Version 0.10.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -78,13 +78,20 @@ Under **Settings → Synchronization**, you can keep several MrTerm installation
 1. Turn on **LAN synchronization** on both devices.
 2. Click **Pair new device** on both devices and select the other one.
 3. Both devices show a 6-digit code. If the codes match, click **Codes match** on both devices.
-4. Choose which **SSH keys, host passwords and VPN configurations** this device may share. Nothing secret is shared unless you select it, and you can change the selection at any time.
+4. Choose which **SSH keys, host passwords and VPN configurations** this device may share. Nothing secret is shared unless you select it, and you can change the selection at any time. When you add a new key, password or VPN later, MrTerm asks whether to share it.
 
 From then on, hosts, groups, snippets, port forwards, VPNs and known hosts are synchronized automatically whenever both devices are running on the same network. Deletions are synchronized too. If a change was made on both devices, the newest one wins. Device-specific settings such as theme, language and app lock stay local.
 
 **Security:** pairing uses an X25519 key exchange confirmed by the matching code, so another device on the network can't intercept it. Every sync connection is mutually authenticated and encrypted with AES-256-GCM, using a new key for each session.
 
-**Firewall:** devices find each other on UDP port 47811 and sync on TCP port 47812. With UFW, allow them with `sudo ufw allow 47811/udp` and `sudo ufw allow 47812/tcp`. Windows asks for permission the first time. If devices can't find each other, you can also add one by its IP address.
+**Firewall:** devices find each other on UDP port 47811 and sync on TCP port 47812. **CachyOS enables the UFW firewall by default**, so run this once on CachyOS (and on any other Linux with UFW enabled):
+
+```sh
+sudo ufw allow 47811/udp
+sudo ufw allow 47812/tcp
+```
+
+MrTerm shows these commands automatically when it detects CachyOS, UFW or firewalld. Windows asks for permission the first time. If devices can't find each other, you can also add one by its IP address.
 
 ## Docker
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mrterm",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mrterm",
-      "version": "0.10.0",
+      "version": "0.10.1",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "mrterm",
   "productName": "MrTerm",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Moderner SSH-, SFTP- und RDP-Client",
   "main": "src/main/main.js",
   "author": "MrBlake",

src/i18n.js

@@ -585,6 +585,18 @@
     'Pairing verification failed.': 'Die Überprüfung der Kopplung ist fehlgeschlagen.',
     'Device is not ready for pairing': 'Das Gerät ist nicht zum Koppeln bereit',
 
+    'CachyOS: allow the sync ports in the firewall': 'CachyOS: Sync-Ports in der Firewall freigeben',
+    'Firewall active: allow the sync ports': 'Firewall aktiv: Sync-Ports freigeben',
+    'Otherwise other devices cannot find or reach this device. Run these commands once in a terminal:': 'Sonst können andere Geräte dieses Gerät weder finden noch erreichen. Führe diese Befehle einmal in einem Terminal aus:',
+    'Copy commands': 'Befehle kopieren',
+    'Already done, hide': 'Erledigt, ausblenden',
+    'CachyOS enables the UFW firewall by default. It blocks the ports MrTerm needs to find and reach other devices (UDP 47811, TCP 47812). Run these commands once in a terminal:': 'CachyOS aktiviert standardmäßig die Firewall UFW. Sie blockiert die Ports, über die MrTerm andere Geräte findet und erreicht (UDP 47811, TCP 47812). Führe diese Befehle einmal in einem Terminal aus:',
+    'No devices found? The firewall on this device may block them:': 'Keine Geräte gefunden? Die Firewall dieses Geräts blockiert sie eventuell:',
+    'Host password': 'Host-Passwort',
+    'Share with paired devices?': 'Mit gekoppelten Geräten teilen?',
+    'Should this secret be synchronized to your paired devices ({names})? You can change this later under Settings → Synchronization.': 'Soll dieses Geheimnis mit deinen gekoppelten Geräten ({names}) synchronisiert werden? Du kannst das später unter Einstellungen → Synchronisation ändern.',
+    'Don\'t share': 'Nicht teilen',
+    'Share': 'Teilen',
     // Main-Prozess
     'Host key has changed!': 'Host-Schlüssel hat sich geändert!',
     'Unknown host': 'Unbekannter Host',

src/main/main.js

@@ -267,6 +267,7 @@ handle('sync:pair', (id) => sync.pair(id));
 handle('sync:unpair', (id) => sync.unpair(id));
 handle('sync:now', () => sync.syncAll());
 handle('sync:share', (sel) => sync.setShare(sel));
+handle('sync:shareItem', (c, id, yes) => sync.shareItem(c, id, yes));
 handle('sync:probe', (address) => sync.probe(address));
 
 // ---------- VPN ----------

src/main/sync.js

@@ -14,6 +14,21 @@ const net = require('net');
 const os = require('os');
 const crypto = require('crypto');
 const i18n = require('../i18n');
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+// Lokale Firewall erkennen, die Broadcasts/eingehende Verbindungen blockieren könnte (Linux).
+// Ob die Ports bereits freigegeben sind, lässt sich ohne root nicht prüfen (UFW-Regeln sind nur für root lesbar).
+function localFirewall() {
+  if (process.platform !== 'linux') return null;
+  const read = (f) => { try { return fs.readFileSync(f, 'utf8'); } catch { return ''; } };
+  const active = (unit) => { try { return execFileSync('systemctl', ['is-active', unit], { timeout: 3000 }).toString().trim() === 'active'; } catch { return false; } };
+  const os = (read('/etc/os-release').match(/^ID=(.*)$/m) || [])[1]?.replace(/"/g, '') || '';
+  const ufw = /^ENABLED=yes/m.test(read('/etc/ufw/ufw.conf')) || active('ufw');
+  const firewalld = active('firewalld');
+  if (!ufw && !firewalld && os !== 'cachyos') return null;
+  return { os, ufw, firewalld };
+}
 
 const UDP_PORT = 47811;
 const TCP_PORT = 47812;
@@ -170,6 +185,7 @@ class SyncService {
     this.running = false;
     this.lastError = '';
     this.syncing = new Set();
+    this.firewall = localFirewall();
   }
 
   get cfg() {
@@ -271,7 +287,7 @@ class SyncService {
       enabled: c.enabled, running: this.running, deviceId: c.deviceId, deviceName: c.deviceName, pairable: this.pairable, port: this.port,
       peers: c.peers.map((p) => ({ id: p.id, name: p.name, lastSync: p.lastSync || 0, online: this.seen.has(p.id), address: p.address, error: p.error || '' })),
       nearby: [...this.seen.values()].filter((p) => !c.peers.some((x) => x.id === p.id)).map(({ id, name, address, pairable }) => ({ id, name, address, pairable })),
-      share: c.share, asked: !!c.asked, sealed: !!this.store.sealed,
+      share: c.share, asked: !!c.asked, sealed: !!this.store.sealed, firewall: this.firewall,
     };
   }
   emitState() { this.emit('sync:state', this.status()); }
@@ -452,12 +468,25 @@ class SyncService {
   setShare(share) {
     const clean = (a) => (Array.isArray(a) ? a.filter((x) => typeof x === 'string') : []);
     const c = this.cfg;
-    c.share = { keys: clean(share?.keys), hosts: clean(share?.hosts), vpns: clean(share?.vpns) };
+    c.share = { keys: clean(share?.keys), hosts: clean(share?.hosts), vpns: clean(share?.vpns), declined: { keys: [], hosts: [], vpns: [] } };
     c.asked = true;
     this.store.save();
     return this.status();
   }
 
+  // Einzelnes neues Geheimnis teilen oder ablehnen (Ablehnung wird gemerkt, damit nicht erneut gefragt wird)
+  shareItem(c, id, yes) {
+    if (!SECRETS[c] || typeof id !== 'string') throw new Error('Invalid');
+    const sh = this.cfg.share;
+    sh.declined ||= { keys: [], hosts: [], vpns: [] };
+    sh[c] = (sh[c] || []).filter((x) => x !== id);
+    sh.declined[c] = (sh.declined[c] || []).filter((x) => x !== id);
+    (yes ? sh[c] : sh.declined[c]).push(id);
+    this.store.save();
+    if (yes) this.schedule(500);
+    return this.status();
+  }
+
   // Gerät per IP hinzufügen (wenn Broadcasts im Netz blockiert sind)
   async probe(address, port = TCP_PORT) {
     if (!/^[\w.:-]+$/.test(address)) throw new Error('Invalid address');

src/renderer/app.js

@@ -556,7 +556,8 @@ function editHost(hst = {}) {
       tags: v.tags.split(',').map((t) => t.trim()).filter(Boolean),
       groupId: v.groupId || null, keyId: v.keyId || null, jumpHostId: v.jumpHostId || null, vpnId: v.vpnId || null,
     };
-    await call('vault:upsert', 'hosts', item);
+    const savedHost = await call('vault:upsert', 'hosts', item);
+    if (item.password) askShareSecret('hosts', savedHost, item.label || item.address);
     reload();
   }, isNew ? null : (() => { const b = h(`<button class="btn danger">${ICONS.trash}</button>`); b.title = T('Delete'); b.onclick = async () => { if (await confirmBox(T('Delete host?'), T('“{name}” will be permanently removed.', { name: hst.label || hst.address }))) { await call('vault:remove', 'hosts', hst.id); closeDrawer(); reload(); } }; return b; })());
   setProto(proto);
@@ -617,7 +618,8 @@ async function generateKey() {
   });
   if (!r) return;
   const k = await call('key:generate', { type: r.type, passphrase: r.passphrase, comment: r.label });
-  await call('vault:upsert', 'keys', { label: r.label, privateKey: k.privateKey, publicKey: k.publicKey, passphrase: r.passphrase || undefined });
+  const newKey = await call('vault:upsert', 'keys', { label: r.label, privateKey: k.privateKey, publicKey: k.publicKey, passphrase: r.passphrase || undefined });
+  askShareSecret('keys', newKey, r.label);
   await call('clipboard:write', k.publicKey);
   toast(T('Key generated – public key copied to clipboard'), 'ok');
   reload();
@@ -633,7 +635,8 @@ function editKey(k = {}, pick = false) {
     const v = formValues(form);
     if (!v.privateKey.trim()) throw new Error(T('Private key is missing.'));
     const parsed = await call('key:parse', { privateKey: v.privateKey, passphrase: v.passphrase });
-    await call('vault:upsert', 'keys', { ...k, ...v, label: v.label || parsed.type, publicKey: v.publicKey.trim() || parsed.publicKey });
+    const savedKey = await call('vault:upsert', 'keys', { ...k, ...v, label: v.label || parsed.type, publicKey: v.publicKey.trim() || parsed.publicKey });
+    askShareSecret('keys', savedKey, savedKey.label);
     reload();
   }, (() => { const b = h(`<button class="btn">${ICONS.folder}${T('File…')}</button>`); b.onclick = loadFile; return b; })());
   async function loadFile() {
@@ -811,6 +814,7 @@ function editVpn(v = {}, pick = false) {
     const item = { ...v, type, label: f.label.trim() || VPN_TYPES[type], config: f.config, disconnectOnQuit: f.disconnectOnQuit,
       username: type === 'openvpn' ? f.username : '', password: type === 'openvpn' ? f.password : '' };
     const saved = await call('vault:upsert', 'vpns', item);
+    askShareSecret('vpns', saved, saved.label);
     for (const cb of $$('[data-host]', hostBox)) {
       const hst = S.vault.hosts.find((x) => x.id === cb.dataset.host);
       const want = cb.checked ? saved.id : (hst.vpnId === saved.id ? null : hst.vpnId || null);
@@ -1103,9 +1107,14 @@ async function renderSyncCard(card) {
   const st = S.syncStatus;
   card.innerHTML = `<h3>${T('Synchronization')}</h3><p style="color:var(--muted);margin-top:0">${T('Synchronize hosts, groups, snippets, port forwards, VPNs and known hosts directly between MrTerm devices in your local network. The connection is end-to-end encrypted; no server or cloud is involved.')}</p>`;
   const en = check(T('Enable LAN synchronization'), 'syncOn', st.enabled);
-  $('input', en).onchange = async (e) => { S.syncStatus = await call('sync:enable', e.target.checked); renderSyncCard(card); };
+  $('input', en).onchange = async (e) => {
+    S.syncStatus = await call('sync:enable', e.target.checked);
+    renderSyncCard(card);
+    if (e.target.checked && S.syncStatus.firewall) showFirewallHint();
+  };
   card.append(en);
   if (!st.enabled) return;
+  if (st.firewall && !syncFwDismissed()) card.append(firewallHintBox(() => renderSyncCard(card)));
   const name = field(T('Device name'), 'devName', st.deviceName);
   $('input', name).onchange = async (e) => { S.syncStatus = await call('sync:enable', true, e.target.value.trim()); };
   card.append(name);
@@ -1128,7 +1137,46 @@ async function renderSyncCard(card) {
   const sec = h(`<button class="btn">${ICONS.key}${T('Choose shared secrets')}</button>`); sec.onclick = chooseSharedSecrets;
   acts.append(pair, now, sec);
   card.append(acts);
-  card.append(h(`<div class="hint" style="color:var(--faint);font-size:11px;margin-top:10px">${T('Devices find each other via UDP port 47811 and synchronize via TCP port 47812. If a firewall is active, allow these ports in your local network (with UFW: sudo ufw allow 47811/udp and sudo ufw allow 47812/tcp).')}</div>`));
+  if (!st.firewall || syncFwDismissed()) card.append(h(`<div class="hint" style="color:var(--faint);font-size:11px;margin-top:10px">${T('Devices find each other via UDP port 47811 and synchronize via TCP port 47812. If a firewall is active, allow these ports in your local network (with UFW: sudo ufw allow 47811/udp and sudo ufw allow 47812/tcp).')}</div>`));
+}
+
+// Neues Geheimnis bei aktiver Synchronisation: fragen, ob es geteilt werden soll (Antwort wird gemerkt)
+async function askShareSecret(c, item, label) {
+  try {
+    const st = S.syncStatus || (S.syncStatus = await api.call('sync:status'));
+    if (!st.enabled || !st.peers.length || !item?.id) return;
+    if ((st.share[c] || []).includes(item.id) || (st.share.declined?.[c] || []).includes(item.id)) return;
+    const what = { keys: T('SSH key'), hosts: T('Host password'), vpns: T('VPN configuration') }[c];
+    const r = await modal({ title: T('Share with paired devices?'), text: `${what}: ${label || ''}`,
+      body: `<p style="margin-top:0">${T('Should this secret be synchronized to your paired devices ({names})? You can change this later under Settings → Synchronization.', { names: st.peers.map((p) => p.name).join(', ') })}</p>`,
+      buttons: [{ label: T("Don't share"), value: 'no', cls: 'ghost' }, { label: T('Share'), value: 'yes', cls: 'primary' }], noEnter: true });
+    if (!r) return; // Dialog geschlossen: beim nächsten Speichern erneut fragen
+    S.syncStatus = await api.call('sync:shareItem', c, item.id, r === 'yes');
+  } catch {}
+}
+
+// Firewall-Hinweis (CachyOS / aktive UFW bzw. firewalld): Ports für die Synchronisation freigeben
+const FW_CMDS = { ufw: 'sudo ufw allow 47811/udp\nsudo ufw allow 47812/tcp', firewalld: 'sudo firewall-cmd --permanent --add-port=47811/udp --add-port=47812/tcp\nsudo firewall-cmd --reload' };
+const fwCmds = (f) => (f.firewalld && !f.ufw ? FW_CMDS.firewalld : FW_CMDS.ufw);
+const syncFwDismissed = () => { try { return localStorage.getItem('mrterm.sync.fwHint') === '1'; } catch { return false; } };
+function firewallHintBox(onDismiss) {
+  const f = S.syncStatus.firewall;
+  const box = h(`<div class="net-banner warn fw-hint"><div>${ICONS.wall}</div><div class="grow"><b>${f.os === 'cachyos' ? T('CachyOS: allow the sync ports in the firewall') : T('Firewall active: allow the sync ports')}</b>
+    <p>${T('Otherwise other devices cannot find or reach this device. Run these commands once in a terminal:')}</p><pre class="mono">${esc(fwCmds(f))}</pre>
+    <div class="row"><button class="btn sm" data-f="copy">${ICONS.copy}${T('Copy commands')}</button><button class="btn sm ghost" data-f="hide">${T('Already done, hide')}</button></div></div></div>`);
+  box.onclick = (e) => {
+    const a = e.target.closest('[data-f]')?.dataset.f;
+    if (a === 'copy') { api.call('clipboard:write', fwCmds(f)); toast(T('Copied'), 'ok'); }
+    if (a === 'hide') { try { localStorage.setItem('mrterm.sync.fwHint', '1'); } catch {} onDismiss?.(); }
+  };
+  return box;
+}
+async function showFirewallHint() {
+  const f = S.syncStatus.firewall;
+  const r = await modal({ title: f.os === 'cachyos' ? T('CachyOS: allow the sync ports in the firewall') : T('Firewall active: allow the sync ports'),
+    body: `<p style="margin-top:0">${T('CachyOS enables the UFW firewall by default. It blocks the ports MrTerm needs to find and reach other devices (UDP 47811, TCP 47812). Run these commands once in a terminal:')}</p><pre class="mono fw-pre">${esc(fwCmds(f))}</pre>`,
+    buttons: [{ label: T('Close'), value: null, cls: 'ghost' }, { label: T('Copy commands'), value: 'copy', cls: 'primary' }] });
+  if (r === 'copy') { await api.call('clipboard:write', fwCmds(f)); toast(T('Copied'), 'ok'); }
 }
 
 // Kopplungsdialog: dieses Gerät ist sichtbar, gefundene Geräte können gekoppelt werden
@@ -1141,7 +1189,7 @@ async function openPairing() {
     const box = $('.pair-list');
     if (!box) return clearInterval(timer);
     const near = S.syncStatus?.nearby || [];
-    box.innerHTML = near.length ? '' : `<div class="hint" style="color:var(--muted);display:flex;gap:10px;align-items:center"><span class="spinner sm"></span>${T('Searching for devices …')}</div>`;
+    box.innerHTML = near.length ? '' : `<div class="hint" style="color:var(--muted);display:flex;gap:10px;align-items:center"><span class="spinner sm"></span>${T('Searching for devices …')}</div>${S.syncStatus?.firewall ? `<div class="hint" style="color:var(--orange);margin-top:10px;font-size:12px">${T('No devices found? The firewall on this device may block them:')}<pre class="mono fw-pre">${esc(fwCmds(S.syncStatus.firewall))}</pre></div>` : ''}`;
     for (const d of near) {
       const row = h(`<div class="card" style="padding:10px 12px;cursor:default"><div class="avatar" style="background:var(--icon-bg);color:var(--accent)">${ICONS.screen}</div><div class="meta"><div class="title">${esc(d.name)}</div><div class="sub">${esc(d.address)}${d.pairable ? '' : ` · ${T('not ready for pairing')}`}</div></div></div>`);
       const b = h(`<button class="btn sm primary" ${d.pairable ? '' : 'disabled'}>${T('Pair')}</button>`);

src/renderer/styles.css

@@ -437,3 +437,9 @@ kbd { background: var(--card); border: 1px solid var(--border); border-bottom-wi
 .pair-list { max-height: 260px; overflow: auto; }
 .share-list { max-height: 380px; overflow: auto; }
 .share-list h4 { margin: 12px 0 6px; }
+.fw-hint { align-items: flex-start; margin: 4px 0 14px; }
+.fw-hint svg { width: 22px; height: 22px; }
+.fw-hint .grow { flex: 1; min-width: 0; }
+.fw-hint b { color: var(--text); }
+.fw-hint p { margin: 4px 0 8px; color: var(--muted); }
+.fw-hint pre, .fw-pre { background: var(--bg); border: 1px solid var(--border); border-radius: 8px; padding: 8px 10px; margin: 0 0 10px; color: var(--text); white-space: pre-wrap; user-select: text; }