinguishable from a wrong password or timeout.
 - Add an unobtrusive diagnostics panel showing counts only: open tabs, active
  protocol sessions, reconnect workers, pending prompts, streaming uploads,
  goroutines, and recent cleanup failures.
 - Disable or debounce reconnect controls while a reconnect is already in
  progress.
 - Prefer `textContent`, element creation, and event delegation for dynamic UI
  state. Keep `innerHTML` for reviewed static templates only.
 - Ensure every async action rechecks that its tab/session still exists before
  updating the DOM. This prevents late remote responses from reviving stale
  state or producing confusing errors.
 - Never put passwords, vault contents, tokens, private keys, bridge tokens, or
  terminal contents in diagnostics or frontend logs.
 ## 5. Testing Roadmap
 Immediate automated coverage:
 - Add tests that call `Service.Shutdown` and `Manager.Shutdown` twice to enforce
  idempotence.
 - Add a race test where an SFTP chunk write, session close, and shutdown overlap.
 - Add tests for a capacity race where two upload starts pass the pre-check and
  only one may claim the final slot.
 - Add address-table tests for IPv4, DNS names, bare IPv6, and scoped IPv6
  literals.
 Packaged soak coverage:
 - Start with zero tabs and record CPU, RSS, goroutines, descriptors, and
  listener/upload counts.
 - Repeat local terminal open/write/close and SSH open/reconnect/close at least
  1,000 times.
 - Repeat cancelled credential prompts and interrupted SFTP uploads.
 - Leave two idle tabs open for several hours and confirm resource counts and
  CPU settle rather than grow.
 - Shut down and verify all subprocesses, sockets, PTYs, uploads, and runtime
  listeners terminate.
 Protocol integration coverage:
 - Real SFTP server: finish, cancel, disconnect mid-chunk, reconnect, dead
  transport, and remote partial-file cleanup.
 - Real IPv6 endpoints for VNC and SSH-tunnelled IRC/VNC.
 - Host-key accept/reject/cancel and secret prompt cancel/timeout.
 - Slow or malicious peers for protocol read limits and cancellation.
 Parser and frontend coverage:
 - Fuzz the PE, ELF, Mach-O, SquashFS, PDF, archive, and transform entry points.
 - Add DOM tests for tab close during asynchronous callbacks.
 - Keep `npm test`, frontend build, `go vet`, focused race tests,
  `govulncheck`, and `npm audit` as release gates.
 ## 6. Recommended New Functionality
 - Add a resource diagnostics view with current and peak counts for tabs,
  sessions, reconnects, prompts, uploads, goroutines, file descriptors where
  available, and local child processes.
 - Add an optional "delete partial remote upload on disconnect" status/history
  entry, including a retry action after reconnect.
 - Add a developer soak command that scripts repeated open/reconnect/close
  cycles against safe fixture servers and emits a machine-readable resource
  summary.
 - Add an export-permission warning when the destination filesystem cannot
  enforce private file access.
 - Add a dependency-health command for development builds that reports the Go
  toolchain version and last audit result without contacting external services
  during normal application use.
 ## 7. Next-Level Opportunities
 - Build one lifecycle coordinator that owns application listeners, service
  uploads, sessions, reconnect workers, protocol clients, timers, and local
  subprocesses. A small dependency graph would make shutdown ordering
  testable.
 - Add pprof-enabled development builds and automated before/after heap,
  goroutine, mutex, and CPU profile comparisons during soak tests.
 - Introduce fault injection around remote writes, EOF, connection resets,
  prompt cancellation, delayed events, and shutdown.
 - Wrap external analysis tools in a sandbox-oriented runner with a context
  deadline, process-group kill, private working directory, output byte/file
  limits, and a minimal environment.
 - Add signed, reproducible release metadata and verify the expected Go
  toolchain, module graph, frontend lock file, and artefact hashes in CI.
 ## 8. Prioritised Action Plan
 Immediate:
 - Run a packaged local/remote tab soak test and capture resource graphs before
  and after `b5c7528`.
 - Validate interrupted SFTP uploads against a real server.
 - Confirm shutdown leaves no Nexus child process, PTY, listener, or open
  connection.
 Short-term:
 - Add shutdown-idempotence and overlapping upload/close race tests.
 - Add resource counters and a development diagnostics view.
 - Refresh modules with unreachable advisories under a dedicated compatibility
  change.
 - Add live IPv6 integration tests.
 Medium-term:
 - Add parser fuzzing and external extractor limits.
 - Reduce dynamic HTML construction and add DOM lifecycle tests.
 - Add fault-injected protocol integration tests.
 Long-term:
 - Make packaged soak, vulnerability, dependency, race, and artefact checks part
  of release qualification.
 - Track resource-count baselines so gradual lifecycle regressions fail before
  release.
 ## 9. Caveats and Validation Needed
 - Automated checks passed, but no packaged Wails application was opened during
  this audit.
 - No real remote protocol server was used, so remote partial-file behaviour and
  third-party client cleanup still need live confirmation.
 - The CPU symptom was not reproduced under a profiler in this pass. The
  reconnect listener leak and upload leak were confirmed from source and fixed,
  but they should not be claimed as the only possible causes of historical
  high CPU without a profile from an affected long-running process.
 - Filesystem permission behaviour was validated on the current POSIX host, not
  Windows ACLs or every network filesystem.
 - `clear` reduces the lifetime of mutable sensitive byte slices but does not
  guarantee complete memory erasure in Go.
 - `govulncheck` reports no reachable vulnerability after the toolchain update;
  its four module-only advisories still deserve normal upgrade testing.
 - The deleted VS Code extension sources were not audited as current code. Only
  the still-tracked Go bridge was reviewed.
@@ -0,0 +1,858 @@
 # Security Audit Report
 ## 1. Executive Summary
 This fix-mode audit reviewed the current Nexus desktop application, its local
 VS Code bridge process, browser-facing frontend, session and upload lifecycles,
 credential handling, network clients, encrypted storage and export, Leviathan
 file analysis, build/release configuration, dependencies, and earlier audit
 reports.
 No Critical or High severity vulnerability was confirmed. Four
 evidence-backed findings were fixed in commit `b5c7528`:
 - Auto-reconnect credential prompts registered a permanent Wails listener on
  every prompt. Long-running processes with repeated reconnects accumulated
  callbacks and unnecessary event-dispatch work.
 - Interrupted streaming SFTP uploads could retain open remote writers and
  in-memory upload entries after their session closed. Concurrent unfinished
  uploads were not bounded.
 - The accepted Go toolchain range included versions affected by a reachable
  standard-library TLS privacy vulnerability.
 - Encrypted exports and Leviathan carve output did not consistently enforce
  private local file permissions. Short-lived plaintext and derived key byte
  slices were also retained until garbage collection.
 The same commit fixed malformed IPv6 host/port construction in VNC, IRC SSH
 tunnels, and the connection tester, and repaired stale frontend regression
 assertions left behind when the VS Code extension tree and CGO build were
 removed.
 All Go tests, focused race tests, Go vet, the complete frontend test suite,
 frontend production build, JavaScript and shell syntax checks, PHP syntax
 check, `npm audit`, and the reachable Go vulnerability scan pass. Live remote
 protocol testing and packaged desktop testing remain manual validation items.
 ## 2. Scope Reviewed
 Reviewed:
 - Go packages under `internal/`, including sessions, SSH, SFTP, VNC, IRC,
  Telnet, RAW TCP, local shells, storage, vault/keychain integration,
  recording, updater, GitHub client, import/export, and Leviathan.
 - The localhost service bridge in `cmd/vscode-bridge`.
 - Frontend source, lifecycle handling, DOM construction, timers, Wails event
  subscriptions, build scripts, and regression harness under `frontend/`.
 - Network address construction, host-key verification, connection setup, and
  session shutdown paths.
 - Dependency manifests and lock files.
 - Build, release, update, and CI configuration.
 - Earlier reports under `audits/`, to distinguish regressions from already
  fixed findings.
 Not live-tested:
 - Packaged Wails applications on every supported operating system.
 - Real SSH, SFTP, VNC, IRC, Telnet, RAW, GitHub, or update endpoints.
 - Malicious network peers under sustained load.
 - External Leviathan extractor tools. Their extraction path is not currently
  exposed by the active Wails document response.
 - A VS Code extension runtime, because the `vscode/` source tree was
  intentionally removed in commit `4fc3b19`.
 ## 3. Methodology
 The review combined:
 - Repository and Git-history inspection.
 - Trust-boundary and attacker-starting-position mapping.
 - Static review of authentication, authorisation, secrets, cryptography,
  filesystem operations, command execution, parsers, network clients, event
  listeners, goroutines, timers, and cleanup paths.
 - Adversarial resource-exhaustion review, with particular attention to a
  process that has run for a long time while tabs and sessions are repeatedly
  opened, reconnected, and closed.
 - Frontend sink/source review for unsafe HTML, event-listener accumulation,
  timers, stale state, and privileged Wails calls.
 - Dependency and supply-chain scanning.
 - Focused regression tests followed by broad test, race, build, syntax, and
  static-analysis checks.
 Principal validation commands:
 - `go test ./... -count=1`
 - `go test -race ./internal/sessions ./internal/api ./internal/exportimport ./internal/vncclient ./cmd/vscode-bridge -count=1`
 - `go vet ./...`
 - `go run golang.org/x/vuln/cmd/govulncheck@latest -show verbose ./...`
 - `go run github.com/securego/gosec/v2/cmd/gosec@latest ./...`
 - `npm test` in `frontend/`
 - `npm run build` in `frontend/`
 - `npm audit --json` in `frontend/`
 - `node --check` for changed JavaScript
 - `bash -n build.sh build-all.sh release.sh scripts/build-common.sh`
 - `php -l updates/index.php`
 - `git diff --check`
 ## 4. Risk Rating Method
 Severity reflects attacker position, prerequisites, exploit repeatability,
 trust-boundary impact, and confidentiality, integrity, and availability
 consequences.
 - Critical: practical unauthenticated remote compromise or broad secret
  disclosure.
 - High: practical code execution, credential theft, or privilege escalation.
 - Medium: meaningful local, renderer, connected-peer, or privacy impact with
  realistic prerequisites.
 - Low: bounded local exposure, defence-in-depth weakness, or correctness issue
  with a security consequence.
 - Informational: hardening or validation work without a confirmed exploit.
 Confidence reflects the strength of source evidence, reproduction, scanner
 evidence, and regression coverage. Severity is not increased merely because a
 scanner reports a possible pattern.
 ## 5. Attack Surface Map
 Entry points:
 - Wails-bound service methods invoked by the desktop renderer.
 - Runtime events crossing between frontend JavaScript and Go.
 - The token-authenticated localhost bridge endpoints.
 - User-selected SSH, SFTP, VNC, IRC, Telnet, RAW TCP, GitHub, and update
  endpoints.
 - Imported profiles, OpenSSH configuration, encrypted Nexus exports,
  recordings, and files selected for Leviathan analysis.
 - Local shell commands and SSH key generation.
 Trust boundaries:
 - Renderer to privileged Go backend.
 - Local bridge client to localhost HTTP/RPC service.
 - OS keychain or encrypted vault to runtime session credentials.
 - Remote network data to protocol clients and frontend rendering.
 - User-selected or hostile files to parsers and external analysis tooling.
 - Release workflow and update manifest to installed application binaries.
 Attacker starting positions considered:
 - A malicious or compromised remote service.
 - A hostile local file or imported configuration.
 - A local unprivileged process targeting the localhost bridge or filesystem
  artefacts.
 - A renderer injection or future renderer compromise invoking bound methods.
 - An observer of TLS traffic.
 - A legitimate local user accidentally creating unbounded resource state over
  a long-running process.
 ## 6. Findings Summary Table
 | ID | Severity | Confidence | Title | Component | Status |
 |---|---|---|---|---|---|
 | SEC-20260729-1237-001 | Medium | High | Reconnect credential prompts accumulated permanent runtime listeners | `internal/sessions` | Fixed in `b5c7528` |
 | SEC-20260729-1237-002 | Medium | High | Interrupted SFTP uploads retained resources without a concurrency bound | `internal/api` | Fixed in `b5c7528` |
 | SEC-20260729-1237-003 | Medium | High | Build accepted a Go toolchain with a reachable TLS privacy vulnerability | `go.mod`, build scripts | Fixed in `b5c7528` |
 | SEC-20260729-1237-004 | Low | High | Sensitive local artefacts did not consistently enforce private permissions | Export/import and Leviathan | Fixed in `b5c7528` |
 ## 7. Detailed Findings
 ### Finding ID: SEC-20260729-1237-001
 #### Title
 Reconnect credential prompts accumulated permanent runtime listeners
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/sessions/manager.go:110`
 - `internal/sessions/manager.go:676`
 - `internal/sessions/manager.go:2577`
 - `internal/sessions/manager.go:2615`
 - `internal/sessions/manager.go:2654`
 - `internal/sessions/manager_test.go:383`
 - `cmd/vscode-bridge/main.go:187`
 - `internal/app/app.go:118`
 #### Description
 Every credential request created during automatic reconnect registered another
 `session:secret:response` Wails listener. The listener was never unregistered,
 including after a response, timeout, cancelled reconnect, session close, or
 application shutdown.
 The request ID check prevented one prompt from accepting another prompt's
 value, but all historical callbacks were still invoked for every future
 credential response. A process left open for a long time could therefore
 accumulate event callbacks in proportion to its reconnect history. A closed
 session could also leave a credential prompt waiting for its full timeout.
 #### Evidence
 Before the fix, `buildInteractiveSecretCallback` called
 `wailsRuntime.EventsOn` inside the callback created for each prompt and
 discarded the returned unsubscribe function.
 The fix registers one manager-level response router from `SetContext`, stores
 the unsubscribe function, routes responses through a request-ID map, honours
 frontend cancellation, and selects on the reconnect context. `Shutdown`
 unregisters both host-key and credential listeners and releases all waiters.
 Application and bridge shutdown now call the complete service and manager
 shutdown methods.
 #### Attack Scenario
 A remote SSH or IRC service repeatedly drops connections after authentication,
 or a user repeatedly opens and reconnects profiles that require an interactive
 secret. Historical event listeners accumulate. Later secret responses fan out
 to all callbacks, increasing CPU work and retained memory even though old tabs
 are closed.
 #### Impact
 Progressive memory and CPU consumption in a long-running process, sluggish
 credential prompts, delayed shutdown, and eventual application availability
 loss. The request-ID routing means no cross-session secret disclosure was
 confirmed.
 #### Recommendation
 Use one application-lifetime event listener per event type, route responses by
 opaque request ID, bind every waiter to a cancellation context, and explicitly
 unsubscribe and release waiters during shutdown.
 #### Safer Example
 Implemented in outline:
 ```go
 cancel := wailsRuntime.EventsOn(ctx, "session:secret:response", m.handleSecretResponse)
 m.secretListenerCancel = cancel
 select {
 case response := <-ch:
    return response.value, cancellationError(response)
 case <-ctx.Done():
    return "", ctx.Err()
 }
 ```
 #### Suggested Tests
 Added tests verify request-ID routing, reconnect-context cancellation, frontend
 cancellation, pending-map cleanup, and shutdown waiter release. The focused
 race suite passes.
 #### References
 - CWE-400: Uncontrolled Resource Consumption
 - CWE-772: Missing Release of Resource after Effective Lifetime
 #### Assumptions / Limitations
 No packaged Wails runtime stress test was run. The defect and fix are directly
 visible in source, and the routing/cancellation logic is covered at Go level.
 ### Finding ID: SEC-20260729-1237-002
 #### Title
 Interrupted SFTP uploads retained resources without a concurrency bound
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/api/api.go:52`
 - `internal/api/api.go:117`
 - `internal/api/api.go:469`
 - `internal/api/api.go:475`
 - `internal/api/api.go:515`
 - `internal/api/api.go:1569`
 - `internal/api/api.go:2189`
 - `internal/api/api.go:2202`
 - `internal/api/api_test.go:145`
 #### Description
 Streaming SFTP upload state held an open remote writer in the service upload
 map. Finish and explicit cancel removed it, but disconnecting, reconnecting, or
 closing the owning session did not. Application shutdown also did not drain
 unfinished uploads. There was no limit on the number of simultaneously open
 streaming uploads.
 #### Evidence
 The earlier lifecycle paths called the session manager directly without
 visiting the upload map. `SFTPUploadStart` inserted every new writer without a
 capacity check.
 The fix:
 - Caps active streaming uploads at 16.
 - Checks capacity before opening a remote writer and atomically rechecks before
  insertion.
 - Removes and closes uploads belonging to a session before disconnect or
  reconnect.
 - Drains every upload during close-all and service shutdown.
 - Best-effort removes the partial remote file.
 - Releases secret-prompt waiters and the service's Wails listener during
  shutdown as part of the same lifecycle hardening.
 #### Attack Scenario
 A compromised renderer, automation loop, or repeated user action starts
 uploads and closes the associated tabs or sessions without finishing them.
 Each iteration can retain a local map entry, SFTP request state, remote file
 handle, and partially written file. Repetition eventually exhausts descriptors,
 memory, or server-side resources.
 #### Impact
 Local and remote resource exhaustion, failed subsequent uploads, leaked partial
 files, and degraded session availability.
 #### Recommendation
 Make resource ownership explicit: uploads must be owned by a session and
 cancelled when that session ends. Bound concurrent work and keep a race-safe
 second capacity check after expensive setup.
 #### Safer Example
 Implemented:
 ```go
 func (s *Service) DisconnectSession(sessionID string) error {
    s.cancelSFTPUploads(sessionID)
    return s.sessions.Disconnect(sessionID)
 }
 ```
 #### Suggested Tests
 Added tests verify session-scoped cancellation, unrelated-upload preservation,
 the active-upload limit, writer closure, and shutdown cleanup. Full and race
 tests pass.
 #### References
 - CWE-400: Uncontrolled Resource Consumption
 - CWE-404: Improper Resource Shutdown or Release
 - CWE-772: Missing Release of Resource after Effective Lifetime
 #### Assumptions / Limitations
 No real SFTP server was used to verify partial-file deletion after a transport
 failure. Removal is best-effort because the session may already be unavailable;
 local writer and map cleanup do not depend on remote deletion succeeding.
 ### Finding ID: SEC-20260729-1237-003
 #### Title
 Build accepted a Go toolchain with a reachable TLS privacy vulnerability
 #### Severity
 Medium
 #### Confidence
 High
 #### Affected Files / Components
 - `go.mod:3`
 - `go.mod:5`
 - `build.sh:21`
 - `build-all.sh:20`
 #### Description
 The build accepted Go 1.25.0 and the local build used Go 1.26.4.
 `govulncheck` identified GO-2026-5856 / CVE-2026-42505 in a reachable
 `crypto/tls` path. Affected clients could expose TLS PSK identities in a
 plaintext ClientHello while Encrypted Client Hello was in use, allowing a
 passive observer to undermine ECH privacy.
 #### Evidence
 The pre-fix scan reported the standard-library vulnerability as reachable.
 The [official Go vulnerability record](https://pkg.go.dev/vuln/GO-2026-5856)
 states that Go 1.25 is fixed in 1.25.12 and Go 1.26 is fixed in 1.26.5.
 The fix raises the module minimum to Go 1.25.12, requests toolchain Go 1.26.5,
 and aligns both Unix build scripts with the new minimum. The post-fix verbose
 scan used the Go 1.26.5 standard library and reported zero symbol or package
 vulnerabilities affecting Nexus.
 #### Attack Scenario
 Where ECH and PSK resumption are used, a passive network observer records the
 client's plaintext ClientHello and correlates an exposed PSK identity with the
 protected destination.
 #### Impact
 Conditional network privacy disclosure. No private key or application
 credential extraction was demonstrated. Nexus does not explicitly configure
 ECH, so actual exposure depends on TLS configuration and runtime behaviour.
 #### Recommendation
 Enforce fixed toolchain floors in `go.mod`, local build scripts, and CI. Keep
 `govulncheck` in release validation so standard-library vulnerabilities cannot
 be missed by module-only scanners.
 #### Safer Example
 Implemented:
 ```text
 go 1.25.12
 toolchain go1.26.5
 ```
 #### Suggested Tests
 Run `go version` and verbose `govulncheck` in release CI, and fail if a
 reachable symbol-level vulnerability is reported.
 #### References
 - GO-2026-5856
 - CVE-2026-42505
 - CWE-200: Exposure of Sensitive Information
 #### Assumptions / Limitations
 The scanner established a reachable TLS symbol path, not that Nexus actively
 negotiated ECH with a vulnerable server during this audit. Severity therefore
 reflects conditional exploitability.
 ### Finding ID: SEC-20260729-1237-004
 #### Title
 Sensitive local artefacts did not consistently enforce private permissions
 #### Severity
 Low
 #### Confidence
 High
 #### Affected Files / Components
 - `internal/exportimport/exportimport.go:68`
 - `internal/exportimport/exportimport.go:111`
 - `internal/exportimport/exportimport.go:116`
 - `internal/exportimport/exportimport.go:170`
 - `internal/exportimport/exportimport_test.go:108`
 - `internal/leviathan/binsnoop/binsnoop.go:137`
 - `internal/leviathan/binsnoop/binsnoop.go:141`
 - `internal/leviathan/binsnoop/extract.go:17`
 - `internal/leviathan/binsnoop/extract.go:20`
 - `internal/leviathan/binsnoop/common_test.go:25`
 #### Description
 Encrypted profile exports were created through `os.Create`, which normally
 uses mode `0666` filtered by the process umask. Overwriting an existing file
 also preserved its existing mode. Leviathan carved binary data and extraction
 directories used `0644` and `0755`. Carved content can include credentials,
 private keys, firmware configuration, or other forensic secrets.
 Export encryption keys, password byte slices, and decrypted plaintext byte
 slices also remained live until garbage collection after use.
 #### Evidence
 The fix opens exports with mode `0600` and explicitly applies `Chmod(0600)` so
 an existing permissive destination is tightened. Leviathan-owned carve files
 now use `0600`, and directories use `0700`. Export/import makes a best-effort
 `clear` of transient password, derived-key, and plaintext byte slices.
 #### Attack Scenario
 On a multi-user host, another local account reads a carved private key or
 configuration from a world-readable output file. For an export destination
 that already had permissive permissions, another account can copy the
 encrypted profile bundle for offline password guessing.
 #### Impact
 Local confidentiality exposure. The export remains protected by Argon2id and
 AES-GCM, which significantly reduces its immediate sensitivity; raw carve
 output has no equivalent encryption.
 #### Recommendation
 Create sensitive artefacts and parent directories with private modes, tighten
 existing destinations explicitly, and minimise the lifetime of mutable
 plaintext and key buffers. Document that Go strings and internal copies cannot
 be guaranteed to be erased.
 #### Safer Example
 Implemented:
 ```go
 f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
 if err == nil {
    err = f.Chmod(0600)
 }
 ```
 #### Suggested Tests
 POSIX-only regression tests verify `0600` export and carve files and a `0700`
 carve directory, including overwriting a pre-existing `0644` export.
 #### References
 - CWE-276: Incorrect Default Permissions
 - CWE-316: Cleartext Storage of Sensitive Information in Memory
 #### Assumptions / Limitations
 POSIX mode bits are not equivalent on Windows, so permission tests skip there.
 `clear` is best-effort in Go and cannot erase immutable password strings,
 copies held by libraries, or compiler-created copies. External extraction
 tools may choose their own modes for files they create beneath the private
 directory.
 ## 8. Blackhat-Style Abuse Paths
 ### Path 1: Reconnect churn to process exhaustion
 Prerequisite: a profile needs an interactive credential during automatic
 reconnect. A hostile endpoint repeatedly drops the connection. Before the fix,
 each prompt left another Wails listener behind. Defensive breakpoint:
 application-level listener routing, context cancellation, and shutdown
 unsubscribe.
 ### Path 2: Renderer-driven SFTP handle exhaustion
 Prerequisite: renderer access to bound service methods. Start streaming uploads
 without finishing them, then close or reconnect sessions repeatedly. Before the
 fix, writers and upload entries survived. Defensive breakpoint: the 16-upload
 cap and session-owned cancellation.
 ### Path 3: Passive observation of vulnerable TLS ECH
 Prerequisite: affected Go runtime, ECH/PSK behaviour, and network visibility.
 Observe plaintext ClientHello state and correlate exposed PSK identity.
 Defensive breakpoint: Go 1.25.12 or 1.26.5 and later.
 ### Path 4: Local recovery of carved secrets
 Prerequisite: another local account can traverse the selected output location.
 Read a `0644` carved file containing a private key or configuration secret.
 Defensive breakpoint: `0700` directories and `0600` files.
 No practical chain to unauthenticated remote code execution was identified.
 ## 9. Denial-of-Service Review
 Fixed in this audit:
 - Reconnect secret listeners no longer grow with historical prompt count.
 - Cancelled reconnect prompts stop immediately instead of waiting up to 60
  seconds.
 - Session close/reconnect and application shutdown drain streaming uploads.
 - Concurrent streaming uploads are capped at 16.
 - Runtime listeners and prompt waiters are released at shutdown.
 - IPv6 literals are joined with ports correctly, preventing connection failure
  and misleading repeated retry behaviour.
 Previously hardened and rechecked:
 - SFTP inline/chunk/total upload size caps.
 - VNC WebSocket frame limits.
 - GitHub archive and update-response size limits.
 - SSH configuration and public-key input caps.
 - Recording and Leviathan file-size limits in exposed paths.
 - Session timers, latency pings, frontend intervals, and closed-tab lifecycle
  cleanup covered by the current regression tests.
 Residual considerations:
 - Network protocols ultimately depend on remote peer responsiveness.
 - External Leviathan tools lack a shared timeout/output-budget wrapper, but
  that path is not currently exposed by the active UI API.
 - Hostile binary parsers deserve continued fuzzing even where current bounds
  checks reject malformed offsets.
 ## 10. Dependency and Supply-Chain Review
 `npm audit --json` reported zero vulnerabilities across 33 frontend
 dependencies.
 Post-fix `govulncheck -show verbose` reported:
 - Zero vulnerabilities in symbols Nexus calls.
 - Zero vulnerabilities in imported package call paths.
 - Four advisories in required module versions that Nexus does not appear to
  call:
  - GO-2026-5970 in `golang.org/x/text@v0.37.0`.
  - GO-2026-5942 in `golang.org/x/net@v0.55.0`.
  - GO-2026-5932 for the unmaintained `x/crypto/openpgp` package.
  - GO-2026-5841 in `github.com/klauspost/compress/s2@v1.17.11`.
 Those versions should be refreshed through normal dependency maintenance, but
 they were not forcibly upgraded in this fix because the scanner found no
 Nexus call path and broad transitive churn would require separate compatibility
 testing.
 The release workflow uses common GitHub Actions by major version and a
 write-capable release job. Pinning actions to immutable commit SHAs would
 further reduce supply-chain drift. Release permissions should remain scoped to
 the release job and tag/manual triggers.
 ## 11. Secrets and Sensitive Data Review
 No hard-coded production credential, private key, token, or certificate was
 found. Test secrets were confined to test fixtures.
 Reviewed controls:
 - OS keychain integration.
 - Argon2id-derived AES-GCM vault and export encryption.
 - SSH host-key verification and known-host handling.
 - Bridge bearer token generation and comparison.
 - Secret prompt routing and cancellation.
 - Sensitive file permissions.
 - Logging and frontend error paths for obvious secret disclosure.
 Fixed:
 - Best-effort clearing of mutable export/import plaintext, password bytes, and
  derived keys.
 - Private export and carve modes.
 - Prompt waiters and listeners released during shutdown.
 Residual:
 - Go strings and library copies cannot be reliably zeroed.
 - Users may explicitly choose plaintext Telnet, RAW TCP, or non-TLS VNC.
 - A user can explicitly select insecure SSH host-key behaviour; that choice
  remains a visible compatibility option and should not be the default.
 ## 12. Authentication and Authorisation Review
 Nexus is a single-user desktop client rather than a multi-tenant server. Its
 primary authorisation boundary is the logged-in OS account plus the Wails
 renderer/backend boundary.
 Checked:
 - Local bridge endpoints retain bearer-token authentication.
 - SSH host-key callbacks are required in the reviewed direct and tunnel paths.
 - GitHub and remote-session credentials are retrieved from configured secret
  stores or interactive prompts.
 - Sensitive service methods validate session identifiers through the manager
  and validate paths, sizes, or option allow-lists where applicable.
 No new authentication bypass or cross-user authorisation defect was confirmed.
 A future renderer compromise would still have substantial privileges because
 Wails-bound methods are designed for the trusted desktop UI; maintaining output
 encoding and a narrow method surface therefore remains important.
 ## 13. Input Validation and Output Encoding Review
 Reviewed:
 - Profile fields, ports, hostnames, paths, filenames, import strategies,
  archive/update URLs, SSH key options, recording files, binary offsets, and
  base64 upload chunks.
 - HTML construction and text insertion in frontend modules.
 - Local subprocess arguments for shell, `ssh-keygen`, and Leviathan extraction.
 Fixed:
 - `net.JoinHostPort` now constructs IPv4, hostname, and IPv6 endpoints in VNC,
  IRC SSH tunnels, and the connection tester.
 - Existing SFTP validation is now combined with a concurrency limit and
  lifecycle cleanup.
 Scanner findings for MD5/SHA-1 in Leviathan are intentional forensic hash
 identifiers, not password or signature protection. Representative integer
 conversion and slice warnings in hostile-file parsers were manually traced to
 existing bounds checks; no concrete out-of-bounds path was confirmed. Parser
 fuzzing remains preferable to broad speculative casting changes.
 ## 14. Frontend HTML/JavaScript Robustness Review
 The frontend contains numerous event listeners because each tab and modal owns
 interactive DOM. Reviewed tab/session paths attach handlers to ephemeral nodes
 that become collectable when their owning DOM is removed, while application
 listeners and intervals have explicit one-time or cleanup behaviour.
 Current regression coverage verifies session cleanup, active latency timer
 behaviour, closed-tab release, safe DOM patterns, upload constraints, build
 hardening, and other earlier fixes.
 The aggregate test harness still referenced VS Code files deleted in
 `4fc3b19` and a CGO flag removed by the same pure-Go migration. This caused
 `npm test` to fail before reaching its current assertions. The stale VS Code
 checks were removed, and the obsolete `-O2 -g0` assertion was replaced with a
 check that the current build retains `CGO_ENABLED=0`. Both frontend suites now
 pass.
 No confirmed exploitable current DOM injection was found. Some `innerHTML`
 usage remains and relies on escaping helpers or trusted static markup; future
 changes should prefer `textContent` and DOM construction for dynamic data.
 ## 15. Infrastructure and Deployment Review
 Reviewed:
 - Shell, PowerShell, Makefile, and shared build helpers.
 - GitHub Actions release configuration.
 - Updater endpoint and PHP manifest delivery.
 - Cross-platform build flags and Go toolchain selection.
 Fixed:
 - Unix build scripts now reject Go versions older than 1.25.12.
 - `go.mod` requests Go 1.26.5 while keeping 1.25.12 as the minimum supported
  language/toolchain floor.
 - Stale regression coverage now reflects the pure-Go build.
 The updater remains a high-value trust boundary. Production release validation
 should verify HTTPS, hashes/signatures where supported, expected artefact
 names, and least-privilege release credentials. No new command-injection or
 manifest-escaping defect was confirmed.
 ## 16. Logging, Monitoring, and Error Handling Review
 The new cleanup paths do not log credentials or secret responses. Upload
 cleanup treats remote partial-file deletion as best-effort because the
 underlying session may already be broken.
 Useful future operational signals:
 - Active and rejected streaming-upload counts.
 - Reconnect attempt count and pending credential prompts.
 - Active runtime listener and session counts in a diagnostics view.
 - Resource snapshots during long-running open/close soak tests.
 These should expose counts and identifiers only, never passwords, tokens,
 private keys, terminal contents, or bridge bearer tokens.
 ## 17. Test Coverage and Security Regression Gaps
 Added:
 - Credential response routing by request ID.
 - Reconnect cancellation releases its secret prompt immediately.
 - Frontend cancellation is honoured.
 - SFTP cleanup is scoped to the owning session.
 - Active streaming uploads are bounded.
 - Service shutdown releases uploads and prompt waiters.
 - Existing permissive export files are tightened to `0600`.
 - Leviathan carve directories/files use `0700`/`0600`.
 Passing:
 - Full Go test suite.
 - Focused Go race suite.
 - Go vet.
 - Complete frontend lifecycle and regression suite.
 - Frontend production build.
 - JavaScript, shell, and PHP syntax checks.
 - `npm audit`.
 - Reachable Go vulnerability scan.
 Remaining gaps:
 - No packaged Wails UI smoke or long-duration tab/reconnect soak test.
 - No real SFTP server test proves partial-file deletion after a broken
  transport.
 - No live IPv6 protocol endpoint was used.
 - Hostile-file parser coverage is uneven; fuzzing should be expanded.
 - Windows ACL behaviour is not verified by POSIX permission tests.
 - External Leviathan extractors lack integration tests for time and output
  limits.
 ## 18. Prioritised Remediation Plan
 Immediate:
 - Soak-test a packaged app while repeatedly opening, reconnecting, and closing
  local and remote tabs. Monitor process CPU, memory, goroutines, file
  descriptors, and listener/upload counts.
 - Exercise interrupted SFTP uploads against a real server and verify local
  handle cleanup plus remote partial-file behaviour.
 Short-term:
 - Add a packaged Wails lifecycle smoke test.
 - Add fuzz targets for the highest-complexity Leviathan parsers.
 - Refresh the four module versions with unreachable advisories and run protocol
  compatibility tests.
 - Add metrics or a diagnostics screen for active sessions, reconnects,
  uploads, prompts, and event subscriptions.
 Medium-term:
 - Wrap every external Leviathan extractor with context timeout, process-group
  termination, and output-size/file-count budgets before exposing extraction
  through the UI.
 - Replace remaining dynamic `innerHTML` paths with text nodes or narrowly
  reviewed rendering helpers.
 - Add real IPv6 SSH/VNC/IRC tunnel integration coverage.
 Long-term:
 - Add release CI gates for full tests, race-focused tests, `govulncheck`,
  frontend audit/build, packaged smoke checks, and signed artefact validation.
 - Pin third-party GitHub Actions to reviewed immutable revisions.
 ## 19. False Positives / Needs Manual Verification
 - Gosec MD5 and SHA-1 reports in Leviathan are forensic digest features, not
  security authentication or password hashing.
 - Gosec subprocess reports include user-selected local shells, allow-listed SSH
  key generation options, and an external extraction path not exposed by the
  current document API. The extraction path still needs limits before future
  exposure.
 - File-parser integer-conversion and slice warnings were reviewed
  representatively; existing range checks rejected the paths inspected.
  Fuzzing is required for stronger assurance.
 - The four remaining Go module advisories are present in required versions,
  but `govulncheck` found no called symbol or imported vulnerable package path.
 - The fixed TLS issue had a reachable standard-library path, but actual ECH
  exposure was not reproduced.
 - Sensitive-buffer clearing is best-effort and must not be described as
  guaranteed memory erasure in Go.
 ## 20. Final Notes
 The confirmed issues and their regression tests are committed in `b5c7528`.
 The most important improvement for the reported long-running-process behaviour
 is that credential event listeners, prompt waiters, and unfinished upload
 writers now have explicit owners and terminal cleanup paths.
 Closing a session now cancels its reconnect work and SFTP uploads; closing all
 sessions drains all uploads; application or bridge shutdown also unregisters
 runtime listeners and releases pending prompts. This materially improves
 cleanup, but live soak testing is still required before claiming that every OS,
 third-party library, and remote-peer resource remains flat indefinitely.
@@ -1,170 +0,0 @@
 #!/usr/bin/env bash
 # build-all.sh — Cross-build helper for Nexus Terminal (macOS/Linux hosts)
 # Builds all supported targets where the required toolchains are installed.
 # Usage: ./build-all.sh
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m'
 log()  { echo -e "${GREEN}[nexus]${NC} $1"; }
 warn() { echo -e "${YELLOW}[nexus]${NC} $1"; }
 err()  { echo -e "${RED}[nexus]${NC} $1" >&2; }
 build_tags() {
    if command -v pkg-config >/dev/null 2>&1 \
        && pkg-config --exists webkit2gtk-4.1 \
        && ! pkg-config --exists webkit2gtk-4.0; then
        echo "webkit2_41"
    fi
 }
 build_version() {
    local tag
    local commit
    tag="$(git describe --tags --abbrev=0 2>/dev/null || echo "dev")"
    commit="$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")"
    echo "${tag}-${commit}"
 }
 build_ldflags() {
    local version="$1"
    local flags="-s -w -X github.com/andydixon/nexus/internal/api.appVersion=${version}"
    if [ -n "${NEXUS_UPDATE_URL:-}" ]; then
        flags="${flags} -X github.com/andydixon/nexus/internal/api.appUpdateURL=${NEXUS_UPDATE_URL}"
    fi
    echo "${flags}"
 }
 check_deps() {
    command -v go >/dev/null 2>&1 || { err "Go is not installed"; exit 1; }
    command -v node >/dev/null 2>&1 || { err "Node.js is not installed"; exit 1; }
    command -v npm >/dev/null 2>&1 || { err "npm is not installed"; exit 1; }
    if ! command -v wails >/dev/null 2>&1; then
        if [ -f "$HOME/go/bin/wails" ]; then
            export PATH="$PATH:$HOME/go/bin"
        else
            err "Wails is not installed. Run: go install github.com/wailsapp/wails/v2/cmd/wails@latest"
            exit 1
        fi
    fi
    log "Go:    $(go version)"
    log "Node:  $(node --version)"
    log "Wails: $(wails version 2>/dev/null | head -1)"
 }
 install_deps() {
    log "Installing Go dependencies…"
    go mod download
    log "Installing frontend dependencies…"
    cd frontend && npm install && cd ..
 }
 host_os() {
    case "$(uname -s)" in
        Darwin) echo "darwin" ;;
        Linux) echo "linux" ;;
        *) echo "unknown" ;;
    esac
 }
 pick_cc() {
    local target_os="$1"
    local target_arch="$2"
    if [ "$target_os" = "windows" ]; then
        if [ "$target_arch" = "amd64" ]; then
            echo "x86_64-w64-mingw32-gcc"
        else
            echo "aarch64-w64-mingw32-gcc"
        fi
        return
    fi
    if [ "$target_os" = "linux" ]; then
        if [ "$target_arch" = "amd64" ]; then
            echo "x86_64-linux-gnu-gcc"
        else
            echo "aarch64-linux-gnu-gcc"
        fi
        return
    fi
    echo ""
 }
 build_target() {
    local target_os="$1"
    local target_arch="$2"
    local host="$3"
    local version="$4"
    local ldflags
    ldflags="$(build_ldflags "${version}")"
    local tags
    tags="$(build_tags)"
    local platform="${target_os}/${target_arch}"
    local cc=""
    if [ "$target_os" != "$host" ]; then
        cc="$(pick_cc "$target_os" "$target_arch")"
        if [ -n "$cc" ] && ! command -v "$cc" >/dev/null 2>&1; then
            warn "Skipping ${platform} (missing C compiler: ${cc})"
            return 0
        fi
    fi
    log "Building ${platform}…"
    if [ -n "$cc" ]; then
        if [ -n "$tags" ]; then
            CC="$cc" CGO_ENABLED=1 wails build -platform "$platform" -tags "$tags" -ldflags "$ldflags"
        else
            CC="$cc" CGO_ENABLED=1 wails build -platform "$platform" -ldflags "$ldflags"
        fi
    else
        if [ -n "$tags" ]; then
            CGO_ENABLED=1 wails build -platform "$platform" -tags "$tags" -ldflags "$ldflags"
        else
            CGO_ENABLED=1 wails build -platform "$platform" -ldflags "$ldflags"
        fi
    fi
 }
 main() {
    check_deps
    install_deps
    local version
    version="$(build_version)"
    local host
    host="$(host_os)"
    if [ "$host" = "unknown" ]; then
        err "Unsupported host OS for this script. Use macOS or Linux."
        exit 1
    fi
    # Build host targets first
    build_target "$host" "amd64" "$host" "$version"
    build_target "$host" "arm64" "$host" "$version"
    # Cross-build Linux and Windows targets where toolchains are available
    if [ "$host" = "darwin" ] || [ "$host" = "linux" ]; then
        build_target "linux" "amd64" "$host" "$version"
        build_target "linux" "arm64" "$host" "$version"
        build_target "windows" "amd64" "$host" "$version"
        build_target "windows" "arm64" "$host" "$version"
    fi
    log "Builds complete. Output: build/bin/"
 }
 main "$@"
@@ -1,124 +0,0 @@
 # build.ps1 — Windows build script for Nexus Terminal
 # Usage: .\build.ps1 [dev|build|test|clean|deps]
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 function Write-Info($Message) { Write-Host "[nexus] $Message" -ForegroundColor Green }
 function Write-Warn($Message) { Write-Host "[nexus] $Message" -ForegroundColor Yellow }
 function Write-Err($Message)  { Write-Host "[nexus] $Message" -ForegroundColor Red }
 function Get-WailsPath {
    $wails = Get-Command wails -ErrorAction SilentlyContinue
    if ($wails) { return $wails.Source }
    $goPath = & go env GOPATH
    $fallback = Join-Path $goPath 'bin\wails.exe'
    if (Test-Path $fallback) { return $fallback }
    return $null
 }
 function Check-Deps {
    if (-not (Get-Command go -ErrorAction SilentlyContinue)) { throw 'Go is not installed.' }
    if (-not (Get-Command node -ErrorAction SilentlyContinue)) { throw 'Node.js is not installed.' }
    if (-not (Get-Command npm -ErrorAction SilentlyContinue)) { throw 'npm is not installed.' }
    $wailsPath = Get-WailsPath
    if (-not $wailsPath) {
        throw 'Wails is not installed. Run: go install github.com/wailsapp/wails/v2/cmd/wails@latest'
    }
    Write-Info "Go:    $(& go version)"
    Write-Info "Node:  $(& node --version)"
    Write-Info "Wails: $(& $wailsPath version | Select-Object -First 1)"
    if (-not (Get-Command gcc -ErrorAction SilentlyContinue)) {
        Write-Warn 'gcc not found. SQLite requires cgo + a C compiler (e.g. MSYS2 mingw-w64).'
    }
    return $wailsPath
 }
 function Install-Deps {
    Write-Info 'Installing Go dependencies...'
    & go mod download
    Write-Info 'Installing frontend dependencies...'
    Push-Location 'frontend'
    & npm install
    Pop-Location
 }
 function Get-BuildVersion {
    try {
        $tag = & git describe --tags --abbrev=0 2>$null
        if (-not $tag) { $tag = 'dev' }
    } catch {
        $tag = 'dev'
    }
    try {
        $commit = & git rev-parse --short HEAD 2>$null
        if (-not $commit) { $commit = 'unknown' }
    } catch {
        $commit = 'unknown'
    }
    return "$tag-$commit"
 }
 function Get-Ldflags([string]$Version) {
    $flags = "-s -w -X github.com/andydixon/nexus/internal/api.appVersion=$Version"
    if ($env:NEXUS_UPDATE_URL) {
        $flags += " -X github.com/andydixon/nexus/internal/api.appUpdateURL=$($env:NEXUS_UPDATE_URL)"
    }
    return $flags
 }
 function Dev {
    $wailsPath = Check-Deps
    Install-Deps
    Write-Info 'Starting development mode...'
    & $wailsPath dev
 }
 function Build {
    $wailsPath = Check-Deps
    Install-Deps
    $version = Get-BuildVersion
    $ldflags = Get-Ldflags $version
    $env:CGO_ENABLED = '1'
    Write-Info 'Building production binary (CGO_ENABLED=1)...'
    & $wailsPath build -ldflags $ldflags
    Write-Info 'Build complete: build\bin\'
 }
 function Run-Tests {
    Write-Info 'Running tests...'
    & go test ./... -v -count=1
 }
 function Clean {
    Write-Info 'Cleaning build artefacts...'
    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue build\bin
    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\node_modules
    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\src\js\lib
    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue frontend\src\css\lib
    & go clean -testcache
    Write-Info 'Clean complete'
 }
 $task = $args[0]
 if (-not $task) { $task = 'build' }
 switch ($task) {
    'dev'   { Dev }
    'build' { Build }
    'test'  { Run-Tests }
    'clean' { Clean }
    'deps'  { Check-Deps | Out-Null; Install-Deps }
    default {
        Write-Err 'Usage: .\\build.ps1 [dev|build|test|clean|deps]'
        exit 1
    }
 }
@@ -1,142 +0,0 @@
 #!/usr/bin/env bash
 # build.sh — Build script for Nexus Terminal
 # Provides a reproducible build process for CI and local builds.
 # Usage: ./build.sh [dev|build|test|clean|deps]
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 # Colours for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m'
 log()  { echo -e "${GREEN}[nexus]${NC} $1"; }
 warn() { echo -e "${YELLOW}[nexus]${NC} $1"; }
 err()  { echo -e "${RED}[nexus]${NC} $1" >&2; }
 build_tags() {
    if command -v pkg-config >/dev/null 2>&1 \
        && pkg-config --exists webkit2gtk-4.1 \
        && ! pkg-config --exists webkit2gtk-4.0; then
        echo "webkit2_41"
    fi
 }
 build_version() {
    local tag
    local commit
    tag="$(git describe --tags --abbrev=0 2>/dev/null || echo "dev")"
    commit="$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")"
    echo "${tag}-${commit}"
 }
 build_ldflags() {
    local version="$1"
    local flags="-s -w -X github.com/andydixon/nexus/internal/api.appVersion=${version}"
    if [ -n "${NEXUS_UPDATE_URL:-}" ]; then
        flags="${flags} -X github.com/andydixon/nexus/internal/api.appUpdateURL=${NEXUS_UPDATE_URL}"
    fi
    echo "${flags}"
 }
 # Check prerequisites
 check_deps() {
    command -v go >/dev/null 2>&1 || { err "Go is not installed"; exit 1; }
    command -v node >/dev/null 2>&1 || { err "Node.js is not installed"; exit 1; }
    command -v npm >/dev/null 2>&1 || { err "npm is not installed"; exit 1; }
    if ! command -v wails >/dev/null 2>&1; then
        if [ -f "$HOME/go/bin/wails" ]; then
            export PATH="$PATH:$HOME/go/bin"
        else
            err "Wails is not installed. Run: go install github.com/wailsapp/wails/v2/cmd/wails@latest"
            exit 1
        fi
    fi
    log "All prerequisites found"
    log "Go:    $(go version)"
    log "Node:  $(node --version)"
    log "Wails: $(wails version 2>/dev/null | head -1)"
 }
 # Install dependencies
 install_deps() {
    log "Installing Go dependencies…"
    go mod download
    log "Installing frontend dependencies…"
    cd frontend && npm install && cd ..
    log "Dependencies installed"
 }
 # Development mode
 dev() {
    check_deps
    install_deps
    log "Starting development mode…"
    wails dev
 }
 # Production build
 build() {
    check_deps
    install_deps
    log "Building production binary…"
    local version
    version="$(build_version)"
    local tags
    tags="$(build_tags)"
    if [ -n "$tags" ]; then
        log "Using Wails build tags: ${tags}"
        wails build -tags "$tags" -ldflags "$(build_ldflags "${version}")"
    else
        wails build -ldflags "$(build_ldflags "${version}")"
    fi
    # Replace Wails-generated icon with custom app icon on macOS.
    if [[ "$OSTYPE" == darwin* ]]; then
        local app_bundle="build/bin/nexus-terminal.app"
        local custom_icns="build/darwin/AppIcon.icns"
        if [ -d "$app_bundle" ] && [ -f "$custom_icns" ]; then
            cp "$custom_icns" "$app_bundle/Contents/Resources/iconfile.icns"
            log "Replaced app icon with custom AppIcon.icns"
        fi
    fi
    log "Build complete: build/bin/"
 }
 # Run tests
 run_tests() {
    log "Running tests…"
    go test ./... -v -count=1
 }
 # Clean build artefacts
 clean() {
    log "Cleaning build artefacts…"
    rm -rf build/bin
    rm -rf frontend/node_modules
    rm -rf frontend/src/js/lib
    rm -rf frontend/src/css/lib
    go clean -testcache
    log "Clean complete"
 }
 # Main
 case "${1:-build}" in
    dev)     dev ;;
    build)   build ;;
    test)    run_tests ;;
    clean)   clean ;;
    deps)    check_deps && install_deps ;;
    *)
        echo "Usage: $0 [dev|build|test|clean|deps]"
        exit 1
        ;;
 esac
@@ -1,69 +0,0 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
    <dict>
        <key>CFBundlePackageType</key>
        <string>APPL</string>
        <key>CFBundleName</key>
        <string>{{.Info.ProductName}}</string>
        <key>CFBundleExecutable</key>
        <string>{{.OutputFilename}}</string>
        <key>CFBundleIdentifier</key>
        <string>com.andydixon.nexusterminal</string>
        <key>CFBundleVersion</key>
        <string>{{.Info.ProductVersion}}</string>
        <key>CFBundleGetInfoString</key>
        <string>{{.Info.Comments}}</string>
        <key>CFBundleShortVersionString</key>
        <string>{{.Info.ProductVersion}}</string>
        <key>CFBundleIconFile</key>
        <string>iconfile</string>
        <key>LSMinimumSystemVersion</key>
        <string>10.13.0</string>
        <key>LSApplicationCategoryType</key>
        <string>public.app-category.developer-tools</string>
        <key>NSHighResolutionCapable</key>
        <string>true</string>
        <key>NSSupportsAutomaticTermination</key>
        <false/>
        <key>NSSupportsSuddenTermination</key>
        <false/>
        <key>NSHumanReadableCopyright</key>
        <string>{{.Info.Copyright}}</string>
        {{if .Info.FileAssociations}}
        <key>CFBundleDocumentTypes</key>
        <array>
          {{range .Info.FileAssociations}}
          <dict>
            <key>CFBundleTypeExtensions</key>
            <array>
              <string>{{.Ext}}</string>
            </array>
            <key>CFBundleTypeName</key>
            <string>{{.Name}}</string>
            <key>CFBundleTypeRole</key>
            <string>{{.Role}}</string>
            <key>CFBundleTypeIconFile</key>
            <string>{{.IconName}}</string>
          </dict>
          {{end}}
        </array>
        {{end}}
        {{if .Info.Protocols}}
        <key>CFBundleURLTypes</key>
        <array>
          {{range .Info.Protocols}}
            <dict>
                <key>CFBundleURLName</key>
                <string>com.wails.{{.Scheme}}</string>
                <key>CFBundleURLSchemes</key>
                <array>
                    <string>{{.Scheme}}</string>
                </array>
                <key>CFBundleTypeRole</key>
                <string>{{.Role}}</string>
            </dict>
          {{end}}
        </array>
        {{end}}
    </dict>
 </plist>
@@ -1,15 +0,0 @@
 {
 	"fixed": {
 		"file_version": "{{.Info.ProductVersion}}"
 	},
 	"info": {
 		"0000": {
 			"ProductVersion": "{{.Info.ProductVersion}}",
 			"CompanyName": "{{.Info.CompanyName}}",
 			"FileDescription": "{{.Info.ProductName}}",
 			"LegalCopyright": "{{.Info.Copyright}}",
 			"ProductName": "{{.Info.ProductName}}",
 			"Comments": "{{.Info.Comments}}"
 		}
 	}
 }
@@ -1,15 +0,0 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
    <assemblyIdentity type="win32" name="com.wails.{{.Name}}" version="{{.Info.ProductVersion}}.0" processorArchitecture="*"/>
    <dependency>
        <dependentAssembly>
            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
        </dependentAssembly>
    </dependency>
    <asmv3:application>
        <asmv3:windowsSettings>
            <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <!-- fallback for Windows 7 and 8 -->
            <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">permonitorv2,permonitor</dpiAwareness> <!-- falls back to per-monitor if per-monitor v2 is not supported -->
        </asmv3:windowsSettings>
    </asmv3:application>
 </assembly>
@@ -1,77 +1,74 @@
 # Build and Release
-This project uses [Wails](https://wails.io/) for desktop packaging.
+Nexus Terminal is a Rust workspace in `rust/`:
-## Ubuntu 24.04 prerequisites
+```
-
+rust/
-Install the Linux build toolchain and Wails runtime headers with:
+├── core/   nexus-core: storage, secrets, protocol clients, session manager, Service. No GUI.
-
+└── app/    nexus: the egui desktop app (binary `nexus-terminal`)
 ```bash
 sudo apt-get update
 sudo apt-get install -y \
  build-essential \
  libgtk-3-dev \
  libwebkit2gtk-4.1-dev \
  libayatana-appindicator3-dev \
  pkg-config \
  zip
 ```
-Notes:
+The toolchain is pinned in `rust/rust-toolchain.toml`; `rustup` installs it on first build.
- Ubuntu 24.04 does not ship `libwebkit2gtk-4.0-dev`.
+## Prerequisites
 - Wails `v2.12.0` supports Ubuntu 24.04 by building with the `webkit2_41` tag.
 - The local build scripts detect that package layout automatically and add the tag when needed.
-You will also need these tools available in `PATH`:
+- **All platforms:** [rustup](https://rustup.rs).
-
+- **Linux:** the X11/Wayland/GL headers eframe links against, and GTK for native file dialogs:
 - `go`
 - `node`
 - `npm`
 - `wails`
 Install the Wails CLI with:
  ```bash
-go install github.com/wailsapp/wails/v2/cmd/wails@latest
+  sudo apt-get install -y build-essential pkg-config libxkbcommon-dev libgl1-mesa-dev \
-export PATH="$PATH:$(go env GOPATH)/bin"
+    libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev zip
  ```
-## Build commands
+- **macOS:** Xcode command-line tools (`xcode-select --install`).
 - **Windows:** the MSVC build tools (Visual Studio Build Tools, "Desktop development with C++").
-Build the app binary for the current host:
+There are no runtime C libraries to install: SQLite is compiled in and TLS uses rustls.
 ## Build and run
 ```bash
-./build.sh
+cd rust
 cargo run --release                 # the app
 cargo test --workspace              # unit and integration tests
 cargo clippy --workspace -- -D warnings
 ```
-Build a packaged release for the current host platform:
+Useful flags (also handy for testing): `nexus-terminal [--theme pro|midnight|light]
-
+[--data-dir DIR] [--screenshot out.png] [--size WxH] [--run-local CMD]`. `--data-dir` points at
-```bash
+another data directory; `--screenshot` renders the window, saves a PNG and exits (works under
-./release.sh
+`xvfb-run`); `--run-local` opens a local terminal and types `CMD` into it.
-```
+
-
+The SSH integration tests start a throwaway `sshd` as the current user on a random port; they
-By default, `./release.sh` now builds only the current host OS/architecture. On this Ubuntu 24.04 `amd64` host that means `linux/amd64`.
+skip themselves when OpenSSH isn't installed.
-
+
-## Optional cross-compilers
+## Release packages
 If you want to add extra Linux/Windows targets from Ubuntu, install the relevant cross-compiler packages first:
 ```bash
 sudo apt-get install -y \
  gcc-aarch64-linux-gnu \
  gcc-mingw-w64-x86-64
 ```
 Then request explicit targets:
 ```bash
 cd rust
 ./release.sh                                            # this machine's platform
 NEXUS_RELEASE_TARGETS=linux/amd64,windows/amd64 ./release.sh
 ```
-## Platform caveats
+Artefacts land in `build/releases/<version>/` at the repo root:
- macOS targets cannot be cross-built from Linux with Wails. Build those on macOS.
+- `NexusTerminal-<os>-<arch>.zip` — on macOS a universal-capable `.app` bundle
- `windows/arm64` is not covered by the default Ubuntu toolchain here.
+  (`rust/packaging/macos/build-app.sh`), on Windows the `.exe` (icon and version info embedded,
- `linux/arm64` needs more than `gcc-aarch64-linux-gnu`; it also needs an `arm64` sysroot and target GTK/WebKit development libraries for CGO to link cleanly.
+  GUI subsystem), on Linux the binary plus `install.sh` and a `.desktop` entry
- Tested on Ubuntu 24.04 `amd64`: `linux/amd64` and `windows/amd64` build successfully; `linux/arm64` does not in the default host setup above.
+  (`rust/packaging/linux/install.sh` installs into `~/.local`).
 - `manifest-<os>-<arch>.json` and `version-<os>-<arch>.txt` for the update server
  (`updates/index.php`), in the same format as before.
 The version is `<latest tag>-<short commit>` unless `NEXUS_VERSION` is set. The update manifest
 URL is compiled in from `NEXUS_UPDATE_URL` (default in `release.sh`); `{platform}` and `{arch}` use
 the old Go names (`darwin`/`linux`/`windows`, `amd64`/`arm64`).
 Cross-building `windows/amd64` from Linux works with `x86_64-pc-windows-gnu` and mingw-w64.
 macOS bundles must be built on a Mac. CI (`.github/workflows/release-builds.yml`) builds every
 platform natively on GitHub runners and attaches the zips to tagged releases;
 `.github/workflows/ci.yml` runs tests and clippy on Linux, macOS and Windows.
 ## Signing
 macOS bundles are ad-hoc signed. For distribution, sign with a Developer ID and notarize (see the
 comments in `build-app.sh`). Windows binaries are unsigned.
@@ -0,0 +1,11 @@
 # Builds nexus-guide.pdf with LuaLaTeX (three passes: contents, page references, then page overlays settle).
 # Needs LuaLaTeX with luaotfload (Debian/Ubuntu: texlive-luatex texlive-latex-extra).
 # Screenshots: tools/screenshots.sh (needs xvfb-run, sshd, python3).
 OUT ?= build
 nexus-guide.pdf: nexus-guide.tex nexus-guide.sty chapters/*.tex img/*
 	mkdir -p $(OUT)
 	lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null || (grep -A8 '^!' $(OUT)/nexus-guide.log; false)
 	for i in 1 2; do lualatex -interaction=nonstopmode -halt-on-error -output-directory=$(OUT) nexus-guide.tex > /dev/null; done
 	cp $(OUT)/nexus-guide.pdf .
 clean:
 	rm -rf $(OUT)
@@ -0,0 +1,111 @@
 \guidepart{slate}{Extras}{The extras}
  {The cheat sheet, the command line, and words you might trip over.}
  {\partitem{\iKeyboard}{Keyboard cheat sheet}
   \partitem{\iTerminal}{Command-line options}
   \partitem{\iBrain}{Glossary}}
 % =========================================================================================
 \chapter{Keyboard cheat sheet}\label{app:keys}
 \chapmeta{print it}{Stick this page next to your monitor}
 \newcommand\shortcut[2]{#1 & #2\\}
 \newcommand\sheet[3]{%
  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=10pt, right=10pt, top=8pt, bottom=8pt,
    before skip=0pt, after skip=10pt, fontupper=\small]
  {\heavy\large\color{#1!85!black}#2}\par\vspace{4pt}
  \renewcommand\arraystretch{1.5}\begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{36mm}@{}}#3\end{tabularx}
  \end{tcolorbox}}
 \begin{multicols}{2}
 \sheet{accent}{\iRocket\enspace Everywhere}{%
  \shortcut{Command palette}{\keys{\mod+K}}
  \shortcut{New connection}{\keys{\mod+N}}
  \shortcut{Quick Connect}{\keys{\mod+Shift+Q}}
  \shortcut{Settings}{\keys{\mod+,}}
  \shortcut{Full screen}{\kbd{F11}}}
 \sheet{violet}{\iSplit\enspace Tabs \& panes}{%
  \shortcut{Close tab}{\keys{\mod+W}}
  \shortcut{Next tab}{\keys{\mod+Tab}}
  \shortcut{Previous tab}{\keys{\mod+Shift+Tab}}
  \shortcut{Go to tab 1–9}{\keys{\mod+1}…\kbd{9}}
  \shortcut{Split right}{\keys{\mod+Shift+D}}
  \shortcut{Split down}{\keys{\mod+Shift+E}}}
 \sheet{teal}{\iWand\enspace Power tools}{%
  \shortcut{Broadcast on/off}{\keys{\mod+Shift+B}}
  \shortcut{Snippets}{\keys{\mod+Shift+S}}
  \shortcut{Record on/off}{\keys{\mod+Shift+R}}}
 \sheet{amber}{\iTerminal\enspace In the terminal}{%
  \shortcut{Copy selection}{\keys{\mod+C}}
  \shortcut{Paste}{\keys{\mod+V}}
  \shortcut{Find}{\keys{\mod+F}}
  \shortcut{Next / previous match}{\kbd{Enter} / \keys{Shift+Enter}}
  \shortcut{Scroll a page}{\keys{Shift+PageUp}}
  \shortcut{Top / bottom}{\keys{Shift+Home} / \kbd{End}}
  \shortcut{Open link}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}}
 \sheet{pink}{\iMap\enspace Mouse moves}{%
  \shortcut{Select word / line}{double / triple-click}
  \shortcut{Extend selection}{\kbd{Shift} + click}
  \shortcut{Select several profiles}{\kbd{Ctrl}/\kbd{\ph{E1C4}} + click}
  \shortcut{Everything else}{right-click it}}
 \end{multicols}
 % =========================================================================================
 \chapter{Command-line options}\label{app:cli}
 \chapmeta{1 minute}{You'll script, demo and test with a few handy flags}
 \renewcommand\arraystretch{1.5}
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\ttfamily\color{ink}}p{52mm}X@{}}
  \toprule
  --data-dir DIR        & Use another data folder (portable installs, demos, testing).\\
  --theme pro|midnight|light & Start with this theme.\\
  --connect NAME        & Connect to a saved profile by name at startup. Repeat it for several.\\
  --open WINDOW         & Open a window at startup: \code{settings}, \code{settings:security}, \code{snippets},
                          \code{keys}, \code{recordings}, \code{palette}, \code{quick}…\\
  --version             & Print the version and exit.\\
  \bottomrule
 \end{tabularx}
 \begin{sidequest}[How the screenshots in this guide were made]
 Every screenshot here is the real app, driven by \code{docs/guide/tools/screenshots.sh}: it starts throwaway
 SSH, IRC, VNC and GitHub-ish servers, fills a demo data folder, and runs Nexus Terminal headless with
 \code{--screenshot}, \code{--do} (run a palette command) and \code{--answer} (fill a password prompt). Change the app,
 rerun the script, rebuild the guide.
 \end{sidequest}
 % =========================================================================================
 \chapter{Glossary}\label{app:glossary}
 \chapmeta{dip in}{Words you might trip over, in one line each}
 \begin{multicols}{2}\small
 \begin{description}[leftmargin=0pt, itemsep=5pt]
  \item[Agent] A background program holding your unlocked SSH keys, so you type the passphrase once.
  \item[Asciicast] The file format for terminal recordings. Plays in Nexus Terminal and \code{asciinema}.
  \item[Bastion / jump host] A server you go \emph{through} to reach the ones behind it.
  \item[Baud rate] How fast a serial line talks. Both ends must agree.
  \item[Broadcast] Typing into several sessions at once.
  \item[DTR / RTS] Serial control lines. Some boards use them for reset or flashing.
  \item[Fingerprint] A short summary of a server's host key, used to spot imposters.
  \item[Host key] A server's identity. Changes when it's rebuilt, or when someone's pretending.
  \item[Keychain] Your operating system's password store.
  \item[Port forward] A tunnel carrying one TCP port through SSH.
  \item[Profile] A saved connection.
  \item[RAW TCP] A plain socket: bytes in, bytes out, no terminal rules.
  \item[SFTP] File transfer over SSH.
  \item[Snippet] A saved command, optionally with blanks to fill in.
  \item[TOTP] Time-based one-time passwords: the six digits from your authenticator app.
  \item[Trigger] A rule that watches output and reacts to a pattern.
  \item[Vault] Nexus Terminal's encrypted password store, for when there's no keychain.
  \item[VNC] A way of seeing and controlling another computer's desktop.
 \end{description}
 \end{multicols}
 \vfill
 \begin{center}
 \includegraphics[width=16mm]{img/logo.pdf}\par\vspace{6pt}
 {\heavy\color{ink}That's the lot.}\par
 {\small\color{muted}Go and connect to something. \iRocket}
 \end{center}
@@ -0,0 +1,248 @@
 \guidepart{accent}{Get going}{Get going}
  {From zero to connected before your tea goes cold.}
  {\partitem{\iRocket}{Five-minute start}
   \partitem{\iMap}{The grand tour}
   \partitem{\iList}{Profiles: your address book}}
 % =========================================================================================
 \chapter{Five-minute start}\label{ch:start}
 \chapmeta{5 minutes}{You'll be connected to something and know the one shortcut that matters}
 \begin{tldr}
 Install it, open it, press \keys{\mod+N}, fill in a host, hit \ui{Create \& Connect}. Done.
 Lost? Press \keys{\mod+K} and type what you want.
 \end{tldr}
 \section{Install it}
 Grab the zip for your machine from \code{dixon.cx/downloads/nexus}. They're named
 \code{NexusTerminal-<os>-<arch>.zip}, so a modern Mac wants \code{darwin-arm64} and most PCs want \code{amd64}.
 \begin{description}
  \item[\iDesktop\enspace Windows] Unzip it and run \code{NexusTerminal-windows-amd64.exe}. No installer, no admin rights,
    nothing in the registry. Pop it somewhere sensible like \code{C:\textbackslash Tools} and pin it to the taskbar.
  \item[\iDesktop\enspace macOS] Unzip it and drag \code{NexusTerminal-darwin-arm64.app} into \ui{Applications}. If macOS
    grumbles that it can't check the developer, right-click the app, choose \ui{Open}, then \ui{Open} again. You only
    have to do that once.
  \item[\iDesktop\enspace Linux] Unzip it and run \code{./install.sh}. It copies \code{nexus-terminal} into
    \code{~/.local/bin} and adds a launcher entry with the icon, so it turns up in your app menu.
    (Make sure \code{~/.local/bin} is on your \code{PATH}.)
 \end{description}
 \begin{sidequest}[Build it yourself]
 It's a single Rust program. With Rust installed: \code{cd rust \&\& cargo run --release}. The finished binary lands in
 \code{rust/target/release/nexus-terminal}. The build guide in \code{docs/build-and-release.md} has the full story.
 \end{sidequest}
 \section{Open it}
 The first time you open Nexus Terminal you get a calm, empty welcome screen. Three buttons, four shortcuts. That's it.
 \shot{welcome.png}{The welcome screen. Your saved connections will live down the left; here there are a few already.}
 \begin{headsup}[Coming from Alchementary Link?]
 Nexus Terminal spots your old data on first run and copies your profiles, vault and recordings across
 automatically. You'll see a little toast saying so. Your old data is left exactly where it was.
 The details are in \hyperref[ch:move]{Moving house} on p.\,\pageref{ch:move}.
 \end{headsup}
 \section{Make your first connection}
 \begin{enumerate}
  \item Click \ui{New Connection}, or press \keys{\mod+N}.
  \item Pick the protocol along the top: \proto[teal]{SSH}, \proto[amber]{Telnet}, \proto[violet]{RAW TCP},
        \proto[slate]{GitHub}, \proto[rose]{VNC}, \proto[amber]{IRC} or \proto[accent]{Serial}.
  \item Fill in the \ui{General} bit: a \ui{Display Name} you'll recognise, the \ui{Host}, the \ui{Port}
        and your \ui{Username}.
  \item Click \ui{Create \& Connect}.
 \end{enumerate}
 That's genuinely it. A tab opens, you log in, and next time it's one click in the sidebar.
 \crop{editor-new.png}{1515}{40}{0}{70}{0.52\linewidth}{A brand-new SSH profile. Only the top few fields are needed to get going.}
 \begin{quickwin}
 Click \ui{Test} before you save. Nexus Terminal checks the host and port are reachable and tells you the
 round-trip time. If that fails, no amount of password-fiddling will help, so it's a great first check.
 \end{quickwin}
 \section{Two shortcuts for impatient people}
 \subsection{Quick Connect}
 Press \keys{\mod+Shift+Q}.
 For a one-off session you don't want to save. Pick SSH, Telnet, RAW, IRC or Serial, type the host (or serial
 device), hit \kbd{Enter}. Nothing gets saved.
 \crop{quick.png}{951}{620}{946}{481}{0.5\linewidth}{Quick Connect. In, out, nobody gets hurt.}
 \subsection{Local terminal}
 Click \ui{Local Machine} at the top of the sidebar (or \ui{Local} on the welcome screen) for a shell on
 \emph{this} computer. When you type \code{exit}, the tab says \code{[Exited - press enter to restart]}.
 Press \kbd{Enter} and you've got a fresh shell in the same tab.
 \section{The one shortcut to rule them all}
 \begin{center}
 \begin{tcolorbox}[enhanced, width=0.8\linewidth, arc=10pt, boxrule=0pt, colback=ink, fontupper=\color{white},
  halign=center, top=10pt, bottom=10pt, drop fuzzy shadow]
 {\scalebox{2.4}{\keys{\mod+K}}}\par\vspace{6pt}\par\vspace{4pt}
 {\color{white!70!ink} The command palette. If you remember nothing else, remember this.}
 \end{tcolorbox}
 \end{center}
 Type a few letters of \emph{anything}: a connection name, a tab, ``theme'', ``split'', ``lock'', ``snippets''. Use
 \kbd{↑}\kbd{↓} to pick, \kbd{Enter} to go, \kbd{Esc} to bail. It's fuzzy, so ``atl'' finds \emph{atlas} and
 ``sft'' finds the \emph{SFTP Browser}.
 \crop{palette.png}{755}{732}{733}{154}{0.72\linewidth}{The command palette: every connection, tab and action in one searchable list.}
 \begin{quickwin}[Your five-minute checklist]
 \begin{checklist}
  \item Installed and opened Nexus Terminal
  \item Opened a \ui{Local Machine} tab and typed \code{exit}, then \kbd{Enter} to get it back
  \item Made a profile with \keys{\mod+N} and clicked \ui{Test}
  \item Connected to it
  \item Opened the palette with \keys{\mod+K} and found something by typing three letters
 \end{checklist}
 All ticked? You're officially more productive than you were five minutes ago. \iConfetti
 \end{quickwin}
 % =========================================================================================
 \chapter{The grand tour}\label{ch:tour}
 \chapmeta{4 minutes}{You'll know what every bit of the window is for}
 \begin{tldr}
 Connections on the left. Sessions in tabs across the top. The terminal in the middle. Status along the bottom.
 Everything else is one \keys{\mod+K} away.
 \end{tldr}
 \begin{annotated}{ssh.png}
  \callout{1}{0.124}{0.022}
  \callout{2}{0.66}{0.022}
  \callout{3}{0.888}{0.022}
  \callout{4}{0.22}{0.067}
  \callout{5}{0.03}{0.152}
  \callout{6}{0.53}{0.063}
  \callout{7}{0.966}{0.063}
  \callout{8}{0.62}{0.42}
  \callout{9}{0.16}{0.945}
  \callout{10}{0.26}{0.985}
  \callout{11}{0.86}{0.985}
 \end{annotated}
 \begin{multicols}{2}\small
 \begin{description}[leftmargin=0pt, labelsep=0.4em]
  \item[\num{1} Menus] \menu{File}, \menu{Session}, \menu{View} and \menu{Help}. Drag the title bar to move the
        window; double-click it to maximise.
  \item[\num{2} Palette] The search box is the command palette. Click it or press \keys{\mod+K}.
  \item[\num{3} Light/dark] Flip between the dark and light themes in one click.
  \item[\num{4} Search] Fuzzy-search your connections by name, host, tag or protocol.
  \item[\num{5} Sections] \ui{Local Machine}, \ui{Favourites} \iStar, \ui{Recent} (your last five), then one section
        per group. Click a header to fold it away.
  \item[\num{6} Tabs] One per session, with a coloured state dot, protocol badge and close button. SSH tabs get a
        little \iFolder{} for files. A blue dot means ``new output while you weren't looking''.
  \item[\num{7} New \& broadcast] \ui{+} opens a new connection; \iBroadcast{} toggles broadcast mode.
  \item[\num{8} Workspace] Your terminal (or IRC chat, VNC desktop, GitHub list…). Split it into panes, too.
  \item[\num{9} Footer] New connection, palette, import, export, recordings and settings.
  \item[\num{10} Status] State, protocol and live latency for SSH. Shows \ui{REC} while recording and
        \ui{BROADCAST} when broadcasting.
  \item[\num{11} Sessions \& vault] How many sessions are connected and whether the vault is locked. Click the vault to
        open security settings.
 \end{description}
 \end{multicols}
 \begin{protip}
 Drag the right-hand edge of the sidebar to make it wider or narrower. Toasts (the little pop-up messages in the
 top-right) tidy themselves away after a few seconds; click \ui{×} if you're impatient.
 \end{protip}
 \section{Three looks}
 Nexus Terminal comes in \ui{Pro} (the default, a soft charcoal), \ui{Midnight} (darker, bluer, for 2\,a.m.
 deploys) and \ui{Light} (for sunny days and projectors). Switch with the \iBulb{} button in the title bar, the
 \menu{View} menu, or type ``theme'' into the palette.
 \shotpair{welcome-midnight.png}{Midnight}{ssh-light.png}{Light, with a session open}
 The \emph{terminal} has its own colour schemes too: eleven of them, including \ui{Dracula}, \ui{Nord},
 \ui{Tokyo Night}, \ui{Catppuccin Mocha} and \ui{Rosé Pine}. Those live in \menu{Settings\then Terminal} and the \menu{View} menu.
 % =========================================================================================
 \chapter{Profiles: your address book}\label{ch:profiles}
 \chapmeta{6 minutes}{You'll keep dozens of connections tidy without thinking about it}
 \begin{tldr}
 A \emph{profile} is a saved connection. Give it a name and a group, star the ones you use daily, and
 right-click for everything else. Ctrl-click to select lots at once.
 \end{tldr}
 \section{Create, edit, copy}
 \begin{itemize}
  \item \textbf{New:} \ui{+} in the sidebar footer or tab strip, \keys{\mod+N}, or right-click a group header and choose
        \ui{New connection in …} (it lands in that group automatically).
  \item \textbf{Edit:} double-click a profile, or right-click\then\ui{Edit}. The editor slides in on the right.
  \item \textbf{Copy:} right-click\then\ui{Duplicate}. Great for ``same as web-01 but web-02''.
  \item \textbf{Delete:} right-click\then\ui{Delete}. This also deletes the saved passwords for that profile.
 \end{itemize}
 \crop{editor-ssh.png}{1515}{40}{0}{70}{0.52\linewidth}{Editing an existing SSH profile. The editor scrolls; sections are grouped so you can ignore most of them.}
 \subsection{What goes in a profile}
 Every profile has the same \ui{General} section, then sections specific to its protocol (Part 2 covers each
 one). The common bits are:
 \renewcommand\arraystretch{1.4}
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{32mm}X@{}}
  \toprule
  Display Name & What you'll see in the sidebar. Make it obvious: ``db-primary'', not ``server 3''.\\
  Host / Port  & Where to connect. Serial profiles have a \ui{Device} instead.\\
  Group        & Pick an existing group or type a new name to create one.\\
  Description  & One line shown on hover.\\
  Terminal     & Font, size (8–36), scrollback (0–100\,000 lines) and cursor style, just for this profile.\\
  Tags \& Notes & Comma-separated tags (searchable!) and free-form notes for future-you.\\
  \bottomrule
 \end{tabularx}
 Each protocol adds its own sections underneath. Here are four of them side by side; Part~2 goes through each one.
 \begin{center}
 \newcommand\mini[2]{\begin{minipage}[t]{0.24\linewidth}\centering\includegraphics[width=\linewidth, trim=1515 600 0 70, clip]{img/#1}\par\vspace{2pt}{\scriptsize\color{muted}#2}\end{minipage}}
 \mini{editor-telnet.png}{Telnet}\hfill\mini{editor-raw.png}{RAW TCP}\hfill\mini{editor-vnc.png}{VNC}\hfill\mini{editor-irc.png}{IRC}
 \end{center}
 \begin{protip}[Tags are secretly brilliant]
 Tag things by where they live and what they do (\code{eu-west}, \code{db}, \code{customer-x}). The sidebar search
 matches tags, so typing ``db'' instantly narrows hundreds of profiles to the database servers.
 \end{protip}
 \section{Favourites, groups and Recent}
 \begin{itemize}
  \item Right-click\then\ui{Add to Favourites} pins a profile into the \ui{\iStar\ Favourites} section at the top.
  \item \ui{Recent} always shows the last five things you connected to. You don't have to do anything.
  \item Groups are just the \ui{Group} field. No group? It goes in \ui{Ungrouped}.
 \end{itemize}
 \section{Do lots at once}
 Hold \kbd{Ctrl} (\kbd{\ph{E1C4}} on a Mac) and click several profiles. A bar appears at the bottom of the sidebar:
 \begin{center}\small
 \begin{tabular}{@{}ll@{\qquad}ll@{}}
  \ui{Connect all} & opens them all in tabs & \ui{Move group} & moves them (blank = Ungrouped)\\
  \ui{Disconnect}  & closes their sessions & \ui{Delete} & deletes them (asks first)\\
  \ui{Tags}        & add or replace tags & \ui{Clear} & forget the selection\\
 \end{tabular}
 \end{center}
 \begin{quickwin}
 Select every web server, choose \ui{Connect all}, then turn on broadcast (\keys{\mod+Shift+B}). You're now typing into
 all of them at once. Chapter~\ref{ch:repeat} has the details, and the safety advice.
 \end{quickwin}
 \section{``It's already open…''}
 Click a profile that already has a live session and Nexus Terminal asks whether to \ui{Use Existing} (jump to that
 tab), open a \ui{New Connection} alongside it, or \ui{Cancel}. No more accidental duplicate sessions.
@@ -0,0 +1,273 @@
 \guidepart{teal}{Connect}{Connect to all the things}
  {Eight ways in. Pick the one you need; skip the rest.}
  {\partitem{\iTerminal}{SSH: the big one}
   \partitem{\iUsb}{Serial: cables and consoles}
   \partitem{\iPlug}{Telnet and RAW TCP}
   \partitem{\iDesktop}{VNC remote desktops}
   \partitem{\iChat}{IRC}
   \partitem{\iGithub}{GitHub}}
 % =========================================================================================
 \chapter{SSH: the big one}\label{ch:ssh}
 \chapmeta{10 minutes (or 2 for the basics)}{You'll log in with keys, hop through bastions and never type a 2FA code again}
 \begin{tldr}
 Host, username, key, done. Everything else (jump hosts, proxies, forwards, 2FA, login scripts) is optional and
 lives in its own fold-away section of the editor. Open only the ones you need.
 \end{tldr}
 \begin{glance}{teal}{SSH}
  Default port & 22\\
  Logs in with & Password, public key, keyboard-interactive, SSH agent\\
  Extras       & SFTP file browser, port forwards, live latency, agent forwarding, TOTP 2FA\\
  Good for     & Servers, VMs, Raspberry Pis, anything with \code{sshd}\\
 \end{glance}
 \section{The two-minute version}
 \begin{enumerate}
  \item \keys{\mod+N}, leave the protocol on \proto[teal]{SSH}.
  \item \ui{Host}, \ui{Username}. Leave the port on 22 unless you know otherwise.
  \item Under \ui{Key \& Passphrase}, pick your key from the suggestions (Nexus Terminal lists the keys in your
        \code{\textasciitilde/.ssh} folder) and check for a little green \ui{Key verified}.
  \item \ui{Create \& Connect}. The first time, you'll be asked to trust the server's host key. Say yes if you
        were expecting it.
 \end{enumerate}
 \crop{hostkey.png}{842}{720}{845}{589}{0.66\linewidth}{First time connecting? You'll be shown the server's fingerprint. \ui{Accept \& Save} if it's the server you meant.}
 \begin{headsup}
 Type the full path to a key if you're not using the suggestions. Nexus Terminal doesn't expand \code{\textasciitilde}
 in that box, so write \code{/home/you/.ssh/id\_ed25519} (or \code{C:\textbackslash Users\textbackslash you\textbackslash .ssh\textbackslash id\_ed25519}).
 \end{headsup}
 \section{How it logs in}
 Under \ui{Authentication}, tick which \ui{Auth Methods} to try: \ui{Public key}, \ui{Password} and
 \ui{Keyboard-interactive}. Under \ui{SSH Agent}, tick \ui{Use SSH Agent for Authentication} to use keys already
 loaded into \code{ssh-agent} (or Pageant, or the Windows OpenSSH agent).
 Every password and passphrase has a \emph{mode}: save it securely, remember it until you quit, or ask every time.
 That's all explained in \hyperref[ch:secrets]{Passwords \& the vault} (p.\,\pageref{ch:secrets}).
 \begin{protip}[Agent forwarding]
 Tick \ui{Forward Agent to Remote} (it's \code{ssh -A}) and you can \code{git pull} or hop onwards from the server using
 the keys on \emph{your} machine. Only do it on servers you trust: anyone with root there can use your agent while
 you're connected.
 \end{protip}
 \section{Jump hosts: getting through the bastion}
 Lots of servers hide behind a bastion. Add one or more hops under \ui{Jump Hosts}, each with its own user, host,
 port and optional key. Nexus Terminal tunnels through them in order, so the chain
 \textit{you\then bastion\then internal-box\then db-primary} is just three rows.
 \section{Proxies}
 Stuck behind a corporate proxy? Under \ui{Proxy}, choose \ui{SOCKS5} or \ui{HTTP CONNECT} and fill in the host,
 port and (optional) username and password. The proxy is used to reach the SSH server, or the first jump host if
 you have some.
 \section{2FA without the phone faff}\label{sec:totp}
 If your server asks for a one-time code, paste the Base32 TOTP secret (the text version of the QR code) into
 \ui{TOTP Secret} and hit \ui{Save}. From then on, Nexus Terminal answers the ``Verification code:'' prompt itself.
 \ui{Test} shows today's code so you can check it matches your phone.
 \begin{headsup}
 Save the profile first, then save the TOTP secret. And make sure your computer's clock is right: TOTP codes are
 time-based, so a clock that's a minute out will produce wrong codes.
 \end{headsup}
 \section{Do things automatically on login}
 \begin{description}
  \item[Startup] A \ui{Startup Command} to run once you're in (say, \code{tmux attach}), plus
        \ui{Environment Variables} as \code{KEY=VALUE}, one per line.
  \item[Login Script] For old-school boxes that ask questions. Add steps: \ui{Wait for} some text, then
        \ui{Send} a reply. Repeat as needed.
 \end{description}
 \section{Keeping it alive}
 Under \ui{Advanced}: the \ui{Terminal Type}, the \ui{Keepalive Interval} and \ui{Max Missed Keepalives}, compression,
 and \ui{Auto-Reconnect} with a maximum number of attempts (1–20). Reconnection backs off politely: 1\,s, 2\,s,
 4\,s… up to 30\,s.
 \begin{sidequest}[What's that number in the status bar?]
 For SSH sessions the status bar shows live latency, the round trip to the server. Green is snappy. If it's
 in the hundreds and your typing feels sticky, it's the network, not you.
 \end{sidequest}
 % =========================================================================================
 \chapter{Serial: cables and consoles}\label{ch:serial}
 \chapmeta{4 minutes}{You'll be talking to a switch, router or microcontroller over USB}
 \begin{tldr}
 Plug in the adapter, pick the device, match the baud rate. 115200 8N1 is the default and usually right.
 Right-click the tab to send a break or wiggle DTR/RTS.
 \end{tldr}
 \begin{glance}{accent}{Serial}
  Device       & \code{/dev/ttyUSB0}, \code{/dev/cu.usbserial-…} or \code{COM3}\\
  Defaults     & 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, DTR and RTS on\\
  Extras       & Send Break, toggle DTR/RTS, auto-reconnect when the cable comes back\\
  Good for     & Network gear consoles, Arduinos, ESP32s, Raspberry Pi UARTs, 3D printers\\
 \end{glance}
 \crop{editor-serial.png}{1515}{40}{0}{70}{0.52\linewidth}{A serial profile for a switch console at 9600 baud. Click refresh after plugging in an adapter.}
 \section{Setting it up}
 \begin{description}
  \item[Device] Pick it from the list (hit refresh after plugging in) or type the path.
  \item[Line Settings] \ui{Baud Rate} (a preset from 300 to 1\,000\,000, or \ui{Custom}), \ui{Data Bits} (5–8),
        \ui{Parity} (none, odd, even), \ui{Stop Bits} (1 or 2) and \ui{Flow Control} (none, XON/XOFF, RTS/CTS).
  \item[Behaviour] \ui{Line Ending}, \ui{Encoding}, \ui{Local Echo} (for devices that don't echo what you type),
        \ui{Assert DTR on connect}, \ui{Assert RTS on connect} and \ui{Auto-reconnect}.
 \end{description}
 \section{While you're connected}
 Right-click the tab for \ui{Send Break} (handy for getting into a router's ROMMON) and to toggle \ui{DTR} and
 \ui{RTS} (handy for resetting boards that wire those to reset). Pull the cable out and the session disconnects; with
 auto-reconnect on, it picks up again when you plug it back in.
 Serial tabs are proper terminals, so recording, triggers, broadcast, snippets, find and split panes all work.
 \begin{headsup}[Gibberish on screen?]
 Garbled characters nearly always mean the baud rate, parity or stop bits don't match the device. Check the
 device's manual. 9600 and 115200 are the usual suspects.
 \end{headsup}
 \begin{protip}[Linux and macOS quirks]
 On Linux, add yourself to the \code{dialout} group (\code{uucp} on some distributions) and log out and in again.
 On a Mac, use the \code{/dev/cu.*} device, not \code{/dev/tty.*}.
 \end{protip}
 % =========================================================================================
 \chapter{Telnet and RAW TCP}\label{ch:raw}
 \chapmeta{4 minutes}{You'll poke at old kit and raw sockets without reaching for netcat}
 \begin{tldr}
 Telnet is a terminal for old devices. RAW is a packet-level conversation with any TCP port, with a hex view.
 \end{tldr}
 \section{Telnet}
 \begin{glance}{amber}{Telnet}
  Default port & 23\\
  Options      & Local echo, line mode, terminal type, encoding (UTF-8, ASCII, ISO 8859-1), line endings, login script\\
  Extras       & Send Break from the tab menu, \ui{Debug Negotiation} for when options go wrong\\
 \end{glance}
 \begin{danger}[Telnet is plain text]
 Everything, including your password, crosses the network unencrypted. Fine on a lab bench, not fine over the
 internet or café Wi-Fi.
 \end{danger}
 \section{RAW TCP}
 RAW connects to any TCP port and shows you exactly what goes back and forth. Instead of a terminal you get a
 traffic log with \ui{Text}, \ui{Hex} and \ui{Split} views.
 \shot{raw.png}{A RAW session to a chatty sensor, with timestamps and direction markers turned on.}
 \begin{itemize}
  \item \textbf{Send bar:} pick \ui{Text}, \ui{Hex} or \ui{Escaped} (\code{\textbackslash r\textbackslash n} and friends),
        type, press \kbd{Enter}. One-click buttons send \ui{NUL}, \ui{CR}, \ui{LF}, \ui{ETX} and \ui{EOT}.
  \item \textbf{Presets:} save payloads you send often in the profile under \ui{Payload Presets}, then pick them from
        \ui{Presets…}.
  \item \textbf{Capture:} \ui{Pause}, \ui{Clear}, and \ui{Save} (writes the whole conversation as JSON).
  \item \textbf{Profile options:} encoding (UTF-8, ASCII, Hex), line ending, timestamps, direction, timeouts and
        auto-reconnect.
 \end{itemize}
 \begin{quickwin}
 Point a RAW profile at a web server on port 80 and send \code{HEAD / HTTP/1.0\textbackslash r\textbackslash n\textbackslash r\textbackslash n}
 in \ui{Escaped} mode. Instant HTTP headers, no browser required.
 \end{quickwin}
 % =========================================================================================
 \chapter{VNC remote desktops}\label{ch:vnc}
 \chapmeta{4 minutes}{You'll see and drive a remote desktop, safely}
 \begin{tldr}
 VNC shows you another computer's screen. Tunnel it through SSH (tick a box), because plain VNC isn't encrypted.
 \end{tldr}
 \begin{glance}{rose}{VNC}
  Default port & 5900 (plus the display number: display \code{:1} is 5901)\\
  Display      & \ui{View Only}, \ui{Scale to Fit}, \ui{Shared Session}, \ui{Quality (0-9)}\\
  Security     & Optional SSH tunnel with password, key or agent login\\
 \end{glance}
 \shot{vnc.png}{A remote desktop, scaled to fit the tab.}
 \section{The toolbar}
 Connection state and desktop size on the left. On the right: switch between scaled and 1:1, refresh,
 \ui{Paste Clipboard} (sends your clipboard to the remote machine) and \ui{Ctrl+Alt+Del}. Click the desktop to give
 it your keyboard. Anything the remote machine copies lands on your clipboard automatically.
 \section{Tunnel it}
 Tick \ui{Enable SSH Tunnel} and fill in the SSH host, port, username and login method. The VNC traffic then
 travels inside an encrypted SSH connection. If you connect to a VNC profile \emph{without} a tunnel, Nexus Terminal
 warns you and offers \ui{Connect Anyway}, \ui{Edit Profile} or \ui{Cancel}.
 \begin{headsup}[Connecting to a Mac?]
 Turn on \ui{VNC viewers may control screen with password} in macOS Screen Sharing settings. Nexus Terminal uses
 standard VNC password authentication, not Apple's own login method.
 \end{headsup}
 % =========================================================================================
 \chapter{IRC}\label{ch:irc}
 \chapmeta{3 minutes}{You'll be chatting in your project's channels from the same window as your servers}
 \begin{tldr}
 Nick, server, rooms to join. Tabs for each room, \code{/commands} as you'd expect, \kbd{Tab} completes nicks.
 \end{tldr}
 \begin{glance}{amber}{IRC}
  Default port & 6667, or 6697 with \ui{Use TLS} (use TLS!)\\
  Extras       & NickServ identify on connect, auto-join rooms, room browser, SSH tunnel\\
 \end{glance}
 \shot{irc.png}{Chatting in \#nexus. Rooms down the right, users in the room below them.}
 \begin{itemize}
  \item A \ui{Server} tab plus one per room or private conversation. A dot means unread messages.
  \item Commands: \code{/join}, \code{/part}, \code{/msg}, \code{/me}, \code{/notice}, \code{/nick}, \code{/topic},
        \code{/list}, \code{/names}, \code{/whois}, \code{/who}, \code{/raw}, \code{/quit} and \code{/help}.
  \item \kbd{Tab} completes a nick; click a nick to mention them.
  \item The side panel lists your rooms, a room browser with a filter (click to join) and who's in the current room.
 \end{itemize}
 % =========================================================================================
 \chapter{GitHub}\label{ch:github}
 \chapmeta{2 minutes}{You'll see all your repositories, freshest first}
 \crop{editor-github.png}{1515}{780}{0}{70}{0.5\linewidth}{A GitHub profile: just the API address and a token.}
 \begin{tldr}
 Paste a personal access token with the \code{repo} scope. Get a tidy, filterable list of every repository you can see.
 \end{tldr}
 \shot{github.png}{Repositories grouped by owner, with the latest commit and who made it.}
 \begin{itemize}
  \item Grouped by owner or organisation, sorted by most recent activity.
  \item Badges for \proto[rose]{Private}, \proto[violet]{Fork} and \proto[amber]{Archived}, plus language and stars.
  \item Filter box, \ui{Refresh now}, \ui{Visit} (opens in your browser) and \ui{ZIP} (downloads an archive).
  \item Works with GitHub Enterprise: set \ui{API Base URL} to your server's API address. Refreshes every 60–3600 seconds.
 \end{itemize}
 % =========================================================================================
 \chapter{Your own computer}\label{ch:local}
 \chapmeta{1 minute}{You'll stop alt-tabbing to a separate terminal app}
 Click \ui{Local Machine} for a shell on this computer. It uses your system's default shell unless you choose
 another in \menu{Settings\then General\then Local shell} (\code{pwsh}, \code{zsh}, \code{fish}, whatever you fancy).
 \shot[0.86\linewidth]{local.png}{A local shell, with all the same terminal powers as SSH.}
@@ -0,0 +1,234 @@
 \guidepart{violet}{Work faster}{Work faster}
  {Fewer clicks, less typing, more getting on with it.}
  {\partitem{\iSplit}{Tabs and split panes}
   \partitem{\iKeyboard}{Terminal superpowers}
   \partitem{\iWand}{Never type it twice}
   \partitem{\iFolder}{Files: SFTP and drag-and-drop}
   \partitem{\iArrows}{Port forwards}
   \partitem{\iFilm}{Recordings}}
 % =========================================================================================
 \chapter{Tabs and split panes}\label{ch:tabs}
 \chapmeta{4 minutes}{You'll juggle a dozen sessions without losing any of them}
 \begin{tldr}
 Right-click a tab for everything. \keys{\mod+Shift+D} splits right, \keys{\mod+Shift+E} splits down.
 \keys{\mod+1} to \keys{\mod+9} jump straight to a tab.
 \end{tldr}
 \section{Tabs}
 \begin{description}
  \item[Move] Drag tabs about, or right-click\then\ui{Move Left} / \ui{Move Right}.
  \item[Pin] Right-click\then\ui{Pin}. Pinned tabs stay at the front.
  \item[Rename] Right-click\then\ui{Rename}. ``prod DB, DON'T TOUCH'' is a perfectly valid tab name.
  \item[Duplicate] Opens another session to the same profile.
  \item[Reconnect] Does what it says.
  \item[Peek] Hover a tab for its name, host, state and when it connected.
  \item[Close] The \ui{×}, \keys{\mod+W}, or right-click\then\ui{Close}. Connected tabs ask first (you can turn that
        off in Settings).
  \item[Switch] \keys{\mod+Tab} and \keys{\mod+Shift+Tab}, or \keys{\mod+1} to \keys{\mod+9}.
 \end{description}
 Lots of tabs? Scroll the tab strip with your mouse wheel or trackpad.
 \section{Split panes}
 Want two sessions side by side? Split the focused pane right with \keys{\mod+Shift+D} or down with
 \keys{\mod+Shift+E} (also in the \menu{Session} menu, the right-click menu and the palette). The new pane asks
 what to open: \ui{Local Machine} or any of your terminal profiles.
 \shot{split.png}{A fresh split. Pick what goes in the new pane.}
 Drag a divider to resize. Click \ui{×} on a pane's header to close it and its neighbour takes the space. Closing
 the tab closes every pane in it.
 \begin{quickwin}
 Split right, open \code{htop} on one side and tail a log on the other. Now you look like a hacker in a film.
 \end{quickwin}
 % =========================================================================================
 \chapter{Terminal superpowers}\label{ch:terminal}
 \chapmeta{4 minutes}{You'll copy, search and scroll like you've used it for years}
 \begin{tldr}
 Select to copy, \keys{\mod+F} to search, Ctrl/\ph{E1C4}-click links. Right-click for the rest.
 \end{tldr}
 \section{Keyboard and mouse}
 \renewcommand\arraystretch{1.45}
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{24mm}X@{}}
  \toprule
  Copy   & Select text, then \keys{\mod+C}. Nothing selected? \keys{Ctrl+C} interrupts the program as usual.\\
  Paste  & \keys{\mod+V}. Pastes are bracketed when the program asks for it, so editors won't auto-indent your paste
           into a staircase.\\
  Select & Drag for a range, double-click a word, triple-click a line, \kbd{Shift}-click to extend.\\
  Links  & Hold \kbd{Ctrl} (\kbd{\ph{E1C4}}) and click a URL to open it in your browser.\\
  Scroll & Mouse wheel, or \keys{Shift+PageUp}, \keys{Shift+PageDown}, \keys{Shift+Home}, \keys{Shift+End}.\\
  \bottomrule
 \end{tabularx}
 \begin{sidequest}[Why does the scroll wheel move the cursor in less?]
 Full-screen programs (\code{less}, \code{vim}, \code{tmux}, \code{byobu}) use the terminal's ``alternate screen'', where the
 wheel sends arrow keys instead of scrolling. Programs with mouse support (\code{htop}, \code{vim} with
 \code{mouse=a}, \code{tmux} mouse mode) get your clicks directly. That's normal terminal behaviour, not a bug.
 \end{sidequest}
 \section{The right-click menu}
 \ui{Copy}, \ui{Paste}, \ui{Select All}, \ui{Find}, \ui{Send Snippet}, \ui{Port Forwards} (SSH), \ui{Split Right},
 \ui{Split Down}, \ui{Export Output} (saves the whole scrollback as a text file), \ui{Clear} and \ui{Reset}.
 \section{Find}
 \keys{\mod+F} opens the find bar. Toggle \ui{Aa} for case-sensitive and \ui{.*} for regular expressions.
 \kbd{Enter} for the next match, \keys{Shift+Enter} for the previous one, \kbd{Esc} to close. It shows
 ``3 of 17'' so you know where you are.
 \section{When the connection drops}
 The pane dims and shows a \ui{Disconnected} card with \ui{Reconnect} and \ui{Close}. If auto-reconnect is on,
 it says \ui{Reconnecting…} with a \ui{Cancel} button, and a toast tells you which attempt it's on.
 If the problem was a password or host key, you get a friendly dialog explaining what happened, with
 \ui{Retry}, \ui{Edit Profile}, \ui{Known Hosts} (for host-key trouble) and \ui{Close}.
 % =========================================================================================
 \chapter{Never type it twice}\label{ch:repeat}
 \chapmeta{6 minutes}{You'll stop retyping the same commands, and let Nexus Terminal watch the logs for you}
 \begin{tldr}
 \textbf{Snippets} store commands. \textbf{Broadcast} types into many sessions at once. \textbf{Triggers} watch output and
 tap you on the shoulder.
 \end{tldr}
 \section{Snippets: \keys{\mod+Shift+S}}
 Save commands you use a lot, with a name, description and folder. Search them, click
 \ui{Send to Session}, and the command is typed into the active session followed by \kbd{Enter}.
 \crop{snippets.png}{633}{384}{611}{402}{0.8\linewidth}{The snippet library, organised into folders.}
 Snippets can have blanks to fill in:
 \begin{itemize}
  \item \code{\{\{hostname\}\}}, \code{\{\{date\}\}}, \code{\{\{time\}\}} and \code{\{\{timestamp\}\}} are filled in for you.
  \item Anything else, like \code{\{\{service\}\}}, is asked for when you send it.
 \end{itemize}
 So \code{journalctl -fu \{\{service\}\}} asks ``service?'' and tails whichever one you type.
 \section{Broadcast: \keys{\mod+Shift+B}}
 Turn broadcast on and everything you type goes to \emph{every} connected terminal. The status bar shows
 \ui{BROADCAST} so you can't forget it's on.
 \shot{broadcast.png}{Broadcast is on: the status bar says so in no uncertain terms.}
 To broadcast to only some sessions, right-click the \iBroadcast{} button (or \menu{Session\then Broadcast
 targets…}), tick the ones you want and click \ui{Apply \& Enable}.
 \begin{danger}[With great power…]
 Broadcast doesn't care which tab you \emph{meant}. Double-check the target list before you type anything
 destructive. \code{sudo reboot} into twenty servers is very efficient and very memorable.
 \end{danger}
 \section{Triggers: let it watch for you}
 \menu{Session\then Trigger Rules} (or the palette). Each rule has a pattern (plain text or a regular
 expression), a case-sensitivity switch, an on/off switch, and an action:
 \begin{center}\small
 \begin{tabular}{@{}ll@{}}
  \ui{Notify} & shows a toast\\
  \ui{Highlight tab} & briefly outlines the pane\\
  \ui{Notify + Highlight} & both\\
  \ui{Sound} & asks your OS for attention (a bouncing dock icon or flashing taskbar button) and shows a toast\\
 \end{tabular}
 \end{center}
 \crop{triggers.png}{725}{610}{725}{625}{0.75\linewidth}{Three rules: shout about errors, ping when a build finishes, and one switched off for now.}
 Rules check each complete line of output, with colours stripped out first.
 \begin{quickwin}
 Add a rule for \code{BUILD SUCCESSFUL} with the \ui{Sound} action, start a long build, and go and make a cup of tea.
 Nexus Terminal will tell you when it's done. (Or \code{(?i)error|fatal} for the opposite.)
 \end{quickwin}
 % =========================================================================================
 \chapter{Files: SFTP and drag-and-drop}\label{ch:files}
 \chapmeta{4 minutes}{You'll move files to and from servers without leaving the terminal}
 \begin{tldr}
 Click the \iFolder{} on an SSH tab. Or drop a file onto the terminal and choose \ui{Upload}.
 \end{tldr}
 \section{The SFTP browser}
 Click the \iFolder{} folder icon on an SSH tab, \menu{Session\then SFTP browser}, or type ``sftp'' in the palette.
 It opens in the side dock next to your terminal.
 \shot{sftp.png}{Browsing the server's files next to the terminal.}
 \begin{itemize}
  \item Move around with the breadcrumb trail, the \code{..} entry or \ui{Go to path}.
  \item Upload files; download one or many to a folder you choose.
  \item Rename, delete (it asks first), make folders, refresh.
  \item \iStar{} bookmarks the current folder, per profile.
  \item Ctrl-click (\ph{E1C4}-click) or Shift-click to select several things. Transfers show progress as they go.
 \end{itemize}
 \section{Drag and drop}
 Drop files onto a terminal and choose:
 \begin{description}
  \item[Upload to current directory] Pick the remote folder (SSH only).
  \item[Paste contents] Types the file's contents into the terminal, as if you'd typed it.
 \end{description}
 The upload picker looks like the SFTP browser but shows folders only, labelled \proto[amber]{READ ONLY} if you can't
 write there and \proto[rose]{NO READ} if you can't look inside. Keyboard fans: \kbd{↑}\kbd{↓} to move, \kbd{Enter} to
 choose, \kbd{Backspace} to go up, \kbd{Esc} to cancel. If the SFTP browser is open, the picker starts in the same folder.
 % =========================================================================================
 \chapter{Port forwards}\label{ch:forwards}
 \chapmeta{3 minutes}{You'll reach a database or web app that only listens on the server}
 \begin{tldr}
 \emph{Local} forwards bring a remote port to your machine. \emph{Remote} forwards do the opposite.
 \end{tldr}
 Forwards saved in an SSH profile (under \ui{Port Forwarding}, with \ui{Active} ticked) start when you connect.
 To manage them on a live session, right-click the terminal\then\ui{Port Forwards}, or \menu{Session\then Port forwards}.
 \begin{description}
  \item[Local \iArrow] Listen on your computer, forward to somewhere the server can reach.
        Example: \code{127.0.0.1:15432}\then\code{127.0.0.1:5432} lets your desktop database app talk to Postgres on
        the server as if it were local.
  \item[Remote \ph{E058}] Ask the server to listen and send connections back to somewhere \emph{your} computer can reach.
        Great for showing a colleague the dev server running on your laptop.
 \end{description}
 Active forwards are listed with an \proto[accent]{L} or \proto[violet]{R} badge and a stop button. Toasts tell you when one
 starts, stops or fails.
 % =========================================================================================
 \chapter{Recordings}\label{ch:recordings}
 \chapmeta{2 minutes}{You'll have a replayable record of exactly what happened}
 \keys{\mod+Shift+R} starts and stops recording the active session. A red dot appears on the tab and \ui{REC} in
 the status bar. Recordings are standard asciicast v2 files, so other tools (like \code{asciinema}) can play them too.
 \crop{recordings.png}{712}{392}{690}{415}{0.75\linewidth}{The recordings browser. Play, delete, or tidy up in bulk.}
 The browser (sidebar footer, \menu{Session} menu or palette) shows how many recordings you have and how much space
 they take. Play or delete each one, or use \ui{Clean up} to remove recordings older than 7, 30 or 90 days, or to keep
 the total under 1\,GB or 5\,GB. Playback has play/pause, restart, a seek bar and speed control.
 \begin{protip}
 Record the next time you do something fiddly and rare (a database failover, a certificate rotation). Six months
 later, ``how did we do that again?'' has an answer you can literally watch.
 \end{protip}
@@ -0,0 +1,123 @@
 \guidepart{amber}{Stay safe}{Stay safe}
  {Passwords, keys and host checks, minus the jargon headache.}
  {\partitem{\iLock}{Passwords and the vault}
   \partitem{\iShield}{Host keys: is it really that server?}
   \partitem{\iKey}{SSH keys}}
 % =========================================================================================
 \chapter{Passwords and the vault}\label{ch:secrets}
 \chapmeta{5 minutes}{You'll know exactly where your passwords live and who can read them}
 \begin{tldr}
 Passwords go in your OS keychain. If there isn't one, they go in an encrypted vault protected by a master password.
 For each password you choose: save it, remember it until you quit, or ask every time.
 \end{tldr}
 \section{Where secrets live}
 \begin{center}
 \begin{tikzpicture}[
  box/.style={rounded corners=6pt, fill=#1!12, draw=#1!60, line width=0.6pt, minimum height=13mm, text width=40mm,
    align=center, font=\small},
  arr/.style={-latex, line width=0.8pt, color=muted}]
  \node[box=accent] (need) {\heavy A session needs\\a password};
  \node[box=green, right=12mm of need] (kc) {\heavy OS keychain\\{\footnotesize Keychain · Credential Manager · Secret Service}};
  \node[box=amber, right=12mm of kc] (vault) {\heavy Encrypted vault\\{\footnotesize AES-256-GCM, Argon2id}};
  \node[box=rose, below=9mm of kc] (ask) {\heavy Ask you\\{\footnotesize then carry on}};
  \draw[arr] (need) -- (kc);
  \draw[arr] (kc) -- node[above, font=\scriptsize]{not there?} (vault);
  \draw[arr] (vault) |- node[pos=0.25, right, font=\scriptsize]{still not there?} (ask);
 \end{tikzpicture}
 \end{center}
 \begin{description}
  \item[OS keychain first] macOS Keychain, Windows Credential Manager, or the Linux Secret Service (GNOME Keyring,
        KWallet and friends).
  \item[Encrypted vault as backup] If there's no keychain, or it refuses, secrets go into Nexus Terminal's own
        vault: AES-256-GCM with a key derived from your master password by Argon2id using 128\,MiB of memory. In
        plain English: very, very expensive to brute-force.
 \end{description}
 \section{Setting up the vault}
 \menu{Settings\then Security\then Initialise Secret Store}. Choose a master password; the strength meter goes from
 \proto[rose]{Weak} through \proto[amber]{Fair} and \proto[accent]{Good} to \proto[green]{Strong}. Unlock and lock it
 from the same page, from the palette, or by clicking the vault badge in the status bar. It locks itself when you quit.
 \crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Security settings on a machine without an OS keychain: the vault does the job instead.}
 \begin{danger}[There's no ``forgot password'' link]
 Lose the master password and the secrets in the vault are gone for good. That's the point of encryption. Put it in
 your password manager.
 \end{danger}
 \section{Three ways to handle each password}
 Every password, passphrase, token or TOTP secret has its own setting:
 \begin{center}
 \begin{tabular}{@{}p{0.3\linewidth}p{0.3\linewidth}p{0.3\linewidth}@{}}
  \begin{tcolorbox}[colback=green!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
    {\heavy\color{green!60!black}\iLock\ Save securely}\par\smallskip Stored in the keychain or vault and used automatically. Most convenient.
  \end{tcolorbox} &
  \begin{tcolorbox}[colback=accent!8, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
    {\heavy\color{accent!80!black}\iClock\ Remember for this session}\par\smallskip Asked once, kept in memory, never written to disk.
  \end{tcolorbox} &
  \begin{tcolorbox}[colback=amber!10, boxrule=0pt, arc=6pt, fontupper=\small, height=33mm]
    {\heavy\color{amber!75!black}\iDetective\ Ask every time}\par\smallskip Asked on every single connection. Most paranoid.
  \end{tcolorbox}
 \end{tabular}
 \end{center}
 When Nexus Terminal needs a secret it doesn't have, it asks. Press \kbd{Esc} or \ui{Cancel} to give up on that
 connection.
 \begin{sidequest}[What gets written down?]
 Connections, disconnections, profile changes, credential access, imports and exports go into an audit log in the
 database. Secrets themselves never do. TOTP secrets live in the keychain or vault too, never in the profile.
 \end{sidequest}
 % =========================================================================================
 \chapter{Host keys: is it really that server?}\label{ch:hostkeys}
 \chapmeta{3 minutes}{You'll understand the scary fingerprint dialog and what to do about it}
 \begin{tldr}
 Every SSH server has a fingerprint. Nexus Terminal remembers it the first time and shouts if it ever changes.
 A changed fingerprint means a reinstalled server, or someone in the middle. Find out which before carrying on.
 \end{tldr}
 Pick a policy per SSH profile under \ui{Host Verification}:
 \renewcommand\arraystretch{1.5}
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{48mm}X@{}}
  \toprule
  Strict (known hosts only)   & Only connects to servers you've already trusted.\\
  Ask on new or changed keys  & Shows the fingerprint and asks. \ui{Accept \& Save} or \ui{Reject}. The default.\\
  Accept new, reject changed  & Trusts first-time servers silently, still refuses changed keys.\\
  Insecure (accept anything)  & Exactly what it says. Lab use only.\\
  \bottomrule
 \end{tabularx}
 Under every policy except \emph{Insecure}, a key that differs from the saved one is rejected.
 \crop{settings-knownhosts.png}{581}{253}{576}{285}{0.8\linewidth}{Known hosts. Click a fingerprint to copy it; \ui{Remove} to forget a server.}
 \begin{headsup}
 Nexus Terminal keeps its own list of known hosts. It doesn't read \code{\textasciitilde/.ssh/known\_hosts}, so the
 first connection to each server asks once, even if your command-line \code{ssh} already knows it.
 \end{headsup}
 % =========================================================================================
 \chapter{SSH keys}\label{ch:keys}
 \chapmeta{2 minutes}{You'll have a key pair without memorising ssh-keygen flags}
 \menu{Session\then SSH key manager} (or the palette) lists the key pairs in \code{\textasciitilde/.ssh} with their type. Copy a
 public key to the clipboard (ready to paste into GitHub or \code{authorized\_keys}), delete a pair, or generate a new
 \proto[teal]{Ed25519}, \proto[accent]{RSA} (2048 or 4096 bits) or \proto[violet]{ECDSA} key with an optional passphrase.
 \crop{keys.png}{725}{523}{725}{546}{0.75\linewidth}{The SSH key manager.}
 \begin{protip}
 Not sure which type? Pick Ed25519. It's small, fast and secure. Key generation uses your system's
 \code{ssh-keygen}, which comes with macOS, Linux and Windows 10 and later.
 \end{protip}
@@ -0,0 +1,107 @@
 \guidepart{pink}{Make it yours}{Make it yours}
  {Settings, backups, and moving in from Alchementary Link.}
  {\partitem{\iGear}{Settings}
   \partitem{\iUpload}{Import and export}
   \partitem{\iPlane}{Moving house}}
 % =========================================================================================
 \chapter{Settings}\label{ch:settings}
 \chapmeta{3 minutes}{You'll know where every setting lives}
 \keys{\mod+,} opens settings (also the \iGear{} in the sidebar footer and \menu{File\then Settings}). Change things,
 then click \ui{Save}.
 \begin{center}\begin{minipage}[t]{0.49\linewidth}\crop{settings-general.png}{581}{253}{576}{285}{\linewidth}{General}\end{minipage}\hfill\begin{minipage}[t]{0.49\linewidth}\crop{settings-terminal.png}{581}{253}{576}{285}{\linewidth}{Terminal}\end{minipage}\end{center}
 \begin{description}
  \item[General] App theme (Pro, Midnight, Light), default protocol for new profiles, whether to ask before closing or
        disconnecting, status bar on or off, sidebar width, and the local shell (leave it empty for the system default,
        or \ui{Browse…} for one).
  \item[Terminal] Colour scheme, font, size, scrollback and cursor style. These are the defaults for new profiles;
        each profile can override them.
  \item[Security] Keychain and vault status; set up, unlock or lock the vault.
  \item[Known Hosts] Saved server fingerprints, with first-seen and last-seen times.
  \item[Help] Built-in help: connection types, shortcuts and troubleshooting, when this guide isn't to hand.
  \item[About] Version, \ui{Check for Updates} and \ui{Import \textasciitilde/.ssh/config}.
 \end{description}
 \crop{settings-help.png}{581}{253}{576}{285}{0.8\linewidth}{The built-in help, for when this guide isn't to hand.}
 \section{Updates}
 Nexus Terminal checks once at launch. If there's a newer version the status bar says \ui{Update available}; click it to
 see the release notes and a \ui{View release} button. Nothing downloads or installs behind your back.
 % =========================================================================================
 \chapter{Import and export}\label{ch:transfer}
 \chapmeta{3 minutes}{You'll back up your profiles, or copy them to another computer}
 \begin{tldr}
 \menu{File\then Export profiles…} makes a password-protected \code{.nexus} file. \menu{File\then Import profiles…}
 reads it back. Already have an \code{\textasciitilde/.ssh/config}? Import that too.
 \end{tldr}
 \begin{description}
  \item[Encrypted export] Choose the profiles, set a password, save a \code{.nexus} file. Saved passwords aren't
        included, so the file is safe to email to yourself.
  \item[Encrypted import] Pick a \code{.nexus} (or an old \code{.link}) file, enter its password and decide what happens to
        profiles that already exist: \ui{Skip existing}, \ui{Overwrite existing} or \ui{Create duplicates}.
  \item[JSON] \ui{Export Profiles (JSON)} and \ui{Import Profiles (JSON)} are in the palette. Tick
        \ui{Include secrets} to keep proxy passwords and TOTP secrets, which are otherwise left out.
  \item[OpenSSH config] \menu{File\then Import \textasciitilde/.ssh/config} turns your \code{Host} blocks into profiles,
        with host names, users, ports, identity files and jump hosts.
 \end{description}
 \crop{export.png}{894}{357}{872}{380}{0.55\linewidth}{Exporting profiles. Everything's ticked to start with; untick what you don't want.}
 \begin{danger}[JSON with secrets is not encrypted]
 A JSON export with \ui{Include secrets} ticked has those secrets in plain text. Use the encrypted \code{.nexus} export to
 move things between machines.
 \end{danger}
 % =========================================================================================
 \chapter{Moving house}\label{ch:move}
 \chapmeta{2 minutes}{You'll know what came over from Alchementary Link and what didn't}
 \begin{tldr}
 It's automatic. First run copies your Alchementary Link profiles, vault and recordings. Your old folder is left
 alone. Recreate trigger rules and SFTP bookmarks by hand.
 \end{tldr}
 When Nexus Terminal starts for the first time and finds an \code{AlchementaryLink} folder next to where its own data
 goes, it \emph{copies} \code{link.db} to \code{nexus.db}, along with the \code{vault/} and \code{recordings/} folders,
 and shows a toast saying where they came from.
 \begin{checklist}
  \item[\color{green}\iCheck] Profiles, groups, favourites, known hosts, snippets and preferences
  \item[\color{green}\iCheck] Vault (same master password as before)
  \item[\color{green}\iCheck] Recordings
  \item[\color{green}\iCheck] Keychain passwords: picked up the first time each one is needed, then copied across
  \item[\color{green}\iCheck] Old \code{.link} export files still import
  \item[\color{rose}\ph{E4F6}] Trigger rules and SFTP bookmarks (they lived in the old app's web storage)
 \end{checklist}
 \begin{headsup}
 If a \code{NexusTerminal/nexus.db} already exists (say, from before the Alchementary Link rebrand), it's used as it is
 and nothing is copied.
 \end{headsup}
 \section{Where everything lives}
 \renewcommand\arraystretch{1.45}
 \begin{tabularx}{\linewidth}{@{}>{\leavevmode\heavy\color{ink}}p{20mm}X@{}}
  \toprule
  macOS   & \code{\textasciitilde/Library/Application Support/NexusTerminal}\\
  Windows & \code{\%APPDATA\%\textbackslash NexusTerminal}\\
  Linux   & \code{\$XDG\_CONFIG\_HOME/NexusTerminal}, usually \code{\textasciitilde/.config/NexusTerminal}\\
  \bottomrule
 \end{tabularx}
 Inside: \code{nexus.db} (profiles, known hosts, preferences, snippets, IRC state and the audit log),
 \code{vault/vault.json}, \code{recordings/}, \code{triggers.json} and \code{sftp-bookmarks.json}. Keychain entries are
 stored under the service name \code{NexusTerminal}.
 \begin{protip}[Try things without touching your real data]
 Start Nexus Terminal with \code{--data-dir /some/other/folder} and it uses that folder instead. Brilliant for
 experiments, demos and a portable install on a USB stick.
 \end{protip}
@@ -0,0 +1,88 @@
 \guidepart{rose}{Fix it}{When things go wrong}
  {Symptom first, fix second. No essays.}
  {\partitem{\iLifebuoy}{Troubleshooting, by symptom}}
 \label{part:fix}
 % =========================================================================================
 \chapter{Troubleshooting, by symptom}\label{ch:trouble}
 \chapmeta{as long as it takes}{You'll find your symptom and the fix in one place}
 \begin{tldr}
 Find the heading that matches what you're seeing. Try the fixes in order. Most problems are the network, the
 password, or the baud rate.
 \end{tldr}
 \section{Connecting}
 \fix{``Authentication failed''}{%
 \begin{itemize}
  \item Check the username, password, key path and the ticked \ui{Auth Methods}.
  \item If the key has a passphrase, check how the passphrase is stored (\ui{Passphrase Mode}).
  \item Two-factor server? Click \ui{Test} next to the TOTP secret and compare with your phone. Check your clock.
  \item Saved password not being used? The vault might be locked: click \ui{Vault locked} in the status bar.
 \end{itemize}}
 \fix{``Host key verification failed''}{%
 The server's fingerprint changed since you last connected. That happens when a server is rebuilt, but it's also exactly
 what an attack looks like. \textbf{Check with whoever runs the server.} If it's legitimate:
 \menu{Settings\then Known Hosts}, \ui{Remove} the entry, reconnect and accept the new key.}
 \fix{It just says ``Connecting…'' forever}{%
 \begin{itemize}
  \item Click \ui{Test} in the profile editor. If that fails too, it's the network, a firewall or the wrong port.
  \item Behind a corporate proxy? Set one up under \ui{Proxy} (SSH profiles).
  \item Going through a bastion? Check each jump host on its own first.
 \end{itemize}}
 \fix{The session keeps reconnecting}{%
 Check the network and the credentials, then the profile's auto-reconnect settings. Reconnection backs off (1\,s, 2\,s,
 4\,s… up to 30\,s) and stops after the maximum number of attempts.}
 \section{Serial}
 \fix{The port won't open}{%
 \begin{itemize}
  \item Is the adapter plugged in? Hit refresh in the device list.
  \item \textbf{Permission denied} on Linux: add yourself to \code{dialout} (or \code{uucp}), then log out and back in.
  \item On a Mac, use \code{/dev/cu.*}, not \code{/dev/tty.*}.
  \item \textbf{Port is in use by another program}: close \code{screen}, \code{minicom}, the Arduino IDE serial monitor or
        whatever else has it open.
 \end{itemize}}
 \fix{Gibberish on screen}{The baud rate, parity or stop bits don't match the device. Check its manual.}
 \section{Remote desktops}
 \fix{VNC won't connect}{%
 \begin{itemize}
  \item VNC ports are 5900 plus the display number: \code{:0} is 5900, \code{:1} is 5901.
  \item Check the password and how it's stored.
  \item Using an SSH tunnel? Check the tunnel's host, user, login method and key, and the host key policy.
  \item Connecting to a Mac? Turn on password access in macOS Screen Sharing settings (see p.\,\pageref{ch:vnc}).
 \end{itemize}}
 \section{Files}
 \fix{Upload is greyed out or fails}{%
 The folder is probably \proto[amber]{READ ONLY} for your user. Pick another, or check permissions on the server. Uploads
 need an SSH session; other protocols can't do it.}
 \fix{``NO READ'' on a folder}{You don't have permission to look inside. Try the parent folder, or ask the server's admin.}
 \section{The terminal itself}
 \fix{The terminal is the wrong size}{%
 Resize the window or nudge a split divider; the terminal re-fits itself. Still wrong? Reconnect. Very old servers may
 prefer a different \ui{Terminal Type} in the profile (try \code{vt100}).}
 \fix{The scroll wheel moves the cursor instead of scrolling}{%
 You're in a full-screen program (\code{less}, \code{vim}, \code{tmux}). That's how terminals work: the wheel sends arrow keys
 there. Quit the program, or use its own scrolling (in \code{tmux}: \keys{Ctrl+B} then \kbd{[}).}
 \fix{Emoji are in black and white}{Known limitation: colour emoji show as monochrome glyphs. Everything else renders
 normally.}
 \begin{quickwin}[Still stuck?]
 Start Nexus Terminal with \code{--data-dir} pointing at an empty folder and try the same connection there. If it
 works, something in your profile is off; duplicate the working one and compare.
 \end{quickwin}
@@ -0,0 +1,21 @@
 MIT License
 Copyright (c) 2023 Romet Tagobert
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
@@ -0,0 +1,286 @@
 % Nexus Terminal user guide — look and feel. Build with lualatex (see Makefile).
 \NeedsTeXFormat{LaTeX2e}
 \ProvidesPackage{nexus-guide}
 \RequirePackage[a4paper,top=24mm,bottom=26mm,inner=22mm,outer=26mm,headsep=8mm,footskip=12mm]{geometry}
 % Latin Modern OpenType isn't always installed, and the kernel selects it once before the guide's own
 % fonts take over. Point that one use at Inter so the build only needs fonts from the repo.
 \DeclareFontShape{TU}{lmr}{m}{n}{<->"[../../rust/app/assets/fonts/Inter-Regular.ttf]:mode=node;"}{}
 \RequirePackage{fontspec}
 \RequirePackage[dvipsnames]{xcolor}
 \RequirePackage{graphicx}
 \RequirePackage[most]{tcolorbox}
 \RequirePackage{tikz}
 \usetikzlibrary{calc,positioning,shadows.blur,fadings}
 \RequirePackage{titlesec}
 \RequirePackage{fancyhdr}
 \RequirePackage{enumitem}
 \RequirePackage{tabularx}
 \RequirePackage{booktabs}
 \RequirePackage{multicol}
 \RequirePackage{eso-pic}
 \RequirePackage{etoolbox}
 \RequirePackage{needspace}
 \RequirePackage{microtype}
 \RequirePackage[hidelinks]{hyperref}
 \RequirePackage{bookmark}
 % --- Fonts: the app's own Inter + JetBrains Mono, and its Phosphor icons ----------------
 \defaultfontfeatures{Ligatures=TeX}
 \setmainfont{Inter-Regular.ttf}[
  Path=../../rust/app/assets/fonts/,
  BoldFont=Inter-SemiBold.ttf,
  ItalicFont=Inter-Regular.ttf, ItalicFeatures={FakeSlant=0.18},
  BoldItalicFont=Inter-SemiBold.ttf, BoldItalicFeatures={FakeSlant=0.18}]
 \setsansfont{Inter-Regular.ttf}[Path=../../rust/app/assets/fonts/, BoldFont=Inter-SemiBold.ttf]
 \setmonofont{JetBrainsMono-Regular.ttf}[Path=../../rust/app/assets/fonts/, Scale=0.92]
 \newfontfamily\heavy{Inter-SemiBold.ttf}[Path=../../rust/app/assets/fonts/]
 \newfontfamily\phfont{Phosphor.ttf}[Path=fonts/]
 \newfontfamily\phfill{Phosphor-Fill.ttf}[Path=fonts/]
 \linespread{1.18}
 \setlength{\parindent}{0pt}
 \setlength{\parskip}{0.62em}
 \raggedbottom
 \sloppy
 % --- Palette (mirrors the app's Pro theme) ---------------------------------------------
 \definecolor{ink}{HTML}{1B1B1F}
 \definecolor{ink2}{HTML}{26262C}
 \definecolor{body}{HTML}{2A2A33}
 \definecolor{muted}{HTML}{6B6B78}
 \definecolor{rule}{HTML}{E4E4EA}
 \definecolor{paper}{HTML}{F7F7FA}
 \definecolor{accent}{HTML}{3B82F6}
 \definecolor{teal}{HTML}{14B8A6}
 \definecolor{violet}{HTML}{8B5CF6}
 \definecolor{amber}{HTML}{F59E0B}
 \definecolor{rose}{HTML}{F43F5E}
 \definecolor{pink}{HTML}{EC4899}
 \definecolor{green}{HTML}{22C55E}
 \definecolor{slate}{HTML}{64748B}
 \color{body}
 % Page-level drawing. Everything that paints relative to the page goes through here, drawn at shipout
 % from the page's lower-left corner, so it never depends on remember-picture positions settling.
 % Inside, the node (pg) is the whole page: use pg.north west, pg.south east and so on.
 \newcommand\pgnode{\node[inner sep=0pt, minimum width=\paperwidth, minimum height=\paperheight, anchor=south west] (pg) at (0,0) {};}
 \newcommand\pagecanvas[1]{\AddToShipoutPictureBG*{\AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode#1\end{tikzpicture}}}}
 % Current part colour (set by \guidepart).
 \colorlet{partcol}{accent}
 \newcounter{guidepart}
 \newcommand\partshort{}
 % --- Icons ------------------------------------------------------------------------------
 \newcommand\ph[1]{{\phfont\symbol{"#1}}}
 \newcommand\phf[1]{{\phfill\symbol{"#1}}}
 \newcommand\iTerminal{\ph{EAE8}}  \newcommand\iBolt{\ph{E2DE}}     \newcommand\iBrain{\ph{E74E}}
 \newcommand\iWarn{\ph{E4E0}}      \newcommand\iBulb{\ph{E2DC}}     \newcommand\iCoffee{\ph{E1C2}}
 \newcommand\iRocket{\ph{E3FE}}    \newcommand\iCheck{\ph{E184}}    \newcommand\iTimer{\ph{E492}}
 \newcommand\iKeyboard{\ph{E2D8}}  \newcommand\iSparkle{\ph{E6A2}}  \newcommand\iShield{\ph{E40C}}
 \newcommand\iWand{\ph{E6B6}}      \newcommand\iBug{\ph{E5F4}}      \newcommand\iStar{\phf{E46A}}
 \newcommand\iSiren{\ph{E9B8}}     \newcommand\iWave{\ph{E580}}     \newcommand\iTarget{\ph{E47C}}
 \newcommand\iMap{\ph{E31A}}       \newcommand\iList{\ph{EADC}}     \newcommand\iBox{\ph{E45E}}
 \newcommand\iKey{\ph{E2D6}}       \newcommand\iPlugs{\ph{EB5A}}    \newcommand\iFolder{\ph{E256}}
 \newcommand\iBroadcast{\ph{E0F2}} \newcommand\iFilm{\ph{E792}}     \newcommand\iCode{\ph{E1BC}}
 \newcommand\iGear{\ph{E270}}      \newcommand\iLock{\ph{E2FA}}     \newcommand\iGithub{\ph{E576}}
 \newcommand\iChat{\ph{E16C}}      \newcommand\iDesktop{\ph{E560}}  \newcommand\iUsb{\ph{E956}}
 \newcommand\iTree{\ph{E67C}}      \newcommand\iArrows{\ph{E0A0}}   \newcommand\iCmd{\ph{E1C4}}
 \newcommand\iSearch{\ph{E30C}}    \newcommand\iSplit{\ph{E870}}    \newcommand\iLifebuoy{\ph{E63A}}
 \newcommand\iInfo{\ph{E2CE}}      \newcommand\iPin{\ph{E3E2}}      \newcommand\iConfetti{\ph{E81A}}
 \newcommand\iDetective{\ph{E83E}} \newcommand\iCompass{\ph{E1C8}}  \newcommand\iBinary{\ph{EE60}}
 \newcommand\iPalette{\ph{E6C8}}   \newcommand\iRecord{\ph{E3EE}}   \newcommand\iArrow{\ph{E06C}}
 \newcommand\iClock{\ph{E19A}}     \newcommand\iFlag{\ph{EA38}}     \newcommand\iPlug{\ph{E946}}
 \newcommand\iGhost{\ph{E62A}}     \newcommand\iBell{\ph{E5E8}}     \newcommand\iHourglass{\ph{E2B2}}
 \newcommand\iDownload{\ph{E20C}}  \newcommand\iUpload{\ph{E4C0}}   \newcommand\iPlane{\ph{E398}}
 % --- Inline bits --------------------------------------------------------------------------
 % \kbd{Ctrl} — a keycap. \keys{Ctrl+Shift+K} — keycaps joined with thin pluses.
 \newtcbox{\kbd}{on line, boxrule=0.4pt, arc=2.2pt, colback=paper, colframe=rule!70!slate,
  boxsep=0pt, left=3.2pt, right=3.2pt, top=1.6pt, bottom=1.2pt, fontupper=\ttfamily\footnotesize\color{ink}}
 % \mod is "Ctrl, or ⌘ on a Mac": every shortcut in the guide is written \keys{\mod+K}.
 \renewcommand\mod{\kbd{Ctrl\,/\,\ph{E1C4}}}
 \def\keystop{\relax}\def\modtok{\mod}
 \DeclareRobustCommand\keys[1]{\keysplit#1+\relax+}
 \def\keysplit#1+{\def\kk{#1}\ifx\kk\keystop\else\keycap{#1}\expandafter\keysplitnext\fi}
 \def\keysplitnext#1+{\def\kk{#1}\ifx\kk\keystop\else{\kern0.15em\scriptsize\color{muted}+\kern0.15em}\keycap{#1}\expandafter\keysplitnext\fi}
 \newcommand\keycap[1]{\def\kc{#1}\ifx\kc\modtok\mod\else\kbd{#1}\fi}
 \newcommand\ui[1]{{\heavy\color{ink}#1}}               % on-screen labels
 \newcommand\code[1]{{\ttfamily\color{ink}#1}}           % file paths and commands
 \newcommand\menu[1]{{\heavy\color{ink}#1}}              % File → Thing
 \newcommand\then{\,{\color{muted}\iArrow}\,}
 \newcommand\proto[2][accent]{\tcbox[on line, arc=6pt, boxrule=0pt, colback=#1!14, boxsep=0pt,
  left=4pt, right=4pt, top=1.2pt, bottom=1.2pt]{\scriptsize\heavy\color{#1!80!black}#2}}
 % --- Callout boxes ----------------------------------------------------------------------
 \tcbset{guidebox/.style={enhanced, breakable, arc=7pt, boxrule=0pt, left=12pt, right=12pt,
  top=8pt, bottom=8pt, before skip=10pt, after skip=12pt, fontupper=\small,
  parbox=false, before upper={\setlength{\parskip}{0.5em}}}}
 \newcommand\boxhead[3]{{\heavy\color{#1}\large#2\enspace\normalsize#3}\par\vspace{2pt}}
 \newtcolorbox{tldr}{guidebox, colback=partcol!8, borderline west={3pt}{0pt}{partcol},
  before upper={\boxhead{partcol}{\iBolt}{TL;DR}\setlength{\parskip}{0.4em}}}
 \newtcolorbox{quickwin}[1][Quick win]{guidebox, colback=green!8, borderline west={3pt}{0pt}{green},
  before upper={\boxhead{green!65!black}{\iTarget}{#1}}}
 \newtcolorbox{headsup}[1][Heads up]{guidebox, colback=amber!10, borderline west={3pt}{0pt}{amber},
  before upper={\boxhead{amber!75!black}{\iWarn}{#1}}}
 \newtcolorbox{protip}[1][Pro tip]{guidebox, colback=accent!7, borderline west={3pt}{0pt}{accent},
  before upper={\boxhead{accent!80!black}{\iBulb}{#1}}}
 \newtcolorbox{sidequest}[1][Side quest]{guidebox, colback=violet!7,
  borderline west={3pt}{0pt}{violet}, borderline={0.5pt}{0pt}{violet!35,dashed},
  before upper={\boxhead{violet}{\iCompass}{#1 {\normalfont\footnotesize\color{muted}\enspace·\enspace optional, skip it if you're in a hurry}}}}
 \newtcolorbox{danger}[1][Careful]{guidebox, colback=rose!8, borderline west={3pt}{0pt}{rose},
  before upper={\boxhead{rose!85!black}{\iSiren}{#1}}}
 % "You are here": a one-line chapter header strip with reading time.
 \newcommand\chapmeta[2]{%
  \begin{tcolorbox}[enhanced, arc=6pt, boxrule=0pt, colback=paper, left=10pt, right=10pt,
    top=5pt, bottom=5pt, before skip=0pt, after skip=10pt, fontupper=\small\color{muted}]
  {\color{partcol}\iTimer}\enspace about \textbf{#1}\hfill{\color{partcol}\iTarget}\enspace #2
  \end{tcolorbox}}
 % Checklists.
 \newlist{checklist}{itemize}{1}
 \setlist[checklist]{label={\color{partcol}\large\iBox}, leftmargin=1.9em, itemsep=2pt, topsep=4pt}
 \setlist[itemize]{label={\color{partcol}\small\textbullet}, leftmargin=1.4em, itemsep=1pt, topsep=3pt}
 \setlist[enumerate]{label={\heavy\color{partcol}\arabic*}, leftmargin=1.6em, itemsep=2pt, topsep=4pt}
 \setlist[description]{font=\heavy\color{ink}, leftmargin=1.2em, itemsep=2pt}
 % --- Screenshots --------------------------------------------------------------------------
 % \shot[width]{file}{caption}
 \newcommand\shot[3][\linewidth]{%
  \par\needspace{0.3\textheight}\begin{center}
  \begin{tikzpicture}
    \node[inner sep=0pt, rounded corners=6pt, blur shadow={shadow blur steps=8, shadow xshift=0pt,
      shadow yshift=-2pt, shadow opacity=25}] (img) {\includegraphics[width=#1]{img/#2}};
    \draw[rule!60!slate, line width=0.4pt, rounded corners=3pt] (img.south west) rectangle (img.north east);
  \end{tikzpicture}\par\vspace{4pt}
  {\footnotesize\color{muted}#3}\end{center}\vspace{-4pt}}
 % Two screenshots side by side.
 \newcommand\shotpair[4]{%
  \par\needspace{0.22\textheight}\begin{center}
  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#1}\par\vspace{3pt}{\footnotesize\color{muted}#2}\end{minipage}\hfill
  \begin{minipage}[t]{0.485\linewidth}\centering\includegraphics[width=\linewidth]{img/#3}\par\vspace{3pt}{\footnotesize\color{muted}#4}\end{minipage}
  \end{center}}
 % A crop of a screenshot: \crop{file}{left}{bottom}{right}{top}{width}{caption}, trims in px of the 2720x1720 image.
 \newcommand\crop[7]{%
  \par\needspace{0.2\textheight}\begin{center}
  \begin{tikzpicture}
    \node[inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
      {\includegraphics[width=#6, trim=#2 #3 #4 #5, clip]{img/#1}};
    \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
  \end{tikzpicture}\par\vspace{4pt}{\footnotesize\color{muted}#7}\end{center}\vspace{-4pt}}
 % Annotated screenshot: \begin{annotated}{file} \callout{1}{x}{y} … \end{annotated}, x/y in 0–1 from top left.
 \newenvironment{annotated}[1]{%
  \par\begin{center}\begin{tikzpicture}
  \node[anchor=north west, inner sep=0pt, blur shadow={shadow blur steps=8, shadow yshift=-2pt, shadow opacity=25}] (img)
    {\includegraphics[width=\linewidth]{img/#1}};
  \draw[rule!60!slate, line width=0.4pt] (img.south west) rectangle (img.north east);
  \begin{scope}[x={(img.north east)}, y={($(img.north west)-(img.south west)$)}, shift={(img.north west)}]}
  {\end{scope}\end{tikzpicture}\end{center}}
 \newcommand\callout[3]{%
  \node[circle, fill=partcol, text=white, font=\heavy\footnotesize, inner sep=0pt, minimum size=15pt,
    draw=white, line width=1.4pt, blur shadow={shadow blur steps=5, shadow opacity=40}] at (#2,-#3) {#1};}
 \newcommand\num[1]{\tikz[baseline=(n.base)]\node[circle, fill=partcol, text=white, font=\heavy\scriptsize,
  inner sep=0pt, minimum size=13pt] (n) {#1};}
 % "At a glance" fact card for each connection type.
 \newenvironment{glance}[2]{%
  \begin{tcolorbox}[enhanced, arc=8pt, boxrule=0pt, colback=#1!7, left=12pt, right=12pt, top=9pt, bottom=9pt,
    before skip=6pt, after skip=12pt, fontupper=\small,
    overlay={\node[anchor=north east, font=\heavy\tiny, text=#1!80!black, inner sep=8pt] at (frame.north east) {AT A GLANCE};}]
  {\heavy\Large\color{#1!85!black}#2}\par\vspace{4pt}
  \renewcommand\arraystretch{1.35}\begin{tabular}{@{}>{\leavevmode\color{muted}}p{0.24\linewidth}p{0.72\linewidth}@{}}}
  {\end{tabular}\end{tcolorbox}}
 % --- Headings --------------------------------------------------------------------------
 \titleformat{\chapter}[display]{\normalfont}{%
  \pagecanvas{\fill[partcol] (pg.north west) rectangle ([yshift=-9mm]pg.north east);
    \fill[partcol!12] ([yshift=-9mm]pg.north west) rectangle ([yshift=-11mm]pg.north east);}%
  {\heavy\small\color{partcol}\MakeUppercase{\partshort}\enspace·\enspace CHAPTER \thechapter}}{2pt}
  {\heavy\fontsize{30}{34}\selectfont\color{ink}}
 \titlespacing*{\chapter}{0pt}{0pt}{14pt}
 \titleformat{\section}{\heavy\Large\color{ink}}{%
  \tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white, font=\heavy\small, inner sep=3pt, minimum width=18pt] (n) {\thesection};}{8pt}{}
 \titlespacing*{\section}{0pt}{18pt}{4pt}
 \titleformat{\subsection}{\heavy\large\color{ink}}{}{0pt}{{\color{partcol}\iArrow}\enspace}
 \titlespacing*{\subsection}{0pt}{12pt}{2pt}
 \renewcommand\thesection{\arabic{chapter}.\arabic{section}}
 \setcounter{secnumdepth}{1}
 \setcounter{tocdepth}{1}
 % --- Running heads + thumb tabs ---------------------------------------------------------
 \pagestyle{fancy}
 \fancyhf{}
 \renewcommand{\headrulewidth}{0pt}
 \renewcommand\chaptermark[1]{\markboth{#1}{}}
 \fancyhead[LE]{\footnotesize\color{muted}\heavy Nexus Terminal\enspace\normalfont·\enspace User Guide}
 \fancyhead[RO]{\footnotesize\color{muted}\leftmark}
 \fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt, text=white,
  font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}
 \fancyfoot[RE,LO]{\footnotesize\color{muted}\partshort}
 \fancypagestyle{plain}{\fancyhf{}\fancyfoot[LE,RO]{\tikz[baseline=(n.base)]\node[fill=partcol, rounded corners=3pt,
  text=white, font=\heavy\footnotesize, inner sep=3pt, minimum width=20pt] (n) {\thepage};}}
 % Thumb tabs on the page edge, one slot per part, so you can flick to a part in print.
 \newif\ifthumbs
 \AddToShipoutPictureBG{%
  \ifthumbs\ifnum\value{guidepart}>0
  \AtPageLowerLeft{\begin{tikzpicture}[overlay]\pgnode
    \pgfmathsetmacro\slot{28 + (\value{guidepart}-1)*30}
    \ifodd\value{page}
      \fill[partcol, rounded corners=4pt] ([xshift=-7mm, yshift=-\slot mm]pg.north east) rectangle ++(9mm,-26mm);
      \node[rotate=-90, text=white, font=\heavy\tiny] at ([xshift=-3.6mm, yshift=-\slot mm - 13mm]pg.north east) {\MakeUppercase{\partshort}};
    \else
      \fill[partcol, rounded corners=4pt] ([xshift=7mm, yshift=-\slot mm]pg.north west) rectangle ++(-9mm,-26mm);
      \node[rotate=90, text=white, font=\heavy\tiny] at ([xshift=3.6mm, yshift=-\slot mm - 13mm]pg.north west) {\MakeUppercase{\partshort}};
    \fi
  \end{tikzpicture}}\fi\fi}
 % \guidepart{colour}{short name}{Title}{tagline}{list of chapters}
 \newcommand\guidepart[5]{%
  \clearpage
  \stepcounter{guidepart}\colorlet{partcol}{#1}\renewcommand\partshort{#2}
  \phantomsection\addcontentsline{toc}{part}{\protect\textcolor{#1}{\arabic{guidepart}}\quad #3}
  \thispagestyle{empty}\thumbsfalse
  \pagecanvas{
    \fill[ink] (pg.south west) rectangle (pg.north east);
    \fill[#1, opacity=0.9] (pg.north west) rectangle ([yshift=-95mm]pg.north east);
    \fill[#1!70!black, opacity=0.35] ([yshift=-95mm]pg.north west) -- ++(0,-18mm) -- ([yshift=-95mm]pg.north east) -- cycle;
    \node[anchor=north west, text=white, font=\heavy\fontsize{150}{150}\selectfont, opacity=0.25]
      at ([xshift=14mm, yshift=-4mm]pg.north west) {\arabic{guidepart}};
    \node[anchor=south west, text=white, font=\heavy\small] at ([xshift=24mm, yshift=-72mm]pg.north west) {PART \arabic{guidepart}};
    \node[anchor=north west, text=white, font=\heavy\fontsize{38}{42}\selectfont, text width=160mm]
      at ([xshift=24mm, yshift=-73mm]pg.north west) {#3};
    \node[anchor=north west, text=white!80!#1, font=\large, text width=150mm]
      at ([xshift=24mm, yshift=-125mm]pg.north west) {#4};
    \node[anchor=north west, text=white, font=\normalsize, text width=150mm]
      at ([xshift=24mm, yshift=-145mm]pg.north west) {#5};
  }\null\clearpage\thumbstrue}
 \newcommand\partitem[2]{{\color{partcol}\large#1}\enspace #2\par\vspace{5pt}}
 % Table of contents.
 \RequirePackage{tocloft}
 \renewcommand\cftpartfont{\heavy\large\color{ink}}
 \renewcommand\cftpartpagefont{\heavy\color{ink}}
 \renewcommand\cftchapfont{\color{body}}
 \renewcommand\cftchappagefont{\color{muted}}
 \renewcommand\cftchapleader{\cftdotfill{\cftdotsep}}
 \setlength\cftbeforepartskip{14pt}
 \setlength\cftbeforechapskip{3pt}
 \renewcommand\cfttoctitlefont{\heavy\fontsize{30}{34}\selectfont\color{ink}}
 % Symptom → fix cards for troubleshooting.
 \newcommand\fix[2]{%
  \begin{tcolorbox}[enhanced, breakable, arc=7pt, boxrule=0.5pt, colframe=rule, colback=white, left=11pt, right=11pt,
    top=8pt, bottom=8pt, before skip=6pt, after skip=8pt, fontupper=\small, parbox=false,
    title={\heavy\color{ink}\normalsize{\color{partcol}\iBug}\enspace #1}, coltitle=ink, colbacktitle=paper,
    titlerule=0pt, toptitle=5pt, bottomtitle=5pt, attach title to upper={}, detach title, before upper={\tcbtitle\par\vspace{4pt}}]
  #2\end{tcolorbox}}
 % Big pull-quote line used to break up long stretches.
 \newcommand\breather[1]{\par\vspace{6pt}{\centering\heavy\large\color{partcol}#1\par}\vspace{6pt}}
@@ -0,0 +1,100 @@
 % Nexus Terminal — User Guide. Build: make (in docs/guide), or: lualatex nexus-guide && lualatex nexus-guide
 \documentclass[10pt,twoside,openany]{book}
 \usepackage{nexus-guide}
 \hypersetup{pdftitle={Nexus Terminal: The User Guide}, pdfauthor={Andy Dixon},
  pdfsubject={SSH, Telnet, RAW, Serial, VNC, IRC and GitHub in one native app}}
 \begin{document}
 \frontmatter
 \pagestyle{empty}
 % --- Cover ------------------------------------------------------------------------------
 \pagecanvas{
  \fill[ink] (pg.south west) rectangle (pg.north east);
  \shade[left color=accent, right color=violet, opacity=0.55]
    ([yshift=-60mm]pg.north west) -- ([yshift=-20mm]pg.north east) --
    ([yshift=-130mm]pg.north east) -- ([yshift=-170mm]pg.north west) -- cycle;
  \shade[left color=teal, right color=accent, opacity=0.35]
    ([yshift=-150mm]pg.north west) -- ([yshift=-120mm]pg.north east) --
    ([yshift=-150mm]pg.north east) -- ([yshift=-185mm]pg.north west) -- cycle;
  \node[anchor=north east, inner sep=0pt] at ([xshift=-22mm, yshift=-24mm]pg.north east)
    {\includegraphics[width=34mm]{img/logo.pdf}};
  \node[anchor=north west, text=white!70!ink, font=\heavy\small] at ([xshift=22mm, yshift=-30mm]pg.north west)
    {THE USER GUIDE};
  \node[anchor=north west, text=white, font=\heavy\fontsize{58}{60}\selectfont, text width=170mm]
    at ([xshift=22mm, yshift=-36mm]pg.north west) {Nexus\\[-2pt]Terminal};
  \node[anchor=north west, text=white, font=\Large, text width=150mm]
    at ([xshift=22mm, yshift=-88mm]pg.north west)
    {Every terminal you need. One window.\\Zero faff.};
  \node[anchor=north west, text=white!65!ink, font=\normalsize, text width=150mm]
    at ([xshift=22mm, yshift=-110mm]pg.north west)
    {SSH\enspace·\enspace Telnet\enspace·\enspace RAW TCP\enspace·\enspace Serial\enspace·\enspace VNC\enspace·\enspace IRC\enspace·\enspace GitHub\enspace·\enspace Local shells};
  \node[anchor=south west, inner sep=0pt] at ([xshift=22mm, yshift=22mm]pg.south west)
    {\begin{tikzpicture}
      \node[inner sep=0pt, draw=white!25!ink, line width=0.6pt, rounded corners=4pt] {\includegraphics[width=166mm]{img/ssh.png}};
    \end{tikzpicture}};
  \node[anchor=south east, text=white!55!ink, font=\footnotesize, align=right]
    at ([xshift=-22mm, yshift=24mm]pg.south east) {Version 0.1\\October 2026\\dixon.cx};
 }\null
 \cleardoublepage
 % --- How to use this guide ----------------------------------------------------------------
 \colorlet{partcol}{accent}
 {\heavy\fontsize{30}{34}\selectfont\color{ink} Start here.\par}
 \vspace{2pt}{\large\color{muted} (Yes, even if you never read manuals. \emph{Especially} then.)\par}
 \vspace{10pt}
 This guide is built for skimming. You do \textbf{not} have to read it in order, cover to cover, like it's
 homework. Find the bit you need, grab it, get back to work. Every chapter opens with the time it takes and
 what you'll be able to do afterwards, and a \textbf{TL;DR} if you only want the gist.
 \vspace{4pt}
 {\heavy\large\color{ink}\iMap\enspace I just want to…}\par\vspace{2pt}
 \renewcommand\arraystretch{1.5}
 \begin{tabularx}{\linewidth}{@{}X>{\raggedleft\arraybackslash}p{52mm}@{}}
  \toprule
  …get connected to something \emph{right now} & \hyperref[ch:start]{Five-minute start}, p.\,\pageref{ch:start}\\
  …work out what all the buttons do & \hyperref[ch:tour]{The grand tour}, p.\,\pageref{ch:tour}\\
  …SSH into a server (keys, jump hosts, 2FA) & \hyperref[ch:ssh]{SSH}, p.\,\pageref{ch:ssh}\\
  …talk to a router or Arduino over a USB cable & \hyperref[ch:serial]{Serial}, p.\,\pageref{ch:serial}\\
  …copy files to and from a server & \hyperref[ch:files]{Files}, p.\,\pageref{ch:files}\\
  …type the same thing into ten servers at once & \hyperref[ch:repeat]{Never type it twice}, p.\,\pageref{ch:repeat}\\
  …keep my passwords safe & \hyperref[ch:secrets]{Passwords \& the vault}, p.\,\pageref{ch:secrets}\\
  …move over from Alchementary Link & \hyperref[ch:move]{Moving house}, p.\,\pageref{ch:move}\\
  …fix something that's broken & \hyperref[part:fix]{When things go wrong}, p.\,\pageref{ch:trouble}\\
  …just see the keyboard shortcuts & \hyperref[app:keys]{The cheat sheet}, p.\,\pageref{app:keys}\\
  \bottomrule
 \end{tabularx}
 \vspace{8pt}
 {\heavy\large\color{ink}\iSparkle\enspace The little boxes}\par\vspace{-2pt}
 \begin{multicols}{2}\small
 \begin{tldr}The whole chapter in three lines.\end{tldr}
 \begin{quickwin}Something you can try in under a minute.\end{quickwin}
 \begin{protip}A trick that saves you time later.\end{protip}
 \columnbreak
 \begin{headsup}A thing that might trip you up.\end{headsup}
 \begin{danger}Could lose data or weaken security. Read it.\end{danger}
 \begin{sidequest}Interesting, but not needed to get the job done.\end{sidequest}
 \end{multicols}
 \vspace{-6pt}
 {\small\color{muted}\textbf{Shortcuts:} \mod{} means \kbd{Ctrl} on Windows and Linux, \kbd{\ph{E1C4}} (Command) on a Mac. So
 \keys{\mod+K} is \kbd{Ctrl}+\kbd{K} or \kbd{\ph{E1C4}}+\kbd{K} depending on your machine.}
 \clearpage
 \pagestyle{plain}
 {\hypersetup{linkcolor=body}\tableofcontents}
 \clearpage
 \mainmatter
 \pagestyle{fancy}
 \input{chapters/part1-start}
 \input{chapters/part2-connect}
 \input{chapters/part3-faster}
 \input{chapters/part4-safe}
 \input{chapters/part5-yours}
 \input{chapters/part6-fix}
 \input{chapters/appendix}
 \end{document}
@@ -0,0 +1,27 @@
 #!/bin/bash
 # ForceCommand for the throwaway screenshot sshd: never a login shell (no ~/.profile, no byobu).
 DEMO_HOME=$1 SFTP_SERVER=$2
 export LC_ALL=C.UTF-8
 case "$SSH_ORIGINAL_COMMAND" in
  *sftp*) exec "$SFTP_SERVER" -d "$DEMO_HOME" ;;
  ?*) cd "$DEMO_HOME" && HOME="$DEMO_HOME" exec bash --norc --noprofile -c "$SSH_ORIGINAL_COMMAND" ;;
 esac
 cd "$DEMO_HOME" || exit 1
 export HOME="$DEMO_HOME" PS1='\[\e[1;32m\]andy@atlas\[\e[0m\]:\[\e[1;34m\]\w\[\e[0m\]\$ '
 row() { # boxed line, padded on visible width
  local plain; plain=$(printf '%b' "$1" | sed 's/\x1b\[[0-9;]*m//g')
  printf '\e[1;36m│\e[0m  %b%*s\e[1;36m│\e[0m\n' "$1" $((44 - ${#plain})) ''
 }
 printf '\e[1;36m╭──────────────────────────────────────────────╮\e[0m\n'
 row 'Welcome to \e[1matlas\e[0m · Debian 13 · kernel 6.12'
 row 'Load \e[32m0.42\e[0m   Memory \e[33m61%\e[0m   Disk \e[32m38%\e[0m'
 row 'Last deploy: \e[1m2 hours ago\e[0m by andy'
 printf '\e[1;36m╰──────────────────────────────────────────────╯\e[0m\n\n'
 printf '\e[1;32m$\e[0m ls -l --color\n'; ls -l --color=always
 printf '\n\e[1;32m$\e[0m ./deploy.sh --dry-run\n'
 for s in "Resolving build" "Uploading artefacts" "Rolling out to 4 nodes" "Health checks"; do
  printf '  \e[32m✔\e[0m %-26s \e[2m%s\e[0m\n' "$s" "$((RANDOM % 900 + 100))ms"
 done
 printf '  \e[33m⚠\e[0m 1 warning: \e[1mnginx.conf\e[0m has a deprecated directive\n'
 printf '  \e[1;32mDone.\e[0m Nothing was actually deployed (dry run).\n\n'
 exec bash --norc --noprofile -i
@@ -0,0 +1,214 @@
 #!/usr/bin/env python3
 """Tiny fake servers for the user-guide screenshots: RAW sensor feed (42023), IRC (42667),
 GitHub API (42080) and a VNC desktop (42900). Stdlib only. Runs until killed."""
 import json, math, random, socket, socketserver, struct, threading, time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 class Threaded(socketserver.ThreadingMixIn, socketserver.TCPServer):
    allow_reuse_address = True
    daemon_threads = True
 # --- RAW: a chatty sensor --------------------------------------------------------------
 class Raw(socketserver.BaseRequestHandler):
    def handle(self):
        s = self.request
        s.sendall(b"SENSOR-7 ready. Commands: STATUS, RESET\n")
        t = 20.5
        s.settimeout(0.25)
        for i in range(400):
            t += random.uniform(-0.3, 0.3)
            s.sendall(f"temp={t:.2f}C hum={48 + 4 * math.sin(i / 3):.1f}% seq={i}\n".encode())
            try:
                if (cmd := s.recv(256)):
                    s.sendall(b"OK " + cmd.strip() + b"\n")
            except socket.timeout:
                pass
 # --- IRC: a small, friendly network ----------------------------------------------------
 CHAT = [
    ("ferris", "anyone tried the new Nexus build yet?"),
    ("crabby", "yep, the split panes are lovely"),
    ("ferris", "the serial console support saved my afternoon tbh"),
    ("lin", "does it do jump hosts?"),
    ("crabby", "lin: multiple hops, plus SOCKS5/HTTP proxies"),
    ("ferris", "and it's Rust all the way down now :)"),
 ]
 class Irc(socketserver.StreamRequestHandler):
    def send(self, line):
        self.wfile.write((line + "\r\n").encode())
    def handle(self):
        nick = "andy"
        for raw in self.rfile:
            line = raw.decode(errors="replace").strip()
            cmd, _, rest = line.partition(" ")
            if cmd == "NICK":
                nick = rest.strip()
            elif cmd == "USER":
                self.send(f":irc.demo 001 {nick} :Welcome to the Demo IRC Network, {nick}")
                self.send(f":irc.demo 375 {nick} :- irc.demo Message of the Day -")
                self.send(f":irc.demo 372 {nick} :- Be excellent to each other.")
                self.send(f":irc.demo 376 {nick} :End of /MOTD command.")
            elif cmd == "JOIN":
                for room in rest.split()[0].split(","):
                    self.send(f":{nick}!u@demo JOIN {room}")
                    self.send(f":irc.demo 332 {nick} {room} :Nexus Terminal chat · be kind · no pasting walls of logs")
                    self.send(f":irc.demo 353 {nick} = {room} :@ferris +crabby lin {nick} octo rustacean")
                    self.send(f":irc.demo 366 {nick} {room} :End of /NAMES list.")
                    if room == "#nexus":
                        for who, msg in CHAT:
                            self.send(f":{who}!u@demo PRIVMSG #nexus :{msg}")
                    else:
                        self.send(f":octo!u@demo PRIVMSG {room} :borrow checker 1, me 0")
            elif cmd == "LIST":
                for room, n, topic in [("#nexus", 42, "Nexus Terminal"), ("#rust", 3110, "Rust"), ("#linux", 905, "Linux"), ("#homelab", 77, "Racks & routers")]:
                    self.send(f":irc.demo 322 {nick} {room} {n} :{topic}")
                self.send(f":irc.demo 323 {nick} :End of /LIST")
            elif cmd == "PING":
                self.send(f":irc.demo PONG irc.demo {rest}")
            elif cmd == "QUIT":
                return
 # --- GitHub API --------------------------------------------------------------------------
 REPOS = [
    ("andydixon", "nexus-terminal", "SSH, Telnet, Serial, IRC and VNC in one tidy native app", "Rust", 128, False, False, False, 1),
    ("andydixon", "leviathan", "The egui design system Nexus borrows its looks from", "Rust", 64, False, False, False, 3),
    ("andydixon", "dotfiles", "Shell, editor and terminal config", "Shell", 12, False, False, False, 6),
    ("andydixon", "homelab-ansible", "Playbooks for the rack under the stairs", "Jinja", 7, True, False, False, 9),
    ("andydixon", "alchementary-link", "The Wails/Go predecessor to Nexus Terminal", "Go", 31, False, False, True, 40),
    ("alchementary", "website", "Marketing site", "TypeScript", 3, True, False, False, 2),
    ("alchementary", "infra", "Terraform for everything", "HCL", 2, True, False, False, 5),
    ("alchementary", "russh", "Fork with a jump-host fix", "Rust", 0, False, True, False, 15),
 ]
 WHO = ["Andy Dixon", "ferris", "crabby", "dependabot[bot]"]
 def iso(days):
    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(time.time() - days * 86400 - 3600 * 5))
 class Github(BaseHTTPRequestHandler):
    def log_message(self, *a):
        pass
    def reply(self, obj):
        body = json.dumps(obj).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def do_GET(self):
        if self.path == "/user":
            return self.reply({"login": "andydixon"})
        if self.path.startswith("/user/repos"):
            page = 1 if "page=1" in self.path else 2
            if page != 1:
                return self.reply([])
            return self.reply([
                {"full_name": f"{o}/{n}", "name": n, "description": d, "html_url": f"https://github.com/{o}/{n}",
                 "default_branch": "main", "private": p, "fork": f, "archived": a, "language": l,
                 "stargazers_count": s, "pushed_at": iso(age), "updated_at": iso(age), "owner": {"login": o}}
                for o, n, d, l, s, p, f, a, age in REPOS])
        if "/commits/" in self.path:
            i = sum(map(ord, self.path)) % len(WHO)
            age = next((r[8] for r in REPOS if f"/{r[1]}/" in self.path), 1)
            return self.reply({"commit": {"committer": {"name": WHO[i], "date": iso(age)}, "author": {"name": WHO[i], "date": iso(age)}}})
        self.send_error(404)
 # --- VNC: a static "desktop" ---------------------------------------------------------------
 W, H = 1280, 800
 def desktop():
    px = bytearray(W * H * 4)
    wins = [(90, 90, 620, 420, (40, 44, 52)), (560, 260, 1180, 700, (250, 250, 252)), (140, 560, 460, 740, (32, 140, 120))]
    for y in range(H):
        for x in range(W):
            # Diagonal violet → teal wallpaper.
            k = (x + y) / (W + H)
            r, g, b = int(88 * (1 - k) + 20 * k), int(40 * (1 - k) + 150 * k), int(160 * (1 - k) + 170 * k)
            for x0, y0, x1, y1, c in wins:
                if x0 <= x < x1 and y0 <= y < y1:
                    r, g, b = (200, 70, 90) if y < y0 + 28 else c
                    if y >= y0 + 28 and c == (40, 44, 52) and (y - y0) % 22 < 9 and x0 + 20 < x < x0 + 20 + ((y * 37) % 400):
                        r, g, b = (120, 220, 140) if (y // 22) % 3 else (230, 200, 120)
            if y >= H - 40:
                r, g, b = 24, 24, 30
            i = (y * W + x) * 4
            px[i:i + 4] = bytes((r, g, b, 0))
    return bytes(px)
 PIXELS = None
 class Vnc(socketserver.BaseRequestHandler):
    def recv(self, n):
        b = b""
        while len(b) < n:
            c = self.request.recv(n - len(b))
            if not c:
                raise EOFError
            b += c
        return b
    def handle(self):
        s = self.request
        s.sendall(b"RFB 003.008\n")
        self.recv(12)
        s.sendall(bytes([1, 1]))  # one security type: None
        self.recv(1)
        s.sendall(struct.pack(">I", 0))
        self.recv(1)  # ClientInit
        name = b"studio:0 (demo)"
        s.sendall(struct.pack(">HH", W, H) + bytes([32, 24, 0, 1, 0, 255, 0, 255, 0, 255, 0, 8, 16, 0, 0, 0]) + struct.pack(">I", len(name)) + name)
        sent = False
        try:
            while True:
                t = self.recv(1)[0]
                if t == 0:
                    self.recv(19)
                elif t == 2:
                    n = struct.unpack(">xH", self.recv(3))[0]
                    self.recv(4 * n)
                elif t == 3:
                    self.recv(9)
                    if not sent:
                        s.sendall(struct.pack(">BxH", 0, 1) + struct.pack(">HHHHi", 0, 0, W, H, 0) + PIXELS)
                        sent = True
                    else:
                        time.sleep(0.5)
                        s.sendall(struct.pack(">BxH", 0, 0))
                elif t == 4:
                    self.recv(7)
                elif t == 5:
                    self.recv(5)
                elif t == 6:
                    n = struct.unpack(">3xI", self.recv(7))[0]
                    self.recv(n)
                else:
                    return
        except (EOFError, ConnectionError):
            pass
 if __name__ == "__main__":
    PIXELS = desktop()
    for port, handler in [(42023, Raw), (42667, Irc), (42900, Vnc)]:
        threading.Thread(target=Threaded(("127.0.0.1", port), handler).serve_forever, daemon=True).start()
    print("fakes ready", flush=True)
    ThreadingHTTPServer(("127.0.0.1", 42080), Github).serve_forever()
@@ -0,0 +1,100 @@
 #!/usr/bin/env bash
 # Regenerates docs/guide/img/*.png: a throwaway sshd (ForceCommand, never a login shell),
 # fake RAW/IRC/GitHub/VNC servers, a demo data directory, then one headless app run per shot.
 # Needs: xvfb-run, sshd, ssh-keygen, python3, ImageMagick. Usage: docs/guide/tools/screenshots.sh [shot...]
 set -euo pipefail
 cd "$(dirname "$0")/.."
 GUIDE=$PWD
 B=${NEXUS_GUIDE_TMP:-/tmp/nexus-guide}
 IMG=$GUIDE/img
 APP=$GUIDE/../../rust/target/debug/nexus-terminal
 SCALE=${SCALE:-2}
 mkdir -p "$IMG"
 rm -rf "$B" && mkdir -p "$B/home/.ssh" "$B/sshd"
 (cd ../../rust && cargo build -q -p nexus && cargo build -q -p nexus-core --example demo_data)
 # Demo home: what the SFTP browser, the shell and the SSH key manager see.
 H=$B/home
 mkdir -p "$H"/{projects/nexus,backups,logs,www/static}
 printf 'server {\n  listen 443 ssl;\n}\n' > "$H/nginx.conf"
 echo '#!/bin/sh' > "$H/deploy.sh"; chmod +x "$H/deploy.sh"
 head -c 180000 /dev/urandom > "$H/backups/db-2026-10-10.sql.gz"
 head -c 52000 /dev/urandom > "$H/logs/access.log"
 echo "# Notes" > "$H/README.md"
 ssh-keygen -q -t ed25519 -N '' -C 'andy@laptop' -f "$H/.ssh/id_ed25519"
 ssh-keygen -q -t rsa -b 2048 -N '' -C 'andy@work' -f "$H/.ssh/work_rsa"
 ssh-keygen -q -t ecdsa -N '' -C 'deploy-bot' -f "$H/.ssh/deploy_ecdsa"
 # sshd on 42022 (ForceCommand keeps it away from ~/.profile).
 S=$B/sshd
 ssh-keygen -q -t ed25519 -N '' -f "$S/host"
 cp "$H/.ssh/id_ed25519.pub" "$S/authorized_keys"
 SFTP=$(ls /usr/lib/openssh/sftp-server /usr/libexec/openssh/sftp-server /usr/libexec/sftp-server 2>/dev/null | head -1 || true)
 cat > "$S/config" <<CFG
 Port 42022
 ListenAddress 127.0.0.1
 HostKey $S/host
 AuthorizedKeysFile $S/authorized_keys
 PidFile $S/pid
 StrictModes no
 UsePAM no
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 PubkeyAuthentication yes
 PrintMotd no
 PrintLastLog no
 Subsystem sftp $SFTP
 ForceCommand $GUIDE/tools/demo-shell.sh $H $SFTP
 CFG
 "$(command -v sshd)" -f "$S/config" -E "$S/log"
 python3 -I "$GUIDE/tools/fakes.py" > "$B/fakes.log" 2>&1 &
 FAKES=$!
 trap 'kill $FAKES 2>/dev/null; kill "$(cat "$S/pid" 2>/dev/null)" 2>/dev/null || true' EXIT
 until grep -q ready "$B/fakes.log"; do sleep 0.2; done
 "$(dirname "$APP")/examples/demo_data" "$B/data" "$H/.ssh/id_ed25519" > /dev/null
 cp -r "$B/data" "$B/data.clean"
 shot() { # name, then app args
  local name=$1; shift
  if [ ${#ONLY[@]} -gt 0 ] && [[ ! " ${ONLY[*]} " =~ " $name " ]]; then return 0; fi
  rm -rf "$B/data" && cp -r "$B/data.clean" "$B/data"
  HOME=$H WINIT_X11_SCALE_FACTOR=$SCALE timeout 60 xvfb-run -a -s "-screen 0 3200x2000x24" \
    "$APP" --data-dir "$B/data" --size 1360x860 --screenshot "$IMG/$name.png" "$@" 2>> "$B/app.log" || echo "  ! $name failed"
  # 256-colour PNGs are a quarter of the size and look identical for UI shots.
  [ -f "$IMG/$name.png" ] && magick "$IMG/$name.png" -colors 256 "PNG8:$IMG/$name.png"
  echo "  $name"
 }
 ONLY=("$@")
 shot welcome
 shot welcome-midnight --theme midnight
 shot welcome-light    --theme light
 shot ssh              --connect "Sensor feed" --connect "Libera Chat" --connect atlas --shot-delay 5500
 shot ssh-light        --theme light --connect atlas --shot-delay 5500
 shot hostkey          --connect hello-ssh --shot-delay 5000
 shot split            --connect atlas --do "Split Pane Right" --shot-delay 5500
 shot sftp             --connect atlas --do "SFTP Browser" --shot-delay 6000
 shot broadcast        --connect build-runner --connect atlas --do "Toggle Broadcast Mode" --shot-delay 5500
 shot raw              --connect "Sensor feed" --shot-delay 5500
 shot irc              --connect "Libera Chat" --shot-delay 5500
 shot github           --connect GitHub --answer ghp_demo --shot-delay 6000
 shot vnc              --connect "Studio desktop" --answer demo --shot-delay 6000
 shot local            --run-local 'printf "\e[1;35mhello from the local shell\e[0m\n"; ls -la --color=always' --shot-delay 5000
 shot palette          --open palette
 shot quick            --open quick
 shot editor-ssh       --open editor:ssh
 shot editor-new       --open editor:new
 shot editor-serial    --open editor:serial
 shot editor-telnet    --open editor:telnet
 shot editor-raw       --open editor:raw
 shot editor-vnc       --open editor:vnc
 shot editor-irc       --open editor:irc
 shot editor-github    --open editor:github
 for t in general terminal security knownhosts help about; do shot "settings-$t" --open "settings:$t"; done
 shot keys             --open keys
 shot snippets         --open snippets
 shot triggers         --open triggers
 shot recordings       --open recordings
 shot export           --open export
@@ -1,26 +1,260 @@
 # Nexus Terminal Overview
-Nexus Terminal is a desktop client for managing SSH, Telnet, RAW TCP, and GitHub sessions in one place. It is designed for people who work across multiple servers, environments, or repositories and want a fast, focused workflow with strong credential handling.
+Nexus Terminal is a native desktop connection workspace for people who manage servers, network services, serial devices, remote desktops, chat networks and repositories every day. It brings SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions into one focused app with secure credential handling, multi-session organisation, file transfer, automation and recording built in.
-## What it does
+It is a single Rust application drawn with egui: there is no webview, no bundled browser engine and no runtime to install. Terminal output goes straight from the network into the terminal emulator, so large outputs stay responsive.
- Connect to SSH, Telnet, and RAW TCP endpoints with saved profiles or quick connect.
+## Product positioning
 - Manage multiple live sessions with tabs, split panes, and broadcast input.
 - Browse and move files on SSH hosts with a built-in SFTP browser.
 - Record sessions for later playback.
 - Store credentials securely with OS keychain support and an encrypted vault fallback.
-## Highlights
+Nexus Terminal is more than an SSH client. It is a single command centre for remote access, terminal operations, file movement, raw socket inspection, serial consoles, IRC, GitHub repository visibility and repeatable operational workflows.
- Multi-session tab bar with pinning, reordering, and split panes.
+Use Nexus Terminal when you need to:
- SFTP browser with drag-and-drop uploads and a directory picker.
+
- Clipboard-aware terminal with search, snippets, and right-click actions.
+- Connect quickly to many systems without re-entering credentials.
- Auto-reconnect, login scripts, and SSH extras such as jump hosts and port forwarding.
+- Keep multiple live sessions organised with tabs, pinned tabs, split panes and status indicators.
- GitHub view for browsing repositories by organisation.
+- Move files over SSH without leaving the terminal workspace.
 - Work safely with host key verification, encrypted secrets, TOTP support and audit logging.
 - Reuse commands, automate login flows, record sessions and react to terminal output.
 - Support mixed estates that include SSH servers, Telnet devices, raw TCP services, serial consoles, VNC desktops, IRC networks, GitHub repositories and local shells.
 ## Main feature groups
 ### Multi-protocol connections
 - **SSH** for secure remote terminal access.
 - **Telnet** for legacy devices and services.
 - **RAW TCP** for direct socket interaction, protocol testing and device troubleshooting.
 - **Serial** for USB-serial adapters, console cables, development boards and network gear.
 - **VNC** for remote desktop access, with a native viewer.
 - **IRC** for chat networks, with rooms, users and an optional SSH tunnel.
 - **GitHub** for repository browsing and download workflows.
 - **Local terminal** for opening a shell on the local machine.
 - **Quick connect** for one-off SSH, Telnet, RAW, IRC or Serial sessions without saving a profile.
 - **Saved profiles** for repeat connections.
 ### Profile management
 - Create, edit, duplicate and delete connection profiles.
 - Store display names, descriptions, notes, groups, tags and favourites.
 - Fuzzy search across name, host, tags and protocol.
 - Sidebar sections for Local Machine, Favourites, Recent (last five), groups and Ungrouped.
 - Multi-select profiles with Ctrl/Cmd-click for bulk connect, disconnect, tagging, moving between groups and deleting.
 - Test basic host and port reachability before connecting.
 - Import existing OpenSSH config entries from `~/.ssh/config`, including hostnames, usernames, ports, identity files and jump hosts.
 - Export and import profiles using encrypted `.nexus` bundles; older `.link` bundles from Alchementary Link import too.
 - Plain JSON export and import, with secrets redacted unless you choose to include them.
 - Choose import behaviour for duplicates: skip, overwrite or duplicate.
 ### Multi-session workspace
 - Custom title bar with File, Session, View and Help menus, a command palette launcher and a light/dark toggle.
 - Tabbed sessions with protocol badges, connection state dots and activity markers.
 - Pin tabs to keep important systems at the front.
 - Rename, duplicate, reconnect and reorder tabs (drag, or Move Left/Right).
 - Scroll overflowing tabs and hover them to see the host, state and connection start time.
 - Split the active tab right or down, as many times as you like, with draggable dividers.
 - Switch tabs by keyboard shortcut.
 - Broadcast input to all connected terminal sessions, or to a chosen set.
 - Disconnected and error overlays with one-click reconnect.
 - Auto-reconnect with exponential backoff for SSH, Telnet, RAW TCP, Serial and IRC profiles.
 - Guided error dialogs for authentication and host-key failures, with shortcuts to edit the profile or open Known Hosts.
 - Command palette for connections, tabs, new profiles, settings, import/export, themes, the secret store, SSH keys, snippets, triggers, recordings and terminal actions.
 - Status bar with session state, protocol, recording indicator, SSH latency, broadcast state, vault state, session count and update notices.
 ### Terminal experience
 - Native terminal emulation (alacritty_terminal) with full colour, mouse reporting, bracketed paste and IME input.
 - Eleven terminal colour schemes, applied to every open terminal at once.
 - Configurable font family, font size, scrollback and cursor style, per profile or as defaults.
 - Find in terminal output, with case-sensitive and regular-expression options and a match counter.
 - Copy with Ctrl/Cmd+C when text is selected (otherwise it sends an interrupt), paste with Ctrl/Cmd+V.
 - Double-click selects a word, triple-click selects a line, Shift-click extends a selection.
 - Ctrl/Cmd-click a web link to open it in your browser.
 - Shift+PageUp/PageDown/Home/End and the mouse wheel scroll the scrollback; on the alternate screen the wheel sends arrow keys, so `tmux`, `screen` and `byobu` scroll naturally.
 - Context menu with Copy, Paste, Select All, Find, Send Snippet, Port Forwards, Split Right, Split Down, Export Output, Clear and Reset.
 - Export the whole scrollback as plain text.
 - Status-bar latency for the active SSH session.
 ### SSH capabilities
 - Password, public key, keyboard-interactive and SSH agent authentication.
 - SSH agent forwarding.
 - Private key suggestions from `~/.ssh`, with a key file check.
 - SSH key manager for listing, generating, copying and deleting key pairs (Ed25519, RSA 2048/4096 and ECDSA, optional passphrase).
 - TOTP / 2FA secret storage and automatic code entry for keyboard-interactive logins.
 - Host key verification policies per profile: Strict, Ask, Accept new and Insecure.
 - Known hosts storage and management.
 - Jump hosts for bastion and multi-hop access.
 - SOCKS5 and HTTP CONNECT proxies.
 - Local and remote port forwarding, started on connect or managed at runtime.
 - Startup commands, custom environment variables and terminal type.
 - Keepalive interval and missed-keepalive settings, and compression.
 - Expect-style login scripts with wait and send steps.
 - Built-in SFTP browser for file transfer.
 ### SFTP file browser
 - Opens in a resizable dock beside the terminal.
 - Navigate remote folders with breadcrumbs, or go directly to a path.
 - Bookmark remote locations (kept per profile).
 - Refresh listings and create folders.
 - Upload files, and download single or multiple selected files.
 - Rename and delete files and folders.
 - Multi-select for batch actions.
 - Transfer queue with progress.
 - Drag and drop files onto an SSH terminal, then upload them or paste their contents.
 - Upload directory picker with folder filtering, breadcrumbs, keyboard navigation and READ ONLY / NO READ badges.
 ### Telnet capabilities
 - Telnet option negotiation, including echo, terminal type and NAWS window-size updates.
 - Local echo and line mode options.
 - Configurable line endings: LF, CR, CRLF or none.
 - Configurable encoding: UTF-8, ASCII and ISO 8859-1.
 - Negotiation debug mode.
 - Expect-style login scripts.
 - Auto-reconnect with a configurable retry count.
 ### RAW TCP capabilities
 - Direct TCP socket sessions.
 - Text, hex and split data views.
 - Send data as text, hex or escaped bytes.
 - Quick insert buttons for NUL, CR, LF, ETX and EOT.
 - Payload presets for reusable test messages.
 - Optional timestamps and send/receive direction labels.
 - Pause and resume display updates, and clear the capture buffer.
 - Save RAW session captures as JSON.
 - Configurable encoding and line endings.
 - Connect and read timeouts.
 - Auto-reconnect option.
 ### Serial capabilities
 - Pick a device from the detected port list, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
 - Baud rate from common presets or any custom value, 5–8 data bits, none/odd/even parity, 1 or 2 stop bits.
 - Flow control: none, XON/XOFF (software) or RTS/CTS (hardware).
 - Line ending, encoding and local echo.
 - Assert DTR and RTS on connect (both on by default).
 - Auto-reconnect: unplugging the adapter disconnects the session, and the port is reopened when it comes back.
 - Clear hints for permission-denied and busy ports.
 - Works with everything a terminal session supports: recording, triggers, broadcast, snippets, find and split panes.
 ### VNC capabilities
 - Native VNC viewer inside the Nexus Terminal workspace (RFB 3.3–3.8; Raw, CopyRect, Hextile, ZRLE and Tight encodings).
 - Password prompt and password storage modes.
 - View-only mode.
 - Scale-to-fit or 1:1 display, switchable from the toolbar.
 - Shared-session option and a quality setting.
 - Send the local clipboard to the remote desktop, send Ctrl+Alt+Del, and request a full refresh.
 - SSH tunnel option for VNC traffic, with password, public key or SSH agent authentication.
 - A warning before connecting without a tunnel, because classic VNC traffic is not encrypted.
 ### IRC capabilities
 - Nick, real name, TLS and an optional server password.
 - NickServ identification on connect.
 - Auto-join rooms.
 - A Server tab plus one tab per room or private conversation, with unread markers.
 - Slash commands such as `/join`, `/part`, `/msg`, `/me`, `/nick`, `/topic`, `/list`, `/names`, `/whois` and `/raw`.
 - Tab nick completion, and click a nick to mention it.
 - Room browser with a filter, and a users list for the current room.
 - mIRC colour and formatting codes rendered in the conversation.
 - Optional SSH tunnel and auto-reconnect.
 ### GitHub capabilities
 - GitHub profile type using a personal access token.
 - GitHub.com and GitHub Enterprise API base URL support.
 - Repository viewer grouped by owner or organisation.
 - Repository filtering.
 - Repositories sorted by latest commit activity.
 - Repository metadata such as language, stars, private/fork/archived state, latest committer and latest commit time.
 - Manual refresh and a configurable refresh interval.
 - Open repositories in the browser.
 - Download repository ZIP archives.
 ### Automation and reusable workflows
 - Snippet library for saved commands, with names, descriptions and folders.
 - Send snippets to the active session.
 - Built-in snippet variables (`{{hostname}}`, `{{date}}`, `{{time}}`, `{{timestamp}}`) and prompted custom variables.
 - Broadcast input mode for running the same command across connected sessions.
 - Trigger rules that watch terminal output, matching plain text or regular expressions.
 - Trigger actions for notifications, tab highlighting, both, or a sound (attention request).
 - Expect-style login scripts for SSH and Telnet.
 - Startup commands for SSH sessions.
 ### Session recording
 - Start and stop terminal recording per session.
 - Recording indicator on the tab and in the status bar.
 - Recordings saved in asciicast v2 format.
 - Recording browser with storage usage and clean-up by age or total size.
 - Playback with play/pause, restart, a seek bar and speed control.
 - Delete saved recordings.
 ### Security and credential handling
 - OS keychain first where available: macOS Keychain, Linux Secret Service and Windows Credential Manager.
 - Encrypted vault fallback, using AES-256-GCM with an Argon2id-derived key.
 - Secret store lock and unlock workflow, with a master-password strength meter.
 - Per-credential secret modes: Save securely, Remember for this session, and Ask every time.
 - Encrypted storage for TOTP secrets.
 - Known host verification and known host management.
 - Audit log of connections, disconnections, profile changes, credential access, imports and exports. Secrets are never written to it.
 - Encrypted profile exports with password-based AES-256-GCM encryption and Argon2id key derivation.
 ### Settings and maintenance
 - App theme (Pro, Midnight or Light) and terminal colour scheme.
 - Default protocol preference.
 - Default terminal font, size, scrollback and cursor settings.
 - Confirm-on-close and confirm-on-disconnect preferences.
 - Status bar visibility and sidebar width.
 - Local shell selection.
 - Secret store settings.
 - Known hosts management.
 - Help topics and troubleshooting inside Settings.
 - A background update check at launch, and a manual check in Settings → About.
 ## Website-ready summary
 ### Suggested headline
 Nexus Terminal: one native desktop workspace for SSH, files, sockets, serial consoles, remote desktops, chat and repositories.
 ### Suggested subheadline
 Manage SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shell sessions from a fast tabbed interface with secure credentials, SFTP file transfer, split panes, snippets, recordings and automation built in.
 ### Short product description
 Nexus Terminal helps developers, operators, support engineers, network and hardware engineers, and homelab users manage many connections without juggling separate tools. Save profiles, organise them with groups and tags, connect in tabs or split panes, move files over SFTP, inspect raw TCP traffic, talk to serial devices, open VNC desktops, join IRC networks, browse GitHub repositories, and keep credentials protected with keychain and encrypted-vault storage.
 ### Product page feature bullets
 - All-in-one connection workspace for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local shells.
 - Native and fast: no webview, with a terminal that stays responsive under heavy output.
 - Multi-session interface with tabs, pinned sessions, split panes, reconnect and broadcast input.
 - Rich SSH support including agent auth and forwarding, TOTP, jump hosts, proxies, port forwarding, startup commands, login scripts and host key policies.
 - Built-in SFTP browser with upload, download, rename, delete, folders, bookmarks, drag-and-drop upload and permission-aware directory picking.
 - RAW TCP tooling with text, hex and split views, payload presets, captures, timestamps and byte-level sending.
 - Serial consoles with full line settings, flow control, DTR/RTS control and auto-reconnect on replug.
 - Native VNC viewer with scale-to-fit, view-only mode, quality controls, shared sessions and optional SSH tunnelling.
 - IRC client with rooms, nick completion, NickServ and mIRC formatting.
 - GitHub repository browser with organisation grouping, filtering, activity sorting, ZIP downloads and GitHub Enterprise support.
 - Secure credential model using the OS keychain first, encrypted vault fallback, per-credential secret modes, known hosts, encrypted exports and audit logging.
 - Productivity tools including command palette, snippets, trigger rules, session recording, terminal search, scrollback export and local terminal.
 ## Who it is for
-Nexus Terminal suits operators, developers, and support teams who need to connect to many endpoints quickly, keep sessions organised, and avoid re-entering credentials.
+- Developers who connect to many application servers, staging environments and production hosts.
 - Platform and DevOps teams who need organised, secure access across infrastructure.
 - Support teams who troubleshoot customer systems, network appliances and legacy Telnet devices.
 - Network and hardware engineers who need RAW TCP, Telnet and serial tools beside normal SSH workflows.
 - Homelab users who want SSH, VNC, file transfer, serial consoles and repo access in one desktop app.
 ## Learn more
@@ -1,33 +1,46 @@
 # Nexus Terminal Quick Start
-Nexus Terminal is a desktop client for SSH, Telnet, RAW TCP, and GitHub sessions. This page is a shareable quick start for everyday use.
+Nexus Terminal is a native desktop client for SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminal sessions. This page is a shareable quick start for everyday use.
 ## Get connected in minutes
 1. Open Nexus Terminal.
-2. Click **New** in the sidebar.
+2. Click **+** at the bottom of the sidebar, or press **Cmd+N** (macOS) / **Ctrl+N** (Windows/Linux).
-3. Choose a protocol and enter the connection details.
+3. Choose a protocol at the top of the editor and enter the connection details.
-4. Click **Connect** to open the session in a new tab.
+4. Click **Create & Connect** to save the profile and open the session in a new tab.
-One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect.
+Next time, just click the profile in the sidebar.
 One-off session? Use **Cmd+Shift+Q** / **Ctrl+Shift+Q** for quick connect. Need a local shell? Click **Local Machine** at the top of the sidebar.
 ## Daily workflow
- **Tabs and splits**: Drag tabs to reorder, and split the workspace to view multiple sessions at once.
+- **Command palette**: Press **Cmd+K** / **Ctrl+K** to connect, switch tabs or run any command by typing a few letters.
- **Broadcast input**: Toggle with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux) to send the same command to all connected sessions.
+- **Tabs and splits**: Drag tabs to reorder them, right-click a tab to pin, rename, duplicate or reconnect it, and split the workspace with **Cmd+Shift+D** / **Ctrl+Shift+D** (right) or **Cmd+Shift+E** / **Ctrl+Shift+E** (down).
- **Snippets**: Save common commands and run them with one click.
+- **Scrollable tabs**: Use the mouse wheel or trackpad over the tab strip when many tabs are open. Hover a tab to see its host, state and connection start time.
- **Search**: Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search within the active terminal.
+- **Broadcast input**: Toggle with **Cmd+Shift+B** / **Ctrl+Shift+B** to send the same keystrokes to every connected terminal. Right-click the broadcast button on the tab strip to pick targets.
 - **Snippets**: Save common commands with **Cmd+Shift+S** / **Ctrl+Shift+S** and send them with one click.
 - **Search**: Press **Cmd+F** / **Ctrl+F** to search within the active terminal.
 - **Copy, paste and links**: Select text and press **Cmd+C** / **Ctrl+C** to copy (with nothing selected, Ctrl+C interrupts as usual). **Cmd+V** / **Ctrl+V** pastes. **Cmd-click** / **Ctrl-click** a URL to open it.
 - **Reconnect quickly**: If a session drops, click **Reconnect** on the disconnected overlay.
 ## Serial consoles
 Create a **Serial** profile, pick the device from the list (click refresh after plugging in an adapter) and set the baud rate and line settings to match the device — 115200 8N1 with no flow control is the default. On Linux your user needs to be in the `dialout` (or `uucp`) group; on macOS use the `/dev/cu.*` device.
 ## VNC remote desktops
 Create a **VNC** profile for remote desktop sessions. Use the SSH tunnel option when possible, especially outside trusted networks. Direct VNC is available for isolated or trusted networks, but classic VNC traffic is not encrypted, so Nexus Terminal asks before connecting without a tunnel.
 ## File transfers on SSH
-Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename, and delete files.
+Click the **folder** icon on an SSH tab to open the SFTP browser. You can browse, upload, download, rename and delete files, create folders and bookmark locations.
 ### Drag and drop files
-Drop file(s) into the terminal and choose to:
+Drop file(s) onto a terminal and choose to:
- **Upload** to a selected remote folder, or
+- **Upload to current directory** — pick a remote folder (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 The upload picker lists folders only and marks permissions:
@@ -38,9 +51,14 @@ The upload picker lists folders only and marks permissions:
 ## Security basics
 - Credentials are stored in the OS keychain where available.
- An encrypted vault is used as a fallback.
+- An encrypted vault (AES-256-GCM, Argon2id) is used as a fallback; set it up in **Settings → Security**.
 - Each password, passphrase or token can be saved, remembered for the session only, or asked for every time.
 - SSH host key checks can be set per profile (Strict, Ask, Accept new, Insecure).
 ## Coming from Alchementary Link
 Your profiles, vault and recordings are copied across automatically on first run, and keychain entries are picked up the first time they are needed. Your old Alchementary Link data is left untouched.
 ## Common shortcuts
 | macOS Shortcut  | Windows/Linux Shortcut | Action                   |
@@ -53,8 +71,8 @@ The upload picker lists folders only and marks permissions:
 | Cmd + Shift + B | Ctrl + Shift + B       | Broadcast input          |
 | Cmd + Shift + Q | Ctrl + Shift + Q       | Quick connect            |
 | Cmd + Shift + R | Ctrl + Shift + R       | Toggle session recording |
-| Cmd + Shift + D | Ctrl + Shift + D       | Split pane vertically    |
+| Cmd + Shift + D | Ctrl + Shift + D       | Split pane right         |
-| Cmd + Shift + E | Ctrl + Shift + E       | Split pane horizontally  |
+| Cmd + Shift + E | Ctrl + Shift + E       | Split pane down          |
 ## Need more detail?
@@ -0,0 +1,481 @@
 # Rust port plan: Nexus Terminal, a native egui app with no Go and no webview
 > **Status (11 October 2026): converted.** Every phase below has been carried out on the
 > `rust-port` branch; Go, Node and Wails are gone. What was verified and what wasn't:
 >
 > - **Verified here (Linux):** the Go-generated fixtures (database, vault, `.link` export,
 >   recording) load; SSH against a real OpenSSH server (key and agent auth, PTY shell, exec,
 >   local/remote forwards, SFTP, jump host, agent forwarding, host-key rejection), including
 >   through the GUI with the host-key prompt and login scripts; local shell, RAW, Telnet/RAW/serial
 >   client tests (serial on a pty pair); the session manager (events, reconnect backoff, restart of
 >   an exited local shell); the terminal renderer (colours, 256/true colour, CJK fallback); every
 >   window rendered headlessly; `cargo clippy` clean; the Windows target builds and links.
 > - **Not verified:** macOS builds (need Apple's C toolchain), running on Windows or macOS, the OS
 >   keychain on a real desktop session (none was available, so the go-keyring compatibility in §3
 >   is untested), IRC, GitHub and VNC against real servers (tested against fakes), serial hardware.
 > - **Update URLs:** moved to `https://dixon.cx/downloads/nexus` (§7).
 Goal: rebuild Alchementary Link in Rust as **Nexus Terminal**, a single Rust application in the
 style of Leviathan Desktop (`../leviathan/rust`).
 - **UI:** the Wails webview (HTML/CSS/JS, xterm.js) is replaced by an **eframe/egui 0.36** shell with
  Leviathan's design system: `Tokens` themes, Inter and JetBrains Mono, Phosphor icons, a custom title
  bar, a navigator rail, document tabs, a dock, a status bar, and the Ctrl/Cmd+K palette over one `Cmd`
  enum. Full functional parity is required.
 - **Backend:** the Go core is ported to Rust. At the end, Go, Node and Wails are gone from the repo.
 - **Rename:** back to **Nexus Terminal** (§7). Existing Alchementary Link data is migrated on first
  run.
 - **Removed:**
  - the hidden **Leviathan** mode (`internal/leviathan/*`, `leviathan.js`, the Konami toggle). It now lives in Leviathan Desktop.
  - the **VS Code bridge** (`cmd/vscode-bridge`).
 - **New:** a Serial protocol (§4).
 - **VNC is included, not deferred.** Rust has a usable RFB client crate (§6a).
 ### Crates
 | Need | Crate | Notes |
 |---|---|---|
 | UI | `eframe`/`egui` 0.36, `egui-phosphor`, `rfd`, `image` | Same versions and features as Leviathan (`glow`, `wayland`, `x11`, `accesskit`, `persistence`) |
 | Async runtime | `tokio` (multi-thread, 2 workers) | Network sessions only. The UI thread never blocks on it |
 | SSH, SFTP | `russh`, `russh-sftp`, `ssh-key` | Strict-kex (Terrapin) support; client-side **agent forwarding** (`server_channel_open_agent_forward`); `direct-tcpip` for jump hosts; `tcpip-forward` for remote forwards |
 | Terminal emulation | `alacritty_terminal` | VT parser, grid, scrollback, selection and regex search (the same engine Zed uses). We draw it with egui's painter (§6) |
 | Local shell | `portable-pty` | `forkpty` on Unix, ConPTY on Windows |
 | Serial | `serialport` | Baud/bits/parity/stop, RTS/CTS and XON/XOFF, DTR/RTS, break, port enumeration |
 | IRC | none (our own client over std TCP, `rustls` for TLS) | Registration, PING, CTCP, NickServ via PRIVMSG; reconnect and channel-state persistence are ours |
 | VNC | none (our own RFB client; `des`, `flate2`, `image` for Tight JPEG) | RFB 3.3–3.8, VNC auth, Raw/CopyRect/Hextile/ZRLE/Tight → egui texture |
 | HTTP (GitHub, updater) | `ureq` 3 | Blocking calls on `spawn_blocking` |
 | SQLite | `rusqlite` (`bundled`) | SQLite compiled in, so no system library is needed |
 | Vault, export | `argon2`, `aes-gcm`, `rand` | Native Argon2id at 128 MiB takes about 0.3 s |
 | Keychain | `keyring` 3 (pure-Rust D-Bus via zbus on Linux) | Must read entries written by go-keyring (§3) |
 | TOTP | none (`hmac` + `sha1`, ~30 lines) | RFC 6238, normalised like pquerna/otp |
 | JSON | `serde`, `serde_json` | Protocol configs stay JSON columns |
 | Telnet, RAW, recordings | none (tokio `TcpStream`, serde) | Small ports of the Go code |
 There are **no system C libraries**. SQLite is compiled in, and TLS uses rustls. The Linux binary needs
 only the X11/Wayland/GL libraries that eframe loads, as Leviathan does.
 ## 1. Architecture
 Like Leviathan, the project is engine-first: a UI-free core crate, and the egui app is one client of it.
 ```
 rust/
 ├── core/    nexus-core: storage, secrets, models, protocol clients, SessionManager, Service. No egui.
 └── app/     nexus: the egui shell
 ```
 - **`Service`** keeps the **same method names** as today's `api.Service` (`connect_session`,
  `sftp_list`, …), and **`Event`** is one enum whose variants match today's event names
  (`SessionData`, `SessionState`, `SecretPrompt`, `HostKeyVerify`, …). The checklist in §10 refers to
  these names. They are now plain Rust calls with no serialisation.
 - **The UI thread** runs egui and owns all UI state. Each frame it drains a
  `crossbeam_channel::Receiver<Event>`. `Service` methods that touch SQLite are fast and run inline
  (rusqlite behind a `Mutex<Connection>`, in WAL mode).
 - **One tokio task per session** (SSH, Telnet, RAW, IRC, GitHub refresh, VNC). Serial and local-shell
  sessions each get a blocking thread (`serialport` and `portable-pty` have blocking APIs). Each session
  has an `mpsc` outbound queue (keystrokes, resize, break, DTR/RTS). Inbound bytes are batched per read
  and sent as one `Event::SessionData`, followed by `ctx.request_repaint()`. Sending raw bytes instead
  of base64 JSON is the main performance gain over the Wails app.
 - **Credential prompts:** when a session task needs a secret or a host-key decision while connecting,
  it sends `Event::SecretPrompt { reply: oneshot::Sender }` and awaits the answer. Closing the session
  drops the receiver, which cancels the prompt. This is the same contract as the Go channel.
 - **Long jobs** (SFTP transfers, archive download, `test_connection`, key generation) are tokio tasks
  or `spawn_blocking`, and report progress through events.
 ## 2. SSH (russh)
 | Feature | Approach |
 |---|---|
 | Interactive shell | `channel.request_pty(term type from the profile)`, env vars, `request_shell`, `window_change` |
 | Auth | password, public key (files, with passphrase), agent (`SSH_AUTH_SOCK`; Pageant and the Windows OpenSSH pipe through russh's agent client), keyboard-interactive, with TOTP answering the prompts |
 | Host keys | `Handler::check_server_key` against **our** SQLite known-hosts table (strict/ask/accept-new/insecure). Never `~/.ssh/known_hosts` |
 | Keepalive | russh `keepalive_interval`/`keepalive_max` from the profile |
 | Jump hosts | Hop N opens `channel_open_direct_tcpip`, and its stream is passed to hop N+1 as the transport (`connect_stream`). No loopback socket is needed |
 | SOCKS5 and HTTP proxies | `tokio-socks` for SOCKS5; HTTP CONNECT is about 40 lines. The resulting stream goes to `connect_stream` |
 | Local forwards | A `TcpListener` per forward → `channel_open_direct_tcpip` → `copy_bidirectional` |
 | Remote forwards | `tcpip_forward`, plus `Handler::server_channel_open_forwarded_tcpip` |
 | Agent forwarding | `agent_forward` request plus `server_channel_open_agent_forward`, bridged to the local agent. ⚠ Prove this in the phase 0 spike |
 | SFTP | `russh-sftp` on a second channel: list/stat/mkdir/rename/remove/upload/download, with progress events |
 | Key manager | `ssh-key`: generate ed25519, RSA 2048/4096 and ECDSA; write OpenSSH private keys (encrypted with bcrypt-pbkdf + aes256-ctr); public-key export; `file_is_private_key`. The key comment becomes `name@nexus-terminal` |
 | `~/.ssh/config` import | Port of `sshconfig` (~300 lines of Go) |
 | Compression | russh `zlib@openssh.com` when the profile enables it |
 The fallback, if a russh gap blocks the spike, is `ssh2` (libssh2 with vendored OpenSSL). It has no
 API for accepting agent-forwarding channels, and it brings C back into the build.
 ## 3. Porting the Go backend
 Sizes are Go lines, excluding tests. The Go tree is 41k lines. Leviathan (25.5k), VNC's Go side and the bridge are not
 ported, which leaves about 15k lines to port.
 | Go package | Lines | Rust replacement |
 |---|---|---|
 | `storage` + `migrations/*.sql` | 949 | rusqlite. **Embed the same `.sql` files** with `include_str!` and keep the same migrations table, so existing databases open unchanged |
 | `models`, `validation`, `preferences`, `audit`, `knownhosts`, `config` | ~1.5k | Plain modules. Protocol configs stay JSON columns, read as `serde_json::Value` or, where the UI edits them, as `#[derive(Deserialize)]` structs with `#[serde(default)]`. Leviathan preferences (`leviathanEnabled`, …) are ignored on read |
 | `secrets` (vault + keychain) | 460 | Vault: `argon2` + `aes-gcm`. Keychain: `keyring`, with explicit target names to match go-keyring (see below) |
 | `exportimport` | 209 | Same envelope and the same crypto; `.nexus` extension (§7) |
 | `sessions` + `api` | ~6k | `SessionManager` + `Service` (§1): reconnect with attempts and backoff, login scripts, broadcast, recording hooks, secret resolution (saved / session-only / ask every time). The Leviathan methods are dropped |
 | `sshclient`, `sftpclient`, `sshconfig`, `terminalenv` | ~1.7k | §2 |
 | `telnetclient` | 603 | tokio `TcpStream` and the option state machine (echo, SGA, NAWS, TTYPE, BRK) |
 | `rawclient` | 561 | tokio; history, capture, and hex/escaped encoders |
 | `ircclient` (on `girc`) | 833 | `irc` crate plus our own state: rooms, NAMES, LIST, topic, reconnect, channel-state persistence (migration 006) |
 | `githubclient` | 408 | `ureq` + serde; periodic refresh; archive download |
 | `localshell` | 294 | `portable-pty` |
 | `recording` | 538 | asciicast v2 writer and reader; the files are the same |
 | `updater` | 303 | `ureq`; same manifest format; URLs per §7 |
 | `vncclient` | 340 | §6a |
 | `leviathan/*` | 25.5k | **Deleted.** |
 | `cmd/vscode-bridge` | 357 | **Deleted.** |
 ### Data compatibility (hard requirement)
 Existing users upgrade in place. **Before any Go is deleted**, generate fixtures from the Go code and
 commit them under `rust/core/tests/fixtures/`:
 - a database with every protocol, snippets and known hosts, migrated through 006
 - a vault file with a known password
 - `.link` exports
 - recordings
 - keychain entries written by go-keyring, on each OS in CI
 Rust must read every fixture byte for byte. The formats are:
 - **Vault:** JSON `{version, salt(b64, 32 bytes), secrets: key → b64(nonce12 ‖ ciphertext ‖ tag)}`;
  Argon2id with t=3, m=128 MiB, lanes=4, and a 32-byte key.
 - **Export:** `[1 byte version][32 bytes salt][12 bytes nonce][ciphertext]`, with the Argon2 parameters
  from `exportimport.go`. Only the extension changes (`.link` → `.nexus`).
 - **Keychain:** ⚠ go-keyring and `keyring` don't store entries the same way by default:
  - **macOS:** both use a generic password stored under service and account, so they match.
  - **Windows:** go-keyring's target is `service:user`, but `keyring` defaults to `user.service`. Use `Entry::new_with_target`.
  - **Linux:** both use the Secret Service, but with different attribute sets. Search by `service` + `username`.
  The phase 0 spike proves all three against the fixtures.
 ## 4. New protocol: Serial
 - **Library:** `serialport`.
 - **Migration:** `007_serial_protocol.sql` adds `serial` to the protocol CHECK, plus a `serial_config` JSON column.
 - **Config fields and defaults:** `baudRate 115200, dataBits 8, parity none|odd|even, stopBits 1|2,
  flowControl none|xonxoff|rtscts, lineEnding cr|lf|crlf, localEcho false, dtrOnConnect true,
  rtsOnConnect true, encoding, autoReconnect true, maxReconnectTries 5`.
  Mark/space parity and 1.5 stop bits are left out because `serialport` doesn't support them. If they're needed, add them
  through `termios`/`DCB` on the raw handle (about 30 lines per OS).
 - **Device path:** stored in `host`, with `port` 0, so the sidebar, search and palette work unchanged.
 - **Session:** a terminal session through `TermView`, so recording, triggers, broadcast, find, snippets
  and split panes all work. Unplugging the adapter sets the session to disconnected, and auto-reconnect re-opens the path.
  New service methods: `list_serial_ports`, `set_serial_lines(dtr, rts)`, `send_break`.
 - **UI:**
  - an editor page (device combo with refresh, line settings, behaviour settings)
  - a Quick Connect entry
  - Send Break and DTR/RTS toggles on the tab
  - a badge colour
  - error hints: the `dialout`/`uucp` group on Linux, `/dev/cu.*` on macOS, and busy ports
  - a Help topic
 ## 5. Toolchain and platforms
 - **Toolchain:** pin the same `rust-toolchain.toml` as Leviathan (`1.99.0`), edition 2024.
 - **Targets:** keep the current release matrix in full: darwin amd64 and arm64 (one universal `.app`),
  linux amd64 and arm64, and windows amd64 and arm64.
 - **UI code from Leviathan:** copy these files into `app/src/` once, then let them evolve
  independently. There is no dependency on the Leviathan repo:
  - `theme.rs` (Tokens, fonts; 278 lines)
  - `widgets.rs` (198 lines)
  - the title bar, command palette and frame layout from `app.rs`
  - `hexview.rs`, for the RAW hex view
  - bundled fonts
  - the `packaging/` layout
 ## 5a. UI mapping: webview module → egui
 egui is immediate mode. Lists are virtualised with `ScrollArea::show_rows`, so the 1000/200/5000-row caps go away.
 Terminal views are repainted only when their session receives data, and for input and cursor blink.
 | Current (JS) | egui replacement |
 |---|---|
 | `index.html` grid layout | Leviathan's frame: custom title bar (Nexus mark, menus, active-session title, ⌘K launcher, window controls); a **navigator rail** holding the connection sidebar (resizable 180–500); a central **tab strip + workspace** with an empty state; a right **dock** for SFTP and the profile editor; a **status bar** |
 | Shortcuts (`app.js`) | The `Cmd` enum plus a shortcut table. `Modifiers::COMMAND` maps to ⌘ on macOS and Ctrl elsewhere. The palette enumerates every `Cmd` |
 | `tabs.js` | A painted tab strip (Leviathan's tab style) with a protocol badge, status dot, activity marker, pin and 📁; pinned tabs first; drag to reorder; scroll with edge fades; context menu; tooltip with "Connected since"; close confirmation |
 | `terminal.js` + xterm.js | `TermView` (§6) |
 | `splitpane.js` | A binary tree of `Pane::{Leaf(session), Split{dir, ratio, a, b}}` laid out by rect, with draggable dividers (minimum 100 px). A placeholder leaf shows the connection picker. Child sessions get no tab |
 | `sidebar.js` | Collapsing sections (Local Machine, ★ Favourites, Recent 5, folders, Ungrouped), a protocol dot and ★, Ctrl/Cmd-click multi-select, a context menu, a bulk-action bar, and fuzzy search |
 | `profiles.js` drawer | A dock panel: protocol selector plus one section per protocol. List editors (jump hosts, forwards, RAW presets, login script) are `egui::Grid` rows with ▲▼✕ |
 | `settings.js` | Settings window with tabs: General, Terminal, Security, Known Hosts, Help, About |
 | `secrets.js` | Modal windows: secret prompt, master password (strength meter using the same formula), host-key dialog |
 | `sshkeys.js` | SSH Keys window: list, generate, copy public key, delete |
 | `sftp.js` | A dock panel per session: breadcrumb, table, bookmarks, and a transfer queue with progress bars. Dialogs via `rfd` |
 | Drop files on terminal | `ctx.input(\|i\| i.raw.dropped_files)` gives real paths. The File Drop dialog stays. Upload by path, so the 768 KiB base64 chunking goes away |
 | `raw.js` | Text view, hex view (the copied `hexview`, read-only), or split; a send bar (format combo, input, quick-byte buttons, presets); Save via `rfd` |
 | `irc.js` | Room tabs + a read-only `TermView` fed by the ported mIRC→ANSI formatter + a composer + side lists (rooms, room list, users) |
 | `github.js` | Painted repo cards under group headers; a filter; Refresh; ZIP and Visit buttons |
 | `vnc.js` | `VncView` (§6a) |
 | `commands.js` | The copied palette widget, with Nexus's sections and a port of `fuzzyMatch` |
 | `snippets.js`, `triggers.js`, `recordings.js` | Windows. Playback uses its own `TermView`, with a scrubber, speed control and autoplay |
 | `notifications.js` | A toast stack painted top-right in an `egui::Area`, auto-dismissed after 4 s (6 s for errors). About 60 lines; no crate needed |
 | `themes.js` | App chrome uses `Tokens` (Pro/Midnight/Light). `terminal_themes.rs` is a const table of the 11 terminal palettes (charcoal … rose-pine) |
 | Help tab HTML | The help topics minus Leviathan, as `include_str!` text with simple heading and paragraph styling |
 | `BrowserOpenURL`, clipboard, fullscreen | `ctx.open_url`, `ctx.copy_text` and egui paste events, `ViewportCommand::Fullscreen` |
 **App theme:** every widget is drawn by egui, so the theme applies everywhere.
 ## 6. TermView (the critical path)
 - **Model:** one `alacritty_terminal::Term` per view, behind a `FairMutex`, fed by
  `vte::ansi::Processor`. Session data events are fed straight in as bytes; UTF-8 is the parser's job.
 - **Drawing:** for each visible row, group cells into runs with the same attributes, then draw one
  `painter.text` call per run, plus background rectangles, cursor, selection and search highlights.
  Cache each row's layout by a hash of its content. Use the profile's font, falling back to the
  preferences (JetBrains Mono is bundled). Wide and emoji cells take the terminal's cell width.
 - **Scrollback:** `Config.scrolling_history`, from the profile, falling back to `defaultScrollback`
  (0–100000).
 - **Input:**
  - egui `Key` events map to escape sequences, respecting the terminal mode (application cursor keys, keypad).
  - `Event::Text` and `Event::Ime(Commit)` send the text, so IME input works.
  - Paste is bracketed when the application enables it.
  - Output goes to `write_session` and to the broadcast targets.
 - **Mouse:**
  - When the application enables mouse reporting, send SGR/X10 reports.
  - Otherwise: drag selects, double-click selects a word, triple-click selects a line.
  - The wheel scrolls the scrollback. On the alternate screen it sends ↑/↓ once per notch (the existing tmux behaviour).
  - Ctrl/Cmd-click on a URL opens it.
 - **Behaviours to keep:**
  - **Clipboard:** Ctrl/Cmd+C copies when there is a selection and otherwise sends SIGINT; Ctrl/Cmd+V pastes.
  - **Resize:** debounced; recompute columns and rows, then `term.resize` and `resize_session`.
  - **Right-click menu:** all 11 items.
  - **Find bar:** alacritty `RegexSearch`, with case and regex options, "i of N", Enter and Shift+Enter.
  - **Overlays:** the disconnect overlay with Reconnect, and the local shell's "[Exited - press enter to restart]".
  - **Cursor:** style (block, underline or bar) and blink.
 - **Performance target:** `cat` of a 50 MB file stays responsive, at parity with or better than xterm.js.
  Parsing runs on the UI thread inside the event drain. If profiling shows that's too slow, feed `Term` on the session
  thread and keep only drawing on the UI thread (the `FairMutex` already allows this).
 - **Reference:** `egui_term` (alacritty_terminal + egui) is prior art. Read it, but don't depend on it,
  because it lags egui releases.
 ## 6a. VNC
 **As built:** `vnc-rs` was not used; the fallback below (our own RFB client) is what shipped.
 - `vnc-rs` on a tokio task, with an optional SSH tunnel through §2's `direct-tcpip`.
 - Decoded rectangles are applied to an RGBA buffer, and dirty frames update a `TextureHandle`, scaled to fit.
 - Input: pointer → `PointerEvent`; keys → X11 keysyms (port the keysym map from `vnc.js`).
 - If `vnc-rs` doesn't work with the servers users run, the fallback is our own RFB client: Raw, CopyRect and ZRLE
  in about 600 lines, plus Tight's JPEG via the `image` crate.
 ## 7. Rename to Nexus Terminal and migrate data
 The rebrand to Alchementary Link (commit `1a380a0`) renamed every path and **migrated nothing**. This rename
 undoes it and migrates the data.
 | Item | Alchementary Link (now) | Nexus Terminal |
 |---|---|---|
 | Product and window title | Alchementary Link | Nexus Terminal |
 | Binary, bundle and app id | `AlchementaryLink` | `NexusTerminal` / `nexus-terminal` |
 | Config dir | `…/AlchementaryLink` | `…/NexusTerminal` |
 | Database and log | `link.db`, `link.log` | `nexus.db`, `nexus.log` |
 | Keychain service | `AlchementaryLink` | `NexusTerminal` |
 | Export file | `.link`, "Link Export" | `.nexus`, "Nexus Export" (import accepts both) |
 | Updater User-Agent and GitHub fallback | `AlchementaryLink-UpdateChecker`, `alchementary-link` | `NexusTerminal-UpdateChecker`, `nexus-terminal` |
 | Update and release URLs | `alchementary.co.uk/download/link/…` | `dixon.cx/downloads/nexus/…` |
 | Icons and brand mark | `alchementary-link-*.png`, ">_ AlchementaryLink" | Restore the `nexus-terminal-*` icons from git history (pre-`1a380a0`), redrawn for the egui title bar |
 **First-run migration** (in `nexus-core`, before the database is opened):
 1. If `NexusTerminal/nexus.db` exists, use it. This covers users from before the rebrand, whose data was never moved.
 2. Otherwise, if `AlchementaryLink/link.db` exists, **copy** (don't move) `link.db` → `nexus.db`, plus the
   `vault/` directory and the recordings, into `NexusTerminal/`. Write a `migrated-from` marker.
   The old directory is left untouched, so the Wails build still works if a user rolls back.
 3. **Keychain:** when a read under `NexusTerminal` misses, try `AlchementaryLink`. If it's found there, write it under
   `NexusTerminal`. Old entries are not deleted.
 4. If both directories hold a database (a user who ran both builds), Nexus wins, and the toast says so.
 The old update channel must point existing Alchementary Link installs at the first Nexus release. That's one
 manifest entry on the update server, so existing users get the Rust build.
 ## 8. Phases and milestones
 Each phase ends with a runnable build and its slice of the §10 checklist ticked off. **The Wails app keeps
 shipping until phase 7**, and Go is deleted only then.
 | # | Phase | Delivers | Milestone |
 |---|---|---|---|
 | 0 | Fixtures and spikes | The Go-generated fixtures (§3). Spikes, each answering one question: (a) a russh PTY shell against OpenSSH with an ed25519 key, strict-kex, a jump host and **agent forwarding**; (b) `TermView` on alacritty_terminal with vim, tmux, htop, IME input, and `cat` of 50 MB; (c) `keyring` reads go-keyring entries on all three OSes; (d) `vnc-rs` against TigerVNC and macOS Screen Sharing | Go/no-go on each risk in §2, §3 and §6a |
 | 1 | Core foundation | `nexus-core`: storage and migrations, models, validation, preferences, audit, known hosts, vault, keychain, export/import, `Service`/`Event`, and the **§7 migration**. App skeleton in Leviathan's frame: rail, sidebar, tabs, status bar, toasts, and the secret, master-password and host-key modals | Opens an existing Alchementary Link user's data as Nexus; profiles listed; lock and unlock |
 | 2 | Terminal | `TermView` (§6), terminal themes, local shell, Telnet, **Serial**, state handling (reconnect toast, error classifier, "Connection Already Open") | A usable local, Telnet and serial terminal |
 | 3 | SSH | §2 in full, plus SFTP and the key manager | Usable as a daily SSH client |
 | 4 | Forms | Profile editor (every field in §10.3), Quick Connect, Settings, Known Hosts, SSH Keys, encrypted export/import, update check | All profile CRUD and settings |
 | 5 | Power features | Split panes, broadcast, snippets, triggers, recording and playback, port-forward dialog, SFTP dock and file drop, palette, shortcuts, fullscreen | Every terminal-session feature |
 | 6 | RAW, IRC, GitHub, VNC | Rust clients and their views | Every protocol |
 | 7 | Ship; delete Go | Packaging and CI (§9). Delete `go.mod`, `go.sum`, `main.go`, `internal/`, `cmd/`, `frontend/`, `wails.json`, the Wails `build/` assets, and the Go build scripts (`build*.sh`, `build.ps1`, `Makefile`, `build-all.sh`). Rewrite the docs, README and `.github/copilot-instructions.md` as Nexus Terminal. Publish the update-server entry that moves users across (§7) | Nexus Terminal released from a tag; no Go or JS left |
 ## 9. Build and release
 - **Build:** `cargo build --release --target …`.
  - Version: `CARGO_PKG_VERSION`, set by `release.sh` in `Cargo.toml`.
  - Update URL: `option_env!("NEXUS_UPDATE_URL")`, defaulting to the URL decided in §7. This replaces Go's `-ldflags -X`.
 - **Packaging:** Leviathan's `packaging/` layout, renamed:
  - **macOS:** a universal `NexusTerminal.app` via `build-app.sh`, with Developer ID signing and notarisation.
  - **Windows:** an `.exe` with an icon and version info from `build.rs`/`winresource`, using the GUI subsystem.
  - **Linux:** a tarball, plus `install.sh` and a `.desktop` file.
 - **CI:** rewrite `release-builds.yml` with `dtolnay/rust-toolchain` and a native runner per OS and arch.
  Drop Go, Node, Wails and `libwebkit2gtk`. Run `cargo test` on every platform.
 - **Unchanged:** the update server (`updates/index.php`) and the manifest format. `release.sh` gets the new names.
 ## 10. Parity checklist
 This is the acceptance list, built from a full read of `frontend/src/js/*`. A feature is done when it works in the native build.
 ### 10.1 Shell, tabs, sessions
 - [ ] Layout: sidebar, tab strip (+ New, Broadcast: left-click toggles, right-click picks targets), workspace empty state (New Connection, Quick Connect), status bar
 - [ ] Sidebar footer: New, ⌘K, Import, Export, Recordings, Settings
 - [ ] Shortcuts: ⌘K, ⌘N, ⌘W, ⌘Tab/⇧⌘Tab (wrap), ⌘1–9, ⌘, (Settings), ⌘F, ⇧⌘D, ⇧⌘E, ⇧⌘R, ⇧⌘B, ⇧⌘S, ⇧⌘Q, F11; Esc closes palette and exits fullscreen
 - [ ] Events handled: `session:data`, `session:state` (with attempt/maxRetries/delaySec toast), `session:closed`, `session:raw:data`, `session:github:*`, `session:irc:event`, `session:forward:started/stopped/error` toasts, `session:recording:started/stopped`, `session:sftp:progress`, `session:secret:prompt`, `session:hostkey:verify`, `app:open-about`
 - [ ] Connect flow: "Connection Already Open" (Cancel / New Connection / Use Existing), "Connecting to X…" toast, refit and resize at 50/300/800 ms after connect
 - [ ] Error classifier: auth errors → Close / Edit Profile / Retry; host-key errors also offer Known Hosts
 - [ ] Tabs:
  - [ ] Visuals: protocol badge, status dot, activity marker cleared on activate, pinned-first order
  - [ ] Interaction: drag reorder; wheel scroll with overflow fades; scroll the active tab into view; hover hint (name + "Connected since"); close activates the nearest neighbour
  - [ ] Context menu: Rename, Duplicate, Pin/Unpin, Move Left/Right, Reconnect, Close
  - [ ] Close confirm when the pref is on (not for GitHub tabs)
 - [ ] Session close is idempotent and cleans up splits, SFTP, triggers, recordings and viewers
 - [ ] Local shell: `ConnectLocal`, exit and restart-on-Enter
 - [ ] Quick Connect: SSH/Telnet/RAW/IRC/Serial, default ports, username (SSH/IRC), nick (IRC), Enter/Esc
 - [ ] Broadcast: toggle toast, target picker with Select All (all selected means null, i.e. all sessions)
 - [ ] Status bar latency: <100 good, <250 warn, else bad; stops on error
 - [ ] Toasts: 4 types, × dismiss, 4 s / 6 s auto-dismiss
 ### 10.2 Terminal
 - [ ] §6 in full; 11 themes; switching theme updates every open terminal
 - [ ] Find bar (case, regex, count, next/prev, clear highlights)
 - [ ] Context menu: all 11 items, with the shortcut labels for the platform
 - [ ] File drop: Paste contents / Upload to current directory (SSH only) via the directory picker (breadcrumb, filter, Up, Refresh, READ ONLY / NO READ badges, "Use this folder" disabled when the directory isn't writable, keyboard navigation)
 - [ ] Port Forwards dialog: list, Stop, add (L/R, bind, dest, label)
 - [ ] Split panes: split the focused pane right/down, placeholder picker (Local Machine + profiles), divider drag with live refit, per-pane ✕ promotes the sibling, late connects to a closed pane are disconnected, closing the tab closes child sessions
 - [ ] Recording toggle and a visible tab indicator
 ### 10.3 Profiles, sidebar, settings, security
 - [ ] Sidebar:
  - [ ] Sections: Local Machine, Favourites, Recent 5, folders (sorted), Ungrouped / "All Connections"; collapsible
  - [ ] Search: fuzzy over name, host, tags and protocol; empty states
  - [ ] Mouse: click connects; Ctrl/Cmd-click multi-selects; double-click edits
  - [ ] Context menu: Connect, Edit, Duplicate, Favourite toggle, Delete (confirm)
  - [ ] Bulk bar: Connect all, Disconnect (confirm), Tags add/replace, Move Group, Clear
 - [ ] Profile editor, common:
  - [ ] Protocol switch keeps common fields
  - [ ] Validation: host, port, IRC nick and rooms, IRC SSH tunnel
  - [ ] Buttons: Test (Reachable — N ms), Delete (confirm), Create/Save, Save & Connect
  - [ ] General fields: Display Name, Host, Port, Username, Group (autocomplete), Description
  - [ ] Terminal fields: font, size 8–36, scrollback 0–100000, cursor style
  - [ ] Tags and Notes
 - [ ] SSH fields:
  - [ ] Password mode, auth methods
  - [ ] Key path with `ListSSHKeys` autocomplete, Browse, and checks (reject `~`, `FileExists`, `FileIsPrivateKey`); passphrase mode
  - [ ] Host key policy (strict/ask/accept-new/insecure)
  - [ ] Jump hosts list, port forwards list
  - [ ] Startup command, env KEY=VALUE, login script (wait/send, timeout 1–120, reorder)
  - [ ] Agent auth and forwarding
  - [ ] TOTP: show/hide, Test (code shown 5 s), Save/Delete, placeholder when a secret is saved
  - [ ] Proxy (none/socks5/http, host, port 1080, user, password)
  - [ ] Advanced: terminalType, keepalive interval/count, compression, autoReconnect, maxReconnectTries 1–20
 - [ ] Telnet fields: localEcho, lineMode, terminalType, encoding, line ending, negotiationDebug, login script, reconnect
 - [ ] RAW fields: encoding, line ending, showTimestamps, showDirection, payload presets (name/payload/format), timeouts, autoReconnect
 - [ ] GitHub fields: API base URL, token storage, refresh interval 60–3600
 - [ ] IRC fields: nick, realName, TLS, server password and mode, NickServ, auto-join rooms, SSH tunnel, reconnect
 - [ ] VNC fields: every current field, saved round-trip
 - [ ] Settings:
  - [ ] General: theme, default protocol, confirm on close/disconnect, status bar, sidebar width, local shell (Browse)
  - [ ] Terminal: theme, font, size, scrollback, cursor
  - [ ] Security: init/unlock/lock
  - [ ] Known Hosts: table, Remove
  - [ ] Help: 13 topics
  - [ ] About: version, Check for Updates, View release, Import ~/.ssh/config
 - [ ] Master password dialog: strength meter (Weak/Fair/Good/Strong), confirm match
 - [ ] Secret prompt (Esc cancels → `cancelled:true`)
 - [ ] Host key dialog (Reject / Accept & Save)
 - [ ] SSH Key Manager: list (name, type, bits), copy public key, delete, generate (ed25519/rsa 2048|4096/ecdsa, passphrase)
 - [ ] Encrypted export (`.nexus`; import also accepts `.link`) (profile checkboxes, password + confirm) and import (password, skip/overwrite/duplicate)
 - [ ] Command palette:
  - [ ] Sections: Connections, Actions, Tabs, Application, Security (lock/unlock), Terminal (Trigger Rules; split/clear/reset when a session is active)
  - [ ] Fuzzy ranking, ↑↓ Enter Esc
 - [ ] Snippets: search, CRUD (name, description, command, folder), send to the active connected session, `{{hostname|date|time|timestamp}}` built-ins plus prompted variables
 - [ ] Triggers: CRUD; name, pattern, regex, case-sensitive, enabled; actions notify/highlight/both/sound; line-buffered matching with CSI stripped
 - [ ] Recordings:
  - [ ] Browser: list, storage info, delete, cleanup by age (7/30/90) and size (1 GB / 5 GB)
  - [ ] Playback: play/pause, restart, scrubber seek (replay to the target), m:ss, speed 0.5–10×, autoplay
 ### 10.4 SFTP, RAW, IRC, GitHub, VNC
 - [ ] SFTP panel:
  - [ ] Layout: toggle, resizable, breadcrumb, Go to path, New folder, Upload, Refresh, Close
  - [ ] File list: folders first, `..` entry, extension icons, size with modified-time hint, loading/empty/error + Retry
  - [ ] Actions: multi-select, Download (files), Rename (single), Delete (confirm)
  - [ ] Bookmarks
  - [ ] Transfer queue with progress; refresh when an upload is done; toast when the panel is closed
 - [ ] RAW:
  - [ ] Views: Text/Hex/Split, Pause/Resume, Clear, Save capture, byte counter, 5000-entry buffer
  - [ ] Prefixes: timestamps and direction per the profile
  - [ ] Send: Text/Hex/Escaped formats, NUL/CR/LF/ETX/EOT, presets, Enter sends, local echo of the sent entry
 - [ ] IRC:
  - [ ] Room tabs: Server tab, unread markers, 2000-line buffers
  - [ ] Composer: /commands via `IRCHandleInput`, Tab nick completion, click a nick to insert `@nick`
  - [ ] Room lists: join box, joined rooms with topic hint, room list (filter, click to join)
  - [ ] Users list with prefixes stripped
  - [ ] Formatting: all event types formatted as today, nick colour hash, full mIRC formatting (^B ^] ^^ ^_ ^V ^O ^C fg,bg ^D hex)
 - [ ] GitHub:
  - [ ] Status line, filter, Refresh
  - [ ] Ordering: owner groups ordered by newest repo (own login first on ties)
  - [ ] Card contents: Private/Fork/Archived badges, last commit and committer, description, language colour, stars, relative pushed time
  - [ ] Actions: ZIP (save dialog → `DownloadGitHubRepoArchiveToPath`), Visit
 - [ ] VNC: connect (direct or SSH-tunnelled), scaled framebuffer, mouse and keyboard, clipboard, disconnect overlay
 ### 10.4a Serial
 - [ ] Profiles: create, edit and duplicate, and export/import round-trip including `serialConfig`
 - [ ] Editor: device list and refresh
 - [ ] Line settings: all baud, data-bit, parity, stop-bit and flow-control options applied
 - [ ] Session behaviour:
  - [ ] data in the terminal
  - [ ] local echo, line ending and encoding
  - [ ] DTR/RTS on connect and as toggles
  - [ ] Send Break
  - [ ] XON/XOFF and RTS/CTS flow control honoured
  - [ ] unplug → disconnected overlay; auto-reconnect when the device returns
 - [ ] Quick Connect Serial; recording, triggers, broadcast, snippets, find and split panes all work on serial sessions
 - [ ] Permission-denied and busy-port hints
 ### 10.5 Rename and migration
 - [ ] Every user-visible string, window title, bundle, binary and icon says Nexus Terminal
 - [ ] First run migrates `AlchementaryLink/` → `NexusTerminal/`, copying the database, vault and recordings, and leaves the old directory intact
 - [ ] Pre-rebrand `NexusTerminal/nexus.db` is used as-is
 - [ ] Keychain entries under `AlchementaryLink` are found and re-saved under `NexusTerminal`
 - [ ] Import accepts `.link` and `.nexus`; export writes `.nexus`
 - [ ] An existing Alchementary Link install updates to Nexus through the update server
 ## 11. Existing quirks: default is to fix during the port
 | Quirk | Native default |
 |---|---|
 | RAW Save passes the capture content as a file path (`raw.js:217` → `SaveSessionCapture(sid, path)`) | Save dialog, pass the path (fixes the bug) |
 | Rename prompt's OK button says "Connect" | "Rename" |
 | Recording tab dot never shows (wrong selectors) | Indicator drawn by the tab strip |
 | `#status-protocol` never filled | Show the active session's protocol |
 | Adding or removing a jump host, forward or preset discards unsaved edits | Grid editing keeps them |
 | `folder` dropped when switching protocol | Keep it |
 | RAW decodes received data as Latin-1 | Decode as UTF-8 in text view (hex view unchanged) |
 | SFTP bookmarks keyed by session id (lost on disconnect) | Key by profile id |
 | Help says sidebar supports drag between groups (it doesn't) | Fix the Help text; use "Move Group" |
 | Trigger "sound" uses a WebAudio 880 Hz beep | the system bell |
 Client-side state that is **not migrated**: trigger rules and SFTP bookmarks live in WebKit localStorage. Users recreate them; everything else is in the SQLite DB, the vault and the keychain, which are read as-is (§3).
 ## 12. Tests
 - **Before Go is deleted:** the §3 fixtures.
 - **`cargo test` in `nexus-core`:**
  - **Compatibility:** every §3 fixture read and round-tripped: database, vault, `.link` exports, recordings, and the keychain on each OS.
  - **Migration (§7):** old dir only → copied; new dir only → untouched; both → Nexus wins; keychain fallback.
  - **Ported Go test tables:** `validation`, `secrets`, `storage`, `exportimport`, `sshconfig`, `knownhosts`,
    `terminalenv`, `rawclient` encoding and history, `models` defaults, and `updater` manifest parsing.
  - **Ported JS tests:** IRC mIRC→ANSI (`test-irc.js`), and split-tree lifecycle with late-connect
    rejection (`test-session-lifecycle.js`).
  - **Pure logic:** fuzzy match, snippet variables, trigger line buffering, and password strength.
  - **Serial:** a pty pair on Linux, covering data, echo, line endings and XON/XOFF.
 - **SSH integration:** a CI job against an `openssh-server` container, covering password, key,
  keyboard-interactive with TOTP, jump host, local and remote forwards, agent forwarding, an SFTP round trip,
  and a host-key mismatch.
 - **Screenshots:** copy Leviathan's `--screenshot out.png` flag, and check each view under `xvfb-run` in CI.
 - `test-regressions.js` is retired; §10 replaces it.
@@ -8,13 +8,16 @@
 4. Connection types
 5. Tabs and split panes
 6. Terminal actions and search
-7. Snippets and broadcast input
+7. Snippets, broadcast input and triggers
 8. SFTP file browser
 9. Drag-and-drop uploads and paste
-10. Session recordings
+10. Port forwards
-11. Security and credentials
+11. Session recordings
-12. Settings
+12. Security and credentials
-13. Troubleshooting
+13. Import and export
 14. Settings and updates
 15. Data locations and migration from Alchementary Link
 16. Troubleshooting
 ---
@@ -23,25 +26,34 @@
 ### Launch and connect
 - Start Nexus Terminal.
- Click **New** in the sidebar, choose a protocol, and fill in the profile details.
+- Click **+** at the bottom of the sidebar (or press **Cmd+N** / **Ctrl+N**), choose a protocol, and fill in the profile details.
- Click **Connect** to open a session in a new tab.
+- Click **Create & Connect** to save the profile and open a session in a new tab, or **Create** to save it for later.
 - Click a profile in the sidebar to connect to it.
 ### Quick connect
-Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. This starts a one-off session without saving a profile.
+Use **Cmd+Shift+Q** (macOS) or **Ctrl+Shift+Q** (Windows/Linux) to open a lightweight connect dialog. Choose SSH, Telnet, RAW, IRC or Serial, enter the host (or serial device), port, and username or nick where relevant, then press **Enter**. This starts a one-off session without saving a profile.
 ### Local terminal
 Click **Local Machine** at the top of the sidebar, choose **File → Local terminal**, or click **Local** on the welcome screen to open a shell on this computer. When the shell exits, the tab shows `[Exited - press enter to restart]`; press **Enter** to start a new shell in the same tab.
 ### Command palette
 Press **Cmd+K** / **Ctrl+K**, or click the search box in the title bar, to open the command palette. Type a few letters to find a connection, switch to a tab, create a profile, open a window, change theme, lock or unlock the secret store, or run a terminal action. Use **Up/Down** to move, **Enter** to run, and **Esc** to close.
 ---
 ## 2. The interface at a glance
- **Sidebar**: Profiles grouped by folders or tags, with search at the top.
+- **Title bar**: the File, Session, View and Help menus, the active session's name and host, the command palette launcher, a light/dark toggle, and the window controls. Drag the title bar to move the window; double-click it to maximise.
- **Tab bar**: One tab per session with status indicators, badges, and quick actions.
+- **Sidebar**: a search box, then **Local Machine**, **★ Favourites**, **Recent** (the last five connections), one section per group, and **Ungrouped** (or **All Connections** when you have no groups). Sections collapse when you click their headers. The footer has buttons for New connection, Command palette, Import, Export, Recordings and Settings. Drag the sidebar edge to resize it.
- **Workspace**: The active terminal or viewer; split panes appear here.
+- **Tab strip**: one tab per session, with a state dot, protocol badge, pin marker, activity dot and close button. SSH tabs also have a folder icon for SFTP. On the right are **+** (new connection) and the broadcast button.
- **Status bar**: Connection state and session details.
+- **Workspace**: the active terminal or viewer; split panes appear here. With no tabs open it shows a welcome screen with **New Connection**, **Quick Connect** and **Local** buttons.
 - **Right dock**: the profile editor or the SFTP browser, resizable.
 - **Status bar**: the active session's state and protocol, a **REC** marker while recording, latency for SSH sessions, a **BROADCAST** marker, the vault state (click it to open Security settings), the number of connected sessions, and an update notice when a new version is available.
-Screenshot: Main window with sidebar, tab bar, and active terminal.
+Notifications appear as toasts in the top-right corner and dismiss themselves after a few seconds; click **×** to dismiss one early.
 Tip: You can drag the divider between split panes to rebalance space.
 ---
@@ -49,22 +61,39 @@ Tip: You can drag the divider between split panes to rebalance space.
 ### Create a new profile
-1. Click **New** in the sidebar.
+1. Click **+** in the sidebar footer or on the tab strip, press **Cmd+N** / **Ctrl+N**, or right-click a group header and choose **New connection in …**.
-2. Choose the protocol (SSH, Telnet, RAW, GitHub).
+2. Choose the protocol (SSH, Telnet, RAW TCP, GitHub, VNC, IRC or Serial) at the top of the editor. Switching protocol keeps the common fields.
-3. Fill in the required fields and optional settings.
+3. Fill in the **General** section: Display Name, Host (or Device for serial), Port, Username, Group and Description.
-4. Save and connect.
+4. Fill in the protocol sections and, for terminal protocols, the **Terminal** section (font family, font size 8–36, scrollback 0–100000 lines, cursor style).
 5. Optionally add **Tags** (comma-separated) and **Notes**.
 6. Click **Create & Connect**, or **Create** to save without connecting.
-Screenshot: New profile form with protocol selector and connection fields.
+Click **Test** to check that the host and port are reachable; a toast reports the round-trip time. Fields with problems are highlighted when you save.
-### Edit, duplicate, or delete
+The **Group** field suggests existing groups; type a new name to create one.
-Right-click a profile in the sidebar to edit, duplicate, or delete it. You can also click the pencil icon on hover, or double-click the item to edit.
+### Edit, duplicate, favourite, export or delete
-### Folders, tags, and favourites
+Right-click a profile in the sidebar for **Connect**, **Edit**, **Duplicate**, **Add to Favourites** / **Remove from Favourites**, **Export…** and **Delete**. Double-click a profile to edit it. Deleting a profile also removes its saved credentials.
-Use folders and tags to organise profiles. Mark profiles as favourites for quick access.
+### Bulk actions
-Tip: Use the search box to filter profiles by name, host, or tag.
+Ctrl-click (Cmd-click on macOS) profiles to select several. A bar appears at the bottom of the sidebar with:
 - **Connect all**
 - **Disconnect** (asks first when **Confirm on disconnect** is on)
 - **Tags** → **Add tags…** or **Replace tags…**
 - **Move group** (leave the name empty to move to Ungrouped)
 - **Delete**
 - **Clear** (clear the selection)
 ### Search
 Type in the sidebar search box to fuzzy-search profiles by name, host, tag and protocol.
 ### Already open?
 If you connect to a profile that already has a live session, Nexus Terminal asks whether to **Use Existing**, open a **New Connection**, or **Cancel**.
 ---
@@ -72,93 +101,192 @@ Tip: Use the search box to filter profiles by name, host, or tag.
 ### SSH
- Password, public key, keyboard-interactive, SSH agent, and TOTP/2FA.
+- **Authentication**: password, public key, keyboard-interactive and SSH agent. Choose which methods to try under **Auth Methods**, and tick **Use SSH Agent for Authentication** to use `ssh-agent` (Pageant or the OpenSSH agent on Windows).
- Jump hosts, port forwarding, proxy support, and auto-reconnect.
+- **Key & Passphrase**: choose a key from the suggestions (keys in `~/.ssh`), click **Browse**, or type a full path (`~` is not expanded). The editor checks that the file exists and is a private key.
- Built-in SFTP browser and session recording.
+- **Host Verification**: the host key policy (see section 12).
 - **Jump Hosts**: one or more bastions, each with user, host, port and an optional key. Nexus Terminal tunnels through each hop in order.
 - **Port Forwarding**: local and remote forwards, each with a bind address and port, destination, label and an **Active** box to start it on connect.
 - **Startup**: a startup command and environment variables (`KEY=VALUE`, one per line).
 - **Login Script**: expect-style steps (see below).
 - **SSH Agent**: agent authentication and **Forward Agent to Remote** (like `ssh -A`).
 - **TOTP / 2FA**: store a Base32 TOTP secret to answer two-factor prompts automatically. Click **Test** to show the current code, **Save** to store the secret, and **Delete** to remove it. Save the profile first.
 - **Proxy**: none, SOCKS5 or HTTP CONNECT, with host, port and optional username and password. The proxy is used to reach the SSH server, or the first jump host.
 - **Advanced**: terminal type, keepalive interval, max missed keepalives, compression, auto-reconnect and the maximum number of reconnect attempts (1–20).
 The SFTP browser, port forwards and status-bar latency are available on SSH sessions.
 ### Telnet
- Option negotiation, encoding, local echo, and line endings.
+- **Login**: local echo and line mode.
- Auto-login scripts and auto-reconnect.
+- **Terminal & Encoding**: terminal type and encoding (UTF-8, ASCII or ISO 8859-1).
 - **Echo & Line Endings**: LF, CR, CRLF or none.
 - **Negotiation**: **Debug Negotiation** for troubleshooting option negotiation.
 - **Login Script** and **Reconnection** settings.
 Telnet sends everything in plain text. Avoid it for anything sensitive over an untrusted network.
 ### RAW TCP
- Text, hex, and split views for binary-safe data.
+- **Encoding & Framing**: encoding (UTF-8, ASCII or Hex) and line ending.
- Payload presets and configurable encoding and line endings.
+- **Display**: show timestamps and show direction.
 - **Payload Presets**: named payloads with a format (Text, Hex or Escaped) for quick sending.
 - **Timeouts & Reconnect**: connect and read timeouts, and auto-reconnect.
 A RAW session opens a viewer instead of a terminal:
 - **Text**, **Hex** and **Split** views of everything sent and received.
 - **Pause** / **Resume**, **Clear**, and **Save** (writes the capture as JSON).
 - A send bar with a format selector (Text, Hex or Escaped), a **Presets…** menu, and quick buttons for EOT, ETX, LF, CR and NUL. Press **Enter** to send.
 ### Serial
 Serial profiles open a terminal on a local serial port.
 - **Device**: pick the port from the list and click refresh after plugging in an adapter, or type a path such as `/dev/ttyUSB0`, `/dev/cu.usbserial-…` or `COM3`.
 - **Line Settings**: baud rate (a preset from 300 to 1000000, or a custom value), data bits (5–8), parity (none, odd or even), stop bits (1 or 2) and flow control (none, XON/XOFF or RTS/CTS).
 - **Behaviour**: line ending, encoding, local echo (for devices that don't echo), **Assert DTR on connect**, **Assert RTS on connect**, and auto-reconnect.
 The defaults are 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control, CR line endings, and DTR and RTS asserted.
 While connected, right-click the tab to **Send Break** or toggle **DTR** and **RTS**. Telnet tabs also offer **Send Break**.
 When the adapter is unplugged the session disconnects; with auto-reconnect on, the port is reopened when the device returns. Serial sessions support everything other terminals do: recording, triggers, broadcast, snippets, find and split panes.
 ### VNC
 - **VNC Server**: VNC host (defaults to the profile's Host), port, and password storage mode.
 - **Display**: **View Only**, **Scale to Fit**, **Shared Session** and **Quality (0-9)**.
 - **SSH Tunnel**: carry VNC traffic through SSH, with host, port, username and password, public key or SSH agent authentication.
 The viewer's toolbar shows the connection state and desktop size, and has buttons to switch between scaled and 1:1 display, refresh the screen, **Paste Clipboard** (send your local clipboard to the remote desktop) and **Ctrl+Alt+Del**. Text the remote desktop copies arrives on your local clipboard. Click the desktop to give it keyboard focus.
 Use SSH tunnelling for VNC whenever possible. If a VNC profile has no tunnel, Nexus Terminal warns that the traffic is unencrypted and offers **Connect Anyway**, **Edit Profile** or **Cancel**.
 ### IRC
 - **IRC**: nick, real name, **Use TLS** (port 6697 for most TLS networks) and an optional server password.
 - **NickServ**: identify on connect, with an optional account name and password.
 - **Rooms**: rooms to join automatically, one per line or comma-separated.
 - **SSH Tunnel** and **Reconnection** settings.
 The IRC view has a **Server** tab and a tab per room or conversation, with a dot on tabs that have unread messages. Type messages or `/commands` in the composer (`/join`, `/part`, `/msg`, `/me`, `/notice`, `/nick`, `/topic`, `/list`, `/names`, `/whois`, `/who`, `/raw`, `/quit`, `/help`). Press **Tab** to complete a nick, or click a nick to mention it. The side panel lists joined rooms, a room browser with a filter (click a room to join it), and the users in the current room.
 ### GitHub
- Browse repositories by organisation.
+- **API**: API base URL (`https://api.github.com`, or your GitHub Enterprise API URL) and personal access token storage. The token needs the `repo` scope.
- Sorted by most recent activity.
+- **Refresh**: refresh interval, 60–3600 seconds.
 Repositories are grouped by owner or organisation and sorted by most recent activity. Each card shows Private, Fork and Archived badges, language, stars, description, and the last commit and committer. Use the filter box to narrow the list, **Refresh now** to update it, **Visit** to open a repository in your browser, and **ZIP** to download an archive.
 ---
 ## 5. Tabs and split panes
- **Reorder** tabs by dragging them.
+- **Reorder** tabs by dragging them, or right-click and choose **Move Left** / **Move Right**.
- **Pin** important sessions to keep them at the front.
+- **Pin** important sessions from the tab's right-click menu; pinned tabs stay at the front.
- **Split** the workspace vertically or horizontally to view multiple sessions at once.
+- **Rename**, **Duplicate** (open another session to the same profile) and **Reconnect** from the right-click menu.
- **Broadcast** input to multiple connected sessions when needed.
+- **Scroll** the tab strip with the mouse wheel or trackpad when many tabs are open.
 - **Hover** a tab to see its name, host, state and, for connected sessions, the connection start time.
 - **Close** a tab with its **×**, **Cmd+W** / **Ctrl+W**, or **Close** in the right-click menu. When **Confirm on close** is on, closing a connected tab asks first (GitHub tabs close straight away).
 - **Switch** tabs with **Cmd+Tab** / **Ctrl+Tab**, **Cmd+Shift+Tab** / **Ctrl+Shift+Tab**, or **Cmd+1–9** / **Ctrl+1–9**.
 - A dot on a background tab means it has new output.
-Screenshot: Tab bar with pinned sessions and split panes.
+### Split panes
-Tip: Pinned tabs stay at the front so key systems never get buried.
+- **Cmd+Shift+D** / **Ctrl+Shift+D** splits the focused pane to the right (side by side).
 - **Cmd+Shift+E** / **Ctrl+Shift+E** splits it downwards (top and bottom).
 - Split Right and Split Down are also in the Session menu, the terminal's right-click menu and the command palette.
 A new pane offers **Local Machine** and your terminal profiles (SSH, Telnet and Serial); click one to open it in that pane. Drag a divider to resize panes. Click **×** on a pane's header to close it; its neighbour takes the space. Closing the tab closes every pane in it.
 ---
 ## 6. Terminal actions and search
 ### Keyboard and mouse
 - **Copy**: select text and press **Cmd+C** / **Ctrl+C**. With nothing selected, **Ctrl+C** sends an interrupt as usual.
 - **Paste**: **Cmd+V** / **Ctrl+V**. Pastes are bracketed when the remote application asks for it.
 - **Select**: drag to select, double-click for a word, triple-click for a line, Shift-click to extend.
 - **Links**: hold **Cmd** / **Ctrl** and click a web link to open it in your browser.
 - **Scroll**: the mouse wheel, or **Shift+PageUp**, **Shift+PageDown**, **Shift+Home** and **Shift+End**. On the alternate screen (for example in `tmux`, `screen`, `byobu` or `less`) the wheel sends arrow keys instead.
 - Applications that use the mouse (such as `htop`, `vim` or `tmux` with mouse mode) receive mouse clicks and the wheel directly.
 ### Context menu
 Right-click in the terminal for:
- Copy and paste
+- Copy and Paste
- Select all
+- Select All
 - Find
- Send snippet
+- Send Snippet
- Clear and reset
+- Port Forwards (SSH)
-
+- Split Right and Split Down
-Screenshot: Terminal context menu and search bar.
+- Export Output (save the whole scrollback as a text file)
 - Clear and Reset
 ### Search
-Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle case sensitivity and regular expressions as needed.
+Press **Cmd+F** (macOS) or **Ctrl+F** (Windows/Linux) to search in the active terminal. Toggle **Aa** for case-sensitive matching and **.\*** for regular expressions. The bar shows "*n* of *total*"; press **Enter** for the next match, **Shift+Enter** for the previous one, and **Esc** to close.
 ### Disconnects and errors
 When a session drops, the pane is dimmed and shows a **Disconnected** (or **Connection error**) card with **Reconnect** and **Close**. While auto-reconnect is running it shows **Reconnecting…** with a **Cancel** button, and a toast shows the attempt number and delay.
 If a connection fails because of authentication or a host key, a guided dialog explains what happened and offers **Retry**, **Edit Profile**, **Known Hosts** (for host-key errors) and **Close**.
 ---
-## 7. Snippets and broadcast input
+## 7. Snippets, broadcast input and triggers
 ### Snippets
-Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux) and save frequently-used commands. Send a snippet to the active session with one click.
+Open the snippet library with **Cmd+Shift+S** (macOS) or **Ctrl+Shift+S** (Windows/Linux), from the Session menu, or with **Send Snippet** in the terminal's right-click menu. Create snippets with a name, description, command and folder, search them, and click **Send to Session** to type the command into the active session followed by Enter.
-Screenshot: Snippet library with search and folder grouping.
+Snippets can use variables:
 - `{{hostname}}`, `{{date}}`, `{{time}}` and `{{timestamp}}` are filled in automatically.
 - Any other `{{name}}` is asked for when you send the snippet.
 ### Broadcast input
-Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux). While active, all input is sent to every connected session.
+Toggle broadcast mode with **Cmd+Shift+B** (macOS) or **Ctrl+Shift+B** (Windows/Linux), the broadcast button on the tab strip, or the Session menu. While it is on, everything you type is also sent to every other connected terminal session, and the status bar shows **BROADCAST**.
 To broadcast to only some sessions, right-click the broadcast button (or choose **Session → Broadcast targets…**), tick the sessions you want, and click **Apply & Enable**.
 ### Trigger rules
 Open **Trigger Rules** from the Session menu or the command palette. Each rule has a name, a pattern (plain text or regular expression), a case-sensitive option, an enabled switch and an action:
 - **Notify**: show a toast.
 - **Highlight tab**: briefly outline the pane.
 - **Notify + Highlight**: both.
 - **Sound**: ask the operating system for attention (for example, a bouncing dock icon or flashing taskbar button) and show a toast.
 Rules are checked against each complete line of terminal output, with colour codes removed.
 ---
 ## 8. SFTP file browser
-Open the file browser with the **folder** icon on an SSH tab. You can:
+Open the file browser with the **folder** icon on an SSH tab, or **Session → SFTP browser**. It opens in the right dock beside the terminal. You can:
- Navigate folders using the breadcrumb trail.
+- Navigate folders using the breadcrumb trail, the `..` entry, or **Go to path**.
- Upload, download, rename, and delete files.
+- Upload files, and download one or more selected files to a folder you choose.
- Refresh and create folders.
+- Rename a single item, and delete one or more items (with confirmation).
 - Create folders and refresh the listing.
 - Bookmark the current folder with the star button; bookmarks are kept per profile.
 - Watch transfers and their progress in the transfer list.
-The browser runs inside the SSH session and shows remote contents in a side panel.
+Ctrl-click (Cmd-click) or Shift-click to select several items. Drag the dock edge to resize it.
 Screenshot: SFTP browser open alongside the terminal.
 ---
 ## 9. Drag-and-drop uploads and paste
-When you drop file(s) into an active terminal, Nexus Terminal asks whether to:
+When you drop file(s) onto an active terminal, Nexus Terminal asks whether to:
- **Upload** to a chosen remote directory, or
+- **Upload to current directory** — choose a remote directory (SSH sessions only), or
 - **Paste contents** into the terminal as if typed.
 ### Upload directory picker
@@ -168,88 +296,202 @@ The picker looks like the SFTP browser and lists remote folders only. It shows:
 - **READ ONLY** for folders you cannot write to.
 - **NO READ** for folders you cannot access.
-Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. You can also use the keyboard:
+Use the filter box to narrow the list, and the breadcrumb trail or **Up** button to move around. **Use this folder** is disabled when the folder is not writable. You can also use the keyboard:
 - **Up/Down**: move selection
 - **Enter**: choose the selected folder
 - **Backspace**: go up a folder (when the filter is empty)
 - **Escape**: cancel
 If the SFTP browser is already open, the picker starts in the same directory.
 Screenshot: Upload directory picker with permissions badges.
 Tip: Use the filter box to jump quickly to common folders.
 ---
-## 10. Session recordings
+## 10. Port forwards
-Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux). Recordings are saved as asciicast v2 files and can be replayed from the recordings panel.
+Forwards saved in an SSH profile start when the session connects. To manage forwards on a live SSH session, choose **Port Forwards** from the terminal's right-click menu or **Session → Port forwards**. The dialog lists active forwards (marked **L** for local or **R** for remote) with a stop button, and lets you start a new one:
-Screenshot: Recordings list with playback controls.
+- **Local →**: listen on a local bind address and port, and forward to a destination reachable from the server.
 - **Remote ←**: ask the server to listen, and forward connections back to a destination reachable from this computer.
 Toasts report when a forward starts, stops or fails.
 ---
-## 11. Security and credentials
+## 11. Session recordings
-Nexus Terminal stores credentials securely:
+Toggle recording with **Cmd+Shift+R** (macOS) or **Ctrl+Shift+R** (Windows/Linux), or **Session → Toggle recording**. A red dot appears on the tab and **REC** in the status bar. Recordings are saved as asciicast v2 files.
- **OS keychain first** (Keychain, Secret Service, or Credential Manager).
+Open the recordings browser from the sidebar footer, the Session menu or the command palette. It shows how many recordings you have and how much space they use, lets you play or delete each one, and has **Clean up** for removing recordings older than 7, 30 or 90 days, or keeping the total under 1 GB or 5 GB.
- **Encrypted vault** fallback using AES-256-GCM with Argon2id.
+
 Playback starts automatically and has play/pause, restart, a seek bar with elapsed and total time, and speed control.
 ---
 ## 12. Security and credentials
 ### Where credentials are stored
 - **OS keychain first** (macOS Keychain, Linux Secret Service or Windows Credential Manager).
 - **Encrypted vault** fallback, using AES-256-GCM with an Argon2id-derived key (128 MiB of memory, which makes brute-force attacks expensive).
 If the keychain is unavailable, or refuses to store a secret, credentials go to the vault. Set the vault up in **Settings → Security** with **Initialise Secret Store**; the master-password dialog shows a strength meter (Weak, Fair, Good, Strong) and asks you to confirm the password. Unlock and lock it from the same page, the command palette, or by clicking the vault state in the status bar. The vault is locked again when Nexus Terminal quits.
 Without the master password, credentials in the vault cannot be recovered.
 ### Secret modes
 Each password, passphrase, token or TOTP secret has its own mode:
 - **Save securely**: stored in the keychain or vault and used automatically.
 - **Remember for this session**: asked for once, kept in memory for that session, never written to disk.
 - **Ask every time**: asked for on every connection.
 When a session needs a credential it doesn't have, a prompt appears; press **Esc** or **Cancel** to abandon the connection.
 ### Host key verification
 Choose one of the following policies per SSH profile:
- **Strict**: only accept previously saved fingerprints.
+- **Strict (known hosts only)**: only accept previously saved host keys.
- **Ask**: prompt before trusting a new host key.
+- **Ask on new or changed keys**: prompt before trusting a new host key; the dialog shows the key type and fingerprint with **Accept & Save** and **Reject**.
- **Accept new**: trust first-time keys, reject changes.
+- **Accept new, reject changed**: trust first-time keys automatically.
- **Insecure**: accept any key (not recommended).
+- **Insecure (accept anything)**: accept any key (not recommended).
 Under every policy except Insecure, a key that differs from the saved one is rejected. Nexus Terminal keeps its own known-hosts list and does not read `~/.ssh/known_hosts`. Review and remove entries in **Settings → Known Hosts**; click a fingerprint to copy it.
 ### TOTP / 2FA
-Store a TOTP secret in the profile editor to auto-fill verification codes during SSH authentication.
+Store a TOTP secret in the profile editor to answer verification-code prompts automatically during SSH keyboard-interactive authentication. Secrets are stored in the keychain or vault, never in the profile database.
-Screenshot: TOTP configuration in the profile editor.
+### SSH key manager
 Open **SSH key manager** from the Session menu or the command palette. It lists key pairs in `~/.ssh` with their type, lets you copy a public key to the clipboard or delete a pair, and generates new Ed25519, RSA (2048 or 4096 bits) or ECDSA keys with an optional passphrase. Key generation uses the `ssh-keygen` program.
 ### Audit log
 Connections, disconnections, profile changes, credential access, imports and exports are recorded in an audit log in the database. Secrets are never written to it.
 ---
-## 12. Settings
+## 13. Import and export
-Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux) and configure:
+- **Encrypted export**: **File → Export profiles…**, the sidebar footer, the command palette, or **Export…** on a profile's right-click menu. Choose the profiles, set a password and save a `.nexus` file. Credentials saved in the keychain or vault are not included.
-
+- **Encrypted import**: **File → Import profiles…** or the sidebar footer. Choose a `.nexus` file (or a `.link` file from Alchementary Link), enter its password, and choose what happens when a profile already exists: **Skip existing**, **Overwrite existing** or **Create duplicates**.
- Terminal themes and fonts
+- **JSON export and import**: **Export Profiles (JSON)** and **Import Profiles (JSON)** in the command palette. JSON export includes every profile; tick **Include secrets** to keep inline proxy passwords and TOTP secrets, which are otherwise removed.
- Default behaviours
+- **OpenSSH config**: **File → Import ~/.ssh/config** or **Settings → About → Import ~/.ssh/config** creates profiles from your `Host` blocks, including hostnames, usernames, ports, identity files and jump hosts.
 - Secrets and vault settings
 - Recording and shortcut preferences
 Screenshot: Settings panel with appearance and security options.
 ---
-## 13. Troubleshooting
+## 14. Settings and updates
 Open settings with **Cmd+,** (macOS) or **Ctrl+,** (Windows/Linux), the sidebar footer, or **File → Settings**. Click **Save** to apply changes.
 - **General**: app theme (Pro, Midnight or Light), default protocol, confirm on close, confirm on disconnect, status bar, sidebar width, and local shell (leave empty for the system default; **Browse…** to pick one).
 - **Terminal**: colour scheme, font family, font size, scrollback lines and cursor style. These are the defaults for new profiles; profiles can override them.
 - **Security**: keychain and vault status; initialise, unlock or lock the secret store.
 - **Known Hosts**: saved host keys with first-seen and last-seen times, and **Remove**.
 - **Help**: built-in help topics, including connection types, shortcuts and troubleshooting.
 - **About**: version, **Check for Updates**, and **Import ~/.ssh/config**.
 The app theme and terminal colour scheme can also be changed from the **View** menu, and the light/dark button in the title bar.
 ### Updates
 Nexus Terminal checks for a new version once at launch. When one is available, the status bar shows **Update available**; click it to open **Settings → About**, which shows the current and latest versions, release notes and a **View release** button. Nothing is downloaded or installed automatically.
 ---
 ## 15. Data locations and migration from Alchementary Link
 ### Data locations
 | OS      | Data directory                                     |
 | ------- | -------------------------------------------------- |
 | macOS   | `~/Library/Application Support/NexusTerminal`      |
 | Windows | `%APPDATA%\NexusTerminal`                          |
 | Linux   | `$XDG_CONFIG_HOME/NexusTerminal` (usually `~/.config/NexusTerminal`) |
 The directory holds:
 - `nexus.db` — profiles, known hosts, preferences, snippets, IRC channel state and the audit log (SQLite)
 - `vault/vault.json` — the encrypted vault
 - `recordings/` — session recordings
 - `triggers.json` — trigger rules
 - `sftp-bookmarks.json` — SFTP bookmarks
 Credentials saved in the OS keychain are stored under the service name `NexusTerminal`.
 ### Migrating from Alchementary Link
 On first run, if Nexus Terminal has no database yet and an Alchementary Link data directory (`AlchementaryLink`, in the same parent folder) exists, Nexus Terminal **copies** `link.db` to `nexus.db`, along with the `vault/` and `recordings/` directories, and shows a toast saying where the data came from. The Alchementary Link directory is left untouched.
 - If a `NexusTerminal/nexus.db` already exists (for example from a version before the Alchementary Link rebrand), it is used as-is and nothing is copied.
 - Keychain entries saved under `AlchementaryLink` are found the first time they are needed and copied to `NexusTerminal`. The old entries are not deleted.
 - Your vault master password is unchanged.
 - Trigger rules and SFTP bookmarks from Alchementary Link are not migrated; recreate them in Nexus Terminal.
 ---
 ## 16. Troubleshooting
 ### Session shows as disconnected
- The terminal is blurred and shows a **DISCONNECTED** overlay when the connection drops.
+- The pane is dimmed and shows a **Disconnected** overlay when the connection drops.
 - Click **Reconnect** to reopen the session with the same profile.
 ### Authentication fails
 - Check the username, password, key path and the auth methods ticked in the profile.
 - If the key has a passphrase, check the passphrase mode.
 - If the server uses two-factor prompts, check the TOTP secret with **Test** and make sure your system clock is accurate.
 ### "Host key verification failed"
 The server's key differs from the one saved earlier. This can happen when a server is reinstalled, but it can also indicate an attack. If you're certain it's safe, open **Settings → Known Hosts**, remove the entry, and reconnect.
 ### Upload fails or is greyed out
 - Check the folder is writable; **READ ONLY** indicates no write permission.
- Confirm the SSH session is connected.
+- Confirm the session is connected over SSH; upload isn't available for other protocols.
 ### Cannot read a folder
 - **NO READ** indicates insufficient permissions.
 - Try a parent folder or check remote access controls.
 ### Serial port won't open
 - Check the device path and that the adapter is plugged in; refresh the device list in the editor.
 - **Permission denied** on Linux: add your user to the `dialout` group (`uucp` on some distributions), then log out and back in.
 - On macOS, use the `/dev/cu.*` device rather than `/dev/tty.*`.
 - **Port is in use by another program**: close any other program that has the port open, such as `screen`, `minicom` or an IDE serial monitor.
 - Garbled output usually means the baud rate, parity or stop bits don't match the device.
 ### VNC will not connect
 - Confirm the VNC host and port are correct. The common VNC port is `5900` plus the display number.
 - If using a password, check whether it is set to save securely, remember for this session, or ask every time.
 - If using an SSH tunnel, verify the tunnel host, username, authentication method, private key and SSH host key policy.
 - If direct VNC is enabled, test from a trusted network first and prefer an SSH tunnel for untrusted networks.
 ### The secret store is locked
 If a saved credential isn't used, the vault may be locked. Click the vault state in the status bar, or open **Settings → Security**, and unlock it.
 ### Session keeps reconnecting
 - Check network stability and credentials.
- Review auto-reconnect settings in the profile.
+- Review the auto-reconnect settings in the profile. Reconnection backs off exponentially (1 s, 2 s, 4 s … up to 30 s) and stops after the maximum number of attempts.
 ### Terminal size looks wrong
 - Resize the window or drag a split divider; the terminal re-fits automatically.
 - Try disconnecting and reconnecting the session.
- Avoid heavy UI resizing during initial connection.
+- Some older servers don't support modern terminal features; try a different terminal type in the profile.
 ### Trying things safely
 To try something without touching your real data, start Nexus Terminal with `--data-dir DIR` to use a different data directory.
@@ -1,13 +0,0 @@
 // Package frontend provides the embedded frontend assets for the Wails application.
 package frontend
 import "embed"
 // Assets contains the frontend files served by the Wails asset server.
 // We embed the root index.html and the entire src/ tree (stylesheets,
 // scripts, vendor libs and static assets) so that `go build` works
 // without a separate npm build step.
 //
 //go:embed index.html
 //go:embed all:src
 var Assets embed.FS
@@ -1,329 +0,0 @@
 <!doctype html>
 <html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Nexus Terminal</title>
    <!-- Vendor styles -->
    <link rel="stylesheet" href="/src/css/lib/xterm.css" />
    <!-- Design system -->
    <link rel="stylesheet" href="/src/css/tokens.css" />
    <link rel="stylesheet" href="/src/css/base.css" />
    <link rel="stylesheet" href="/src/css/components.css" />
    <link rel="stylesheet" href="/src/css/layout.css" />
    <link rel="stylesheet" href="/src/css/sidebar.css" />
    <link rel="stylesheet" href="/src/css/tabs.css" />
    <link rel="stylesheet" href="/src/css/terminal.css" />
    <link rel="stylesheet" href="/src/css/splitpane.css" />
    <link rel="stylesheet" href="/src/css/recordings.css" />
    <link rel="stylesheet" href="/src/css/sftp.css" />
    <link rel="stylesheet" href="/src/css/forms.css" />
    <link rel="stylesheet" href="/src/css/modals.css" />
    <link rel="stylesheet" href="/src/css/github.css" />
    <link rel="stylesheet" href="/src/css/vnc.css" />
  </head>
  <body>
    <div id="app" class="app">
      <!-- ============================================================
             Sidebar — connection manager
             ============================================================ -->
      <aside class="sidebar" id="sidebar">
        <div class="sidebar-header wails-drag">
          <div class="sidebar-logo">
            <!-- Terminal prompt icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="18"
              height="18"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="2"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <polyline points="4 17 10 11 4 5"></polyline>
              <line x1="12" y1="19" x2="20" y2="19"></line>
            </svg>
            <span class="sidebar-title">Nexus Terminal</span>
          </div>
        </div>
        <div class="sidebar-search">
          <div class="search-wrapper">
            <input
              type="text"
              class="search-input"
              id="profile-search"
              placeholder="Search connections…"
              autocomplete="off"
              spellcheck="false"
            />
          </div>
        </div>
        <nav class="sidebar-nav" id="sidebar-nav">
          <!-- Dynamically managed by sidebar.js -->
          <div id="sidebar-profiles" class="sidebar-profiles"></div>
        </nav>
        <div class="sidebar-footer">
          <button
            class="btn btn-ghost btn-sm"
            id="btn-new-connection"
            title="New Connection"
          >
            <span>+ New</span>
          </button>
          <button
            class="btn btn-ghost btn-sm"
            id="btn-command-palette"
            title="Command Palette (⌘K)"
          >
            <span>⌘K</span>
          </button>
          <button
            class="btn btn-ghost btn-icon btn-sm"
            id="btn-import"
            title="Import Profiles"
          >
            <!-- Upload icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="14"
              height="14"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="2"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
              <polyline points="17 8 12 3 7 8"></polyline>
              <line x1="12" y1="3" x2="12" y2="15"></line>
            </svg>
          </button>
          <button
            class="btn btn-ghost btn-icon btn-sm"
            id="btn-export"
            title="Export Profiles"
          >
            <!-- Download icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="14"
              height="14"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="2"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path>
              <polyline points="7 10 12 15 17 10"></polyline>
              <line x1="12" y1="15" x2="12" y2="3"></line>
            </svg>
          </button>
          <button
            class="btn btn-ghost btn-icon btn-sm"
            id="btn-recordings"
            title="Session Recordings"
          >
            <!-- Film icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="14"
              height="14"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="2"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <circle cx="12" cy="12" r="10"></circle>
              <circle cx="12" cy="12" r="3"></circle>
            </svg>
          </button>
          <button
            class="btn btn-ghost btn-icon btn-sm"
            id="btn-settings"
            title="Settings"
          >
            <!-- Cog icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="14"
              height="14"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="2"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <circle cx="12" cy="12" r="3"></circle>
              <path
                d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0
                                 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65
                                 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0
                                 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9
                                 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0
                                 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06A1.65 1.65 0
                                 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0
                                 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6
                                 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0
                                 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65
                                 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2
                                 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0
                                 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2
                                 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65
                                 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51
                                 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65
                                 1.65 0 0 0-1.51 1z"
              ></path>
            </svg>
          </button>
        </div>
      </aside>
      <!-- ============================================================
             Tab bar — session tabs
             ============================================================ -->
      <div class="tab-bar" id="tab-bar">
        <div class="tab-list" id="tab-list">
          <!-- Tabs are injected dynamically by JS -->
        </div>
        <button class="tab-new" id="btn-new-tab" title="New Tab">+</button>
        <button
          class="tab-broadcast"
          id="btn-broadcast"
          title="Toggle Broadcast Mode (Ctrl+Shift+B)"
        >
          <!-- Broadcast icon (loudspeaker) -->
          <svg
            xmlns="http://www.w3.org/2000/svg"
            width="12"
            height="12"
            viewBox="0 0 24 24"
            fill="none"
            stroke="currentColor"
            stroke-width="2"
            stroke-linecap="round"
            stroke-linejoin="round"
          >
            <path d="M19.69 14a6.9 6.9 0 0 0 .31-2 6.9 6.9 0 0 0-.31-2"></path>
            <path d="M22.82 16.18a10 10 0 0 0 0-8.36"></path>
            <path d="M1 12s3-7 9-7 9 7 9 7-3 7-9 7-9-7-9-7z"></path>
            <circle cx="12" cy="12" r="3"></circle>
          </svg>
        </button>
      </div>
      <!-- ============================================================
             Workspace — terminal area
             ============================================================ -->
      <main class="workspace" id="workspace">
        <!-- Empty state — shown when no sessions are active -->
        <div class="empty-state" id="empty-state">
          <div class="empty-state-icon">
            <!-- Terminal icon -->
            <svg
              xmlns="http://www.w3.org/2000/svg"
              width="48"
              height="48"
              viewBox="0 0 24 24"
              fill="none"
              stroke="currentColor"
              stroke-width="1.5"
              stroke-linecap="round"
              stroke-linejoin="round"
            >
              <polyline points="4 17 10 11 4 5"></polyline>
              <line x1="12" y1="19" x2="20" y2="19"></line>
            </svg>
          </div>
          <h2>No active sessions</h2>
          <p>
            Select a connection from the sidebar or create a new one to get
            started.
          </p>
          <div class="empty-state-actions">
            <button class="btn btn-primary" id="btn-empty-connect">
              New Connection
            </button>
            <button class="btn btn-secondary" id="btn-empty-quick">
              Quick Connect
            </button>
          </div>
        </div>
        <!-- Session panels are injected here dynamically by tabs.js -->
        <div id="panel-container" class="panel-container"></div>
      </main>
      <!-- ============================================================
             Status bar
             ============================================================ -->
      <footer class="status-bar" id="status-bar">
        <span id="status-connection">
          <span class="status-dot is-disconnected"></span>
          Disconnected
        </span>
        <span id="status-protocol"></span>
        <span id="status-latency"></span>
        <span id="status-session-count">0 sessions</span>
        <span class="status-spacer"></span>
        <button
          class="status-update is-hidden"
          id="status-update"
          type="button"
        >
          Update available
        </button>
        <span id="status-vault">🔒 Locked</span>
      </footer>
    </div>
    <!-- Modal container (dynamically populated) -->
    <div id="modals"></div>
    <!-- Notification toasts -->
    <div id="notifications" class="notifications-container"></div>
    <!-- Vendor libraries -->
    <script src="/src/js/lib/xterm.min.js"></script>
    <script src="/src/js/lib/xterm-addon-fit.min.js"></script>
    <script src="/src/js/lib/xterm-addon-search.min.js"></script>
    <script src="/src/js/lib/xterm-addon-unicode11.min.js"></script>
    <script src="/src/js/lib/xterm-addon-web-links.min.js"></script>
    <!-- Application scripts (loaded in dependency order) -->
    <script src="/src/js/utils.js"></script>
    <script src="/src/js/state.js"></script>
    <script src="/src/js/notifications.js"></script>
    <script src="/src/js/sidebar.js"></script>
    <script src="/src/js/tabs.js"></script>
    <script src="/src/js/themes.js"></script>
    <script src="/src/js/terminal.js"></script>
    <script src="/src/js/profiles.js"></script>
    <script src="/src/js/raw.js"></script>
    <script src="/src/js/github.js"></script>
    <script src="/src/js/lib/novnc.min.js"></script>
    <script src="/src/js/vnc.js"></script>
    <script src="/src/js/settings.js"></script>
    <script src="/src/js/commands.js"></script>
    <script src="/src/js/secrets.js"></script>
    <script src="/src/js/recordings.js"></script>
    <script src="/src/js/sftp.js"></script>
    <script src="/src/js/splitpane.js"></script>
    <script src="/src/js/snippets.js"></script>
    <script src="/src/js/sshkeys.js"></script>
    <script src="/src/js/triggers.js"></script>
    <script src="/src/js/app.js"></script>
  </body>
 </html>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Andy Dixon	8766846a3b	docs: illustrated LaTeX user guide (docs/guide) with generated screenshots	2026-10-11 19:41:31 +01:00
Andy Dixon	ce9c5c6b44	Screenshot automation (--connect repeatable, --do, --answer, --shot-delay), SFTP Browser palette entry, centred dialogs, IRC opens the first joined room; demo_data example	2026-10-11 19:41:30 +01:00
Andy Dixon	84eff02c15	Move update and release URLs to dixon.cx/downloads/nexus	2026-10-11 19:06:48 +01:00
Andy Dixon	7b92b81ecd	Serial/Telnet Send Break and DTR/RTS tab controls; fix Help and hints; drop unused log path; docs	2026-10-11 17:54:11 +01:00
Andy Dixon	8d798124e9	Merge branch 'docs-rewrite' into rust-port	2026-10-11 17:52:43 +01:00
Andy Dixon	8c646e7176	docs: rewrite for Nexus Terminal	2026-10-11 17:52:35 +01:00
Andy Dixon	b3de13f0b7	docs: port status	2026-10-11 17:49:37 +01:00
Andy Dixon	1c16079584	Remove the Go backend, JS frontend, Wails config and old build scripts; release.sh now wraps rust/release.sh	2026-10-11 17:43:55 +01:00
Andy Dixon	e1707e4751	rust: VNC remote clipboard to the local clipboard	2026-10-11 17:43:35 +01:00
Andy Dixon	cc42a9086d	rust: --connect startup flag; palette launcher hint fits narrow windows	2026-10-11 17:42:40 +01:00
Andy Dixon	2bb12c3a58	rust: merge UI feature modules; fix Ctrl+key on Linux/Windows (egui command_only shadowing); clippy clean; rustfmt config	2026-10-11 17:40:48 +01:00
Andy Dixon	327ca1caa9	Merge branch 'ui-views' into rust-port	2026-10-11 17:35:22 +01:00
Andy Dixon	3ed4454081	rust: RAW, IRC, GitHub and VNC views	2026-10-11 17:35:15 +01:00
Andy Dixon	b646950738	rust: --open <window> for headless screenshot checks	2026-10-11 17:34:15 +01:00
Andy Dixon	cce0bdb1fb	Merge branch 'ui-sftp' into rust-port	2026-10-11 17:32:39 +01:00
Andy Dixon	19c5862288	rust: apply sidebar width from Settings; egui Panel::show	2026-10-11 17:32:39 +01:00
Andy Dixon	143e4900e0	rust: SFTP browser, file drop, port forwards	2026-10-11 17:32:07 +01:00
Andy Dixon	31d8d6fdae	Merge branch 'ui-settings' into rust-port	2026-10-11 17:27:33 +01:00
Andy Dixon	580c7239ba	Merge branch 'ui-tools' into rust-port	2026-10-11 17:26:02 +01:00
Andy Dixon	4ff59f6183	Merge branch 'ui-editor' into rust-port	2026-10-11 17:26:01 +01:00
Andy Dixon	4b17298925	rust: settings, SSH key manager, export/import	2026-10-11 17:25:56 +01:00
Andy Dixon	52770923df	rust: snippets, triggers, recordings and playback	2026-10-11 17:23:54 +01:00
Andy Dixon	7f4f9376fb	rust: profile editor and quick connect	2026-10-11 17:23:47 +01:00
Andy Dixon	f80374db77	docs: build and release for the Rust app	2026-10-11 17:14:40 +01:00
Andy Dixon	b1e18a8ffb	rust: optimise the app crate in dev builds (terminal parser); throughput test	2026-10-11 17:14:11 +01:00
Andy Dixon	0f4a906914	rust: keychain calls off the tokio runtime; plan reflects as-built crate choices	2026-10-11 17:04:24 +01:00
Andy Dixon	328507c57b	rust: packaging (Linux desktop entry, macOS bundle), cargo release script with update manifests, CI	2026-10-11 16:53:19 +01:00
Andy Dixon	ea09aeafe8	rust: system CJK font fallback, sidebar footer layout, --run-local test hook	2026-10-11 16:51:53 +01:00
Andy Dixon	43acc57c51	rust: Nexus Terminal app shell (title bar, sidebar, tabs, split panes, terminal view, palette, prompts, dialogs, toasts, status bar)	2026-10-11 16:48:33 +01:00
Andy Dixon	c36f4633a1	rust: wire VNC client into the session manager (password asked only when required, SSH tunnel)	2026-10-11 16:38:07 +01:00
Andy Dixon	2e9fdffeeb	Merge branch 'vnc-work' into rust-port	2026-10-11 16:37:04 +01:00
Andy Dixon	327a3a814c	rust: app design system (theme, widgets) from Leviathan	2026-10-11 16:37:04 +01:00
Andy Dixon	d654671bc1	rust: Service facade (profiles, credentials, TOTP, import/export, SSH keys, SFTP, updates)	2026-10-11 16:36:37 +01:00
Andy Dixon	81360cc4c2	rust: native VNC (RFB) client	2026-10-11 16:36:32 +01:00
Andy Dixon	cbd83489b2	rust: session manager (lifecycle, reconnect backoff, login scripts, recording, host-key policy, credential modes) and SSH tunnels	2026-10-11 16:33:17 +01:00
Andy Dixon	03bb1db936	Merge GitHub and IRC clients, IRC formatting	2026-10-11 16:23:31 +01:00
Andy Dixon	55e65410ce	rust: use terminalenv for SSH and local shell env	2026-10-11 16:23:05 +01:00
Andy Dixon	d20d16e8c8	rust: port GitHub and IRC clients, IRC formatting	2026-10-11 16:21:08 +01:00
Andy Dixon	1a42f65af1	Merge telnet, raw and serial clients	2026-10-11 16:20:27 +01:00
Andy Dixon	0b846e90d0	Merge utility ports (recording, sshconfig, terminalenv, validation, updater, keyfiles)	2026-10-11 16:19:14 +01:00
Andy Dixon	4674c7cb3f	rust: app crate scaffolding, terminal colour schemes	2026-10-11 16:18:15 +01:00
Andy Dixon	fb3e49a2a8	rust: port telnet and raw clients; add serial client	2026-10-11 16:18:04 +01:00
Andy Dixon	25e5f67a4d	rust: commit DB and vault fixtures (were gitignored)	2026-10-11 16:17:44 +01:00
Andy Dixon	fd54c988b6	rust: port recording, sshconfig, terminalenv, validation, updater, keyfiles	2026-10-11 16:17:03 +01:00
Andy Dixon	5ffee4a7c4	rust: local shell client on portable-pty	2026-10-11 16:15:58 +01:00
Andy Dixon	026f27add6	rust: SSH client on russh (auth chain, TOTP, jump hosts, proxies, forwards, agent forwarding) and SFTP, with sshd integration tests	2026-10-11 16:14:55 +01:00
Andy Dixon	38dff53485	rust: client callback conventions	2026-10-11 16:05:31 +01:00
Andy Dixon	e03298de11	rust: nexus-core storage, vault, keychain, export/import, data-dir migration	2026-10-11 16:05:13 +01:00
Andy Dixon	f588a797f9	rust: Go-generated compatibility fixtures (db, vault, export, recording)	2026-10-10 12:58:10 +01:00
Andy Dixon	7df353a6eb	docs: Rust port plan (Nexus Terminal)	2026-10-10 12:56:36 +01:00
Andy DixonandClaude Sonnet 5	2387476d0b	Point release.sh default update/release URLs at alchementary.co.uk The defaults still pointed at a stale dixon.cx placeholder from before the rebrand. Releases are now published under https://alchementary.co.uk/download/link, so future release.sh runs without an explicit LINK_UPDATE_URL/LINK_RELEASE_BASE_URL embed the real update-check and download URLs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n	2026-09-03 17:29:23 +01:00
Andy DixonandClaude Sonnet 5	6740553e6d	Bump golang.org/x/crypto to v0.56.0 Fixes two high-severity DoS vulnerabilities in x/crypto/ssh (GO-2026-6354, GO-2026-6355) reachable via the SSH and VNC clients, flagged by GitHub Dependabot. Requires bumping the go.mod go directive to 1.26.0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n	2026-09-03 16:46:58 +01:00
Andy DixonandClaude Sonnet 5	1a380a0e99	Rebrand: Nexus Terminal → Alchementary Link Renames the product across the codebase: Go module path, config/data paths, keychain service name, export file extension, build tooling, docs, and UI text. Sidebar brand mark now reads ">_ AlchementaryLink" with "Alchementary" in the connection-group gold accent colour, and the window title is "Alchementary Link". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n	2026-09-03 16:41:23 +01:00
Andy Dixon	114060127f	update frontend dependency checksum	2026-08-13 17:47:25 +01:00
Andy Dixon	49064a845c	improve IRC channel continuity and formatting	2026-08-13 17:35:32 +01:00
Andy Dixon	696661bfa9	fix SSH ping CPU spin and Linux releases	2026-08-13 17:22:48 +01:00
Andy Dixon	04c05e20bb	release changes	2026-07-30 11:29:32 +01:00
Andy Dixon	8326defae4	Updates	2026-07-29 13:32:05 +01:00
Andy Dixon	7f25b52055	docs: add July security audit reports	2026-07-29 12:41:04 +01:00
Andy Dixon	b5c7528160	fix: harden security resource lifecycles	2026-07-29 12:37:02 +01:00
Andy Dixon	f0a1a0b8f2	fix: release closed session resources	2026-07-29 12:07:59 +01:00
Andy Dixon	5d5993d9c4	feat: improve local terminal workflows	2026-07-22 11:57:52 +01:00
Andy Dixon	4fc3b19441	chore: migrate to pure Go SQLite build	2026-06-24 10:22:41 +01:00
Andy Dixon	614f87b8f2	docs: add security audit reports	2026-06-24 09:47:59 +01:00
Andy Dixon	3a16a14d6e	fix: harden VS Code bridge and webview CSP	2026-06-24 09:45:36 +01:00
Andy Dixon	07c31b5d1e	Improve VS Code terminal panel behaviour	2026-06-24 09:11:01 +01:00
Andy Dixon	b6db30c95f	Merge pull request #6 from andydixon/vscode-ext-ux-and-cross-platform vscode: revamp terminal UX, fix sizing, add cross-platform packaging	2026-06-23 19:59:35 +01:00
andyandClaude Opus 4.8	ab0e3a44e6	vscode: revamp terminal UX, fix sizing, add cross-platform packaging Nexus terminal: - Fix CSP that silently blocked the inline <style>, so the terminal now fills 100% of the tab; theme xterm from VSCode colour variables and use the editor/terminal monospace font. - Re-fit via ResizeObserver/visibility/font-load and re-send geometry once the session is connected, so the remote PTY no longer stays at 80x24. - Remove the floating SFTP icon; SFTP now opens in the user's home folder (retry SFTPPwd instead of falling back to /). Both extensions: - Polish panels to VSCode design standards (themed buttons, focus rings, primary actions); redraw the activity-bar logos. - chmod +x the bridge on activation (VSIX extraction may drop the exec bit). Packaging: - Stop tracking the per-host bridge binary (committed a macOS arm64 build that broke Linux/Windows); ignore vscode/bin, vscode/dist, vscode/*/bin. - Add package-all.sh to cross-compile the pure-Go bridge and produce one platform-specific VSIX per target (win32/darwin/linux x64+arm64), with an opt-in macOS codesign + notarization hook. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-23 19:56:31 +01:00
Andy Dixon	0f0b18c124	vscode extensions	2026-06-23 19:12:24 +01:00
Andy Dixon	89e0af3817	Merge pull request #5 from andydixon/irc IRC support	2026-06-23 14:49:21 +01:00
Andy Dixon	e1381e66d7	IRC support	2026-06-17 08:55:56 +01:00
Andy Dixon	0e6f54901b	Stop github from asking to close	2026-06-16 18:56:18 +01:00
Andy Dixon	cb2fbf70eb	fix: harden local proxy and import boundaries	2026-06-16 17:09:20 +01:00
Andy Dixon	739651d548	Documentation	2026-06-16 16:15:47 +01:00
Andy Dixon	3577b800d1	Final tweaks for v3	2026-06-16 16:08:05 +01:00
Andy Dixon	d5295772cb	Updates to xterm	2026-06-16 15:59:28 +01:00
Andy Dixon	58e916ecf8	v3 fixes and styling	2026-06-16 15:43:25 +01:00
Andy Dixon	493bfed599	v3 candidate	2026-06-16 11:51:07 +01:00
Andy Dixon	fcb19c96c8	Security Fixes	2026-06-16 09:41:51 +01:00
Andy Dixon	9bbd9ceccf	fix: harden profile imports and release dependencies	2026-06-15 19:39:16 +01:00
andy	b2fc84846c	Styling	2026-06-06 19:25:59 +01:00
Andy Dixon	18aa193039	Tightening security	2026-06-02 12:49:24 +01:00
Andy Dixon	ea6a9743d1	fix: harden SSH trust and dependency security	2026-06-02 12:25:20 +01:00
Andy Dixon	fb230ee35d	More paste fixes	2026-06-02 11:56:18 +01:00
Andy Dixon	74f16bfd0d	Fix for pasting	2026-06-02 10:47:59 +01:00
Andy Dixon	2eed4ea548	Fix for pasting	2026-06-02 10:47:31 +01:00
Andy Dixon	759485fc47	fix: ensure session state is removed correctly when closing tabs	2026-05-22 15:29:29 +01:00
Andy Dixon	cb76b77f1b	Tab hightligh	2026-05-21 20:24:10 +01:00
Andy Dixon	c2aa0349fc	Tab hightligh	2026-05-21 20:08:22 +01:00