* feat: folder shares apply to hosts added later
Sharing a folder only fanned grants out to the hosts in it at the time.
The share is now also kept as a standing rule on the folder, and a host
created in or moved into it (or a subfolder) inherits the same access
and secret snapshots. Rules follow folder renames and can be stopped
from the share dialog.
* fix: stabilize folder access migrations
* feat: share credentials with users and roles, inherit data on account deletion
Credentials can be shared at "use" or "manage" level. Recipients get
a copy re-encrypted under their own data key (shared_credential_secrets),
kept in step with the owner's row through the same lifecycle hooks as
shared host secrets. One gate, findUsableCredential(), replaces the
private-namespace lookups so a shared credential works wherever a
private one does. Deleting a user now hands their hosts and credentials
to a successor (the deleting admin by default) instead of revoking
everything they shared.
* fix: harden credential ownership transfer
* feat: 1Password Connect secret sources for SSH credentials
Hosts and credentials can hold op://vault/item/field references instead
of secrets; they are resolved at connect time from the user's secret
source (1Password Connect) at the single point where every subsystem
receives plaintext credentials, so terminal, SFTP, Docker, metrics and
tunnels all work without per-subsystem changes. Sources are per user,
optionally shared, with the access token encrypted under the owner's
data key; resolved values are cached briefly in memory.
* style: format secret source changes
* feat: Step CA SSH certificates as a host authentication type
Issue short-lived SSH user certificates from a smallstep CA through its
OIDC provisioner, over the CA's HTTP API rather than the step binary.
Everything after issuance reuses the OPKSSH plumbing: the same encrypted
per-user/host token store, WebSocket dialog and ssh2 certificate
injection, with the connect paths branching on a shared
usesIssuedCertificate() predicate. Instance-wide CA settings live in the
admin panel, with a private-host allowlist for the SSRF guard.
* fix: harden Step CA callback flow
* style: format Step CA changes
* fix: guide users to Auto-Tmux when a persisted session expires
A timed-out terminal session silently reconnected to a fresh shell, so
people running long jobs lost them with no explanation and never learned
about Auto-Tmux. Explain the expiry with a one-click Enable Auto-Tmux
action, let admins default it for new hosts and tune the persistence
timeout from the UI, and move the setting up with copy that says what it
does. The global default stays off.
* style: format terminal expiry notice
A "Show Commands" toggle in the snippets settings menu hides the command
text under each snippet name, for people who dock the panel on the
narrow right rail and only need the names. Local preference, on by
default.
With metrics enabled, the status probe left SSH authentication to the
metrics poll - which only runs while someone is viewing the host. An
unwatched host therefore never left "reachable", while a host with
metrics disabled (whose probe always authenticates) showed online. The
probe now authenticates whenever no metrics poll will.
The Quick Connect panel gets a protocol switch. RDP/VNC quick hosts are
built like SSH ones (never saved) and opened as regular remote desktop
tabs; GuacamoleApp mints their token from the typed fields through the
existing /guacamole/token endpoint instead of a host-row lookup.
* fix: make RDP drive redirection writable on the stock deployment
The default drive-path was /drive on the guacd side, which the official
guacd image cannot create as its non-root user, so every upload was
refused with guacd's raw "FAIL (CANNOT OPEN)" ack. Default to
GUACD_DRIVE_PATH (set to the shared termix-data volume in compose) with
one folder per user, and explain guacd's refusal in the file browser.
* style: format RDP drive settings
The CMD column rendered ps's comm field, which the kernel caps at 15
characters, so anything longer looked truncated no matter how wide the
column was. The full args were already collected; show them.
* feat: add collaboration rooms with switchable presenter
Rooms are a group of members watching one stage - the live SSH/RDP/VNC
session the current presenter shares. Any member can take over the
stage; the host can invite, force-stop and end the meeting. Stages
reuse session_shares (new room share type), so gating, recording,
expiry and the global sharing toggle all apply unchanged.
* feat: add stage control handoff to collaboration rooms
The presenter or host can grant any member write access to the live
stage and take it back; members can raise a hand to ask. SSH flips the
participant's permission on the live gate; RDP/VNC re-mint the viewer's
join token. Control clears on every stage switch.
* feat: guest links, role invites and invite awareness for collab rooms
- Anonymous guest link per room (host toggles/rotates), followed by
polling the public resolve endpoint; SSH guests join over the terminal
WS with roomGuestToken, guac guests get read-only join tokens
- Invite by role (expands to current members, snapshot semantics)
- Toast when a room you were invited to appears
- Stale stages are cleared lazily when the presenter is gone
- Telnet presenting, expired-tab fallback, documented single-instance
and guac-kick limits
- Tests for the collab routes, room hub, share access and control flip
* fix: keep remote desktop collaboration read-only
* feat: enforce RBAC and harden collaboration features
- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing
* fix: enforce RBAC across split routes
* Add Helm and GitOps deployment setup
* fix: build better-sqlite3 from source in Docker (#1267)
* fix: preserve runtime SSL settings (#1268)
* fix: support forwarding from the memory SSH agent (#1269)
* fix: support forwarding from the memory agent
* style: format memory agent test
* fix: prompt for encrypted SFTP key passphrases (#1270)
* fix: prompt for SFTP key passphrases
* style: format SSH key utility test
* fix: include host context in automation notifications (#1271)
* fix: include host context in automation notifications
* style: format automation notification changes
* fix: reserve sidebar height for host tags (#1272)
* fix: keep host action rows stable at large font sizes (#1273)
* fix: honor certificate setting during server probe (#1274)
* fix: package standard Linux icon sizes (#1275)
* fix: avoid duplicate Docker HTTPS listener (#1276)
* Fix host status without metrics collection (#1277)
* fix: allow eight-digit secure auth codes (#1263)
Allow TOTP prompts to accept secure auth codes longer than six digits without blocking valid authentication attempts.
Generated with Codebuff 🤖
Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
* Harden Helm deployment defaults
* Update Helm workflow action
* Exclude Helm templates from Prettier
* Fix browser RDP file drops (#1279)
* Fix Proxmox guest credential usernames (#1280)
* Add WSL local terminal option (#1281)
* refactor: split the transfer engine into focused modules (#1282)
* refactor: extract SFTP promisify helpers into sftp-promisify module
* refactor: extract transfer timing and rate stats into transfer-stats module
* refactor: extract transfer error classes and recovery checks into transfer-errors module
* refactor: extract host/path utility helpers into transfer-host-utils module
* refactor: extract SFTP directory tree helpers into transfer-sftp-dir module
* refactor: extract segment copy job builder into transfer-segment-copy module
* refactor: extract file scan and sample helpers into transfer-scan module
* refactor: move throttled progress helper into transfer-stats module
* style: format transfer modules
* perf: optimize tmux monitor aggregation (#1283)
* fix: reserve credential tag row height (#1284)
* feat: edit AI provider model settings (#1285)
* fix: clarify click-to-expand host setting (#1286)
* fix: allow portable imports on remote databases (#1287)
* fix: allow HTTPS to share the configured port (#1288)
* fix: resolve synced jump hosts on the server (#1289)
* fix: make terminal clipboard shortcuts layout independent (#1290)
* fix: use compatible fetch dispatcher for Tailscale (#1291)
* fix: add OIDC environment recovery override (#1292)
* fix: coalesce rapid mobile terminal input (#1293)
* fix: coalesce rapid mobile terminal input
* fix: support clean xterm patch installs
* fix: resolve synced remote desktop host IDs (#1295)
* feat: make the SFTP file manager path bar editable (#1294)
Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
* feat: add passkey sign in to the login screen
* fix: remove rounded corners from the host list search bar
* fix: stop image storage settings text wrapping to one word per line
* fix: prevent malformed websocket messages from crashing the server
* chore: increment version
* fix: remove gaps between host rows in the sidebar list
Keep sub-pixel row measurements and stop wiping the size cache on hover.
* fix: Failed to connect through jump hosts (#1180)
https://github.com/Termix-SSH/Support/issues/1180
* feat: Progress bar for file downloads in the file manager (#1158)
https://github.com/Termix-SSH/Support/issues/1158
* feat: Allow setting Silent OIDC Login via ENV var (#1174)
https://github.com/Termix-SSH/Support/issues/1174
* feat: `IdentityFile` to limit the number of attempts by agents (#1165)
https://github.com/Termix-SSH/Support/issues/1165
* feat: Credentials clone (#1159)
https://github.com/Termix-SSH/Support/issues/1159
* chore: update release notes
* docs: move helm setup guide to the docs site
* fix: type errors in FilteredAgent agent identity handling
* fix: remove stale better-sqlite3 prebuilds so the source build is used
* fix: actually build better-sqlite3 from source so arm64 docker images work
* fix: credential edit pencil in host editor and add clone action to credential list
* fix: clear editingHost so the credential pencil actually opens the editor
* chore: run format and lint
* fix: folder drag and drop upload failing in the file manager
* chore: sync Crowdin translations for 2.7.1
---------
Co-authored-by: alex-ctms <alex-ctms@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: Chetan Kumar <74929596+ckloop@users.noreply.github.com>
Co-authored-by: Chetan <chetan.development@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: ZacharyZcR <payasonorahc@protonmail.com>
Co-authored-by: dropafterfree <maxime.bonillo@gmail.com>
Co-authored-by: Maxime Bonillo <257463937+dropafterfree@users.noreply.github.com>
ZacharyZcR