release-2.5.1 (#1067)

* chore(deps): bump node from 24-slim to 26-slim in /docker in the docker-major-updates group (#1021) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump node in /docker in the docker-major-updates group Bumps the docker-major-updates group in /docker with 1 update: node. Updates `node` from 24-slim to 26-slim --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: docker-major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 24 updates (#1023) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump the dev-patch-updates group with 24 updates Bumps the dev-patch-updates group with 24 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.1` | `2.5.2` | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.3` | `6.10.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.1` | `6.43.5` | | [@radix-ui/react-accordion](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/accordion) | `1.2.14` | `1.2.15` | | [@radix-ui/react-alert-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-checkbox](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox) | `1.3.5` | `1.3.6` | | [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.17` | `1.1.18` | | [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.18` | `2.1.19` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.10` | `2.1.11` | | [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) | `1.1.17` | `1.1.18` | | [@radix-ui/react-progress](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/progress) | `1.1.10` | `1.1.11` | | [@radix-ui/react-scroll-area](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/scroll-area) | `1.2.12` | `1.2.13` | | [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.1` | `2.3.2` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.10` | `1.1.11` | | [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.4.1` | `1.4.2` | | [@radix-ui/react-switch](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/switch) | `1.3.1` | `1.3.2` | | [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.15` | `1.1.16` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.10` | `1.2.11` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.2` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.3` | | [i18next](https://github.com/i18next/i18next) | `26.3.1` | `26.3.4` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.0` | `1.6.1` | | [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.1` | `4.3.2` | Updates `@biomejs/biome` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.2/packages/@biomejs/biome) Updates `@codemirror/commands` from 6.10.3 to 6.10.4 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/view` from 6.43.1 to 6.43.5 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@radix-ui/react-accordion` from 1.2.14 to 1.2.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/accordion/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/accordion) Updates `@radix-ui/react-alert-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/alert-dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/alert-dialog) Updates `@radix-ui/react-checkbox` from 1.3.5 to 1.3.6 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/checkbox/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/checkbox) Updates `@radix-ui/react-dialog` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog) Updates `@radix-ui/react-dropdown-menu` from 2.1.18 to 2.1.19 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu) Updates `@radix-ui/react-label` from 2.1.10 to 2.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-popover` from 1.1.17 to 1.1.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover) Updates `@radix-ui/react-progress` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/progress/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/progress) Updates `@radix-ui/react-scroll-area` from 1.2.12 to 1.2.13 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/scroll-area/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/scroll-area) Updates `@radix-ui/react-select` from 2.3.1 to 2.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select) Updates `@radix-ui/react-separator` from 1.1.10 to 1.1.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slider` from 1.4.1 to 1.4.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider) Updates `@radix-ui/react-switch` from 1.3.1 to 1.3.2 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/switch/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/switch) Updates `@radix-ui/react-tabs` from 1.1.15 to 1.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs) Updates `@radix-ui/react-tooltip` from 1.2.10 to 1.2.11 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `@tailwindcss/vite` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-vite) Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `i18next` from 26.3.1 to 26.3.4 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.1...v26.3.4) Updates `radix-ui` from 1.6.0 to 1.6.1 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `sharp` from 0.35.2 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3) Updates `tailwindcss` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/commands" dependency-version: 6.10.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-accordion" dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-alert-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-checkbox" dependency-version: 1.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dialog" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-dropdown-menu" dependency-version: 2.1.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-popover" dependency-version: 1.1.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-progress" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-scroll-area" dependency-version: 1.2.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-select" dependency-version: 2.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-slider" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-switch" dependency-version: 1.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tabs" dependency-version: 1.1.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: i18next dependency-version: 26.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: radix-ui dependency-version: 1.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 2 updates (#1025) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-patch-updates group with 2 updates Bumps the prod-patch-updates group with 2 updates: [axios](https://github.com/axios/axios) and [nanoid](https://github.com/ai/nanoid). Updates `axios` from 1.18.0 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.18.1) Updates `nanoid` from 5.1.15 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.15...5.1.16) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-minor-updates group with 3 updates (#1026) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps): bump the prod-minor-updates group with 3 updates Bumps the prod-minor-updates group with 3 updates: [js-yaml](https://github.com/nodeca/js-yaml), [motion](https://github.com/motiondivision/motion) and [undici](https://github.com/nodejs/undici). Updates `js-yaml` from 5.0.0 to 5.2.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.0.0...5.2.1) Updates `motion` from 12.40.0 to 12.42.2 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](https://github.com/motiondivision/motion/compare/v12.40.0...v12.42.2) Updates `undici` from 8.5.0 to 8.7.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.5.0...v8.7.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: motion dependency-version: 12.42.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: undici dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump electron from 42.4.1 to 43.0.0 in the major-updates group (#1027) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore(deps-dev): bump electron in the major-updates group Bumps the major-updates group with 1 update: [electron](https://github.com/electron/electron). Updates `electron` from 42.4.1 to 43.0.0 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v42.4.1...v43.0.0) --- updated-dependencies: - dependency-name: electron dependency-version: 43.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix MC syntax highlighting artifacts (#996) * Filter dashboard status hosts (#997) * Persist dashboard service link changes (#999) * Fix snippet text overflow (#1000) * Persist remote desktop credential auth (#1001) * Guard language switching failures (#1002) * Resolve tunnel source credentials (#1003) * Support Vault auth for monitors (#1004) * Fix Windows file delete command (#1005) * Fix release artifact checkout ref (#1006) * Fix command palette escape in fullscreen (#1008) * Fix alerts and audit log data normalization (#1010) * Fix macOS VNC protocol negotiation (#1012) * Fix port knocking before SSH connect (#1013) * Allow Escape to close link confirmation (#1014) * Prevent Electron modifier wheel zoom (#1016) * Fix credential auth optional password (#1009) * Retry transient terminal DNS lookups (#1011) * Retry transient terminal DNS lookups * Apply DNS retry to SSH entry points * Fix OIDC redirect forwarded port handling (#1007) * Preserve recent open tabs on startup (#1015) * Fix fish prompt OSC highlighting (#998) * Fix terminal font selection (#1018) * fix: font legibility (#1019) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix: font legibility Text was entirely unreadable in places for me. Especially with themes like Catppuccin. The muted-foreground text and the tags too similiar to the background. --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: russell <git@0896c69e.com> * fix(file-manager): chunked uploads fail with 'Expected multipart/form-data request' (#1020) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * fix(file-manager): use postForm for chunked uploads so multipart content-type is sent The fileManagerApi axios instance defaults to Content-Type: application/json. Axios 1.x's default transformRequest converts a FormData body to JSON whenever the request content type is application/json, so every chunk POSTed to /ssh/uploadFileChunk arrived as a JSON body like {"chunk":{}} and the backend rejected it with 400 'Expected multipart/form-data request'. This breaks all uploads of files larger than the 1.5 GiB chunking threshold. The non-chunked path already uses postForm for /ssh/uploadFileStream; use it for the chunk path too so axios keeps the FormData intact and the browser sets the multipart boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: implement OIDC back-channel logout support with session management (#1028) * feat: implement OIDC back-channel logout support with session management * Fix OIDC back-channel logout handling * Require logout token replay identifiers --------- Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * Add API key host enrollment endpoint (#1029) * Fix tmux detection for non-POSIX shells (#1030) * Fix OPKSSH js-yaml ESM import (#1031) * Fix Android Vietnamese IME input (#1032) * Fix Firefox RDP clipboard paste (#1033) * Fix Proxmox discovery over HTTPS (#1041) * Fix external editor actions in file preview (#1042) * Allow pinned hosts with name sorting (#1043) * Fix Firefox desktop OIDC callback (#1044) * feat(session): add recording and replay (#1049) * Fix status checks through jump hosts (#1045) * Add terminal font size shortcuts (#1047) * feat: add Open File Manager to tab right-click menu (#1051) Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> * perf: frontend request cache, poll pause, and code-split shell (#1052) Host/status caching, shell code-split, SSH pool waits, host-metrics concurrency, background-tab idle, per-host status subscriptions, homepage poll quieting, and virtualized host sidebar + file manager lists. * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * feat: save quick connect sessions as hosts (#1055) * fix: restore sudo password autofill settings (#1056) * fix: preserve file editor position on save (#1057) * fix: sync cloud preference storage mode (#1058) * fix: render RDP sessions at native pixel density (#1059) * fix: restore database import in embedded desktop mode (#1060) * Update Auto-complete.tsx (#1061) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * Update Auto-complete.tsx --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * feat(auth): opt-in OIDC DEK unlock for API-key requests (ALLOW_APIKEY_DATA_UNLOCK) (#1064) * chore: fix release workflow to merge docs branch * fix: svg donation generator push fail * fix: svg donation generator push fail * Update termix.rb * fix: svg donation generator push fail * chore: move donation badge to badges branch to avoid ruleset conflicts * chore: remove unneeded token from donation badge workflow * chore: debug donation badge commit step * fix: escape < character in donation SVG * fix: point donation badge to badges branch * chore: remove unused donation badge svg from main * Add Rack Genius logo to README Added Rack Genius logo to the README. * chore: improve donation goal svg generator to include stablecoins * chore: donation goal generator syntax error * chore: donation goal generator incorrect docs url usage * chore: donation bar reporting wrong result * feat: add Open File Manager to tab right-click menu (#1046) * Revert "feat: add Open File Manager to tab right-click menu (#1046)" (#1050) This reverts commit 0712fdd731. * Remove donation badge from README Removed donation badge from README. * Delete .github/workflows/donation-goal.yml * feat(auth): opt-in OIDC DEK unlock for API-key requests API keys authenticate but cannot touch the encrypted credential/host store ('User data not unlocked') unless the user has a live interactive session, making them unusable for headless automation. For OIDC users the DEK is server-derivable (deriveOIDCSystemKey), so handleApiKeyAuth can unlock it without a password. Gated behind ALLOW_APIKEY_DATA_UNLOCK (default off) because enabling it widens the blast radius of a leaked API key. OIDC-only; password users are untouched. Refs #1063 --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: Luke Gustafson <88517757+LukeGus@users.noreply.github.com> Co-authored-by: Sankeerth Nara <sankeerthnara@gmail.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> * chore: package lock sync * Add Proxmox guest auto sync (#1053) * draft: database layer refactor (#1054) * feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: start database layer refactor * docs: plan database layer refactor * docs: audit database layer refactor phase zero * chore: add database runtime adapter skeleton * chore: add settings repository skeleton * chore: add user session repository skeleton * chore: add host credential repository skeleton * chore: add field encryption boundary * chore: migrate settings route slice * chore: migrate user settings routes * chore: migrate host metrics settings routes * chore: migrate acme settings route * chore: migrate terminal settings route * chore: migrate tailscale settings read * chore: migrate guacamole settings reads * chore: migrate session timeout settings reads * chore: migrate auth route settings reads * chore: migrate host metrics settings reads * chore: migrate startup settings reads * chore: migrate user settings cleanup * chore: migrate password reset settings * chore: migrate oidc legacy settings read * chore: migrate user route settings slice * chore: migrate oidc state settings * chore: migrate user login settings reads * chore: migrate user crypto settings * chore: consolidate startup settings defaults * chore: consolidate database settings import export * chore: migrate core session auth paths * chore: migrate remaining session auth paths * chore: migrate admin user routes * chore: migrate user route admin checks * chore: migrate user lifecycle routes * chore: migrate auth user lookups * chore: migrate oidc user routes * chore: migrate api key repository paths * docs: add database gray rollout guide * chore: migrate trusted device paths * chore: migrate user session route user lookups * chore: add database repository rollout guard * chore: expose repository rollout status * chore: warn on repository rollout misconfiguration * chore: migrate remaining user lookup helpers * chore: migrate ssh user lookups * chore: migrate user settings admin lookups * chore: migrate acme ssl user lookups * chore: migrate audit log admin checks * chore: migrate oidc account user updates * chore: migrate password reset user updates * chore: migrate user deletion core records * chore: migrate snippet audit user lookups * chore: migrate ldap user sync paths * chore: migrate totp user updates * chore: migrate rbac user checks * chore: migrate rbac role paths * chore: migrate permission role lookups * chore: migrate rbac access list reads * chore: migrate shared rbac reads * chore: migrate rbac access writes * chore: migrate permission host access * chore: migrate role host access lookup * chore: migrate snippet access lookup * chore: migrate shared credential access lookups * chore: migrate host access cleanup writes * chore: migrate host list access checks * chore: migrate host access cleanup routes * chore: migrate shared credential role lookups * chore: migrate user role cleanup * chore: migrate admin role sync * chore: migrate ldap role sync * chore: migrate user role assignment * chore: migrate sso provider access * chore: migrate audit log access * chore: migrate user preference access * chore: migrate open tab access * chore: migrate dismissed alert access * chore: migrate homepage layout access * chore: migrate network topology access * chore: migrate dashboard service link access * chore: migrate command history access * chore: migrate recent activity cleanup * chore: migrate ssh credential usage access * chore: migrate transfer recent access * chore: migrate file manager bookmark access * chore: migrate c2s tunnel preset access * chore: migrate homepage item access * chore: migrate session recording access * chore: migrate tmux session tag access * chore: migrate opkssh token access * chore: migrate vault token access * chore: migrate vault profile access * chore: migrate host metrics preference access * chore: migrate host health access * chore: migrate host metrics history access * chore: migrate alert persistence access * chore: route alert host lookup through repository * chore: migrate user data export reads * chore: route host metrics stats sync through repository * chore: migrate host folder persistence * chore: migrate host resolution reads * chore: route jump host resolution reads * chore: route docker console jump host reads * chore: route docker ssh resolution reads * chore: route proxmox discovery resolution reads * chore: route file manager activity host reads * chore: route host metrics resolution reads * chore: route ssh auth credential reads * chore: route tunnel endpoint credential reads * chore: route credential deployment resolution reads * chore: route command history host flag reads * chore: route snippet execution resolution reads * chore: route terminal host resolution reads * chore: route vault oidc host resolution reads * chore: route wake on lan host reads * chore: route internal host list reads * chore: route host key verification persistence * chore: route credential read paths * chore: route credential host usage reads * chore: route credential folder rename * chore: route host owner access checks * chore: route shared credential source reads * chore: route user host credential cleanup * chore: route credential delete reads * chore: route credential update reads * chore: route host credential reads * chore: route host read paths * chore: route host projection reads * chore: route host list reads * chore: route snippet read paths * chore: route snippet folder writes * chore: route snippet crud paths * chore: route snippet bulk import * chore: route rbac ownership reads * chore: route user count reads * chore: route cleanup snippets folders * chore: route shared credential persistence * chore: route dashboard activity * chore: route guacamole host reads * chore: route host bulk lookups * chore: remove unlock-only simple db ops * chore: route host autostart persistence * chore: route ldap provisioning through users * chore: route credential encrypted writes * chore: route host encrypted writes * chore: route bulk host encrypted writes * chore: route termix id credentials * chore: route termix id ca persistence * chore: route termix identity persistence * chore: route credential system migration * chore: isolate user encryption migration storage * chore: remove legacy simple db ops * chore: isolate legacy sqlite migration copy * chore: route database settings import export * chore: route database host credential export * chore: route database host credential import * chore: route database file-manager import export * chore: route database alert usage import export * chore: route database user checks * chore: isolate auth lazy migration storage * chore: route explicit database saves * chore: initialize database save boundary * chore: route migration snapshot saves * chore: isolate sqlite import constraints * chore: route import sqlite boundary * chore: route user encryption migration store * chore: centralize current repository runtime * chore: route more current repositories * chore: route activity repository runtimes * chore: route token repository runtimes * chore: route health repository runtimes * chore: route identity repository runtimes * chore: route rbac repository runtime * chore: centralize current sqlite runtime access * chore: route user deletion key cleanup * chore: route user deletion vault cleanup * chore: route user deletion homepage cleanup * chore: route user deletion health cleanup * chore: route user deletion alert cleanup * chore: route user deletion identity cleanup * chore: add database layer preupgrade backup * Fix database repository type errors * fix: complete post-merge compile fixes for database refactor Restore missing DatabaseSaveTrigger/getDb imports, session log format fallback, OIDC provider resolution, guacamole recording insert, and passwordFallbackOnly typing after merging current dev. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: LukeGus <bugattiguy527@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> * refactor(db): collapse repository rollout scaffolding into single factory Repositories are now the only data path. Replaces the 41 current-*-repository wrapper files, the DATABASE_LAYER_REPOSITORY_ROLLOUT flag/alias map and the unused database/runtime adapter with repositories/factory.ts, a plain DatabaseContext type and an in-memory TestSqliteDatabase test harness. * refactor(db): route remaining raw DB access through repositories proxmox, session-log, oidc-utils, webauthn and guacamole recording now use repositories (new WebauthnCredentialRepository; SsoProviderRepository listEnabled; HostRepository findDecryptedByIdAs/listProxmoxEnabled). Remaining raw access: db boot code, simple-db-ops and docker.ts, which are removed/restructured in later phases. * feat(crypto): add UserKeyManager with system-wrapped per-user DEKs New utils/user-keys.ts: one random 32-byte DEK per user, wrapped AES-256-GCM under an HKDF key derived from the system ENCRYPTION_KEY (per-user info string + AAD binding, versioned v3 wrap format stored in settings). Synchronous unwrap-on-demand with a 15-minute cache so the existing DataCrypto facade keeps its sync call sites. Not wired up yet. * feat(crypto): boot-time DEK migration to system-wrapped v3 format utils/crypto-migration/dek-migration.ts carries the legacy unwrap paths (PBKDF2 password KEK, OIDC/WebAuthn system keys, hardcoded-default fallback) and migrates every server-unwrappable DEK to the v3 wrap at startup. Password-wrapped DEKs migrate at next login or from a live session via adoptRecoveredDEK. Legacy rows are kept for now; cleanup flips on once the new path is authoritative. * refactor(crypto): make system-wrapped DEKs the authoritative key path DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone. utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps. A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active password users migrate without re-login. Password login migrates legacy password-wrapped DEKs via migratePasswordUserAtLogin. * refactor(crypto): remove pending share queue and credential sharing key With server-unwrappable DEKs both sides of a share are always available, so the needsReEncryption queue, CREDENTIAL_SHARING_KEY and the system_* shadow columns on ssh_credentials are gone. A one-time boot cleanup re-creates legacy pending share copies where possible (dropping unresolvable ones with a warning) and drops the legacy columns. * feat(auth): non-destructive password resets and admin reset endpoint Password resets no longer destroy user data: the DEK is system-wrapped, so forgot-password and admin resets are just a hash update plus session revoke. The wipe branch survives only for accounts that never logged in since the encryption upgrade and now requires explicit confirmDataWipe (surfaced as a 409 DATA_WIPE_REQUIRED; the reset UI asks for confirmation). Adds POST /users/admin/reset-password and removes the dead re-encryption paths. * refactor(ssh): consolidate four jump-host chain copies into one module terminal, host-metrics and docker now use ssh/jump-host-chain.ts (already shared by file-manager, tmux-monitor and docker-console); docker's inline copy also drops its raw SimpleDBOps host/credential lookups in favor of repositories. * refactor(ssh): single shared createConnectionLog helper file-manager-log.ts becomes ssh/connection-log.ts; the copies in docker.ts and host-metrics-helpers.ts are gone. * refactor(ssh): split docker module into layered directory ssh/docker/{index,routes,session-manager,container-routes,console}.ts: server boot and wiring in index, HTTP handlers in routes, SSH session registry and command execution in session-manager. Code motion only; port 30007/30009 and endpoints unchanged. Swagger now scans ssh subdirectories. * refactor(ssh): split tunnel module into layered directory ssh/tunnel/{index,routes,manager}.ts: server boot in index, HTTP handlers in routes, tunnel state and engine (connect/retry/autostart) in manager. Code motion only; port 30003 and endpoints unchanged. * refactor(backend): reorganize top-level layout - ssh/ renamed to hosts/ (it covers SSH, RDP, VNC, Telnet, Docker, metrics) - serial/serial.ts and guacamole/ moved inside hosts/ - dashboard.ts and homepage.ts moved to services/ - swagger.ts moved to utils/ with adjusted scan globs Import paths and the generate:openapi script updated; ports and endpoints unchanged. * refactor(tests): move backend tests into src/backend/tests mirror tree Backend *.test.ts files (and the test-support harness) no longer sit next to source files; they live under src/backend/tests/ mirroring the source layout. Imports rewritten accordingly; CLAUDE.md convention updated. * refactor(hosts): group host modules into per-feature directories file-manager/, metrics/ (incl. widgets, managers, alert-engine), terminal/, tmux/ and tunnel/ each own their files; docker/ gains container-runtime. Genuinely shared helpers (jump-host chain, host resolver, connection pool, opkssh, vault, serial) stay at hosts/ root. Pure file moves with import path updates; mirrored test paths follow. * refactor(backend): final cleanup pass - re-register WebAuthn passkey routes (registration was dropped in the #1054 merge, breaking passkey login) and document all six endpoints - delete utils/simple-db-ops.ts (last caller migrated to DataCrypto) - starter: use the typed serverReady export, collapse the four-way version lookup to env then package.json candidates - add OpenAPI JSDoc to c2s-tunnel-presets endpoints - strip block-divider comment banners * feat: remove legacy "data_unlocked" field * feat: refactor rbac/sharing to support new permissions and auth types * feat: refactor rbac/sharing to support new permissions and auth types * feat: add "id" to user profile hide list * chore: root cleanup * feat: add more donation references and a 30-day donation reminder * chore: update readme * feat: automate beta tests * feat: add links to milestones * fix: hoist github/google SSO defaults to module scope (#1065) * fix(ssh-tools): allow clipboard paste in key recording field (#1066) The broadcast key-recording input was marked readOnly, which makes browsers block paste entirely (no context-menu Paste, Ctrl+V does nothing). handleKeyDown also called preventDefault() unconditionally, swallowing the Ctrl+V shortcut before a paste event could even fire. Let Ctrl/Cmd+V pass through in handleKeyDown, drop readOnly, and add an onPaste handler that reads the clipboard text and broadcasts it to the selected terminals like any other captured keystroke. Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com> * chore: write release notes * chore: update release notes * chore: update readmes * chore: add crypto only reminder in en.json * fix: macOS and cask errors on release workflow * chore: sync Crowdin translations for 2.5.1 --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: emreumar <emreumar@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Russell Poovey <09.our_seekers@icloud.com> Co-authored-by: russell <git@0896c69e.com> Co-authored-by: Subedi Bibek <77529535+questbibek@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Alexander Elsner <101340634+Bensonheimer992@users.noreply.github.com> Co-authored-by: SankeerthNara <sankeerthnara@gmail.com> Co-authored-by: Stephan Groth <96803994+Kalvalax@users.noreply.github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> Co-authored-by: lhojun <ldgs3324@gmail.com> Co-authored-by: Yunus Emre Umar <77045015+emre155@users.noreply.github.com> Co-authored-by: emreumar <emreumar@users.noreply.github.com>
2026-09-14 02:59:06 +00:00 · 2026-07-19 12:29:52 -05:00
parent fba645e92e
commit ddbdd5c437
562 changed files with 52303 additions and 23645 deletions
@@ -0,0 +1,116 @@
+import type { IncomingMessage } from "http";
+import type { Duplex } from "stream";
+import type { ClientChannel } from "ssh2";
+import type { WebSocket } from "ws";
+
+const C2S_WS_HIGH_WATERMARK = 1024 * 1024;
+const C2S_WS_LOW_WATERMARK = 256 * 1024;
+const C2S_STREAM_WRITE_LIMIT = 8 * 1024 * 1024;
+
+export function extractRequestToken(req: IncomingMessage): string | undefined {
+  const cookieHeader = req.headers.cookie;
+  if (cookieHeader) {
+    const match = cookieHeader.match(/(?:^|;\s*)jwt=([^;]+)/);
+    if (match) return decodeURIComponent(match[1]);
+  }
+
+  const authHeader = req.headers.authorization;
+  if (authHeader?.startsWith("Bearer ")) {
+    return authHeader.slice("Bearer ".length);
+  }
+
+  return undefined;
+}
+
+export function sendC2SError(ws: WebSocket, message: string): void {
+  if (ws.readyState === 1) {
+    ws.send(JSON.stringify({ type: "error", error: message }));
+  }
+}
+
+export function describeC2SRelayError(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  const lowerMessage = message.toLowerCase();
+
+  if (
+    lowerMessage.includes("administratively prohibited") ||
+    lowerMessage.includes("forwarding disabled") ||
+    lowerMessage.includes("open failed")
+  ) {
+    return `SSH forwarding was rejected by the endpoint server: ${message}`;
+  }
+  if (
+    lowerMessage.includes("address already in use") ||
+    lowerMessage.includes("unable to bind") ||
+    lowerMessage.includes("bind")
+  ) {
+    return `Remote port is not available on the endpoint server: ${message}`;
+  }
+  if (
+    lowerMessage.includes("name or service not known") ||
+    lowerMessage.includes("enotfound") ||
+    lowerMessage.includes("econnrefused")
+  ) {
+    return `Tunnel target is not reachable from the endpoint host: ${message}`;
+  }
+
+  return message || "Failed to open relay";
+}
+
+function pauseSourceForC2SWebSocket(ws: WebSocket, source?: Duplex): void {
+  if (!source) return;
+  if (ws.bufferedAmount <= C2S_WS_HIGH_WATERMARK) return;
+
+  source.pause();
+  const resumeTimer = setInterval(() => {
+    if (
+      ws.readyState !== 1 ||
+      source.destroyed ||
+      ws.bufferedAmount <= C2S_WS_LOW_WATERMARK
+    ) {
+      clearInterval(resumeTimer);
+      if (ws.readyState === 1 && !source.destroyed) {
+        source.resume();
+      }
+    }
+  }, 25);
+}
+
+export function sendC2SMessage(
+  ws: WebSocket,
+  message: Record<string, unknown>,
+  source?: Duplex,
+): void {
+  if (ws.readyState === 1) {
+    ws.send(JSON.stringify(message), (error) => {
+      if (error && source && !source.destroyed) {
+        source.destroy(error);
+      }
+    });
+    pauseSourceForC2SWebSocket(ws, source);
+  }
+}
+
+export function writeC2SRemoteChunk(
+  target: ClientChannel,
+  chunk: Buffer,
+  ws: WebSocket,
+  closeTarget: () => void,
+): void {
+  if (!target || target.destroyed) return;
+
+  if (target.writableLength > C2S_STREAM_WRITE_LIMIT) {
+    closeTarget();
+    return;
+  }
+
+  const canContinue = target.write(chunk);
+  if (!canContinue) {
+    ws.pause();
+    target.once("drain", () => {
+      if (ws.readyState === 1) {
+        ws.resume();
+      }
+    });
+  }
+}
@@ -0,0 +1,406 @@
+import { Client, type ClientChannel } from "ssh2";
+import type { WebSocket } from "ws";
+import type { TunnelConfig } from "../../../types/index.js";
+import { createSocks5Connection } from "../../utils/socks5-helper.js";
+import { tunnelLogger } from "../../utils/logger.js";
+import { PermissionManager } from "../../utils/permission-manager.js";
+import {
+  applyAuthOptions,
+  bindForwardIn,
+  connectClient,
+  forwardOut,
+  getManagedTunnelAlgorithms,
+  unbindForwardIn,
+} from "./ssh-primitives.js";
+import { sendC2SMessage, writeC2SRemoteChunk } from "./c2s-relay-utils.js";
+import { getTunnelMode } from "./utils.js";
+
+export type C2SOpenMessage = {
+  type: "open" | "test";
+  tunnelConfig?: Partial<TunnelConfig>;
+  targetHost?: string;
+  targetPort?: number;
+};
+
+const permissionManager = PermissionManager.getInstance();
+let c2sRemoteStreamCounter = 0;
+
+async function resolveC2STunnelSource(
+  tunnelConfig: Partial<TunnelConfig>,
+  userId: string,
+): Promise<TunnelConfig> {
+  if (!tunnelConfig.sourceHostId) {
+    throw new Error("Endpoint SSH host is required");
+  }
+
+  const accessInfo = await permissionManager.canAccessHost(
+    userId,
+    tunnelConfig.sourceHostId,
+    "connect",
+  );
+  if (!accessInfo.hasAccess) {
+    throw new Error("Access denied to this host");
+  }
+
+  const { resolveHostById } = await import("../host-resolver.js");
+  const resolvedHost = await resolveHostById(tunnelConfig.sourceHostId, userId);
+  if (!resolvedHost) {
+    throw new Error("Endpoint SSH host not found");
+  }
+
+  return {
+    name: tunnelConfig.name || `c2s:${tunnelConfig.sourceHostId}`,
+    scope: "c2s",
+    mode: tunnelConfig.mode || "local",
+    tunnelType:
+      tunnelConfig.tunnelType ||
+      (tunnelConfig.mode === "remote" ? "remote" : "local"),
+    bindHost: tunnelConfig.bindHost,
+    targetHost: tunnelConfig.targetHost || "127.0.0.1",
+    sourceHostId: resolvedHost.id || tunnelConfig.sourceHostId,
+    tunnelIndex: tunnelConfig.tunnelIndex || 0,
+    requestingUserId: userId,
+    hostName:
+      resolvedHost.name || `${resolvedHost.username}@${resolvedHost.ip}`,
+    sourceIP: resolvedHost.ip,
+    sourceSSHPort: resolvedHost.port,
+    sourceUsername: resolvedHost.username,
+    sourcePassword: resolvedHost.password,
+    sourceAuthMethod: resolvedHost.authType,
+    sourceSSHKey: resolvedHost.key,
+    sourceKeyPassword: resolvedHost.keyPassword,
+    sourceKeyType: resolvedHost.keyType,
+    sourceCredentialId: resolvedHost.credentialId,
+    sourceUserId: resolvedHost.userId,
+    endpointIP: tunnelConfig.endpointIP || resolvedHost.ip,
+    endpointSSHPort: tunnelConfig.endpointSSHPort || resolvedHost.port,
+    endpointUsername: resolvedHost.username,
+    endpointHost:
+      tunnelConfig.endpointHost || resolvedHost.name || resolvedHost.ip,
+    endpointAuthMethod: resolvedHost.authType,
+    endpointSSHKey: resolvedHost.key,
+    endpointKeyPassword: resolvedHost.keyPassword,
+    endpointKeyType: resolvedHost.keyType,
+    endpointCredentialId: resolvedHost.credentialId,
+    endpointUserId: resolvedHost.userId,
+    sourcePort: Number(tunnelConfig.sourcePort) || 0,
+    endpointPort: Number(tunnelConfig.endpointPort) || 0,
+    maxRetries: Number(tunnelConfig.maxRetries) || 0,
+    retryInterval: Number(tunnelConfig.retryInterval) || 0,
+    autoStart: Boolean(tunnelConfig.autoStart),
+    isPinned: Boolean(resolvedHost.pin),
+    useSocks5: Boolean(resolvedHost.useSocks5),
+    socks5Host: resolvedHost.socks5Host,
+    socks5Port: resolvedHost.socks5Port,
+    socks5Username: resolvedHost.socks5Username,
+    socks5Password: resolvedHost.socks5Password,
+    socks5ProxyChain: resolvedHost.socks5ProxyChain,
+    keepaliveInterval:
+      typeof resolvedHost.terminalConfig?.keepaliveInterval === "number"
+        ? resolvedHost.terminalConfig.keepaliveInterval * 1000
+        : 60000,
+    keepaliveCountMax:
+      typeof resolvedHost.terminalConfig?.keepaliveCountMax === "number"
+        ? resolvedHost.terminalConfig.keepaliveCountMax
+        : 5,
+  };
+}
+
+async function connectC2SSourceClient(
+  tunnelConfig: TunnelConfig,
+): Promise<Client> {
+  const connOptions: Record<string, unknown> = {
+    host:
+      tunnelConfig.sourceIP?.replace(/^\[|\]$/g, "") || tunnelConfig.sourceIP,
+    port: tunnelConfig.sourceSSHPort,
+    username: tunnelConfig.sourceUsername,
+    tryKeyboard: true,
+    keepaliveInterval: tunnelConfig.keepaliveInterval ?? 30000,
+    keepaliveCountMax: tunnelConfig.keepaliveCountMax ?? 3,
+    readyTimeout: 60000,
+    tcpKeepAlive: true,
+    tcpKeepAliveInitialDelay: 30000,
+    algorithms: getManagedTunnelAlgorithms(),
+  };
+
+  applyAuthOptions(connOptions, {
+    password: tunnelConfig.sourcePassword,
+    sshKey: tunnelConfig.sourceSSHKey,
+    keyPassword: tunnelConfig.sourceKeyPassword,
+    keyType: tunnelConfig.sourceKeyType,
+    authMethod: tunnelConfig.sourceAuthMethod,
+  });
+
+  if (
+    tunnelConfig.useSocks5 &&
+    (tunnelConfig.socks5Host ||
+      (tunnelConfig.socks5ProxyChain &&
+        tunnelConfig.socks5ProxyChain.length > 0))
+  ) {
+    const socks5Socket = await createSocks5Connection(
+      tunnelConfig.sourceIP,
+      tunnelConfig.sourceSSHPort,
+      {
+        useSocks5: tunnelConfig.useSocks5,
+        socks5Host: tunnelConfig.socks5Host,
+        socks5Port: tunnelConfig.socks5Port,
+        socks5Username: tunnelConfig.socks5Username,
+        socks5Password: tunnelConfig.socks5Password,
+        socks5ProxyChain: tunnelConfig.socks5ProxyChain,
+      },
+    );
+    if (socks5Socket) {
+      connOptions.sock = socks5Socket;
+    }
+  }
+
+  return connectClient(connOptions, tunnelConfig.name, "source");
+}
+
+async function handleC2SRemoteRelayOpen(
+  ws: WebSocket,
+  tunnelConfig: TunnelConfig,
+): Promise<void> {
+  const tunnelName = tunnelConfig.name;
+  const sourceClient = await connectC2SSourceClient(tunnelConfig);
+  const bindHost = tunnelConfig.targetHost || "127.0.0.1";
+  const bindPort = Number(tunnelConfig.sourcePort);
+  let closed = false;
+
+  if (!Number.isInteger(bindPort) || bindPort < 1 || bindPort > 65535) {
+    throw new Error("Invalid remote port");
+  }
+
+  const actualPort = await bindForwardIn(sourceClient, bindHost, bindPort);
+  const streams = new Map<string, ClientChannel>();
+
+  const closeStream = (streamId: string): void => {
+    const stream = streams.get(streamId);
+    if (!stream) return;
+    streams.delete(streamId);
+    try {
+      stream.destroy();
+    } catch {
+      // expected during shutdown
+    }
+  };
+
+  const close = (): void => {
+    if (closed) return;
+    closed = true;
+    for (const streamId of streams.keys()) {
+      closeStream(streamId);
+    }
+    unbindForwardIn(sourceClient, bindHost, actualPort);
+    try {
+      sourceClient.end();
+    } catch {
+      // expected during shutdown
+    }
+  };
+
+  sourceClient.on("tcp connection", (info, accept, reject) => {
+    if (info.destPort !== actualPort) {
+      reject();
+      return;
+    }
+
+    const inbound = accept();
+    const streamId = `${Date.now()}-${++c2sRemoteStreamCounter}`;
+    streams.set(streamId, inbound);
+
+    sendC2SMessage(ws, { type: "connection", streamId });
+
+    inbound.on("data", (chunk) => {
+      sendC2SMessage(
+        ws,
+        {
+          type: "data",
+          streamId,
+          data: chunk.toString("base64"),
+        },
+        inbound,
+      );
+    });
+    inbound.on("close", () => {
+      streams.delete(streamId);
+      sendC2SMessage(ws, { type: "close", streamId });
+    });
+    inbound.on("error", (error) => {
+      streams.delete(streamId);
+      sendC2SMessage(ws, {
+        type: "close",
+        streamId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    });
+  });
+
+  ws.on("message", (data, isBinary) => {
+    if (isBinary) return;
+
+    try {
+      const message = JSON.parse(data.toString()) as {
+        type?: string;
+        streamId?: string;
+        data?: string;
+      };
+      if (!message.streamId) return;
+
+      if (message.type === "data" && message.data) {
+        const stream = streams.get(message.streamId);
+        if (stream) {
+          writeC2SRemoteChunk(
+            stream,
+            Buffer.from(message.data, "base64"),
+            ws,
+            () => closeStream(message.streamId as string),
+          );
+        }
+      } else if (message.type === "close") {
+        closeStream(message.streamId);
+      }
+    } catch (error) {
+      tunnelLogger.warn("Invalid C2S remote relay message", {
+        operation: "c2s_remote_relay_invalid_message",
+        tunnelName,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  });
+
+  ws.on("close", close);
+  ws.on("error", close);
+  sourceClient.on("close", () => {
+    if (ws.readyState === 1) ws.close();
+  });
+  sourceClient.on("error", (error) => {
+    sendC2SMessage(ws, {
+      type: "error",
+      error: error instanceof Error ? error.message : String(error),
+    });
+    if (ws.readyState === 1) ws.close();
+  });
+
+  tunnelLogger.info("C2S remote tunnel ready", {
+    operation: "c2s_remote_tunnel_ready",
+    tunnelName,
+    bindHost,
+    bindPort: actualPort,
+    endpointHost: tunnelConfig.endpointHost,
+  });
+  sendC2SMessage(ws, { type: "ready", bindHost, bindPort: actualPort });
+}
+
+export async function handleC2SRelayOpen(
+  ws: WebSocket,
+  message: C2SOpenMessage,
+  userId: string,
+): Promise<void> {
+  const tunnelConfig = await resolveC2STunnelSource(
+    message.tunnelConfig || {},
+    userId,
+  );
+  const mode = getTunnelMode(tunnelConfig);
+  if (mode === "remote") {
+    await handleC2SRemoteRelayOpen(ws, tunnelConfig);
+    return;
+  }
+
+  const targetHost =
+    mode === "dynamic"
+      ? message.targetHost
+      : tunnelConfig.targetHost || "127.0.0.1";
+  const targetPort =
+    mode === "dynamic"
+      ? Number(message.targetPort)
+      : Number(tunnelConfig.endpointPort);
+
+  if (!targetHost || !Number.isInteger(targetPort) || targetPort < 1) {
+    throw new Error("Invalid client tunnel target");
+  }
+
+  const sourceClient = await connectC2SSourceClient(tunnelConfig);
+  const outbound = await forwardOut(sourceClient, targetHost, targetPort);
+
+  const close = () => {
+    try {
+      outbound.destroy();
+    } catch {
+      // expected during shutdown
+    }
+    try {
+      sourceClient.end();
+    } catch {
+      // expected during shutdown
+    }
+  };
+
+  outbound.on("data", (chunk) => {
+    if (ws.readyState === 1) {
+      ws.send(chunk);
+    }
+  });
+  outbound.on("close", () => {
+    if (ws.readyState === 1) ws.close();
+  });
+  outbound.on("error", () => {
+    if (ws.readyState === 1) ws.close();
+  });
+  ws.on("close", close);
+  ws.on("error", close);
+  ws.on("message", (data, isBinary) => {
+    if (!isBinary) return;
+    const chunk = Buffer.isBuffer(data)
+      ? data
+      : Array.isArray(data)
+        ? Buffer.concat(data)
+        : Buffer.from(data);
+    outbound.write(chunk);
+  });
+
+  ws.send(JSON.stringify({ type: "ready" }));
+}
+
+export async function handleC2SRelayTest(
+  ws: WebSocket,
+  message: C2SOpenMessage,
+  userId: string,
+): Promise<void> {
+  const tunnelConfig = await resolveC2STunnelSource(
+    message.tunnelConfig || {},
+    userId,
+  );
+  const mode = getTunnelMode(tunnelConfig);
+  const sourceClient = await connectC2SSourceClient(tunnelConfig);
+
+  try {
+    if (mode === "remote") {
+      const bindHost = tunnelConfig.targetHost || "127.0.0.1";
+      const bindPort = Number(tunnelConfig.sourcePort);
+      if (!Number.isInteger(bindPort) || bindPort < 1 || bindPort > 65535) {
+        throw new Error("Invalid remote port");
+      }
+
+      const actualPort = await bindForwardIn(sourceClient, bindHost, bindPort);
+      unbindForwardIn(sourceClient, bindHost, actualPort);
+    } else if (mode === "local") {
+      const targetHost = tunnelConfig.targetHost || "127.0.0.1";
+      const targetPort = Number(tunnelConfig.endpointPort);
+      if (!Number.isInteger(targetPort) || targetPort < 1) {
+        throw new Error("Invalid remote target port");
+      }
+
+      const outbound = await forwardOut(sourceClient, targetHost, targetPort);
+      outbound.destroy();
+    }
+
+    sendC2SMessage(ws, { type: "ready" });
+  } finally {
+    try {
+      sourceClient.end();
+    } catch {
+      // expected during shutdown
+    }
+  }
+}
@@ -0,0 +1,92 @@
+import express from "express";
+import { createServer } from "http";
+
+import { createCorsMiddleware } from "../../utils/cors-config.js";
+import cookieParser from "cookie-parser";
+import { WebSocketServer } from "ws";
+
+import { tunnelLogger } from "../../utils/logger.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+
+import {
+  describeC2SRelayError,
+  extractRequestToken,
+  sendC2SError,
+} from "./c2s-relay-utils.js";
+import {
+  handleC2SRelayOpen,
+  handleC2SRelayTest,
+  type C2SOpenMessage,
+} from "./c2s-relay.js";
+
+import { registerTunnelRoutes } from "./routes.js";
+import { initializeAutoStartTunnels } from "./manager.js";
+
+const authManager = AuthManager.getInstance();
+
+const app = express();
+app.use(createCorsMiddleware(["GET", "POST", "PUT", "DELETE", "OPTIONS"]));
+app.use(cookieParser());
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.setHeader("Cache-Control", "no-store");
+  next();
+});
+
+registerTunnelRoutes(app);
+
+const PORT = 30003;
+const server = createServer(app);
+const c2sRelayWss = new WebSocketServer({
+  server,
+  path: "/ssh/tunnel/c2s/stream",
+});
+
+c2sRelayWss.on("connection", (ws, req) => {
+  let opened = false;
+
+  ws.once("message", async (raw) => {
+    try {
+      const token = extractRequestToken(req);
+      const payload = token ? await authManager.verifyJWTToken(token) : null;
+      if (!payload?.userId || payload.pendingTOTP) {
+        sendC2SError(ws, "Authentication required");
+        ws.close();
+        return;
+      }
+
+      const message = JSON.parse(raw.toString()) as C2SOpenMessage;
+      if (message.type !== "open" && message.type !== "test") {
+        throw new Error("Invalid client tunnel relay request");
+      }
+
+      opened = true;
+      if (message.type === "test") {
+        await handleC2SRelayTest(ws, message, payload.userId);
+      } else {
+        await handleC2SRelayOpen(ws, message, payload.userId);
+      }
+    } catch (error) {
+      const message = describeC2SRelayError(error);
+      tunnelLogger.error("Failed to open C2S relay", error, {
+        operation: "c2s_relay_open_failed",
+      });
+      sendC2SError(ws, message);
+      ws.close();
+    }
+  });
+
+  ws.on("close", () => {
+    if (!opened) {
+      tunnelLogger.info("C2S relay closed before opening", {
+        operation: "c2s_relay_closed_before_open",
+      });
+    }
+  });
+});
+
+server.listen(PORT, () => {
+  setTimeout(() => {
+    initializeAutoStartTunnels();
+  }, 2000);
+});
@@ -0,0 +1,596 @@
+import express, { type Response } from "express";
+
+import axios from "axios";
+import type {
+  SSHHost,
+  TunnelConfig,
+  AuthenticatedRequest,
+} from "../../../types/index.js";
+import { CONNECTION_STATES } from "../../../types/index.js";
+import { tunnelLogger } from "../../utils/logger.js";
+import { SystemCrypto } from "../../utils/system-crypto.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { PermissionManager } from "../../utils/permission-manager.js";
+
+import { getTunnelMode, validateTunnelConfig } from "./utils.js";
+
+import {
+  tunnelConfigs,
+  activeRetryTimers,
+  pendingTunnelOperations,
+  manualDisconnects,
+  retryExhaustedTunnels,
+  retryCounters,
+  countdownIntervals,
+  tunnelConnecting,
+  tunnelStatusClients,
+  connectionStatus,
+  cleanupTunnelResources,
+  broadcastTunnelStatus,
+  handleDisconnect,
+  sendTunnelStatusSnapshot,
+  isSingleHostTunnel,
+  getAllTunnelStatus,
+  findHostByTunnelEndpoint,
+  connectSSHTunnel,
+} from "./manager.js";
+
+const permissionManager = PermissionManager.getInstance();
+
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+export function registerTunnelRoutes(app: express.Express): void {
+  app.get(
+    "/ssh/tunnel/status",
+    authenticateJWT,
+    (req: AuthenticatedRequest, res: Response) => {
+      if (!req.userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      res.json(getAllTunnelStatus());
+    },
+  );
+
+  app.get(
+    "/ssh/tunnel/status/stream",
+    authenticateJWT,
+    (req: AuthenticatedRequest, res: Response) => {
+      if (!req.userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-store, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no",
+      });
+      res.flushHeaders?.();
+
+      tunnelStatusClients.add(res);
+      sendTunnelStatusSnapshot(res);
+
+      const heartbeat = setInterval(() => {
+        try {
+          res.write(": keepalive\n\n");
+        } catch {
+          closeStream();
+        }
+      }, 30000);
+
+      const closeStream = () => {
+        clearInterval(heartbeat);
+        tunnelStatusClients.delete(res);
+      };
+
+      req.on("close", closeStream);
+    },
+  );
+
+  /**
+   * @openapi
+   * /ssh/tunnel/status/{tunnelName}:
+   *   get:
+   *     summary: Get tunnel status by name
+   *     description: Retrieves the status of a specific SSH tunnel by its name.
+   *     tags:
+   *       - SSH Tunnels
+   *     parameters:
+   *       - in: path
+   *         name: tunnelName
+   *         required: true
+   *         schema:
+   *           type: string
+   *     responses:
+   *       200:
+   *         description: Tunnel status.
+   *       404:
+   *         description: Tunnel not found.
+   */
+  app.get(
+    "/ssh/tunnel/status/:tunnelName",
+    authenticateJWT,
+    (req: AuthenticatedRequest, res: Response) => {
+      if (!req.userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      const tunnelNameParam = req.params.tunnelName;
+      const tunnelName = Array.isArray(tunnelNameParam)
+        ? tunnelNameParam[0]
+        : tunnelNameParam;
+      const status = connectionStatus.get(tunnelName);
+
+      if (!status) {
+        return res.status(404).json({ error: "Tunnel not found" });
+      }
+
+      res.json({ name: tunnelName, status });
+    },
+  );
+
+  /**
+   * @openapi
+   * /ssh/tunnel/connect:
+   *   post:
+   *     summary: Connect SSH tunnel
+   *     description: Establishes an SSH tunnel connection with the specified configuration.
+   *     tags:
+   *       - SSH Tunnels
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             properties:
+   *               name:
+   *                 type: string
+   *               sourceHostId:
+   *                 type: integer
+   *               tunnelIndex:
+   *                 type: integer
+   *     responses:
+   *       200:
+   *         description: Connection request received.
+   *       400:
+   *         description: Invalid tunnel configuration.
+   *       401:
+   *         description: Authentication required.
+   *       403:
+   *         description: Access denied to this host.
+   *       500:
+   *         description: Failed to connect tunnel.
+   */
+  app.post(
+    "/ssh/tunnel/connect",
+    authenticateJWT,
+    async (req: AuthenticatedRequest, res: Response) => {
+      const tunnelConfig: TunnelConfig = req.body;
+      const userId = req.userId;
+
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      if (!tunnelConfig || !tunnelConfig.name) {
+        return res.status(400).json({ error: "Invalid tunnel configuration" });
+      }
+
+      const tunnelName = tunnelConfig.name;
+      tunnelConfig.requestingUserId = userId;
+
+      try {
+        if (!validateTunnelConfig(tunnelName, tunnelConfig)) {
+          tunnelLogger.error(`Tunnel config validation failed`, {
+            operation: "tunnel_connect",
+            tunnelName,
+            configHostId: tunnelConfig.sourceHostId,
+            configTunnelIndex: tunnelConfig.tunnelIndex,
+          });
+          return res.status(400).json({
+            error: "Tunnel configuration does not match tunnel name",
+          });
+        }
+
+        if (tunnelConfig.sourceHostId) {
+          const accessInfo = await permissionManager.canAccessHost(
+            userId,
+            tunnelConfig.sourceHostId,
+            "connect",
+          );
+
+          if (!accessInfo.hasAccess) {
+            tunnelLogger.warn("User attempted tunnel connect without access", {
+              operation: "tunnel_connect_unauthorized",
+              userId,
+              hostId: tunnelConfig.sourceHostId,
+              tunnelName,
+            });
+            return res
+              .status(403)
+              .json({ error: "Access denied to this host" });
+          }
+        }
+
+        if (pendingTunnelOperations.has(tunnelName)) {
+          try {
+            await pendingTunnelOperations.get(tunnelName);
+          } catch {
+            tunnelLogger.warn(`Previous tunnel operation failed`, {
+              tunnelName,
+            });
+          }
+        }
+
+        const operation = (async () => {
+          manualDisconnects.delete(tunnelName);
+          retryCounters.delete(tunnelName);
+          retryExhaustedTunnels.delete(tunnelName);
+
+          await cleanupTunnelResources(tunnelName);
+
+          if (tunnelConfigs.has(tunnelName)) {
+            const existingConfig = tunnelConfigs.get(tunnelName);
+            if (
+              existingConfig &&
+              (existingConfig.sourceHostId !== tunnelConfig.sourceHostId ||
+                existingConfig.tunnelIndex !== tunnelConfig.tunnelIndex)
+            ) {
+              throw new Error(`Tunnel name collision detected: ${tunnelName}`);
+            }
+          }
+
+          if (
+            !isSingleHostTunnel(tunnelConfig) &&
+            (!tunnelConfig.endpointIP || !tunnelConfig.endpointUsername)
+          ) {
+            try {
+              const systemCrypto = SystemCrypto.getInstance();
+              const internalAuthToken =
+                await systemCrypto.getInternalAuthToken();
+
+              const allHostsResponse = await axios.get(
+                "http://localhost:30001/host/db/host/internal/all",
+                {
+                  headers: {
+                    "Content-Type": "application/json",
+                    "X-Internal-Auth-Token": internalAuthToken,
+                  },
+                },
+              );
+
+              const allHosts: SSHHost[] = allHostsResponse.data || [];
+              const endpointHost = findHostByTunnelEndpoint(
+                allHosts,
+                tunnelConfig.endpointHost,
+              );
+
+              if (!endpointHost) {
+                if (getTunnelMode(tunnelConfig) !== "remote") {
+                  tunnelConfig.endpointIP =
+                    tunnelConfig.endpointIP || tunnelConfig.endpointHost;
+                } else {
+                  throw new Error(
+                    `Endpoint host '${tunnelConfig.endpointHost}' not found in database`,
+                  );
+                }
+              } else {
+                if (!endpointHost.id) {
+                  throw new Error("Endpoint host not found");
+                }
+
+                const endpointAccess = await permissionManager.canAccessHost(
+                  userId,
+                  endpointHost.id,
+                  "connect",
+                );
+                if (!endpointAccess.hasAccess) {
+                  tunnelLogger.warn(
+                    "User attempted tunnel connect without endpoint access",
+                    {
+                      operation: "tunnel_connect_endpoint_unauthorized",
+                      userId,
+                      hostId: endpointHost.id,
+                      tunnelName,
+                    },
+                  );
+                  throw new Error("Endpoint host not found");
+                }
+
+                tunnelConfig.endpointIP = endpointHost.ip;
+                tunnelConfig.endpointSSHPort = endpointHost.port;
+                tunnelConfig.endpointUsername = endpointHost.username;
+                tunnelConfig.endpointAuthMethod = endpointHost.authType;
+                tunnelConfig.endpointKeyType = endpointHost.keyType;
+                tunnelConfig.endpointCredentialId =
+                  endpointHost.userId === userId
+                    ? endpointHost.credentialId
+                    : undefined;
+                tunnelConfig.endpointUserId = userId;
+
+                // Resolve credentials server-side instead of from HTTP response
+                if (endpointHost.id) {
+                  try {
+                    const { resolveHostById } =
+                      await import("../host-resolver.js");
+                    const resolved = await resolveHostById(
+                      endpointHost.id,
+                      userId,
+                    );
+                    if (resolved) {
+                      tunnelConfig.endpointPassword = resolved.password;
+                      tunnelConfig.endpointSSHKey = resolved.key;
+                      tunnelConfig.endpointKeyPassword = resolved.keyPassword;
+                    }
+                  } catch (credError) {
+                    tunnelLogger.warn(
+                      "Failed to resolve endpoint credentials from DB",
+                      {
+                        operation: "tunnel_endpoint_credential_resolve",
+                        endpointHostId: endpointHost.id,
+                        error:
+                          credError instanceof Error
+                            ? credError.message
+                            : "Unknown",
+                      },
+                    );
+                  }
+                }
+              }
+            } catch (resolveError) {
+              tunnelLogger.error(
+                "Failed to resolve endpoint host",
+                resolveError,
+                {
+                  operation: "tunnel_connect_resolve_endpoint_failed",
+                  tunnelName,
+                  endpointHost: tunnelConfig.endpointHost,
+                },
+              );
+              throw new Error(
+                `Failed to resolve endpoint host: ${resolveError instanceof Error ? resolveError.message : "Unknown error"}`,
+                { cause: resolveError },
+              );
+            }
+          }
+
+          tunnelConfigs.set(tunnelName, tunnelConfig);
+          await connectSSHTunnel(tunnelConfig, 0);
+        })();
+
+        pendingTunnelOperations.set(tunnelName, operation);
+
+        res.json({ message: "Connection request received", tunnelName });
+
+        operation
+          .catch((err) => {
+            tunnelLogger.error("Tunnel operation failed", err, {
+              operation: "tunnel_operation_failed",
+              tunnelName,
+            });
+            broadcastTunnelStatus(tunnelName, {
+              connected: false,
+              status: CONNECTION_STATES.FAILED,
+              reason: err instanceof Error ? err.message : "Unknown error",
+            });
+            tunnelConnecting.delete(tunnelName);
+          })
+          .finally(() => {
+            pendingTunnelOperations.delete(tunnelName);
+          });
+      } catch (error) {
+        tunnelLogger.error("Failed to process tunnel connect", error, {
+          operation: "tunnel_connect",
+          tunnelName,
+          userId,
+        });
+        res.status(500).json({ error: "Failed to connect tunnel" });
+      }
+    },
+  );
+
+  /**
+   * @openapi
+   * /ssh/tunnel/disconnect:
+   *   post:
+   *     summary: Disconnect SSH tunnel
+   *     description: Disconnects an active SSH tunnel.
+   *     tags:
+   *       - SSH Tunnels
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             properties:
+   *               tunnelName:
+   *                 type: string
+   *     responses:
+   *       200:
+   *         description: Disconnect request received.
+   *       400:
+   *         description: Tunnel name required.
+   *       401:
+   *         description: Authentication required.
+   *       403:
+   *         description: Access denied.
+   *       500:
+   *         description: Failed to disconnect tunnel.
+   */
+  app.post(
+    "/ssh/tunnel/disconnect",
+    authenticateJWT,
+    async (req: AuthenticatedRequest, res: Response) => {
+      const { tunnelName } = req.body;
+      const userId = req.userId;
+
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      if (!tunnelName) {
+        return res.status(400).json({ error: "Tunnel name required" });
+      }
+
+      try {
+        const config = tunnelConfigs.get(tunnelName);
+        if (config && config.sourceHostId) {
+          const accessInfo = await permissionManager.canAccessHost(
+            userId,
+            config.sourceHostId,
+            "connect",
+          );
+          if (!accessInfo.hasAccess) {
+            return res.status(403).json({ error: "Access denied" });
+          }
+        }
+
+        tunnelLogger.info("Tunnel stop request received", {
+          operation: "tunnel_stop_request",
+          userId,
+          hostId: config?.sourceHostId,
+          tunnelName,
+        });
+        manualDisconnects.add(tunnelName);
+        retryCounters.delete(tunnelName);
+        retryExhaustedTunnels.delete(tunnelName);
+
+        if (activeRetryTimers.has(tunnelName)) {
+          clearTimeout(activeRetryTimers.get(tunnelName)!);
+          activeRetryTimers.delete(tunnelName);
+        }
+
+        await cleanupTunnelResources(tunnelName, true);
+        tunnelLogger.info("Tunnel cleanup completed", {
+          operation: "tunnel_cleanup_complete",
+          userId,
+          hostId: config?.sourceHostId,
+          tunnelName,
+        });
+
+        broadcastTunnelStatus(tunnelName, {
+          connected: false,
+          status: CONNECTION_STATES.DISCONNECTED,
+          manualDisconnect: true,
+        });
+
+        const tunnelConfig = tunnelConfigs.get(tunnelName) || null;
+        handleDisconnect(tunnelName, tunnelConfig, false);
+
+        setTimeout(() => {
+          manualDisconnects.delete(tunnelName);
+        }, 5000);
+
+        res.json({ message: "Disconnect request received", tunnelName });
+      } catch (error) {
+        tunnelLogger.error("Failed to disconnect tunnel", error, {
+          operation: "tunnel_disconnect",
+          tunnelName,
+          userId,
+        });
+        res.status(500).json({ error: "Failed to disconnect tunnel" });
+      }
+    },
+  );
+
+  /**
+   * @openapi
+   * /ssh/tunnel/cancel:
+   *   post:
+   *     summary: Cancel tunnel retry
+   *     description: Cancels the retry mechanism for a failed SSH tunnel connection.
+   *     tags:
+   *       - SSH Tunnels
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             properties:
+   *               tunnelName:
+   *                 type: string
+   *     responses:
+   *       200:
+   *         description: Cancel request received.
+   *       400:
+   *         description: Tunnel name required.
+   *       401:
+   *         description: Authentication required.
+   *       403:
+   *         description: Access denied.
+   *       500:
+   *         description: Failed to cancel tunnel retry.
+   */
+  app.post(
+    "/ssh/tunnel/cancel",
+    authenticateJWT,
+    async (req: AuthenticatedRequest, res: Response) => {
+      const { tunnelName } = req.body;
+      const userId = req.userId;
+
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      if (!tunnelName) {
+        return res.status(400).json({ error: "Tunnel name required" });
+      }
+
+      try {
+        const config = tunnelConfigs.get(tunnelName);
+        if (config && config.sourceHostId) {
+          const accessInfo = await permissionManager.canAccessHost(
+            userId,
+            config.sourceHostId,
+            "connect",
+          );
+          if (!accessInfo.hasAccess) {
+            return res.status(403).json({ error: "Access denied" });
+          }
+        }
+
+        retryCounters.delete(tunnelName);
+        retryExhaustedTunnels.delete(tunnelName);
+
+        if (activeRetryTimers.has(tunnelName)) {
+          clearTimeout(activeRetryTimers.get(tunnelName)!);
+          activeRetryTimers.delete(tunnelName);
+        }
+
+        if (countdownIntervals.has(tunnelName)) {
+          clearInterval(countdownIntervals.get(tunnelName)!);
+          countdownIntervals.delete(tunnelName);
+        }
+
+        await cleanupTunnelResources(tunnelName, true);
+
+        broadcastTunnelStatus(tunnelName, {
+          connected: false,
+          status: CONNECTION_STATES.DISCONNECTED,
+          manualDisconnect: true,
+        });
+
+        const tunnelConfig = tunnelConfigs.get(tunnelName) || null;
+        handleDisconnect(tunnelName, tunnelConfig, false);
+
+        setTimeout(() => {
+          manualDisconnects.delete(tunnelName);
+        }, 5000);
+
+        res.json({ message: "Cancel request received", tunnelName });
+      } catch (error) {
+        tunnelLogger.error("Failed to cancel tunnel retry", error, {
+          operation: "tunnel_cancel",
+          tunnelName,
+          userId,
+        });
+        res.status(500).json({ error: "Failed to cancel tunnel retry" });
+      }
+    },
+  );
+}
@@ -0,0 +1,106 @@
+import type { Duplex } from "stream";
+import { tunnelLogger } from "../../utils/logger.js";
+
+function parseSocksAddress(buffer: Buffer): {
+  address: string;
+  port: number;
+  bytesRead: number;
+} | null {
+  if (buffer.length < 7 || buffer[0] !== 0x05 || buffer[1] !== 0x01) {
+    return null;
+  }
+
+  const addressType = buffer[3];
+  let offset = 4;
+  let address: string;
+
+  if (addressType === 0x01) {
+    if (buffer.length < offset + 4 + 2) return null;
+    address = Array.from(buffer.subarray(offset, offset + 4)).join(".");
+    offset += 4;
+  } else if (addressType === 0x03) {
+    const len = buffer[offset];
+    offset += 1;
+    if (buffer.length < offset + len + 2) return null;
+    address = buffer.subarray(offset, offset + len).toString("utf8");
+    offset += len;
+  } else if (addressType === 0x04) {
+    if (buffer.length < offset + 16 + 2) return null;
+    const parts: string[] = [];
+    for (let i = 0; i < 16; i += 2) {
+      parts.push(buffer.readUInt16BE(offset + i).toString(16));
+    }
+    address = parts.join(":");
+    offset += 16;
+  } else {
+    return null;
+  }
+
+  const port = buffer.readUInt16BE(offset);
+  return { address, port, bytesRead: offset + 2 };
+}
+
+export function handleSocks5Connect(
+  inbound: Duplex,
+  openOutbound: (host: string, port: number) => Promise<Duplex>,
+  tunnelName: string,
+): void {
+  let buffer = Buffer.alloc(0);
+  let stage: "greeting" | "connect" | "piping" = "greeting";
+
+  const fail = (code = 0x01) => {
+    if (!inbound.destroyed) {
+      inbound.write(Buffer.from([0x05, code, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+      inbound.destroy();
+    }
+  };
+
+  const onData = (chunk: Buffer) => {
+    buffer = Buffer.concat([buffer, chunk]);
+
+    if (stage === "greeting") {
+      if (buffer.length < 2) return;
+      if (buffer[0] !== 0x05) {
+        fail(0x01);
+        return;
+      }
+      const methodsLength = buffer[1];
+      if (buffer.length < 2 + methodsLength) return;
+      inbound.write(Buffer.from([0x05, 0x00]));
+      buffer = buffer.subarray(2 + methodsLength);
+      stage = "connect";
+    }
+
+    if (stage === "connect") {
+      const parsed = parseSocksAddress(buffer);
+      if (!parsed) return;
+      stage = "piping";
+      inbound.off("data", onData);
+      const remainder = buffer.subarray(parsed.bytesRead);
+      openOutbound(parsed.address, parsed.port)
+        .then((outbound) => {
+          inbound.write(
+            Buffer.from([0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0]),
+          );
+          if (remainder.length > 0) {
+            outbound.write(remainder);
+          }
+          inbound.pipe(outbound).pipe(inbound);
+          inbound.on("error", () => outbound.destroy());
+          outbound.on("error", () => inbound.destroy());
+        })
+        .catch((error) => {
+          tunnelLogger.error("SOCKS5 tunnel connect failed", error, {
+            operation: "managed_tunnel_socks_connect_failed",
+            tunnelName,
+            targetHost: parsed.address,
+            targetPort: parsed.port,
+          });
+          fail(0x05);
+        });
+    }
+  };
+
+  inbound.on("data", onData);
+  inbound.on("error", () => inbound.destroy());
+}
@@ -0,0 +1,181 @@
+import { Client, type ClientChannel } from "ssh2";
+import type { Duplex } from "stream";
+import { SSH_ALGORITHMS } from "../../utils/ssh-algorithms.js";
+import { tunnelLogger } from "../../utils/logger.js";
+
+export function getManagedTunnelAlgorithms() {
+  return {
+    kex: [
+      "curve25519-sha256",
+      "curve25519-sha256@libssh.org",
+      "ecdh-sha2-nistp521",
+      "ecdh-sha2-nistp384",
+      "ecdh-sha2-nistp256",
+      "diffie-hellman-group-exchange-sha256",
+      "diffie-hellman-group14-sha256",
+      "diffie-hellman-group14-sha1",
+      "diffie-hellman-group-exchange-sha1",
+      "diffie-hellman-group1-sha1",
+    ],
+    serverHostKey: [
+      "ssh-ed25519",
+      "ecdsa-sha2-nistp521",
+      "ecdsa-sha2-nistp384",
+      "ecdsa-sha2-nistp256",
+      "rsa-sha2-512",
+      "rsa-sha2-256",
+      "ssh-rsa",
+      "ssh-dss",
+    ],
+    cipher: SSH_ALGORITHMS.cipher,
+    hmac: [
+      "hmac-sha2-512-etm@openssh.com",
+      "hmac-sha2-256-etm@openssh.com",
+      "hmac-sha2-512",
+      "hmac-sha2-256",
+      "hmac-sha1",
+      "hmac-md5",
+    ],
+    compress: ["none", "zlib@openssh.com", "zlib"],
+  };
+}
+
+export function applyAuthOptions(
+  connOptions: Record<string, unknown>,
+  credentials: {
+    password?: string;
+    sshKey?: string;
+    keyPassword?: string;
+    keyType?: string;
+    authMethod?: string;
+  },
+): void {
+  if (credentials.authMethod === "key" && credentials.sshKey) {
+    const cleanKey = credentials.sshKey
+      .trim()
+      .replace(/\r\n/g, "\n")
+      .replace(/\r/g, "\n");
+    connOptions.privateKey = Buffer.from(cleanKey, "utf8");
+    if (credentials.keyPassword) {
+      connOptions.passphrase = credentials.keyPassword;
+    }
+    if (credentials.keyType && credentials.keyType !== "auto") {
+      connOptions.privateKeyType = credentials.keyType;
+    }
+  } else {
+    connOptions.password = credentials.password;
+  }
+}
+
+export function connectClient(
+  connOptions: Record<string, unknown>,
+  tunnelName: string,
+  role: "source" | "endpoint",
+): Promise<Client> {
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+    let settled = false;
+    client.once("ready", () => {
+      settled = true;
+      resolve(client);
+    });
+    client.once("error", (error) => {
+      if (!settled) {
+        reject(error);
+        return;
+      }
+      tunnelLogger.error("Managed tunnel SSH client error", error, {
+        operation: "managed_tunnel_client_error",
+        tunnelName,
+        role,
+      });
+    });
+    client.connect(connOptions);
+  });
+}
+
+export function forwardOut(
+  client: Client,
+  targetHost: string,
+  targetPort: number,
+  tunnelName?: string,
+): Promise<ClientChannel> {
+  return new Promise((resolve, reject) => {
+    client.forwardOut("127.0.0.1", 0, targetHost, targetPort, (err, stream) => {
+      if (err) {
+        if (tunnelName) {
+          tunnelLogger.error("Managed tunnel forwardOut failed", err, {
+            operation: "managed_tunnel_forward_out_failed",
+            tunnelName,
+            targetHost,
+            targetPort,
+          });
+        }
+        reject(err);
+        return;
+      }
+      resolve(stream);
+    });
+  });
+}
+
+export function bindForwardIn(
+  client: Client,
+  bindHost: string,
+  bindPort: number,
+): Promise<number> {
+  return new Promise((resolve, reject) => {
+    client.forwardIn(bindHost, bindPort, (err, actualPort) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      resolve(actualPort || bindPort);
+    });
+  });
+}
+
+export function unbindForwardIn(
+  client: Client,
+  bindHost: string,
+  bindPort: number,
+): void {
+  try {
+    client.unforwardIn(bindHost, bindPort, (err) => {
+      if (err) {
+        tunnelLogger.warn("Failed to unbind managed tunnel listener", {
+          operation: "managed_tunnel_unforward_failed",
+          bindHost,
+          bindPort,
+          error: err.message,
+        });
+      }
+    });
+  } catch {
+    // The connection may already be gone.
+  }
+}
+
+export function pipeTunnelStreams(
+  inbound: Duplex,
+  outboundPromise: Promise<Duplex>,
+  tunnelName: string,
+): void {
+  outboundPromise
+    .then((outbound) => {
+      inbound.pipe(outbound).pipe(inbound);
+      inbound.on("error", () => outbound.destroy());
+      outbound.on("error", () => inbound.destroy());
+    })
+    .catch((error) => {
+      tunnelLogger.error(
+        "Failed to open managed tunnel outbound stream",
+        error,
+        {
+          operation: "managed_tunnel_outbound_failed",
+          tunnelName,
+        },
+      );
+      inbound.destroy();
+    });
+}
@@ -0,0 +1,131 @@
+import type { ErrorType, TunnelConfig } from "../../../types/index.js";
+import { tunnelLogger } from "../../utils/logger.js";
+
+export function classifyTunnelError(errorMessage: string): ErrorType {
+  if (!errorMessage) return "UNKNOWN";
+
+  const message = errorMessage.toLowerCase();
+
+  if (
+    message.includes("closed by remote host") ||
+    message.includes("connection reset by peer") ||
+    message.includes("connection refused") ||
+    message.includes("broken pipe")
+  ) {
+    return "NETWORK_ERROR";
+  }
+
+  if (
+    message.includes("authentication failed") ||
+    message.includes("permission denied") ||
+    message.includes("incorrect password")
+  ) {
+    return "AUTHENTICATION_FAILED";
+  }
+
+  if (
+    message.includes("connect etimedout") ||
+    message.includes("timeout") ||
+    message.includes("timed out") ||
+    message.includes("keepalive timeout")
+  ) {
+    return "TIMEOUT";
+  }
+
+  if (
+    message.includes("bind: address already in use") ||
+    message.includes("failed for listen port") ||
+    message.includes("port forwarding failed")
+  ) {
+    return "CONNECTION_FAILED";
+  }
+
+  if (message.includes("permission") || message.includes("access denied")) {
+    return "CONNECTION_FAILED";
+  }
+
+  return "UNKNOWN";
+}
+
+export function getTunnelMarker(tunnelName: string): string {
+  return `TUNNEL_MARKER_${tunnelName.replace(/[^a-zA-Z0-9]/g, "_")}`;
+}
+
+export function normalizeTunnelName(
+  hostId: number,
+  tunnelIndex: number,
+  displayName: string,
+  sourcePort: number,
+  endpointHost: string,
+  endpointPort: number,
+): string {
+  return `${hostId}::${tunnelIndex}::${displayName}::${sourcePort}::${endpointHost}::${endpointPort}`;
+}
+
+export function getTunnelMode(
+  tunnelConfig: TunnelConfig,
+): "local" | "remote" | "dynamic" {
+  return tunnelConfig.mode || tunnelConfig.tunnelType || "remote";
+}
+
+export function getTunnelScope(tunnelConfig: TunnelConfig): "s2s" | "c2s" {
+  return tunnelConfig.scope || "s2s";
+}
+
+export function getTunnelBindHost(tunnelConfig: TunnelConfig): string {
+  return tunnelConfig.bindHost || "127.0.0.1";
+}
+
+export function parseTunnelName(tunnelName: string): {
+  hostId?: number;
+  tunnelIndex?: number;
+  displayName: string;
+  sourcePort: string;
+  endpointHost: string;
+  endpointPort: string;
+  isLegacyFormat: boolean;
+} {
+  const parts = tunnelName.split("::");
+
+  if (parts.length === 6) {
+    return {
+      hostId: parseInt(parts[0]),
+      tunnelIndex: parseInt(parts[1]),
+      displayName: parts[2],
+      sourcePort: parts[3],
+      endpointHost: parts[4],
+      endpointPort: parts[5],
+      isLegacyFormat: false,
+    };
+  }
+
+  tunnelLogger.warn(`Legacy tunnel name format: ${tunnelName}`);
+
+  const legacyParts = tunnelName.split("_");
+  return {
+    displayName: legacyParts[0] || "unknown",
+    sourcePort: legacyParts[legacyParts.length - 3] || "0",
+    endpointHost: legacyParts[legacyParts.length - 2] || "unknown",
+    endpointPort: legacyParts[legacyParts.length - 1] || "0",
+    isLegacyFormat: true,
+  };
+}
+
+export function validateTunnelConfig(
+  tunnelName: string,
+  tunnelConfig: TunnelConfig,
+): boolean {
+  const parsed = parseTunnelName(tunnelName);
+
+  if (parsed.isLegacyFormat) {
+    return true;
+  }
+
+  return (
+    parsed.hostId === tunnelConfig.sourceHostId &&
+    parsed.tunnelIndex === tunnelConfig.tunnelIndex &&
+    String(parsed.sourcePort) === String(tunnelConfig.sourcePort) &&
+    parsed.endpointHost === tunnelConfig.endpointHost &&
+    String(parsed.endpointPort) === String(tunnelConfig.endpointPort)
+  );
+}