release-2.8.0

.github/workflows/electron.yml

@@ -427,6 +427,7 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -538,6 +539,14 @@ jobs:
           fi
           npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
 
+      - name: Verify macOS sharp packaging
+        run: |
+          artifacts=(release/termix_macos_*_dmg.dmg)
+          if [ -f release/termix_macos_universal_mas.pkg ]; then
+            artifacts+=(release/termix_macos_universal_mas.pkg)
+          fi
+          node scripts/verify-macos-sharp.cjs "${artifacts[@]}"
+
       - name: Upload macOS MAS PKG
         if: steps.check_certs.outputs.has_certs == 'true' && hashFiles('release/termix_macos_universal_mas.pkg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
         uses: actions/upload-artifact@v7
@@ -923,6 +932,9 @@ jobs:
           echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
           echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
 
+      - name: Verify macOS sharp packaging
+        run: node scripts/verify-macos-sharp.cjs release_asset/termix_macos_universal_dmg.dmg
+
       - name: Prepare Homebrew submission files
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
@@ -1013,6 +1025,7 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -1154,6 +1167,10 @@ jobs:
           BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
           npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
 
+      - name: Verify macOS sharp packaging
+        if: steps.check_certs.outputs.has_certs == 'true'
+        run: node scripts/verify-macos-sharp.cjs release/termix_macos_universal_mas.pkg
+
       - name: Generate App Store release notes
         id: asc_notes
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'

.github/workflows/helm.yml

@@ -5,13 +5,11 @@ on:
     paths:
       - "charts/**"
       - ".github/workflows/helm.yml"
-      - "deploy/**"
   push:
     branches: [main]
     paths:
       - "charts/**"
       - ".github/workflows/helm.yml"
-      - "deploy/**"
   workflow_dispatch:
     inputs:
       publish:

README.md

@@ -89,7 +89,7 @@ Local, remote, and dynamic SOCKS forwarding with auto reconnect and health check
 <td width="50%" valign="top">
 
 **File Manager:**
-Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another, with the fastest route picked for you and transfers checked for integrity.
+Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another in a dedicated transfer tab, with the fastest route picked for you and transfers checked for integrity. The desktop app also has a side-by-side local and remote view.
 
 </td>
 </tr>
@@ -111,7 +111,7 @@ Save and organize hosts with tags and nested folders you can name and color. Reu
 <td width="50%" valign="top">
 
 **Host Metrics:**
-CPU, memory, disk, network, temperature, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
+CPU, memory, disk, network, temperature, NVIDIA GPU, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Save a set of tabs with their split layout and reopen the whole thing in one cli
 </td>
 <td width="50%" valign="top">
 
-**Guided Setup:**
-A short setup walks you through picking an interface preset, your theme, the features you want, and your first host. Simple mode hides what you do not use, and you can rerun setup or switch presets any time.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop Standalone and Sync:**
-The desktop app runs on its own with a local backend and database, no server needed. You can also connect it to a Termix server for two-way sync of hosts, credentials, snippets, and more, and choose whether connections start locally or through the server.
-
-</td>
-<td width="50%" valign="top">
-
 **Command Line Interface:**
 A `termix` CLI for your shell and your scripts. Open terminals, run a command on one host or a whole fleet, move files over SFTP, and manage hosts, snippets, and credentials. Install with `npm install -g @termix-cli/cli` or grab a standalone binary. See the [CLI docs](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ A `termix` CLI for your shell and your scripts. Open terminals, run a command on
 <td width="50%" valign="top">
 
 **Security:**
-Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/security) for how it works.
+Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/features/authentication/security/) for how it works.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Around 30 languages built in, managed through [Crowdin](https://docs.termix.site
 - **Keyboard Shortcuts** - Move between tabs, close tabs, and more, all rebindable
 - **Wake-on-LAN** - Wake a machine from Termix or from an automation step
 - **Trusted Proxy Auth** - Let a reverse proxy handle sign-in and pass the user through
-- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more
+- **White Label** - Admins can rebrand the instance with their own name, logo, and colors
+- **Web Endpoints** - Open a host's own web UI, like a router admin page, embedded inside Termix instead of a separate tab
+- **Collaboration Rooms** - Persistent rooms where a group can jump between sessions together, with a presenter stage and invites
+- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, Step CA, 1Password Connect, and more
 - **Termix ID** - A built-in take on sshid.io. Claim a handle, publish your public keys at a resolver URL, and issue SSH certificates from the built-in CA
+- **Command History Autosuggestions** - Inline suggestions in the terminal as you type, based on your command history
+- **Desktop Standalone and Sync** - The desktop app runs on its own with a local backend and database, and can optionally sync with a Termix server
 
 </details>
 

RELEASE_NOTES.md

@@ -1,6 +1,6 @@
 <!-- SUMMARY -->
 
-Credential cloning, a WSL local terminal, Helm and GitOps deployment, an editable file manager path bar, download progress bars, and a large batch of connection, sync, and remote desktop fixes.
+A side-by-side local and remote file manager for desktop, a new tab for transferring files straight between two servers, collaboration rooms, Step CA and 1Password credential support, per-host Web Endpoints, credential sharing with users and roles, and a large batch of connection, sync, and remote desktop fixes.
 
 <!-- /SUMMARY -->
 
@@ -12,49 +12,102 @@ https://youtu.be/lngaePO96tM
 
 <!-- UPDATE_LOG -->
 
-- Added the ability to clone an existing credential
-- Added a WSL option for the local terminal
-- Added Helm charts and a GitOps deployment setup
-- Added an editable path bar to the file manager
-- Added a progress bar for file downloads in the file manager
-- Added an identity file option so agent authentication stops after the right key
-- Added an environment variable to turn on silent OIDC login
-- Added editable model settings for AI providers
-- Improved tmux monitor performance when aggregating sessions
-- Improved Linux packaging with standard icon sizes
+- Added a side-by-side local and remote view to the desktop file manager
+- Added a dedicated tab for transferring files directly between two servers
+- Added a dedicated Port Forwarding tab to the desktop app sidebar
+- Added inline autosuggestions in the terminal using command history
+- Added collaboration rooms for sharing a terminal or remote desktop session with a group
+- Added Step CA as an SSH authentication type
+- Added 1Password Connect as a credential source for SSH
+- Added the ability to share credentials with specific users and roles
+- Added automatic sharing for hosts added to an already-shared folder
+- Added per-host Web Endpoints
+- Added quick connect for RDP and VNC
+- Added a button to pin the sidebar rail open instead of it auto-collapsing
+- Added a compact snippet list option
+- Added copy/paste support to the local terminal
+- Added a terminal copy-on-select option
+- Added tab switching and command palette actions to custom keybindings
+- Added selectable host temperature sensors
+- Added accessible interface font choices
+- Added VNC display zoom controls
+- Added more actions to the host right-click context menu
+- Added white label branding for admins
+- Added support for additional TOTP authenticator apps
+- Added the ability to open RDP, VNC, and Telnet sessions directly from the desktop app
+- Improved file manager navigation
+- Improved motion and transition animations throughout the app
+- Improved macOS packaging and terminal keyboard shortcuts
+- Improved the terminal AI assistant with a toggle for terminal context
+- Began plugin backend work (cut cross feature imports, added plugin DB tables, made the rail/tab system use registries, and updated nginx and manifests for plugins)
 
 <!-- /UPDATE_LOG -->
 
 <!-- BUG_FIXES -->
 
-- Passkey sign in not showing up on the login screen
-- Connections through jump hosts failing
-- Jump hosts and remote desktop hosts not resolving after a sync
-- Malformed websocket messages crashing the server
-- Encrypted file manager keys not prompting for a passphrase
-- SSH agent forwarding not working with the in-memory agent
-- Two factor prompts rejecting codes longer than six digits
-- OIDC lockout with no way to recover from environment settings
-- Tailscale requests failing on some setups
-- Terminal clipboard shortcuts not working on non-QWERTY layouts
-- Rapid mobile terminal input being sent one keystroke at a time
-- HTTPS not being able to share the configured port
-- Portable imports failing on remote databases
-- Host status not showing when metrics collection is off
-- Proxmox guest credential usernames being wrong
-- File drops not working for RDP in the browser
-- Duplicate Docker HTTPS listener on startup
-- Remote sync server probe ignoring the certificate setting
-- Runtime SSL settings not being preserved
-- Automation notifications missing host details
-- Connection screens crashing outside the connection log provider
-- better-sqlite3 failing in Docker on some platforms
-- Host action rows shifting at large font sizes
-- Sidebar height jumping when hosts or credentials have tags
-- Gaps between host rows in the sidebar list
-- Rounded corners on the host list search bar
-- Image storage settings text wrapping to one word per line
-- Unclear wording on the click-to-expand host setting
-- Dragging a folder into the file manager failing to upload
+- Private AI custom endpoints failing to connect
+- Proxmox credential guest imports not working correctly
+- Fleet command results layout being broken
+- Synced client tunnel endpoints not matching the source host
+- Proxmox jump host settings not persisting after a sync
+- Command palette keyboard navigation not working correctly
+- Split layout selection not being restored
+- macOS VNC connections failing to establish
+- Rapid VNC scroll wheel input queuing up and making the remote desktop keep scrolling after you stop
+- Remote desktop connections timing out unexpectedly
+- RDP clipboard paste not working across some browsers
+- Process inspector command column showing truncated commands
+- RDP drive redirection uploads failing on the default deployment
+- A terminal session that expired silently reconnected without explaining Auto-Tmux as an option
+- Host status wrongly showing as offline when nothing was actively watching it
+- Shared RDP users not being prompted for credentials when required
+- Protected file reads failing without a sudo retry
+- Host status polling unnecessarily authenticating over SSH
+- Some host protocol settings being dropped when left unset
+- Remote sync reauthentication failures not being surfaced to the user
+- Dashboard metrics sessions not recovering after expiring
+- RDP file uploads to redirected drives failing
+- Connection toolbar visibility being inconsistent
+- Host list scroll position resetting incorrectly after editing a host
+- Live SSH sessions not being reflected in host status
+- Vault authentication not working in the file manager
+- Running snippets and commands on shared hosts being blocked
+- Chunked file uploads failing due to a contract mismatch
+- Bulk uploads failing partway through
+- Local echo not being disabled on the terminal alternate screen
+- Invalid timezones in the clock widget crashing the homepage
+- Connection origin setting not being preserved when editing a host
+- Local login notifications not appearing after a remote sync
+- Passkey login not working in the desktop app
+- Proxmox guest discovery commands failing without elevated permissions
+- File transfer completion toasts staying on screen permanently
+- SSH key type not being clearable once set
+- Local echo appearing during password prompts inside other programs
+- The desktop app hanging on a loading screen with no message when the embedded backend's port was in use
+- Backend ports silently failing to bind, leaving a feature dead with no error in the logs
+- Imported host settings and jump host references being lost or broken after import
+- SSH agent forwarding breaking after certain unsupported extensions
+- Sidebar host tree continuing to render while hidden, wasting resources
+- macOS Alt+digit tab shortcuts producing characters instead of switching tabs
+- macOS Option key producing Meta/escape sequences instead of special characters by default
+- Dashboard not opening the correct remote desktop protocol
+- Version checks overwriting the local version number on failure
+- SFTP directory creation relying on shell access
+- GPU acceleration opt-out setting being ignored on desktop
+- Remote-only hosts leaking into local tab persistence on desktop
+- Host metrics not being collected correctly on macOS and Windows hosts
+- CORS rejecting requests by default when no allowed origins were configured
+- Streamed SFTP uploads not completing correctly
+- The SSH connection pool not enforcing its connection limits, letting stale connections pile up
+- Local connections to shared hosts being blocked
+- Client-to-server tunnels using the wrong bind or target address in some setups
+- SSH host key changes not being surfaced as a warning
+- Nested subhost parent references breaking after a remote sync
+- Termix ID certificates missing principals needed for some servers to accept them
+- TOTP being skipped without a fully verified WebAuthn check
+- SSH connections not verifying the resolved server's host identity
+- The OPKSSH binary not having its integrity verified before use
+- Several transitive dependency security advisories
+- Various HTTP and application trust boundary hardening (CSP, Docker, config defaults)
 
 <!-- /BUG_FIXES -->

SECURITY.md

@@ -3,3 +3,21 @@
 ## Reporting a Vulnerability
 
 Please report any vulnerabilities to [GitHub Security](https://github.com/Termix-SSH/Termix/security/advisories).
+
+## External secret storage
+
+By default, a single-container installation generates its keys in the Termix
+data directory for ease of recovery. Production deployments that keep backups
+or database files outside a trusted encrypted volume should set
+`TERMIX_REQUIRE_EXTERNAL_SECRETS=true` and provide all four keys through a
+secret manager:
+
+- `JWT_SECRET` (at least 64 characters)
+- `DATABASE_KEY` (64 hexadecimal characters)
+- `ENCRYPTION_KEY` (64 hexadecimal characters)
+- `INTERNAL_AUTH_TOKEN` (at least 32 characters)
+
+Each value can instead be mounted as a Docker or Kubernetes secret and supplied
+with its corresponding `_FILE` variable, such as `ENCRYPTION_KEY_FILE`.
+Hardened mode fails closed instead of writing a replacement key beside the
+encrypted database.

charts/termix/values.yaml

@@ -75,6 +75,7 @@ env:
   PORT: "8080"
   DATA_DIR: /app/data
   NODE_ENV: production
+  TERMIX_REQUIRE_EXTERNAL_SECRETS: "false"
   GUACD_RECORDING_PATH: /termix-data/session_recordings/guacamole
   GUACD_RECORDING_BACKEND_PATH: /app/data/session_recordings/guacamole
 
@@ -86,6 +87,9 @@ secrets:
   name: ""
   data:
     JWT_SECRET: ""
+    DATABASE_KEY: ""
+    ENCRYPTION_KEY: ""
+    INTERNAL_AUTH_TOKEN: ""
     DATABASE_URL: ""
     GUACAMOLE_ENCRYPTION_KEY: ""