Release notes

Equipment that refused to connect at all now connects, and SSH takes a private key.

• FixedSSH and file transfer failed with “No common key exchange algorithm” against anything offering ecdh-sha2-nistp256 or the SHA-1 exchanges — most enterprise network hardware and all older kit. Both now negotiate what equipment actually offers, modern algorithms first.
• AddedPrivate key authentication for SSH and file transfer. OpenSSH format — Ed25519, RSA, ECDSA — including encrypted keys, with any key already in ~/.ssh offered on the connection form. A saved key connection reconnects in one click.
• AddedCopy and Paste buttons on the SSH and serial terminals. The clipboard already worked three ways; none of them were discoverable, and Ctrl+C in a terminal interrupts the running command rather than copying.
• ChangedA PuTTY .ppk is now identified by content and reported with the PuTTYgen conversion steps, rather than failing as an unreadable file.
• FixedA saved key connection with no passphrase could never reconnect in one click, because an entry with nothing stored was treated as incomplete.

The app password, encrypted transcripts, and a port scanner that takes more than one host.

• SecuritySaved credentials are now encrypted with ChaCha20-Poly1305 under a key derived from your app password with Argon2id. Previously they were protected by Windows DPAPI, which ties them to your Windows account — meaning anything running as you could read them back, which is exactly what credential-stealing malware does.
• SecuritySession transcripts are encrypted and renamed .clog. They routinely contain running-config, SNMP communities and pre-shared keys, and were plain text on disk.
• AddedA Security page: change the password, lock on demand, and optionally lock after a stretch with no keyboard or mouse activity — off by default.
• AddedThe port scanner takes more than one host: a subnet, a range, a list or a mix. Multi-host targets are swept for live hosts first and only those are scanned. Results group by host with name, vendor and open-port count, and filter, sort and export to CSV, JSON or text.
• ChangedScan parallelism, retries and timeout are adjustable, and a running scan can be stopped.

Fixes the blank terminal that made SSH and serial unusable in 0.6.1.

• FixedThe webview's content security policy was refusing the styles xterm applies to its own rows, so a connected session printed into a pane that never showed anything.
• FixedA session that dies silently is now noticed and closed rather than sitting on “connected” indefinitely.
• FixedThe public IP on the overview screen works for the first time.

Fixes found by using 0.6.0 on real equipment.

• FixedSSH full screen could trap you with no way back out.
• FixedThe saved-connections list is reachable again when opening a new session.
• FixedThe sidebar widens in place instead of covering the page.
• AddedSession transcripts, off by default.
• AddedPort Finder shows vendor marks for the manufacturers we hold.
• FixedPacket capture says when it cannot open an adapter, and an IP sweep reports what it found.

The dark instrument theme and the icon rail.

• ChangedDark became the primary theme, with light as an opt-in that is remembered across launches.
• ChangedThe sidebar became an icon rail that widens on hover.
• AddedCtrl+K to jump between screens.
• AddedSignal traces and heat bars on the networks view, and an oscilloscope-style trace on the signal view.

The security work: host key verification, and the fixes around it.

• SecuritySSH host keys are pinned on first connect and a change is refused, with a panel showing both fingerprints when a device has genuinely been rebuilt.
• SecurityTFTP path limits, so a served folder cannot be escaped.
• SecuritySystem binaries are invoked by absolute path, and the update helper runs in its own working directory.
• SecurityRDP credentials are handed to the Windows client through the Credential Manager rather than on a command line.
• FixedThe executable name is pinned. It had changed between builds, so the installer added the new binary alongside the old one instead of replacing it.