Version 0.17.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+dist
+mobile
+build
+docs
+.git
+.gitea-token
+web-data

.gitignore

@@ -8,3 +8,4 @@ mobile/vendor/
 mobile/www/
 mobile/android/keystore.properties
 mobile/android/*.jks
+web-data/

Dockerfile

@@ -0,0 +1,29 @@
+# MrTerm Web – die MrTerm-Oberfläche im Browser, selbst gehostet.
+#   docker compose up -d   →   http://<server>:8080 (beim ersten Aufruf Admin-Konto anlegen)
+
+# ---- Build: Server samt ssh2/ws in eine Datei bündeln
+FROM node:22-alpine AS build
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts --no-audit --no-fund
+COPY src ./src
+RUN npx esbuild src/web/server.js --bundle --platform=node --target=node22 --minify --legal-comments=none \
+      --external:electron --external:cpu-features --external:bufferutil --external:utf-8-validate \
+      --outfile=dist/server.js
+
+# ---- Laufzeit: nur Node, gebündelter Server und die Dateien der Oberfläche
+FROM node:22-alpine
+ENV NODE_ENV=production PORT=8080 DATA_DIR=/data MRTERM_ROOT=/app
+WORKDIR /app
+COPY package.json ./
+COPY --from=build /src/dist/server.js dist/server.js
+COPY src/i18n.js src/i18n.js
+COPY src/renderer src/renderer
+COPY src/web/public src/web/public
+COPY --from=build /src/node_modules/@xterm node_modules/@xterm
+RUN mkdir -p /data && chown node:node /data
+USER node
+VOLUME /data
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s CMD wget -qO- http://127.0.0.1:8080/healthz >/dev/null || exit 1
+CMD ["node", "dist/server.js"]

README.md

@@ -62,7 +62,8 @@ RDP, SFTP, port forwarding and VPN are only available in the desktop app.
 - **Known hosts**: MrTerm warns you if a server's host key changes
 - **History** of recent connections
 - **Import** from `~/.ssh/config` and from **Devolutions Remote Desktop Manager** (`.rdm`/XML, JSON or CSV)
-- **Backup** export and import
+- **Backup** of everything (hosts, keys, passwords, snippets, forwards, VPNs, known hosts, settings), optionally encrypted with a password (scrypt + AES-256-GCM); import can merge or replace
+- **Web version** for your own server (Docker), usable in any browser. See [Web version (Docker)](#web-version-docker)
 - **LAN sync**: keep several MrTerm devices in sync over your local network, end-to-end encrypted and without a server
 - **7 app themes** (Midnight, Navy, Nord, Dracula, Catppuccin, Forest, Light) plus a custom accent color
 - **Encrypted vault** using your operating system's keyring (Windows DPAPI, Linux libsecret/KWallet)
@@ -82,6 +83,39 @@ RDP, SFTP, port forwarding and VPN are only available in the desktop app.
 | ![Settings](docs/screenshots/settings.png) | |
 | **Settings**: language, app lock, LAN sync and themes | |
 
+## Web version (Docker)
+
+MrTerm also runs as a self-hosted web app, similar to Termix: you use the familiar MrTerm interface in the browser, from any computer.
+
+```bash
+curl -O https://git.mrblake.cc/MrBlake/MrTerm/raw/branch/main/docker-compose.yml
+docker compose up -d
+```
+
+Then open `http://<your-server>:8080` and create the administrator account. As an administrator you can add more users under **Settings → Account**.
+
+- **Included:** hosts and groups, SSH terminal tabs, SFTP file manager (upload by button or drag & drop, download to your computer), keys, snippets, known hosts, Docker, firewall and network management, themes.
+- **Not included:** RDP, VPN, port forwarding, LAN sync and the app lock. These need direct access to your computer.
+- **Security:** every user has their own vault, encrypted with a key that only their login password can unlock. The server stores no readable passwords or keys. If a user forgets their password, their vault cannot be recovered.
+- **HTTPS:** put MrTerm behind a reverse proxy with HTTPS (Traefik, Caddy, nginx …) before you use it over the internet, and set `TRUST_PROXY=1` in `docker-compose.yml`. The proxy must forward WebSockets.
+- **Data** lives in the `mrterm-data` volume (`/data` in the container). Back it up regularly. A restored vault still needs its user's password to open.
+- **SSH connections** start from the server, so the server must be able to reach your hosts.
+
+### Updating the web version
+
+Run these commands in the folder that contains your `docker-compose.yml`:
+
+```bash
+docker compose build --pull --no-cache
+docker compose up -d
+```
+
+This fetches the latest MrTerm from the repository, rebuilds the image and restarts the container. Your users and vaults stay in the `mrterm-data` volume and are kept. Everyone has to sign in again after the restart.
+
+To check which version is running, look at the bottom of the sign-in page. If a release note mentions changes to `docker-compose.yml`, download it again first (`curl -O …` as above) and copy over your own changes, such as ports or `TRUST_PROXY`.
+
+To remove images left over from earlier builds: `docker image prune`.
+
 ## Getting started
 
 1. Click **New host**, enter the address, username and password or key, and click **Save**.

docker-compose.yml

@@ -0,0 +1,22 @@
+# MrTerm Web
+#   docker compose up -d
+# Danach http://<server>:8080 öffnen und das Admin-Konto anlegen.
+# Hinter einem Reverse-Proxy mit HTTPS (empfohlen): TRUST_PROXY=1 setzen und den Port nur lokal freigeben.
+services:
+  mrterm:
+    build:
+      # Baut direkt aus dem Repository – kein Klonen nötig. Alternativ "context: ." in einem Klon.
+      context: https://git.mrblake.cc/MrBlake/MrTerm.git
+    image: mrterm-web
+    container_name: mrterm
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      - TZ=Europe/Berlin
+      # - TRUST_PROXY=1
+    volumes:
+      - mrterm-data:/data
+
+volumes:
+  mrterm-data:

mobile/nodejs/server.js

@@ -1,16 +1,11 @@
-// Node-Backend der Android-App. Nutzt dieselben Module wie der Electron-Hauptprozess
-// (Tresor, SSH, LAN-Sync, Docker, Firewall, Netzwerk) und spricht über die Capacitor-Bridge mit der Oberfläche.
+// Node-Backend der Android-App. Die Kanäle kommen aus src/core/backend.js (gemeinsam mit der Web-Version);
+// hier nur, was Android betrifft: Bridge-Anbindung, Entsperren per Fingerabdruck, Pause/Fortsetzen.
 // Protokoll: Oberfläche → 'call' [reqId, Kanal, Argumente] bzw. 'send' [Kanal, Argumente];
 //            Backend  → 'reply' [reqId, ok, Wert|Fehler] und 'evt' [Kanal, Argumente].
 const { channel } = require('bridge');
 const crypto = require('crypto');
-const { utils: sshUtils } = require('ssh2');
 const { Store } = require('../../src/main/store');
-const { SshManager } = require('../../src/main/ssh');
-const { DockerManager } = require('../../src/main/docker');
-const { FirewallManager } = require('../../src/main/firewall');
-const { NetworkConfigManager } = require('../../src/main/network');
-const { SyncService } = require('../../src/main/sync');
+const { createBackend } = require('../../src/core/backend');
 const i18n = require('../../src/i18n');
 
 const send = (ch, ...args) => channel.send('evt', ch, args);
@@ -18,182 +13,36 @@ process.on('uncaughtException', (e) => { console.error(e); send('toast', e?.mess
 process.on('unhandledRejection', (e) => console.error('Unhandled rejection:', e));
 
 const store = new Store();
-const applyLanguage = () => i18n.setLanguage(store.get().settings.language, process.env.MRTERM_LOCALE || 'en');
-
-// Rückfragen an die Oberfläche (Hostschlüssel, Passwörter, Kopplungscode)
-const pending = new Map();
-function ask(ch, req, timeout = 0) {
-  return new Promise((resolve) => {
-    const reqId = crypto.randomUUID();
-    pending.set(reqId, resolve);
-    send(ch, { reqId, ...req });
-    if (timeout) setTimeout(() => { if (pending.delete(reqId)) resolve(null); }, timeout);
-  });
-}
-const answer = (reqId, value) => { const r = pending.get(reqId); pending.delete(reqId); r?.(value); };
-
-const confirmHostKey = async (target, fingerprint, known) =>
-  !!(await ask('hostkey:request', { host: `${target.host}:${target.port}`, fingerprint, previous: known?.fingerprint || '' }));
-const askSecret = (sessionId, req) => ask('secret:request', { sessionId, ...req });
-
-const ssh = new SshManager(store, confirmHostKey, askSecret);
-const docker = new DockerManager(ssh);
-const firewall = new FirewallManager(ssh);
-const network = new NetworkConfigManager(ssh);
-const sync = new SyncService(store, send, async (req) => !!(await ask('sync:pairPrompt', req, 115000)));
-store.onChange = () => sync.schedule();
-
-const handlers = new Map();
-const OPEN_WHILE_LOCKED = new Set(['app:version']);
-const handle = (ch, fn) => handlers.set(ch, fn);
+const applyLanguage = (lang = store.get().settings.language) => i18n.setLanguage(lang, process.env.MRTERM_LOCALE || 'en');
+const be = createBackend({ store, send, platform: 'android', version: process.env.MRTERM_VERSION || '0.0.0', withSync: true, onLanguage: applyLanguage });
 
 channel.addListener('call', async (reqId, ch, args = []) => {
-  try {
-    const fn = handlers.get(ch);
-    if (!fn) throw new Error(`Unknown channel ${ch}`);
-    if (store.locked && !ch.startsWith('lock:') && !OPEN_WHILE_LOCKED.has(ch)) throw new Error(i18n.t('MrTerm is locked.'));
-    channel.send('reply', reqId, true, await fn(...args));
-  } catch (e) { channel.send('reply', reqId, false, e?.message || String(e)); }
+  try { channel.send('reply', reqId, true, await be.call(ch, args)); } catch (e) { channel.send('reply', reqId, false, e?.message || String(e)); }
 });
-const listeners = {
-  'ssh:write': (id, d) => ssh.write(id, d),
-  'ssh:resize': (id, c, r) => ssh.resize(id, c, r),
-  'ssh:close': (id) => ssh.close(id),
-  'ask:reply': answer,
-};
-channel.addListener('send', (ch, args = []) => { try { listeners[ch]?.(...args); } catch (e) { console.error(e); } });
+channel.addListener('send', (ch, args = []) => be.notify(ch, args));
 
-// ---------- App-Sperre: Passwort, zusätzlich Fingerabdruck (Geheimnis aus dem Android Keystore) ----------
-const kdf = (pw, salt, N) => new Promise((resolve, reject) =>
-  crypto.scrypt(String(pw), salt, 32, { N, r: 8, p: 1, maxmem: 256 * N * 8 }, (e, k) => (e ? reject(e) : resolve(k))));
+// ---------- Fingerabdruck (Geheimnis aus dem Android Keystore, nur zusätzlich zum Passwort) ----------
 const bioKek = (b64) => Buffer.from(crypto.hkdfSync('sha256', Buffer.from(b64, 'base64'), Buffer.alloc(0), 'mrterm-bio-kek', 32));
-function lockStatus() {
-  const { language, appTheme, accent } = store.get().settings;
-  return { enabled: store.lockEnabled, locked: store.locked, hasPassword: !!store.lock?.password, bio: !!store.lock?.bio, meta: { language, appTheme, accent } };
-}
-const requireUnlocked = () => { if (store.locked) throw new Error(i18n.t('MrTerm is locked.')); };
-const afterUnlock = () => { applyLanguage(); sync.start().catch(() => {}); };
-
-handle('lock:status', lockStatus);
-handle('lock:lock', () => { if (store.lockEnabled) store.locked = true; return lockStatus(); });
-handle('lock:unlockPassword', async (pw) => {
-  const p = store.lock?.password;
-  if (!p) throw new Error(i18n.t('No password set.'));
-  const kek = await kdf(pw, Buffer.from(p.salt, 'base64'), p.N);
-  try { store.unlockWith(kek, p.wrap); } catch { throw new Error(i18n.t('Wrong password.')); }
-  afterUnlock();
-  return true;
-});
-handle('lock:unlockBio', (secret) => {
+be.handle('lock:unlockBio', (secret) => {
   if (!store.lock?.bio) throw new Error(i18n.t('Fingerprint unlock is not set up.'));
   try { store.unlockWith(bioKek(secret), store.lock.bio.wrap); } catch { throw new Error(i18n.t('Fingerprint unlock failed. Use your password.')); }
-  afterUnlock();
+  applyLanguage();
+  be.sync.start().catch(() => {});
   return true;
 });
-handle('lock:setPassword', async (pw) => {
-  requireUnlocked();
-  if (!pw || String(pw).length < 6) throw new Error(i18n.t('The password must be at least 6 characters long.'));
-  const salt = crypto.randomBytes(16), N = 2 ** 15;
-  const kek = await kdf(pw, salt, N);
-  store.lock = store.lock || { password: null, fido: [] };
-  store.lock.password = { salt: salt.toString('base64'), N, wrap: store.wrapDek(kek) };
-  store.save();
-  return lockStatus();
-});
-handle('lock:removePassword', () => {
-  requireUnlocked();
-  if (store.lock) { store.lock.password = null; store.lock.bio = null; } // Fingerabdruck nur zusätzlich zum Passwort
-  store.dropLockIfEmpty();
-  store.save();
-  return lockStatus();
-});
-handle('lock:setBio', (secret) => {
-  requireUnlocked();
+be.handle('lock:setBio', (secret) => {
+  be.requireUnlocked();
   if (!store.lock?.password) throw new Error(i18n.t('Set a password first.'));
   store.lock.bio = secret ? { wrap: store.wrapDek(bioKek(secret)) } : null;
   store.save();
-  return lockStatus();
+  return be.lockStatus();
 });
 
-// ---------- Tresor ----------
-const publicData = () => { const { sync: _s, tombstones: _t, ...rest } = store.get(); return rest; };
-handle('vault:get', () => ({ ...publicData(), encrypted: store.encrypted, platform: 'android' }));
-handle('vault:upsert', (col, item) => store.upsert(col, item));
-handle('vault:remove', (col, id) => {
-  if (col === 'vpns') store.get().hosts.forEach((h) => { if (h.vpnId === id) { h.vpnId = null; h.updatedAt = Date.now(); } });
-  return store.remove(col, id);
-});
-handle('vault:settings', (s) => { store.setSettings(s); if ('language' in s) applyLanguage(); });
-handle('vault:forgetHost', (id) => store.forgetKnownHost(id));
-handle('app:version', () => process.env.MRTERM_VERSION || '0.0.0');
-
-// ---------- Schlüssel ----------
-handle('key:generate', ({ type, bits, comment, passphrase }) => {
-  const opts = { comment: comment || 'mrterm@android' };
-  if (type === 'rsa') opts.bits = Number(bits) || 4096;
-  if (passphrase) { opts.passphrase = passphrase; opts.cipher = 'aes256-cbc'; }
-  const k = sshUtils.generateKeyPairSync(type === 'rsa' ? 'rsa' : type === 'ecdsa' ? 'ecdsa' : 'ed25519', opts);
-  return { privateKey: k.private, publicKey: k.public };
-});
-handle('key:parse', ({ privateKey, passphrase }) => {
-  const k = sshUtils.parseKey(privateKey, passphrase || undefined);
-  if (k instanceof Error) throw k;
-  const key = Array.isArray(k) ? k[0] : k;
-  return { type: key.type, publicKey: `${key.type} ${key.getPublicSSH().toString('base64')} ${key.comment || ''}`.trim() };
-});
-
-// ---------- SSH-Terminal ----------
-function hostWithOverrides(ref) {
-  if (typeof ref === 'string') {
-    const h = store.resolveHost(ref);
-    if (!h) throw new Error(i18n.t('Host not found'));
-    return h;
-  }
-  if (ref?.ref) return { ...hostWithOverrides(ref.ref), execCommand: ref.execCommand, label: ref.label };
-  return ref;
-}
-handle('ssh:open', async (sessionId, ref, size) => {
-  const host = hostWithOverrides(ref);
-  if (host.id && !host.execCommand) store.addHistory({ hostId: host.id, at: Date.now() });
-  await ssh.openShell(sessionId, host, size, (type, payload) => send('ssh:event', sessionId, type, payload));
-  return true;
-});
-
-// ---------- Docker / Firewall / Netzwerk (gleiche Module wie am Desktop) ----------
-handle('docker:open', (id, ref) => docker.open(id, hostWithOverrides(ref), () => send('docker:closed', id)));
-handle('docker:list', (id) => docker.list(id));
-handle('docker:stats', (id) => docker.stats(id));
-handle('docker:action', (id, action, cid) => docker.action(id, action, cid));
-handle('docker:command', (id, kind, cid) => docker.command(id, kind, cid));
-handle('docker:close', (id) => docker.close(id));
-handle('firewall:open', (id, ref) => firewall.open(id, hostWithOverrides(ref), () => send('firewall:closed', id)));
-handle('firewall:list', (id, backend) => firewall.list(id, backend));
-handle('firewall:ufw', (id, op, args) => firewall.ufw(id, op, args));
-handle('firewall:ipt', (id, op, args) => firewall.ipt(id, op, args));
-handle('firewall:close', (id) => firewall.close(id));
-handle('network:open', (id, ref) => network.open(id, hostWithOverrides(ref), () => send('network:closed', id)));
-handle('network:read', (id) => network.read(id));
-handle('network:save', (id, model, verify) => network.saveInterface(id, model, verify));
-handle('network:remove', (id, model) => network.removeInterface(id, model));
-handle('network:hostname', (id, name) => network.setHostname(id, name));
-handle('network:resolv', (id, servers, search) => network.setResolv(id, servers, search));
-handle('network:close', (id) => network.close(id));
-
-// ---------- Synchronisation ----------
-handle('sync:status', () => sync.status());
-handle('sync:enable', (on, name) => sync.setEnabled(on, name));
-handle('sync:pairable', (on) => { sync.setPairable(on); return sync.status(); });
-handle('sync:pair', (id) => sync.pair(id));
-handle('sync:unpair', (id) => sync.unpair(id));
-handle('sync:now', () => sync.syncAll());
-handle('sync:share', (sel) => sync.setShare(sel));
-handle('sync:shareItem', (c, id, yes) => sync.shareItem(c, id, yes));
-handle('sync:probe', (address) => sync.probe(address));
 // App im Hintergrund: Sync-Sockets schließen, im Vordergrund wieder öffnen
-handle('app:pause', () => sync.stop());
-handle('app:resume', () => sync.start().catch(() => {}));
+be.handle('app:pause', () => be.sync.stop());
+be.handle('app:resume', () => be.sync.start().catch(() => {}));
 
 store.load();
 applyLanguage();
-sync.start().catch(() => {});
+be.sync.start().catch(() => {});
 channel.send('ready');

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mrterm",
-  "version": "0.12.0",
+  "version": "0.17.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mrterm",
-      "version": "0.12.0",
+      "version": "0.17.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",
@@ -18,7 +18,9 @@
       },
       "devDependencies": {
         "electron": "^44.4.5",
-        "electron-builder": "^26.15.3"
+        "electron-builder": "^26.15.3",
+        "esbuild": "^0.28.2",
+        "ws": "^8.21.3"
       }
     },
     "node_modules/@electron-internal/extract-zip": {
@@ -325,6 +327,448 @@
         "node": ">=14.14"
       }
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
@@ -2071,6 +2515,48 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/esbuild": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
+      }
+    },
     "node_modules/escalade": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
@@ -3992,6 +4478,28 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/xmlbuilder": {
       "version": "15.1.1",
       "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-15.1.1.tgz",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "mrterm",
   "productName": "MrTerm",
-  "version": "0.12.0",
+  "version": "0.17.0",
   "description": "Moderner SSH-, SFTP- und RDP-Client",
   "main": "src/main/main.js",
   "author": "MrBlake",
@@ -68,12 +68,15 @@
   },
   "devDependencies": {
     "electron": "^44.4.5",
-    "electron-builder": "^26.15.3"
+    "electron-builder": "^26.15.3",
+    "esbuild": "^0.28.2",
+    "ws": "^8.21.3"
   },
   "allowScripts": {
     "electron@44.4.5": true,
     "electron-winstaller@5.4.0": true,
     "ssh2@1.17.0": true,
-    "koffi@3.3.1": true
+    "koffi@3.3.1": true,
+    "esbuild@0.28.2": true
   }
 }

src/core/backend.js

@@ -0,0 +1,240 @@
+// Gemeinsame Backend-Kanäle für die Android-App und die Web-Version (Docker).
+// Der Electron-Hauptprozess (src/main/main.js) registriert seine Kanäle selbst, nutzt aber dieselben Module.
+//
+// createBackend({ store, send, platform, version, withSync, onLanguage })
+//   store     Store-Instanz (bereits geladen)
+//   send      (kanal, ...args) → Ereignis an die Oberfläche
+//   → { call(kanal, args), notify(kanal, args), close(), ssh, sync, handle }
+const crypto = require('crypto');
+const { utils: sshUtils } = require('ssh2');
+const { SshManager } = require('../main/ssh');
+const { DockerManager } = require('../main/docker');
+const { FirewallManager } = require('../main/firewall');
+const { NetworkConfigManager } = require('../main/network');
+const { AiAssistant } = require('../main/ai');
+const i18n = require('../i18n');
+const backup = require('./backup');
+const composeTemplates = require('../main/compose-templates');
+
+function createBackend({ store, send, platform, version = '0.0.0', withSync = false, onLanguage = () => {} }) {
+  // Rückfragen an die Oberfläche (Hostschlüssel, Passwörter, Kopplungscode)
+  const pending = new Map();
+  const ask = (ch, req, timeout = 0) => new Promise((resolve) => {
+    const reqId = crypto.randomUUID();
+    pending.set(reqId, resolve);
+    send(ch, { reqId, ...req });
+    if (timeout) setTimeout(() => { if (pending.delete(reqId)) resolve(null); }, timeout);
+  });
+  const answer = (reqId, value) => { const r = pending.get(reqId); pending.delete(reqId); r?.(value); };
+
+  const confirmHostKey = async (target, fingerprint, known) =>
+    !!(await ask('hostkey:request', { host: `${target.host}:${target.port}`, fingerprint, previous: known?.fingerprint || '' }));
+  const askSecret = (sessionId, req) => ask('secret:request', { sessionId, ...req });
+
+  const ssh = new SshManager(store, confirmHostKey, askSecret);
+  const docker = new DockerManager(ssh);
+  const firewall = new FirewallManager(ssh);
+  const network = new NetworkConfigManager(ssh);
+  const ai = new AiAssistant(store, send);
+  let sync = null;
+  if (withSync) {
+    const { SyncService } = require('../main/sync');
+    sync = new SyncService(store, send, async (req) => !!(await ask('sync:pairPrompt', req, 115000)));
+    store.onChange = () => sync.schedule();
+  }
+
+  const handlers = new Map();
+  const handle = (ch, fn) => handlers.set(ch, fn);
+  const OPEN_WHILE_LOCKED = new Set(['app:version']);
+
+  async function call(ch, args = []) {
+    const fn = handlers.get(ch);
+    if (!fn) throw new Error(`Unknown channel ${ch}`);
+    if (store.locked && !ch.startsWith('lock:') && !OPEN_WHILE_LOCKED.has(ch)) throw new Error(i18n.t('MrTerm is locked.'));
+    return fn(...args);
+  }
+  const listeners = {
+    'ssh:write': (id, d) => ssh.write(id, d),
+    'ssh:resize': (id, c, r) => ssh.resize(id, c, r),
+    'ssh:close': (id) => ssh.close(id),
+    'ask:reply': answer,
+    // Namen der Desktop-Vorlage (preload.js)
+    'secret:reply': answer,
+    'sync:pairReply': answer,
+  };
+  const notify = (ch, args = []) => { try { listeners[ch]?.(...args); } catch (e) { console.error(e); } };
+
+  // ---------- App-Sperre (Passwort) ----------
+  const kdf = (pw, salt, N) => new Promise((resolve, reject) =>
+    crypto.scrypt(String(pw), salt, 32, { N, r: 8, p: 1, maxmem: 256 * N * 8 }, (e, k) => (e ? reject(e) : resolve(k))));
+  const lockStatus = () => {
+    const { language, appTheme, accent } = store.get().settings;
+    return { enabled: store.lockEnabled, locked: store.locked, hasPassword: !!store.lock?.password, bio: !!store.lock?.bio, fido: [], meta: { language, appTheme, accent } };
+  };
+  const requireUnlocked = () => { if (store.locked) throw new Error(i18n.t('MrTerm is locked.')); };
+  const afterUnlock = () => { onLanguage(store.get().settings.language); sync?.start().catch(() => {}); };
+  handle('lock:status', lockStatus);
+  handle('lock:lock', () => { if (store.lockEnabled) store.locked = true; return lockStatus(); });
+  handle('lock:unlockPassword', async (pw) => {
+    const p = store.lock?.password;
+    if (!p) throw new Error(i18n.t('No password set.'));
+    const kek = await kdf(pw, Buffer.from(p.salt, 'base64'), p.N);
+    try { store.unlockWith(kek, p.wrap); } catch { throw new Error(i18n.t('Wrong password.')); }
+    afterUnlock();
+    return true;
+  });
+  handle('lock:setPassword', async (pw) => {
+    requireUnlocked();
+    if (!pw || String(pw).length < 6) throw new Error(i18n.t('The password must be at least 6 characters long.'));
+    const salt = crypto.randomBytes(16), N = 2 ** 15;
+    const kek = await kdf(pw, salt, N);
+    store.lock = store.lock || { password: null, fido: [] };
+    store.lock.password = { salt: salt.toString('base64'), N, wrap: store.wrapDek(kek) };
+    store.save();
+    return lockStatus();
+  });
+  handle('lock:removePassword', () => {
+    requireUnlocked();
+    if (store.lock) { store.lock.password = null; store.lock.bio = null; }
+    store.dropLockIfEmpty();
+    store.save();
+    return lockStatus();
+  });
+
+  // ---------- Tresor ----------
+  const publicData = () => { const { sync: _s, tombstones: _t, ...rest } = store.get(); return rest; };
+  handle('vault:get', () => ({ ...publicData(), encrypted: store.encrypted, platform }));
+  handle('vault:upsert', (col, item) => store.upsert(col, item));
+  handle('vault:remove', (col, id) => {
+    if (col === 'vpns') store.get().hosts.forEach((h) => { if (h.vpnId === id) { h.vpnId = null; h.updatedAt = Date.now(); } });
+    return store.remove(col, id);
+  });
+  handle('vault:settings', (s) => { store.setSettings(s); if ('language' in s) onLanguage(s.language); });
+  handle('vault:forgetHost', (id) => store.forgetKnownHost(id));
+  handle('backup:export', (opts) => backup.createBackup(store, { ...opts, version }));
+  handle('backup:inspect', (content) => backup.inspectBackup(content));
+  handle('backup:import', (content, password, opts) => {
+    const r = backup.importBackup(store, content, password, opts);
+    if (opts?.settings) onLanguage(store.get().settings.language);
+    return r;
+  });
+  // entries: [{ folder: ['A','B'], host?: {...} }] – wie am Desktop (Import aus Remote Desktop Manager)
+  handle('vault:bulkImport', (entries) => {
+    const groups = store.get().groups;
+    const ensure = (parts) => {
+      let parent = null;
+      for (const label of parts) {
+        let g = groups.find((x) => (x.parentId || null) === parent && x.label.toLowerCase() === label.toLowerCase());
+        if (!g) { g = { id: crypto.randomUUID(), label, parentId: parent, createdAt: Date.now() }; groups.push(g); }
+        parent = g.id;
+      }
+      return parent;
+    };
+    let hosts = 0, skipped = 0;
+    for (const e of entries) {
+      const groupId = ensure(e.folder || []);
+      if (!e.host) continue;
+      const dup = store.get().hosts.find((h) => h.address === e.host.address && (h.groupId || null) === groupId && (h.label || '') === (e.host.label || '') && (h.protocol || 'ssh') === e.host.protocol);
+      if (dup) { skipped++; continue; }
+      store.get().hosts.push({ ...e.host, id: crypto.randomUUID(), groupId, createdAt: Date.now(), updatedAt: Date.now() });
+      hosts++;
+    }
+    store.save();
+    return { hosts, skipped, groups: groups.length };
+  });
+  handle('app:version', () => version);
+
+  // ---------- Schlüssel ----------
+  handle('key:generate', ({ type, bits, comment, passphrase }) => {
+    const opts = { comment: comment || `mrterm@${platform}` };
+    if (type === 'rsa') opts.bits = Number(bits) || 4096;
+    if (passphrase) { opts.passphrase = passphrase; opts.cipher = 'aes256-cbc'; }
+    const k = sshUtils.generateKeyPairSync(type === 'rsa' ? 'rsa' : type === 'ecdsa' ? 'ecdsa' : 'ed25519', opts);
+    return { privateKey: k.private, publicKey: k.public };
+  });
+  handle('key:parse', ({ privateKey, passphrase }) => {
+    const k = sshUtils.parseKey(privateKey, passphrase || undefined);
+    if (k instanceof Error) throw k;
+    const key = Array.isArray(k) ? k[0] : k;
+    return { type: key.type, publicKey: `${key.type} ${key.getPublicSSH().toString('base64')} ${key.comment || ''}`.trim() };
+  });
+
+  // ---------- SSH-Terminal & SFTP ----------
+  function hostWithOverrides(ref) {
+    if (typeof ref === 'string') {
+      const h = store.resolveHost(ref);
+      if (!h) throw new Error(i18n.t('Host not found'));
+      return h;
+    }
+    if (ref?.ref) return { ...hostWithOverrides(ref.ref), execCommand: ref.execCommand, label: ref.label };
+    return ref;
+  }
+  handle('ssh:open', async (sessionId, ref, size) => {
+    const host = hostWithOverrides(ref);
+    if (host.id && !host.execCommand) store.addHistory({ hostId: host.id, at: Date.now() });
+    await ssh.openShell(sessionId, host, size, (type, payload) => send('ssh:event', sessionId, type, payload));
+    return true;
+  });
+  handle('sftp:open', (id, ref) => ssh.openSftp(id, hostWithOverrides(ref)));
+  handle('sftp:list', (id, dir) => ssh.sftpList(id, dir));
+  handle('sftp:op', (id, op, a, b) => ssh.sftpOp(id, op, a, b));
+  handle('sftp:close', (id) => ssh.close(id));
+
+  // ---------- Docker / Firewall / Netzwerk ----------
+  handle('docker:open', (id, ref) => docker.open(id, hostWithOverrides(ref), () => send('docker:closed', id)));
+  handle('docker:list', (id) => docker.list(id));
+  handle('docker:stats', (id) => docker.stats(id));
+  handle('docker:action', (id, action, cid) => docker.action(id, action, cid));
+  handle('docker:command', (id, kind, cid) => docker.command(id, kind, cid));
+  handle('docker:close', (id) => docker.close(id));
+  handle('docker:stacks', (id, dir) => docker.stacks(id, dir));
+  handle('docker:stackRead', (id, file) => docker.readStack(id, file));
+  handle('docker:stackSave', (id, data) => docker.saveStack(id, data));
+  handle('docker:stackCommand', (id, action, st, opts) => docker.stackCommand(id, action, st, opts));
+  handle('docker:templates', (url) => composeTemplates.list(url));
+  handle('docker:template', (index, url) => composeTemplates.build(index, url));
+  handle('firewall:open', (id, ref) => firewall.open(id, hostWithOverrides(ref), () => send('firewall:closed', id)));
+  handle('firewall:list', (id, backend) => firewall.list(id, backend));
+  handle('firewall:ufw', (id, op, args) => firewall.ufw(id, op, args));
+  handle('firewall:ipt', (id, op, args) => firewall.ipt(id, op, args));
+  handle('firewall:close', (id) => firewall.close(id));
+  handle('network:open', (id, ref) => network.open(id, hostWithOverrides(ref), () => send('network:closed', id)));
+  handle('network:read', (id) => network.read(id));
+  handle('network:save', (id, model, verify) => network.saveInterface(id, model, verify));
+  handle('network:remove', (id, model) => network.removeInterface(id, model));
+  handle('network:hostname', (id, name) => network.setHostname(id, name));
+  handle('network:resolv', (id, servers, search) => network.setResolv(id, servers, search));
+  handle('network:readFile', (id, path) => network.readFile(id, path));
+  handle('network:writeFile', (id, path, content, verify) => network.writeFile(id, path, content, verify));
+  handle('network:close', (id) => network.close(id));
+
+  // ---------- Support-Assistent (Ollama) ----------
+  handle('ai:models', (url) => ai.models(url));
+  handle('ai:chat', (id, messages, context) => ai.chat(id, messages, context));
+  handle('ai:stop', (id) => ai.stop(id));
+
+  // ---------- Synchronisation ----------
+  if (sync) {
+    handle('sync:status', () => sync.status());
+    handle('sync:enable', (on, name) => sync.setEnabled(on, name));
+    handle('sync:pairable', (on) => { sync.setPairable(on); return sync.status(); });
+    handle('sync:pair', (id) => sync.pair(id));
+    handle('sync:unpair', (id) => sync.unpair(id));
+    handle('sync:now', () => sync.syncAll());
+    handle('sync:share', (sel) => sync.setShare(sel));
+    handle('sync:shareItem', (c, id, yes) => sync.shareItem(c, id, yes));
+    handle('sync:probe', (address) => sync.probe(address));
+  }
+
+  function close() {
+    ssh.closeAll?.();
+    ai.stopAll();
+    sync?.stop();
+    for (const r of pending.values()) r(null);
+    pending.clear();
+  }
+
+  return { call, notify, close, handle, ssh, sync, store, kdf, requireUnlocked, lockStatus };
+}
+
+module.exports = { createBackend };

src/core/backup.js

@@ -0,0 +1,99 @@
+// Vollständiges Backup (Desktop, Web, Android): alle Collections, bekannte Hosts, Verlauf und Einstellungen.
+// Optional mit Passwort verschlüsselt: scrypt (N=2^16, r=8, p=1) → AES-256-GCM.
+// Gerätebezogenes (LAN-Sync-Kopplungen, Löschvermerke, App-Sperre) wird nicht exportiert.
+const crypto = require('crypto');
+
+const FORMAT = 'mrterm-backup';
+const COLLECTIONS = ['groups', 'hosts', 'keys', 'snippets', 'forwards', 'vpns'];
+const KDF = { N: 1 << 16, r: 8, p: 1 };
+const scrypt = (password, salt, k) => crypto.scryptSync(String(password).normalize('NFC'), salt, 32, { ...k, maxmem: 256 * 1024 * 1024 });
+
+function snapshot(store, { settings = true } = {}) {
+  const d = store.get();
+  const out = { knownHosts: d.knownHosts || {}, history: d.history || [] };
+  for (const c of COLLECTIONS) out[c] = d[c] || [];
+  if (settings) out.settings = d.settings;
+  return out;
+}
+
+// Liefert den Dateiinhalt (JSON-Text)
+function createBackup(store, { password = '', settings = true, version = '' } = {}) {
+  const data = snapshot(store, { settings });
+  const head = { format: FORMAT, version: 2, app: version, createdAt: new Date().toISOString() };
+  if (!password) return JSON.stringify({ ...head, encrypted: false, data }, null, 2);
+  const salt = crypto.randomBytes(16);
+  const key = scrypt(password, salt, KDF);
+  const iv = crypto.randomBytes(12);
+  const c = crypto.createCipheriv('aes-256-gcm', key, iv);
+  c.setAAD(Buffer.from(FORMAT));
+  const ct = Buffer.concat([c.update(JSON.stringify(data)), c.final()]);
+  return JSON.stringify({
+    ...head, encrypted: true,
+    kdf: { name: 'scrypt', salt: salt.toString('base64'), ...KDF },
+    cipher: { name: 'aes-256-gcm', iv: iv.toString('base64'), tag: c.getAuthTag().toString('base64') },
+    ct: ct.toString('base64'),
+  }, null, 2);
+}
+
+function parse(content) {
+  let j;
+  try { j = JSON.parse(String(content).replace(/^/, '')); } catch { throw new Error('INVALID'); }
+  if (!j || typeof j !== 'object') throw new Error('INVALID');
+  // Altes Format (bis 0.14): unverschlüsseltes JSON mit den Collections auf oberster Ebene
+  if (j.format !== FORMAT) {
+    if (!COLLECTIONS.some((c) => Array.isArray(j[c]))) throw new Error('INVALID');
+    return { encrypted: false, data: j, createdAt: null, app: '' };
+  }
+  return { encrypted: !!j.encrypted, raw: j, data: j.encrypted ? null : j.data, createdAt: j.createdAt, app: j.app };
+}
+
+const counts = (data) => Object.fromEntries([...COLLECTIONS.map((c) => [c, (data[c] || []).length]), ['knownHosts', Object.keys(data.knownHosts || {}).length], ['settings', data.settings ? 1 : 0]]);
+
+// Vorabinfo für die Oberfläche (ohne Passwort)
+function inspectBackup(content) {
+  const b = parse(content);
+  return { encrypted: b.encrypted, createdAt: b.createdAt, app: b.app, counts: b.data ? counts(b.data) : null };
+}
+
+function decrypt(content, password) {
+  const b = parse(content);
+  if (!b.encrypted) return b.data;
+  if (!password) throw new Error('PASSWORD_REQUIRED');
+  const { kdf, cipher, ct } = b.raw;
+  const key = scrypt(password, Buffer.from(kdf.salt, 'base64'), { N: kdf.N, r: kdf.r, p: kdf.p });
+  try {
+    const d = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(cipher.iv, 'base64'));
+    d.setAAD(Buffer.from(FORMAT));
+    d.setAuthTag(Buffer.from(cipher.tag, 'base64'));
+    return JSON.parse(Buffer.concat([d.update(Buffer.from(ct, 'base64')), d.final()]).toString('utf8'));
+  } catch { throw new Error('WRONG_PASSWORD'); }
+}
+
+// opts: { replace: vorhandene Einträge entfernen, die nicht im Backup sind; settings: Einstellungen übernehmen }
+function importBackup(store, content, password, { replace = false, settings = false } = {}) {
+  const data = decrypt(content, password);
+  const d = store.get();
+  store.muted = true;
+  try {
+    for (const c of COLLECTIONS) {
+      const items = Array.isArray(data[c]) ? data[c].filter((x) => x && typeof x === 'object') : [];
+      if (replace) {
+        const keep = new Set(items.map((x) => x.id).filter(Boolean));
+        for (const x of [...(d[c] || [])]) if (!keep.has(x.id)) store.remove(c, x.id);
+      }
+      for (const item of items) store.upsert(c, { ...item });
+    }
+    if (data.knownHosts && typeof data.knownHosts === 'object') d.knownHosts = replace ? { ...data.knownHosts } : { ...d.knownHosts, ...data.knownHosts };
+    if (Array.isArray(data.history)) {
+      const seen = new Set();
+      d.history = [...(replace ? [] : d.history || []), ...data.history].filter((h) => h && !seen.has(h.hostId) && seen.add(h.hostId)).slice(0, 30);
+    }
+    if (settings && data.settings && typeof data.settings === 'object') d.settings = { ...d.settings, ...data.settings };
+  } finally {
+    store.muted = false;
+  }
+  store.save();
+  return counts(data);
+}
+
+module.exports = { createBackup, inspectBackup, importBackup };

src/i18n.js

@@ -151,6 +151,25 @@
     'Send Enter automatically': 'Enter automatisch senden',
     'Command is missing.': 'Befehl fehlt.',
     'No open terminal': 'Kein offenes Terminal',
+    // Support-Assistent
+    'Support assistant (Ollama)': 'Support-Assistent (Ollama)',
+    'Assistant': 'Assistent',
+    'Support assistant': 'Support-Assistent',
+    'New chat': 'Neuer Chat',
+    'Include terminal output': 'Terminalausgabe mitsenden',
+    'Describe the problem … (Enter = send)': 'Problem beschreiben … (Enter = senden)',
+    'Explain last error': 'Letzten Fehler erklären',
+    'Send': 'Senden',
+    'Explain the last error in the terminal output and how to fix it.': 'Erkläre den letzten Fehler in der Terminalausgabe und wie ich ihn behebe.',
+    'Please select an Ollama model in the settings first.': 'Bitte zuerst in den Einstellungen ein Ollama-Modell auswählen.',
+    'Insert into terminal (not executed)': 'Ins Terminal einfügen (wird nicht ausgeführt)',
+    'Insert': 'Einfügen',
+    'Helps with errors in the Linux console via a local <b>Ollama</b> instance. Open it in a terminal tab with the <i>Assistant</i> button. The latest terminal output is sent to the Ollama server as context.': 'Hilft bei Fehlern in der Linux-Konsole über eine lokale <b>Ollama</b>-Instanz. Im Terminal-Tab über den Button <i>Assistent</i> öffnen. Die letzte Terminalausgabe wird als Kontext an den Ollama-Server gesendet.',
+    'Ollama server': 'Ollama-Server',
+    'Model': 'Modell',
+    '– select –': '– auswählen –',
+    'No models installed (ollama pull …)': 'Keine Modelle installiert (ollama pull …)',
+    'Load models': 'Modelle laden',
     'No snippets yet.': 'Noch keine Snippets.',
 
     // Port Forwarding
@@ -351,6 +370,93 @@
     'Touch your security key to unlock MrTerm.': 'Berühre deinen Sicherheitsschlüssel, um MrTerm zu entsperren.',
     'Security key prompt was cancelled or timed out.': 'Die Abfrage des Sicherheitsschlüssels wurde abgebrochen oder ist abgelaufen.',
     'This security key does not support the hmac-secret/PRF extension.': 'Dieser Sicherheitsschlüssel unterstützt die hmac-secret/PRF-Erweiterung nicht.',
+    'This file is not a MrTerm backup.': 'Diese Datei ist kein MrTerm-Backup.',
+    'This backup is encrypted. Please enter the password.': 'Dieses Backup ist verschlüsselt. Bitte gib das Passwort ein.',
+    'Exports all hosts, groups, SSH keys, passwords, snippets, port forwards, VPNs, known hosts and settings.': 'Exportiert alle Hosts, Gruppen, SSH-Keys, Passwörter, Snippets, Portweiterleitungen, VPNs, bekannten Hosts und Einstellungen.',
+    'Recommended. Without a password, keys and passwords are stored in plain text in the file.': 'Empfohlen. Ohne Passwort stehen Schlüssel und Passwörter im Klartext in der Datei.',
+    'Include settings': 'Einstellungen einschließen',
+    'Export': 'Exportieren',
+    'Export without password?': 'Ohne Passwort exportieren?',
+    'Private keys and passwords will be readable by anyone who gets the file.': 'Private Schlüssel und Passwörter sind dann für jeden lesbar, der die Datei erhält.',
+    '{hosts} hosts, {keys} keys, {snippets} snippets, {vpns} VPNs': '{hosts} Hosts, {keys} Schlüssel, {snippets} Snippets, {vpns} VPNs',
+    'Contents are encrypted.': 'Inhalt ist verschlüsselt.',
+    'Import settings': 'Einstellungen übernehmen',
+    'Replace existing data (entries not contained in the backup are deleted)': 'Vorhandene Daten ersetzen (Einträge, die nicht im Backup sind, werden gelöscht)',
+    'Replace existing data?': 'Vorhandene Daten ersetzen?',
+    'Hosts, keys, snippets and other entries that are not in the backup will be deleted.': 'Hosts, Schlüssel, Snippets und andere Einträge, die nicht im Backup sind, werden gelöscht.',
+    'Replace': 'Ersetzen',
+    'Import complete: {hosts} hosts, {keys} keys, {snippets} snippets': 'Import abgeschlossen: {hosts} Hosts, {keys} Schlüssel, {snippets} Snippets',
+    'Stacks folder': 'Stack-Ordner',
+    'Folder on the host in which each stack gets its own subfolder': 'Ordner auf dem Host, in dem jeder Stack einen eigenen Unterordner bekommt',
+    'Template source': 'Vorlagen-Quelle',
+    'URL of a templates.json in Portainer format. Empty = Lissy93/portainer-templates.': 'URL einer templates.json im Portainer-Format. Leer = Lissy93/portainer-templates.',
+    'Containers': 'Container',
+    'Folder': 'Ordner',
+    'Change folder': 'Ordner ändern',
+    'Creates the folder with sudo and makes it writable for {user}.': 'Legt den Ordner per sudo an und macht ihn für {user} beschreibbar.',
+    'Set up folder': 'Ordner einrichten',
+    'From Git': 'Aus Git',
+    'New stack': 'Neuer Stack',
+    'Compose file': 'Compose-Datei',
+    'Found via docker compose ls, outside the stacks folder': 'Über docker compose ls gefunden, außerhalb des Stack-Ordners',
+    'external': 'extern',
+    'not deployed': 'nicht gestartet',
+    'no compose file found': 'keine Compose-Datei gefunden',
+    'Deploy (up -d)': 'Starten (up -d)',
+    'No matches.': 'Keine Treffer.',
+    'No stacks yet. Create one, clone it from Git or start from a template.': 'Noch keine Stacks. Lege einen an, klone ihn aus Git oder starte mit einer Vorlage.',
+    'Update images (pull + up)': 'Images aktualisieren (pull + up)',
+    'Git pull + redeploy': 'Git pull + neu starten',
+    'Down (remove containers)': 'Down (Container entfernen)',
+    'Stack from Git': 'Stack aus Git',
+    'Repository URL': 'Repository-URL',
+    'Stack name': 'Stack-Name',
+    'Branch (optional)': 'Branch (optional)',
+    'Compose file in the repository (optional)': 'Compose-Datei im Repository (optional)',
+    'If empty, the first compose file found is used.': 'Leer = die erste gefundene Compose-Datei wird verwendet.',
+    'Deploy right after cloning': 'Nach dem Klonen direkt starten',
+    'The repository is cloned on the host into the stacks folder. Git asks for credentials in the terminal if needed; for private repos an SSH deploy key or a token in the URL also works.': 'Das Repository wird auf dem Host in den Stack-Ordner geklont. Git fragt Zugangsdaten bei Bedarf im Terminal ab; für private Repos funktioniert auch ein SSH-Deploy-Key oder ein Token in der URL.',
+    'Clone': 'Klonen',
+    'App templates': 'App-Vorlagen',
+    'Search templates …': 'Vorlagen durchsuchen …',
+    'Source: {url} (Portainer template format, changeable in the settings).': 'Quelle: {url} (Portainer-Vorlagenformat, in den Einstellungen änderbar).',
+    'All categories': 'Alle Kategorien',
+    'Delete stack?': 'Stack löschen?',
+    'The stack “{name}” is stopped (down) and its folder {dir} is deleted.': 'Der Stack „{name}“ wird gestoppt (down) und sein Ordner {dir} gelöscht.',
+    'Also delete named volumes (data!)': 'Auch benannte Volumes löschen (Daten!)',
+    'Remove containers?': 'Container entfernen?',
+    'docker compose down stops and removes the containers of “{name}”. Volumes and files are kept.': 'docker compose down stoppt und entfernt die Container von „{name}“. Volumes und Dateien bleiben erhalten.',
+    'Down': 'Down',
+    'Back': 'Zurück',
+    'Save & deploy': 'Speichern & starten',
+    '(variables, used as ${NAME} in the compose file)': '(Variablen, in der Compose-Datei als ${NAME} nutzbar)',
+    'Saved, but the compose file has an error: {msg}': 'Gespeichert, aber die Compose-Datei enthält einen Fehler: {msg}',
+    'Docker Compose was not found on this host (docker compose plugin or docker-compose).': 'Docker Compose wurde auf diesem Host nicht gefunden (docker-compose-Plugin oder docker-compose).',
+    'Could not read {file}': '{file} konnte nicht gelesen werden',
+    'Stack names may only contain lowercase letters, digits, - and _.': 'Stack-Namen dürfen nur Kleinbuchstaben, Ziffern, - und _ enthalten.',
+    'A stack named “{name}” already exists.': 'Ein Stack namens „{name}“ existiert bereits.',
+    'No write permission in {dir}. Use “Set up folder” or save the host password so MrTerm can use sudo.': 'Keine Schreibrechte in {dir}. Nutze „Ordner einrichten“ oder speichere das Host-Passwort, damit MrTerm sudo verwenden kann.',
+    'Templates': 'Vorlagen',
+    'Run': 'Ausführen',
+    'Authorize SSH key for a user': 'SSH-Key für Benutzer freischalten',
+    'Adds a public key from the keychain to ~/.ssh/authorized_keys of the user.': 'Trägt einen öffentlichen Schlüssel aus dem Schlüsselbund in ~/.ssh/authorized_keys des Benutzers ein.',
+    'Key': 'Schlüssel',
+    'Public key is missing.': 'Öffentlicher Schlüssel fehlt.',
+    'User is missing.': 'Benutzer fehlt.',
+    'Install QEMU guest agent': 'QEMU Guest Agent installieren',
+    'Installs and starts qemu-guest-agent (apt, dnf, yum, pacman, zypper or apk).': 'Installiert und startet qemu-guest-agent (apt, dnf, yum, pacman, zypper oder apk).',
+    'Use APT cache server': 'APT-Cache-Server verwenden',
+    'Routes APT downloads through a cache proxy such as apt-cacher-ng (/etc/apt/apt.conf.d/00proxy).': 'Leitet APT-Downloads über einen Cache-Proxy wie apt-cacher-ng (/etc/apt/apt.conf.d/00proxy).',
+    'Proxy URL': 'Proxy-URL',
+    'Invalid URL.': 'Ungültige URL.',
+    'Remove APT cache server': 'APT-Cache-Server entfernen',
+    'Removes the APT proxy setting again.': 'Entfernt die APT-Proxy-Einstellung wieder.',
+    'Updates all packages with the system package manager.': 'Aktualisiert alle Pakete mit dem Paketmanager des Systems.',
+    'Connecting to security key …': 'Verbinde mit dem Sicherheitsschlüssel …',
+    'Enter the PIN of your security key.': 'Gib die PIN deines Sicherheitsschlüssels ein.',
+    'Wrong PIN.': 'Falsche PIN.',
+    '{n} attempts left.': 'Noch {n} Versuche.',
+    'The PIN of this security key is blocked. Remove and reinsert the key, or reset it.': 'Die PIN dieses Sicherheitsschlüssels ist gesperrt. Ziehe den Schlüssel ab und stecke ihn neu ein oder setze ihn zurück.',
 
     // VPN
     '— No VPN —': '— Kein VPN —',
@@ -650,6 +756,38 @@
     'Fingerprint unlock is not set up.': 'Entsperren per Fingerabdruck ist nicht eingerichtet.',
     'Fingerprint unlock failed. Use your password.': 'Entsperren per Fingerabdruck fehlgeschlagen. Verwende dein Passwort.',
     'Set a password first.': 'Lege zuerst ein Passwort fest.',
+    // Web-Version
+    'RDP is not available in the web version.': 'RDP ist in der Web-Version nicht verfügbar.',
+    'Account': 'Konto',
+    'Signed in as {name}': 'Angemeldet als {name}',
+    'Administrator': 'Administrator',
+    'Current password': 'Aktuelles Passwort',
+    'Sign out': 'Abmelden',
+    'Users': 'Benutzer',
+    'User': 'Benutzer',
+    'Delete user?': 'Benutzer löschen?',
+    '“{name}” and their vault will be permanently deleted.': '„{name}“ und der zugehörige Tresor werden endgültig gelöscht.',
+    'Add user': 'Benutzer hinzufügen',
+    'Your vault is stored on the server, encrypted with a key that only your login password can unlock.': 'Dein Tresor liegt auf dem Server, verschlüsselt mit einem Schlüssel, den nur dein Login-Passwort entsperren kann.',
+    'Folders cannot be downloaded in the browser: {name}': 'Ordner können im Browser nicht heruntergeladen werden: {name}',
+    'Welcome! Create the administrator account for this MrTerm server.': 'Willkommen! Lege das Administrator-Konto für diesen MrTerm-Server an.',
+    'Sign in to your MrTerm server.': 'Melde dich an deinem MrTerm-Server an.',
+    'Create account': 'Konto anlegen',
+    'Sign in': 'Anmelden',
+    'Administrators only.': 'Nur für Administratoren.',
+    'Forbidden': 'Nicht erlaubt',
+    'Not signed in': 'Nicht angemeldet',
+    'Setup is already complete.': 'Die Einrichtung ist bereits abgeschlossen.',
+    'The current password is wrong.': 'Das aktuelle Passwort ist falsch.',
+    'The last administrator cannot be deleted.': 'Der letzte Administrator kann nicht gelöscht werden.',
+    'Too many failed attempts. Try again in 15 minutes.': 'Zu viele Fehlversuche. Versuche es in 15 Minuten erneut.',
+    'User not found.': 'Benutzer nicht gefunden.',
+    'Wrong username or password.': 'Benutzername oder Passwort falsch.',
+    'You cannot delete yourself.': 'Du kannst dich nicht selbst löschen.',
+    'The password must be at least 8 characters long.': 'Das Passwort muss mindestens 8 Zeichen lang sein.',
+    'This username is already taken.': 'Dieser Benutzername ist bereits vergeben.',
+    'Usernames may contain letters, digits and . _ @ - (max. 64).': 'Benutzernamen dürfen Buchstaben, Ziffern und . _ @ - enthalten (max. 64).',
+    'Connection lost – reconnecting …': 'Verbindung verloren – verbinde neu …',
     // Main-Prozess
     'Host key has changed!': 'Host-Schlüssel hat sich geändert!',
     'Unknown host': 'Unbekannter Host',

src/main/ai.js

@@ -0,0 +1,91 @@
+// Support-Assistent über eine Ollama-Instanz (lokal oder im Netz).
+// Antworten werden gestreamt: send('ai:event', chatId, 'data' | 'done' | 'error', payload)
+const http = require('http');
+const https = require('https');
+
+const SYSTEM_PROMPT = `You are the MrTerm support assistant, an experienced Linux system administrator.
+The user works in an SSH terminal on a Linux server (typically Ubuntu, Debian or Proxmox).
+You may receive the latest terminal output as context. Your job:
+- Explain errors briefly and clearly, name the most likely cause.
+- Suggest concrete, copy-pasteable shell commands in \`\`\`bash code blocks, one step at a time.
+- Warn explicitly before destructive commands (rm -rf, dd, mkfs, firewall changes that may lock out SSH, network changes).
+- If information is missing, say which command would provide it.
+Answer in the language of the user's question. Be concise.`;
+
+function request(base, path, { method = 'GET', body, signal } = {}) {
+  const url = new URL(path, base.endsWith('/') ? base : base + '/');
+  const lib = url.protocol === 'https:' ? https : http;
+  return new Promise((resolve, reject) => {
+    const req = lib.request(url, { method, headers: body ? { 'Content-Type': 'application/json' } : {}, signal, timeout: 15000 }, (res) => {
+      if (res.statusCode >= 400) {
+        let t = ''; res.on('data', (c) => (t += c));
+        res.on('end', () => { let m = t; try { m = JSON.parse(t).error || t; } catch {} reject(new Error(`Ollama: ${m || res.statusCode}`)); });
+        return;
+      }
+      resolve(res);
+    });
+    req.on('timeout', () => req.destroy(new Error('Ollama: timeout')));
+    req.on('error', (e) => reject(e.code === 'ECONNREFUSED' ? new Error(`Ollama not reachable at ${base}`) : e));
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+class AiAssistant {
+  constructor(store, send) {
+    this.store = store;
+    this.send = send;
+    this.running = new Map();
+  }
+
+  get cfg() {
+    const s = this.store.get().settings;
+    return { url: s.aiUrl || 'http://localhost:11434', model: s.aiModel || '' };
+  }
+
+  async models(url) {
+    const res = await request(url || this.cfg.url, 'api/tags');
+    let t = ''; for await (const c of res) t += c;
+    return (JSON.parse(t).models || []).map((m) => m.name);
+  }
+
+  // messages: [{ role: 'user' | 'assistant', content }], context: letzte Terminalausgabe
+  async chat(chatId, messages, context = '') {
+    const { url, model } = this.cfg;
+    if (!model) throw new Error('No Ollama model selected (Settings → Support assistant).');
+    this.stop(chatId);
+    const ctrl = new AbortController();
+    this.running.set(chatId, ctrl);
+    const sys = SYSTEM_PROMPT + (context ? `\n\nLatest terminal output:\n\`\`\`\n${context.slice(-12000)}\n\`\`\`` : '');
+    (async () => {
+      try {
+        const res = await request(url, 'api/chat', { method: 'POST', signal: ctrl.signal, body: { model, stream: true, messages: [{ role: 'system', content: sys }, ...messages] } });
+        res.setTimeout(0);
+        let buf = '';
+        for await (const chunk of res) {
+          buf += chunk;
+          let i;
+          while ((i = buf.indexOf('\n')) >= 0) {
+            const line = buf.slice(0, i).trim(); buf = buf.slice(i + 1);
+            if (!line) continue;
+            const m = JSON.parse(line);
+            if (m.error) throw new Error(`Ollama: ${m.error}`);
+            if (m.message?.content) this.send('ai:event', chatId, 'data', m.message.content);
+          }
+        }
+        this.send('ai:event', chatId, 'done');
+      } catch (e) {
+        if (ctrl.signal.aborted) this.send('ai:event', chatId, 'done');
+        else this.send('ai:event', chatId, 'error', e.message || String(e));
+      } finally {
+        if (this.running.get(chatId) === ctrl) this.running.delete(chatId);
+      }
+    })();
+    return true;
+  }
+
+  stop(chatId) { this.running.get(chatId)?.abort(); this.running.delete(chatId); }
+  stopAll() { for (const c of this.running.values()) c.abort(); this.running.clear(); }
+}
+
+module.exports = { AiAssistant };

src/main/compose-templates.js

@@ -0,0 +1,75 @@
+// App-Vorlagen im Portainer-Format (v2/v3), z. B. https://github.com/Lissy93/portainer-templates.
+// Container-Vorlagen (type 1) werden in eine compose.yaml umgewandelt; Stack-Vorlagen (type 2/3) laden die
+// Compose-Datei aus dem angegebenen GitHub-Repository. Umgebungsvariablen landen mit Standardwerten in der .env.
+const DEFAULT_URL = 'https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json';
+
+let cache = { url: '', at: 0, list: [] };
+
+const y = (v) => JSON.stringify(String(v)); // JSON-Strings sind gültiges YAML
+const slug = (s) => String(s || 'app').toLowerCase().replace(/[^a-z0-9_-]+/g, '-').replace(/^[-_]+|[-_]+$/g, '').slice(0, 40) || 'app';
+
+async function list(url = DEFAULT_URL) {
+  url = url || DEFAULT_URL;
+  if (cache.url === url && Date.now() - cache.at < 3600e3) return cache.list;
+  const res = await fetch(url, { headers: { Accept: 'application/json' } });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const j = await res.json();
+  const items = (Array.isArray(j) ? j : j.templates || []).filter((t) => t && t.title && (t.image || t.repository?.stackfile));
+  const listed = items.map((t, i) => ({
+    i, title: t.title, description: String(t.description || '').slice(0, 400), categories: t.categories || [],
+    kind: t.image ? 'container' : 'stack', note: t.note || '', t,
+  }));
+  cache = { url, at: Date.now(), list: listed };
+  return listed;
+}
+
+// Für die Oberfläche ohne Rohdaten
+const summary = (l) => l.map(({ t: _t, ...rest }) => rest);
+
+function envFile(env) {
+  return (env || []).filter((e) => e?.name).map((e) => {
+    const def = e.select ? (e.select.find((x) => x.default) || e.select[0] || {}).value : e.default;
+    const hint = [e.label && e.label !== e.name ? e.label : '', e.description || '', e.select ? `(${e.select.map((x) => x.value).join(' | ')})` : ''].filter(Boolean).join(' – ');
+    return `${hint ? `# ${hint.replace(/\n/g, ' ')}\n` : ''}${e.name}=${def ?? ''}`;
+  }).join('\n');
+}
+
+function containerCompose(t, name) {
+  const L = ['services:', `  ${name}:`, `    image: ${y(t.image)}`, `    container_name: ${y(name)}`, `    restart: ${y(t.restart_policy || 'unless-stopped')}`];
+  if (t.hostname) L.push(`    hostname: ${y(t.hostname)}`);
+  if (t.command) L.push(`    command: ${y(t.command)}`);
+  if (t.privileged) L.push('    privileged: true');
+  if (t.interactive) L.push('    stdin_open: true', '    tty: true');
+  if (t.network === 'host') L.push('    network_mode: host');
+  if (t.ports?.length && t.network !== 'host') L.push('    ports:', ...t.ports.map((p) => `      - ${y(p)}`));
+  if (t.env?.length) L.push('    environment:', ...t.env.filter((e) => e?.name).map((e) => `      - ${y(`${e.name}=\${${e.name}}`)}`));
+  if (t.volumes?.length) {
+    L.push('    volumes:', ...t.volumes.filter((v) => v?.container).map((v) => {
+      const host = v.bind ? v.bind.replace(/^\/portainer\/Files\/AppData\/[^/]+\/?/, './data/') : `./data${v.container}`;
+      return `      - ${y(`${host.replace(/\/$/, '') || './data'}:${v.container}${v.readonly ? ':ro' : ''}`)}`;
+    }));
+  }
+  if (t.labels?.length) L.push('    labels:', ...t.labels.filter((l) => l?.name).map((l) => `      ${y(l.name)}: ${y(l.value ?? '')}`));
+  return L.join('\n') + '\n';
+}
+
+// Liefert { name, compose, env, note }
+async function build(index, url) {
+  const l = await list(url);
+  const item = l.find((x) => x.i === index);
+  if (!item) throw new Error('Template not found');
+  const t = item.t;
+  const name = slug(t.name || t.title);
+  let compose;
+  if (t.image) compose = containerCompose(t, name);
+  else {
+    const m = /^https:\/\/github\.com\/([^/]+)\/([^/.]+?)(?:\.git)?\/?$/.exec(t.repository.url || '');
+    if (!m) throw new Error(`Only GitHub repositories are supported (${t.repository.url}). Use “Clone from Git” instead.`);
+    const res = await fetch(`https://raw.githubusercontent.com/${m[1]}/${m[2]}/HEAD/${t.repository.stackfile.replace(/^\/+/, '')}`);
+    if (!res.ok) throw new Error(`HTTP ${res.status}: ${t.repository.stackfile}`);
+    compose = await res.text();
+  }
+  return { name, compose, env: envFile(t.env), note: String(t.note || '').replace(/<[^>]+>/g, '') };
+}
+
+module.exports = { list: async (url) => summary(await list(url)), build, DEFAULT_URL };

src/main/ctap2.js

@@ -0,0 +1,257 @@
+// Minimaler CTAP2-Client über Linux-hidraw (ohne native Module).
+// Nötig, weil Chromium/Electron keine PIN-Eingabe für WebAuthn hat: Schlüssel mit gesetzter FIDO2-PIN
+// (z. B. YubiKey 5 ohne makeCredUvNotRqd) verlangen die PIN beim Registrieren, und Chromium bricht dann
+// nach dem Berühren mit NotAllowedError ab. Hier läuft makeCredential direkt, mit PIN-Token (Protokoll 1).
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+// ---- CBOR (nur was CTAP2 braucht; Map-Schlüssel kanonisch sortiert) ----
+function head(major, n) {
+  if (n < 24) return Buffer.from([(major << 5) | n]);
+  if (n < 0x100) return Buffer.from([(major << 5) | 24, n]);
+  if (n < 0x10000) { const b = Buffer.alloc(3); b[0] = (major << 5) | 25; b.writeUInt16BE(n, 1); return b; }
+  const b = Buffer.alloc(5); b[0] = (major << 5) | 26; b.writeUInt32BE(n, 1); return b;
+}
+function enc(v) {
+  if (typeof v === 'number') return v >= 0 ? head(0, v) : head(1, -1 - v);
+  if (typeof v === 'boolean') return Buffer.from([v ? 0xf5 : 0xf4]);
+  if (typeof v === 'string') { const s = Buffer.from(v, 'utf8'); return Buffer.concat([head(3, s.length), s]); }
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.concat([head(2, v.length), Buffer.from(v)]);
+  if (Array.isArray(v)) return Buffer.concat([head(4, v.length), ...v.map(enc)]);
+  if (v instanceof Map) {
+    const items = [...v].map(([k, x]) => [enc(k), enc(x)])
+      .sort(([a], [b]) => a.length - b.length || Buffer.compare(a, b));
+    return Buffer.concat([head(5, items.length), ...items.flat()]);
+  }
+  throw new Error('CBOR: unsupported value');
+}
+function dec(buf, pos = 0) {
+  const ib = buf[pos++], major = ib >> 5, ai = ib & 31;
+  let n = ai;
+  if (ai === 24) n = buf[pos++];
+  else if (ai === 25) { n = buf.readUInt16BE(pos); pos += 2; }
+  else if (ai === 26) { n = buf.readUInt32BE(pos); pos += 4; }
+  else if (ai === 27) { n = Number(buf.readBigUInt64BE(pos)); pos += 8; }
+  switch (major) {
+    case 0: return [n, pos];
+    case 1: return [-1 - n, pos];
+    case 2: return [buf.subarray(pos, pos + n), pos + n];
+    case 3: return [buf.toString('utf8', pos, pos + n), pos + n];
+    case 4: { const a = []; for (let i = 0; i < n; i++) { let x; [x, pos] = dec(buf, pos); a.push(x); } return [a, pos]; }
+    case 5: { const m = new Map(); for (let i = 0; i < n; i++) { let k, x; [k, pos] = dec(buf, pos); [x, pos] = dec(buf, pos); m.set(k, x); } return [m, pos]; }
+    case 6: return dec(buf, pos);
+    default: return [ai === 20 ? false : ai === 21 ? true : null, pos];
+  }
+}
+
+// ---- CTAPHID ----
+const CMD = { CBOR: 0x10, INIT: 0x06, CANCEL: 0x11, KEEPALIVE: 0x3b, ERROR: 0x3f };
+
+class CtapError extends Error {
+  constructor(code) { super(`CTAP2 error 0x${code.toString(16).padStart(2, '0')}`); this.code = code; }
+}
+
+function findDevice() {
+  const base = '/sys/class/hidraw';
+  let names = [];
+  try { names = fs.readdirSync(base); } catch { return null; }
+  for (const n of names) {
+    try {
+      const rd = fs.readFileSync(path.join(base, n, 'device', 'report_descriptor'));
+      if (rd.includes(Buffer.from([0x06, 0xd0, 0xf1]))) return '/dev/' + n; // Usage Page 0xF1D0 (FIDO)
+    } catch { /* ignorieren */ }
+  }
+  return null;
+}
+
+class Device {
+  static open() {
+    const p = findDevice();
+    if (!p) return null;
+    const d = new Device();
+    d.fd = fs.openSync(p, 'r+');
+    d.cid = Buffer.from([0xff, 0xff, 0xff, 0xff]);
+    return d;
+  }
+  close() {
+    this.closed = true;
+    try { fs.closeSync(this.fd); } catch { /* ignorieren */ }
+  }
+  // Nur lesen, während eine Antwort erwartet wird – so hängt nach close() kein blockierender Read im Threadpool
+  readPacket() {
+    const b = Buffer.alloc(64);
+    return new Promise((resolve, reject) => fs.read(this.fd, b, 0, 64, null, (e, n) => (e ? reject(e) : resolve(b.subarray(0, n)))));
+  }
+  write(cmd, data) {
+    const pkt = (b) => { const r = Buffer.alloc(65); b.copy(r, 1); fs.writeSync(this.fd, r); };
+    const first = Buffer.alloc(64);
+    this.cid.copy(first, 0); first[4] = 0x80 | cmd; first.writeUInt16BE(data.length, 5);
+    data.copy(first, 7, 0, 57); pkt(first);
+    for (let off = 57, seq = 0; off < data.length; off += 59, seq++) {
+      const c = Buffer.alloc(64);
+      this.cid.copy(c, 0); c[4] = seq; data.copy(c, 5, off, off + 59); pkt(c);
+    }
+  }
+  async transact(cmd, data) {
+    this.write(cmd, data);
+    for (;;) {
+      const r = await this.readPacket();
+      if (!r.subarray(0, 4).equals(this.cid)) continue;
+      const rcmd = r[4] & 0x7f;
+      if (rcmd === CMD.KEEPALIVE) continue;
+      const len = r.readUInt16BE(5);
+      const parts = [r.subarray(7)];
+      let got = r.length - 7;
+      while (got < len) { const c = await this.readPacket(); parts.push(c.subarray(5)); got += c.length - 5; }
+      const body = Buffer.concat(parts).subarray(0, len);
+      if (rcmd === CMD.ERROR) throw new Error(`CTAPHID error 0x${body[0].toString(16)}`);
+      return body;
+    }
+  }
+  async init() {
+    const nonce = crypto.randomBytes(8);
+    for (;;) {
+      const r = await this.transact(CMD.INIT, nonce);
+      if (r.subarray(0, 8).equals(nonce)) { this.cid = Buffer.from(r.subarray(8, 12)); return; }
+    }
+  }
+  cancel() { try { if (!this.closed) this.write(CMD.CANCEL, Buffer.alloc(0)); } catch { /* ignorieren */ } }
+  async cbor(cmd, params) {
+    const r = await this.transact(CMD.CBOR, Buffer.concat([Buffer.from([cmd]), params ? enc(params) : Buffer.alloc(0)]));
+    if (r[0] !== 0) throw new CtapError(r[0]);
+    return r.length > 1 ? dec(r, 1)[0] : new Map();
+  }
+}
+
+// ---- PIN-Protokoll 1 ----
+const aes = (mode, key, data) => {
+  const c = mode === 'enc' ? crypto.createCipheriv('aes-256-cbc', key, Buffer.alloc(16)) : crypto.createDecipheriv('aes-256-cbc', key, Buffer.alloc(16));
+  c.setAutoPadding(false);
+  return Buffer.concat([c.update(data), c.final()]);
+};
+
+async function sharedSecret(dev) {
+  const ka = (await dev.cbor(0x06, new Map([[1, 1], [2, 2]]))).get(1);
+  const ecdh = crypto.createECDH('prime256v1');
+  ecdh.generateKeys();
+  const z = ecdh.computeSecret(Buffer.concat([Buffer.from([4]), ka.get(-2), ka.get(-3)]));
+  const pub = ecdh.getPublicKey();
+  const platformKey = new Map([[1, 2], [3, -25], [-1, 1], [-2, pub.subarray(1, 33)], [-3, pub.subarray(33, 65)]]);
+  return { key: crypto.createHash('sha256').update(z).digest(), platformKey };
+}
+
+async function pinToken(dev, pin) {
+  const { key, platformKey } = await sharedSecret(dev);
+  const pinHash = crypto.createHash('sha256').update(pin, 'utf8').digest().subarray(0, 16);
+  const r = await dev.cbor(0x06, new Map([[1, 1], [2, 5], [3, platformKey], [6, aes('enc', key, pinHash)]]));
+  return aes('dec', key, r.get(2));
+}
+
+async function pinRetries(dev) {
+  try { return (await dev.cbor(0x06, new Map([[1, 1], [2, 1]]))).get(3); } catch { return undefined; }
+}
+
+// Status-Codes, die für "abgebrochen / nicht bestätigt / Zeit abgelaufen" stehen
+const CANCEL_CODES = new Set([0x27, 0x2d, 0x2f, 0x3a]);
+const PIN = { INVALID: 0x31, BLOCKED: 0x32, AUTH_BLOCKED: 0x34 };
+
+// Registriert ein nicht-residentes Credential mit hmac-secret für rpId "localhost" (kompatibel zur
+// WebAuthn-PRF-Abfrage in fido.js). ui: { askPin(retries, wrong) -> Promise<string|null>, touch() }
+// Liefert die Credential-ID als Buffer, oder null, wenn kein FIDO2-Gerät per hidraw erreichbar ist.
+async function makeCredential(ui, { timeoutMs = 60000 } = {}) {
+  let dev;
+  try { dev = Device.open(); } catch { return null; }
+  if (!dev) return null;
+  let timer;
+  const abort = () => dev.cancel();
+  try {
+    await dev.init();
+    const info = await dev.cbor(0x04);
+    if (!(info.get(1) || []).some((v) => String(v).startsWith('FIDO_2'))) return null;
+    if (!(info.get(2) || []).includes('hmac-secret')) throw new CtapError(-1);
+    const opts = info.get(4) || new Map();
+
+    const params = new Map([
+      [2, new Map([['id', 'localhost'], ['name', 'MrTerm']])],
+      [3, new Map([['id', crypto.randomBytes(16)], ['name', 'MrTerm'], ['displayName', 'MrTerm']])],
+      [4, [-7, -8, -257].map((alg) => new Map([['alg', alg], ['type', 'public-key']]))],
+      [6, new Map([['hmac-secret', true]])],
+    ]);
+    const cdh = crypto.randomBytes(32);
+    params.set(1, cdh);
+
+    if (opts.get('clientPin') === true && opts.get('makeCredUvNotRqd') !== true) {
+      let wrong = false;
+      for (;;) {
+        const pin = await ui.askPin(await pinRetries(dev), wrong);
+        if (pin == null) throw new CtapError(0x2d);
+        try {
+          const tok = await pinToken(dev, pin);
+          params.set(8, crypto.createHmac('sha256', tok).update(cdh).digest().subarray(0, 16));
+          params.set(9, 1);
+          break;
+        } catch (e) {
+          if (e.code === PIN.INVALID) { wrong = true; continue; }
+          throw e;
+        }
+      }
+    }
+
+    ui.touch(abort);
+    timer = setTimeout(abort, timeoutMs);
+    const r = await dev.cbor(0x01, params);
+    const authData = r.get(2);
+    const idLen = authData.readUInt16BE(53);
+    return Buffer.from(authData.subarray(55, 55 + idLen));
+  } finally {
+    clearTimeout(timer);
+    dev.close();
+  }
+}
+
+// Entspricht WebAuthn-PRF (evalByCredential) über hmac-secret, ohne PIN (wie Chromium mit
+// userVerification "discouraged"). creds: [{ credId: Buffer, salt: Buffer }] – salt ist der rohe PRF-Eingabewert.
+// Liefert { credId: Buffer, secret: Buffer(32) }, oder null, wenn kein FIDO2-Gerät per hidraw erreichbar ist.
+async function getHmacSecret(ui, creds, { timeoutMs = 60000 } = {}) {
+  let dev;
+  try { dev = Device.open(); } catch { return null; }
+  if (!dev) return null;
+  let timer;
+  try {
+    await dev.init();
+    const info = await dev.cbor(0x04);
+    if (!(info.get(1) || []).some((v) => String(v).startsWith('FIDO_2'))) return null;
+    const rpId = 'localhost';
+    const desc = (c) => new Map([['id', c.credId], ['type', 'public-key']]);
+    // Welches Credential liegt auf diesem Schlüssel? (Vorabprüfung ohne Berühren, up=false)
+    let cred = null;
+    for (const c of creds) {
+      try {
+        await dev.cbor(0x02, new Map([[1, rpId], [2, crypto.randomBytes(32)], [3, [desc(c)]], [5, new Map([['up', false]])]]));
+        cred = c; break;
+      } catch (e) { if (e.code !== 0x2e) throw e; }
+    }
+    if (!cred) throw new CtapError(0x2e);
+    const { key, platformKey } = await sharedSecret(dev);
+    const salt = crypto.createHash('sha256').update(Buffer.concat([Buffer.from('WebAuthn PRF\0', 'latin1'), cred.salt])).digest();
+    const saltEnc = aes('enc', key, salt);
+    const saltAuth = crypto.createHmac('sha256', key).update(saltEnc).digest().subarray(0, 16);
+    ui.touch(() => dev.cancel());
+    timer = setTimeout(() => dev.cancel(), timeoutMs);
+    const r = await dev.cbor(0x02, new Map([
+      [1, rpId], [2, crypto.randomBytes(32)], [3, [desc(cred)]],
+      [4, new Map([['hmac-secret', new Map([[1, platformKey], [2, saltEnc], [3, saltAuth]])]])],
+    ]));
+    const authData = r.get(2);
+    if (!(authData[32] & 0x80)) throw new CtapError(-1);
+    const ext = dec(authData, 37)[0].get('hmac-secret');
+    if (!ext) throw new CtapError(-1);
+    return { credId: Buffer.from(cred.credId), secret: aes('dec', key, ext).subarray(0, 32) };
+  } finally {
+    clearTimeout(timer);
+    dev.close();
+  }
+}
+
+module.exports = { makeCredential, getHmacSecret, CtapError, CANCEL_CODES, PIN };

src/main/docker.js

@@ -8,6 +8,12 @@ const ACTIONS = { start: 'start', stop: 'stop', restart: 'restart', remove: 'rm
 const LIST_FMT = "'{{.ID}}\\t{{.Names}}\\t{{.Image}}\\t{{.State}}\\t{{.Status}}\\t{{.Ports}}'";
 const STATS_FMT = "'{{.ID}}\\t{{.CPUPerc}}\\t{{.MemUsage}}'";
 const lastLine = (s) => String(s || '').split('\n').map((l) => l.trim()).filter(Boolean).slice(-1)[0] || '';
+const q = (v) => `'${String(v).replace(/'/g, `'\\''`)}'`;
+const STACK_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+const COMPOSE_NAMES = ['compose.yaml', 'compose.yml', 'docker-compose.yaml', 'docker-compose.yml'];
+const absPath = (p) => { if (typeof p !== 'string' || !p.startsWith('/') || /[\n\0]/.test(p) || p.split('/').includes('..')) throw new Error('Invalid path'); return p; };
+const dirname = (p) => p.replace(/\/[^/]*$/, '') || '/';
+const b64 = (t) => Buffer.from(String(t), 'utf8').toString('base64');
 const denied = (s) => /permission denied|connect to the docker daemon socket/i.test(s);
 
 function execOn(conn, cmd, stdin) {
@@ -102,6 +108,133 @@ class DockerManager {
     return `${pre} exec -it ${cid} sh -c 'if command -v bash >/dev/null 2>&1; then exec bash; else exec sh; fi'`;
   }
 
+  // ---------- Compose-Stacks ----------
+  // Stacks liegen je in einem Unterordner von stacksDir (wie Dockge); zusätzlich werden per `compose ls`
+  // gefundene Projekte außerhalb davon angezeigt. Dateien werden ohne sudo geschrieben, sonst per sudo mit Host-Passwort.
+  async composeCmd(s) {
+    if (s.compose) return s.compose;
+    const cands = s.runtime === 'podman' ? ['podman compose', 'podman-compose'] : ['docker compose', 'docker-compose'];
+    for (const c of cands) {
+      const r = await execOn(s.conn, `${c} version >/dev/null 2>&1`);
+      if (!r.code) return (s.compose = c);
+    }
+    throw new Error(i18n.t('Docker Compose was not found on this host (docker compose plugin or docker-compose).'));
+  }
+
+  // Shell-Skript ausführen, bei fehlender Berechtigung per sudo (nur mit gespeichertem Passwort)
+  async sh(s, script) {
+    let r = await execOn(s.conn, `sh -c ${q(script)}`);
+    if (r.code && /permission denied|operation not permitted/i.test(r.err) && s.host.password) {
+      r = await execOn(s.conn, `sudo -S -p '' sh -c ${q(script)}`, `${s.host.password}\n`);
+    }
+    return r;
+  }
+
+  async stacks(id, stacksDir) {
+    const s = this.get(id);
+    const dir = absPath(stacksDir);
+    const compose = await this.composeCmd(s);
+    const find = COMPOSE_NAMES.map((n) => `-name ${n}`).join(' -o ');
+    const scan = `d=${q(dir)}; [ -d "$d" ] && echo "#exists"; [ -w "$d" ] && echo "#writable"; for p in "$d"/*/; do [ -d "$p" ] || continue; `
+      + `f=""; for c in ${COMPOSE_NAMES.join(' ')}; do [ -f "$p$c" ] && { f="$p$c"; break; }; done; `
+      + `[ -n "$f" ] || f=$(find "$p" -maxdepth 3 \\( ${find} \\) 2>/dev/null | head -n1); `
+      + `g=""; [ -d "$p.git" ] && g="git:$(git -C "$p" remote get-url origin 2>/dev/null)"; `
+      + `printf '%s\\t%s\\t%s\\n' "$(basename "$p")" "$f" "$g"; done`;
+    const [r, ls] = await Promise.all([execOn(s.conn, `sh -c ${q(scan)}`), this.runCompose(s, compose, 'ls -a --format json')]);
+    const lines = r.out.split('\n').filter(Boolean);
+    let running = [];
+    try { running = JSON.parse(ls.out.trim() || '[]'); } catch { /* podman-compose kennt kein ls */ }
+    const status = new Map(running.map((x) => [x.Name, { status: x.Status, files: String(x.ConfigFiles || '').split(',').filter(Boolean) }]));
+    const list = lines.filter((l) => !l.startsWith('#')).map((l) => {
+      const [name, file, git] = l.split('\t');
+      return { name, dir: `${dir.replace(/\/$/, '')}/${name}`, file: file ? file.replace(/\/\//g, '/') : '', git: git ? git.slice(4) || true : false, managed: true, status: status.get(name)?.status || '' };
+    });
+    for (const [name, st] of status) {
+      if (list.some((x) => x.name === name) || !st.files[0]) continue;
+      list.push({ name, dir: dirname(st.files[0]), file: st.files[0], git: false, managed: false, status: st.status });
+    }
+    return { dir, exists: lines.includes('#exists'), writable: lines.includes('#writable'), compose, sudo: s.sudo, stacks: list.sort((a, b) => a.name.localeCompare(b.name)) };
+  }
+
+  runCompose(s, compose, args) {
+    const sudo = s.sudo ? "sudo -S -p '' " : '';
+    return execOn(s.conn, `${sudo}${compose} ${args}`, s.sudo ? `${s.host.password || ''}\n` : '');
+  }
+
+  async readStack(id, file) {
+    const s = this.get(id);
+    const f = absPath(file);
+    const r = await this.sh(s, `cat ${q(f)} && printf '\\n\\0' && { cat ${q(dirname(f) + '/.env')} 2>/dev/null || true; }`);
+    if (r.code) throw new Error(lastLine(r.err) || i18n.t('Could not read {file}', { file: f }));
+    const i = r.out.lastIndexOf('\n\0');
+    return { compose: r.out.slice(0, i), env: r.out.slice(i + 2) };
+  }
+
+  // { stacksDir, name, file?, compose, env } – ohne file wird ein neuer Stack angelegt. Liefert { file, warning }
+  async saveStack(id, { stacksDir, name, file, compose, env }) {
+    const s = this.get(id);
+    let f;
+    if (file) f = absPath(file);
+    else {
+      if (!STACK_NAME.test(name || '')) throw new Error(i18n.t('Stack names may only contain lowercase letters, digits, - and _.'));
+      f = `${absPath(stacksDir).replace(/\/$/, '')}/${name}/compose.yaml`;
+    }
+    const d = dirname(f);
+    const envFile = `${d}/.env`;
+    const script = `${file ? '' : `[ -e ${q(d)} ] && { echo "exists" >&2; exit 3; }; `}mkdir -p ${q(d)} && echo ${b64(compose)} | base64 -d > ${q(f)} && `
+      + (String(env || '').trim() ? `(umask 077; echo ${b64(env.endsWith('\n') ? env : env + '\n')} | base64 -d > ${q(envFile)})` : `rm -f ${q(envFile)}`);
+    const r = await this.sh(s, script);
+    if (r.code === 3) throw new Error(i18n.t('A stack named “{name}” already exists.', { name }));
+    if (r.code) {
+      if (/permission denied/i.test(r.err)) throw new Error(i18n.t('No write permission in {dir}. Use “Set up folder” or save the host password so MrTerm can use sudo.', { dir: d }));
+      throw new Error(lastLine(r.err) || 'Error');
+    }
+    const compose2 = await this.composeCmd(s);
+    const v = await this.runCompose(s, compose2, `--project-directory ${q(d)} -f ${q(f)} config -q`);
+    return { file: f, warning: v.code ? lastLine(v.err) || 'compose config failed' : '' };
+  }
+
+  // Befehl für einen Terminal-Tab (Ausgabe live; sudo/git fragen dort selbst nach Passwörtern)
+  async stackCommand(id, action, st, opts = {}) {
+    const s = this.get(id);
+    const compose = `${s.sudo ? 'sudo ' : ''}${await this.composeCmd(s)}`;
+    const S = (dir) => `S=$([ -w ${q(dir)} ] || echo sudo); `;
+    if (action === 'setup') {
+      const d = absPath(st.dir);
+      return `sudo mkdir -p ${q(d)} && sudo chown "$(id -u):$(id -g)" ${q(d)} && echo OK: ${q(d)}`;
+    }
+    if (action === 'clone') {
+      if (!STACK_NAME.test(st.name || '')) throw new Error(i18n.t('Stack names may only contain lowercase letters, digits, - and _.'));
+      if (!/^(https?:\/\/|git@|ssh:\/\/)\S+$/.test(opts.url || '')) throw new Error(i18n.t('Invalid repository URL: {url}', { url: opts.url || '' }));
+      const parent = absPath(st.stacksDir).replace(/\/$/, '');
+      const d = `${parent}/${st.name}`;
+      const sub = opts.path ? absPath('/' + opts.path.replace(/^\/+/, '')).slice(1) : '';
+      const find = COMPOSE_NAMES.map((n) => `-name ${n}`).join(' -o ');
+      const locate = sub ? `f=${q(`${d}/${sub}`)}` : `f=$(find ${q(d)} -maxdepth 3 \\( ${find} \\) | head -n1)`;
+      return `${S(parent)}command -v git >/dev/null || { echo "git is not installed"; exit 1; }; $S git clone ${opts.branch ? `--branch ${q(opts.branch)} ` : ''}${q(opts.url)} ${q(d)} && `
+        + `{ [ "$S" ] && $S chown -R "$(id -u):$(id -g)" ${q(d)}; true; } && ${locate} && [ -f "$f" ] && echo "Compose: $f"`
+        + (opts.deploy ? ` && cd "$(dirname "$f")" && ${compose} -p ${q(st.name)} up -d` : '');
+    }
+    const f = absPath(st.file);
+    const cd = `cd ${q(dirname(f))} && `;
+    const p = `${compose} -p ${q(st.name)} -f ${q(f)}`;
+    switch (action) {
+      case 'up': return `${cd}${p} up -d --remove-orphans`;
+      case 'stop': return `${cd}${p} stop`;
+      case 'restart': return `${cd}${p} restart`;
+      case 'down': return `${cd}${p} down`;
+      case 'pull': return `${cd}${p} pull && ${p} up -d --remove-orphans`;
+      case 'logs': return `${cd}${p} logs -f --tail 200`;
+      case 'gitpull': return `${cd}${S(dirname(f))}$S git pull --ff-only && ${p} up -d --remove-orphans`;
+      case 'delete': {
+        if (!st.managed) throw new Error('Only stacks in the stacks folder can be deleted');
+        const d = absPath(st.dir);
+        return `${cd}${p} down${opts.volumes ? ' -v' : ''}; cd / && ${S(dirname(d))}$S rm -rf ${q(d)} && echo "Deleted: ${d.replace(/"/g, '')}"`;
+      }
+      default: throw new Error('Invalid action');
+    }
+  }
+
   close(id) {
     const s = this.sessions.get(id);
     if (!s) return;

src/main/fido.js

@@ -4,8 +4,11 @@
 // abgefangen wird (kein echter Server). rpId ist damit immer "localhost".
 // Aus dem Schlüssel wird per PRF-Erweiterung (CTAP hmac-secret) ein geheimer Wert abgeleitet, der den
 // Datenschlüssel des Vaults verpackt. userVerification "discouraged": Berühren genügt (Electron hat keine PIN-Eingabe).
+// Registrieren läuft unter Linux direkt per CTAP2 (ctap2.js), weil Electron keine PIN-Abfrage kennt und
+// Schlüssel mit gesetzter PIN sonst nach dem Berühren mit NotAllowedError scheitern.
 const { BrowserWindow, session } = require('electron');
 const i18n = require('../i18n');
+const ctap2 = require('./ctap2');
 
 const PAGE = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>
   html,body{margin:0;height:100%;background:#1a1d27;color:#e6e8ef;font:14px system-ui,sans-serif;-webkit-app-region:drag}
@@ -13,7 +16,10 @@ const PAGE = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>
   .ic{font-size:34px} #t{max-width:340px;line-height:1.4}
   button{-webkit-app-region:no-drag;background:#2a2f40;color:#e6e8ef;border:1px solid #3a4054;border-radius:8px;padding:7px 16px;font:inherit;cursor:pointer}
   button:hover{background:#343a4f}
-</style></head><body><div class="ic">🔑</div><div id="t"></div><button id="c"></button></body></html>`;
+  form{display:flex;gap:8px;-webkit-app-region:no-drag} form[hidden]{display:none}
+  input{background:#10131b;color:#e6e8ef;border:1px solid #3a4054;border-radius:8px;padding:7px 10px;font:inherit;width:170px}
+  .row{display:flex;gap:8px}
+</style></head><body><div class="ic">🔑</div><div id="t"></div><form id="f" hidden><input id="p" type="password" autocomplete="off"><button id="ok"></button></form><div class="row"><button id="c"></button></div></body></html>`;
 
 let fidoSession;
 function getSession() {
@@ -29,17 +35,23 @@ const HELPERS = `
   const unb64 = (s) => Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0));
 `;
 
-async function ceremony(parent, text, script) {
+async function openWindow(parent, text) {
   const w = new BrowserWindow({
-    parent, modal: !!parent, width: 420, height: 210, frame: false, resizable: false, show: false,
+    parent, modal: !!parent, width: 420, height: 230, frame: false, resizable: false, show: false,
     backgroundColor: '#1a1d27', webPreferences: { session: getSession(), contextIsolation: true, sandbox: true },
   });
+  await w.loadURL('http://localhost/');
+  await w.webContents.executeJavaScript(`document.getElementById('t').textContent = ${JSON.stringify(text)};
+    document.getElementById('ok').textContent = ${JSON.stringify(i18n.t('OK'))};
+    const c = document.getElementById('c'); c.textContent = ${JSON.stringify(i18n.t('Cancel'))}; c.onclick = () => window.close(); 0;`);
+  w.show();
+  w.focus();
+  return w;
+}
+
+async function ceremony(parent, text, script) {
+  const w = await openWindow(parent, text);
   try {
-    await w.loadURL('http://localhost/');
-    await w.webContents.executeJavaScript(`document.getElementById('t').textContent = ${JSON.stringify(text)};
-      const c = document.getElementById('c'); c.textContent = ${JSON.stringify(i18n.t('Cancel'))}; c.onclick = () => window.close(); 0;`);
-    w.show();
-    w.focus();
     const closed = new Promise((resolve) => w.once('closed', () => resolve({ error: 'cancelled' })));
     const r = await Promise.race([w.webContents.executeJavaScript(`(async () => { try { ${HELPERS} ${script} } catch (e) { return { error: e.name + ': ' + e.message }; } })()`, true), closed]);
     if (r?.error === 'cancelled' || /NotAllowedError|AbortError/.test(r?.error || '')) throw new Error(i18n.t('Security key prompt was cancelled or timed out.'));
@@ -50,8 +62,71 @@ async function ceremony(parent, text, script) {
   }
 }
 
+// Registrierung direkt per CTAP2 (Linux). Liefert die Credential-ID (base64url) oder null, wenn kein
+// FIDO2-Gerät per hidraw erreichbar ist (dann übernimmt Chromium).
+async function registerNative(parent) {
+  const w = await openWindow(parent, i18n.t('Connecting to security key …'));
+  let abort = () => {};
+  let cancelled = false;
+  w.once('closed', () => { cancelled = true; abort(); });
+  const js = (code) => (w.isDestroyed() ? Promise.resolve(null) : w.webContents.executeJavaScript(code).catch(() => null));
+  const setText = (t) => js(`document.getElementById('t').textContent = ${JSON.stringify(t)}; 0;`);
+  const ui = {
+    async askPin(retries, wrong) {
+      let t = i18n.t('Enter the PIN of your security key.');
+      if (wrong) t = i18n.t('Wrong PIN.') + ' ' + t;
+      if (retries != null) t += ' ' + i18n.t('{n} attempts left.', { n: retries });
+      await setText(t);
+      const closed = new Promise((resolve) => w.once('closed', () => resolve(null)));
+      return Promise.race([closed, js(`new Promise((resolve) => {
+        const f = document.getElementById('f'), p = document.getElementById('p');
+        f.hidden = false; p.value = ''; p.focus();
+        f.onsubmit = (e) => { e.preventDefault(); f.hidden = true; resolve(p.value); };
+      })`)]);
+    },
+    touch(a) { abort = a; if (cancelled) a(); setText(i18n.t('Touch your security key to register it.')); },
+  };
+  try {
+    const id = await ctap2.makeCredential(ui);
+    return id && b64url(id);
+  } catch (e) {
+    if (cancelled || ctap2.CANCEL_CODES.has(e.code)) throw new Error(i18n.t('Security key prompt was cancelled or timed out.'));
+    if (e.code === ctap2.PIN.BLOCKED || e.code === ctap2.PIN.AUTH_BLOCKED) throw new Error(i18n.t('The PIN of this security key is blocked. Remove and reinsert the key, or reset it.'));
+    if (e.code === -1) throw new Error(i18n.t('This security key does not support the hmac-secret/PRF extension.'));
+    throw e;
+  } finally {
+    if (!w.isDestroyed()) w.destroy();
+  }
+}
+
+// PRF-Abfrage direkt per CTAP2 (Linux); null, wenn kein FIDO2-Gerät per hidraw erreichbar ist
+async function deriveNative(parent, creds, text) {
+  const w = await openWindow(parent, text || i18n.t('Touch your security key to unlock MrTerm.'));
+  let abort = () => {};
+  let cancelled = false;
+  w.once('closed', () => { cancelled = true; abort(); });
+  try {
+    const r = await ctap2.getHmacSecret({ touch(a) { abort = a; if (cancelled) a(); } },
+      creds.map((c) => ({ credId: Buffer.from(c.credId, 'base64url'), salt: Buffer.from(c.prfSalt, 'base64url') })));
+    return r && { credId: b64url(r.credId), secret: r.secret };
+  } catch (e) {
+    if (cancelled || ctap2.CANCEL_CODES.has(e.code)) throw new Error(i18n.t('Security key prompt was cancelled or timed out.'));
+    if (e.code === 0x2e) throw new Error(i18n.t('Unknown security key.'));
+    if (e.code === -1) throw new Error(i18n.t('This security key does not support the hmac-secret/PRF extension.'));
+    throw e;
+  } finally {
+    if (!w.isDestroyed()) w.destroy();
+  }
+}
+
+const b64url = (buf) => Buffer.from(buf).toString('base64url');
+
 // Neuen Schlüssel registrieren; liefert die Credential-ID (base64url)
 async function register(parent) {
+  if (process.platform === 'linux') {
+    const id = await registerNative(parent);
+    if (id) return id;
+  }
   const r = await ceremony(parent, i18n.t('Touch your security key to register it.'), `
     const cred = await navigator.credentials.create({ publicKey: {
       challenge: crypto.getRandomValues(new Uint8Array(32)),
@@ -69,6 +144,10 @@ async function register(parent) {
 // PRF-Wert für einen der Schlüssel abfragen. creds: [{ credId, prfSalt }] (base64url)
 // Liefert { credId, secret: Buffer(32) }
 async function derive(parent, creds, text) {
+  if (process.platform === 'linux') {
+    const r = await deriveNative(parent, creds, text);
+    if (r) return r;
+  }
   const r = await ceremony(parent, text || i18n.t('Touch your security key to unlock MrTerm.'), `
     const creds = ${JSON.stringify(creds)};
     const evalByCredential = Object.fromEntries(creds.map((c) => [c.credId, { first: unb64(c.prfSalt) }]));

src/main/main.js

@@ -16,6 +16,9 @@ const { DockerManager } = require('./docker');
 const { FirewallManager } = require('./firewall');
 const { NetworkConfigManager } = require('./network');
 const { SyncService } = require('./sync');
+const backup = require('../core/backup');
+const composeTemplates = require('./compose-templates');
+const { AiAssistant } = require('./ai');
 const applyLanguage = () => i18n.setLanguage(store.get().settings.language, app.getLocale());
 
 let win;
@@ -75,6 +78,7 @@ const vpn = new VpnManager(store, app.getPath('userData'));
 const docker = new DockerManager(ssh);
 const firewall = new FirewallManager(ssh);
 const network = new NetworkConfigManager(ssh);
+const ai = new AiAssistant(store, send);
 
 // LAN-Synchronisation; Vergleichscode beim Koppeln bestätigt der Nutzer in der Oberfläche
 const pairReplies = new Map();
@@ -232,6 +236,12 @@ handle('docker:stats', (id) => docker.stats(id));
 handle('docker:action', (id, action, cid) => docker.action(id, action, cid));
 handle('docker:command', (id, kind, cid) => docker.command(id, kind, cid));
 handle('docker:close', (id) => docker.close(id));
+handle('docker:stacks', (id, dir) => docker.stacks(id, dir));
+handle('docker:stackRead', (id, file) => docker.readStack(id, file));
+handle('docker:stackSave', (id, data) => docker.saveStack(id, data));
+handle('docker:stackCommand', (id, action, st, opts) => docker.stackCommand(id, action, st, opts));
+handle('docker:templates', (url) => composeTemplates.list(url));
+handle('docker:template', (index, url) => composeTemplates.build(index, url));
 
 // ---------- Firewall ----------
 handle('firewall:open', async (id, hostRef) => {
@@ -270,6 +280,11 @@ handle('sync:share', (sel) => sync.setShare(sel));
 handle('sync:shareItem', (c, id, yes) => sync.shareItem(c, id, yes));
 handle('sync:probe', (address) => sync.probe(address));
 
+// ---------- Support-Assistent (Ollama) ----------
+handle('ai:models', (url) => ai.models(url));
+handle('ai:chat', (id, messages, context) => ai.chat(id, messages, context));
+handle('ai:stop', (id) => ai.stop(id));
+
 // ---------- VPN ----------
 handle('vpn:status', () => vpn.status());
 handle('vpn:up', (id) => vpn.up(id));
@@ -280,19 +295,19 @@ handle('vault:settings', (s) => {
   if ('rdpEmbed' in s) fs.writeFileSync(launchFile, JSON.stringify({ ...readLaunch(), x11: s.rdpEmbed !== false }));
 });
 handle('vault:forgetHost', (id) => store.forgetKnownHost(id));
-handle('vault:export', async () => {
-  const r = await dialog.showSaveDialog(win, { defaultPath: 'mrterm-backup.json', filters: [{ name: 'JSON', extensions: ['json'] }] });
-  if (r.canceled) return false;
-  fs.writeFileSync(r.filePath, JSON.stringify(publicData(), null, 2), { mode: 0o600 });
-  return r.filePath;
+// Backup: vollständig, optional per Passwort verschlüsselt (src/core/backup.js)
+handle('backup:export', (opts) => backup.createBackup(store, { ...opts, version: app.getVersion() }));
+handle('backup:inspect', (content) => backup.inspectBackup(content));
+handle('backup:import', (content, password, opts) => {
+  const r = backup.importBackup(store, content, password, opts);
+  if (opts?.settings) applyLanguage();
+  return r;
 });
-handle('vault:import', async () => {
-  const r = await dialog.showOpenDialog(win, { filters: [{ name: 'JSON', extensions: ['json'] }], properties: ['openFile'] });
+handle('backup:saveFile', async (content, name) => {
+  const r = await dialog.showSaveDialog(win, { defaultPath: name, filters: [{ name: 'MrTerm Backup', extensions: ['json'] }] });
   if (r.canceled) return false;
-  const data = JSON.parse(fs.readFileSync(r.filePaths[0], 'utf8'));
-  for (const col of ['groups', 'hosts', 'keys', 'snippets', 'forwards', 'vpns'])
-    for (const item of data[col] || []) store.upsert(col, item);
-  return true;
+  fs.writeFileSync(r.filePath, content, { mode: 0o600 });
+  return r.filePath;
 });
 
 // Import aus ~/.ssh/config

src/main/store.js

@@ -1,6 +1,7 @@
 // Persistenter Vault: Hosts, Keys, Snippets, Forwards, Settings.
 // Wird mit Electron safeStorage (DPAPI unter Windows, libsecret/kwallet unter Linux) verschlüsselt.
-const { app, safeStorage } = require('electron');
+// Im Web-Server gibt es kein Electron: dort übergibt der Aufrufer Verzeichnis und Verschlüsselung (opts)
+const electron = (() => { try { const e = require('electron'); return typeof e === 'object' ? e : {}; } catch { return {}; } })();
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
@@ -38,6 +39,10 @@ const DEFAULTS = {
     updatePrerelease: false,
     autoLock: 0,
     language: 'auto',
+    dockerStacksDir: '/opt/stacks',
+    dockerTemplatesUrl: '',
+    aiUrl: 'http://localhost:11434',
+    aiModel: '',
   },
 };
 
@@ -57,8 +62,10 @@ function unbox(key, b) {
 }
 
 class Store {
-  constructor() {
-    this.dir = app.getPath('userData');
+  // opts: { dir, crypto } – crypto hat die Schnittstelle von Electrons safeStorage
+  constructor(opts = {}) {
+    this.dir = opts.dir || electron.app.getPath('userData');
+    this.crypto = opts.crypto || electron.safeStorage;
     this.file = path.join(this.dir, 'vault.dat');
     this.data = structuredClone(DEFAULTS);
     this.encrypted = false;
@@ -97,9 +104,9 @@ class Store {
 
   canEncrypt() {
     try {
-      if (!safeStorage.isEncryptionAvailable()) return false;
+      if (!this.crypto.isEncryptionAvailable()) return false;
       // Unter Linux ohne Keyring fällt Electron auf "basic_text" zurück – das ist keine echte Verschlüsselung.
-      if (process.platform === 'linux' && safeStorage.getSelectedStorageBackend?.() === 'basic_text') return false;
+      if (process.platform === 'linux' && this.crypto.getSelectedStorageBackend?.() === 'basic_text') return false;
       return true;
     } catch { return false; }
   }
@@ -110,7 +117,7 @@ class Store {
     const raw = fs.readFileSync(this.file);
     let json;
     if (raw.slice(0, 4).toString() === 'ENC1') {
-      json = safeStorage.decryptString(raw.slice(4));
+      json = this.crypto.decryptString(raw.slice(4));
       this.encrypted = true;
     } else {
       json = raw.toString('utf8');
@@ -136,7 +143,7 @@ class Store {
     }
     const tmp = this.file + '.tmp';
     if (this.canEncrypt()) {
-      fs.writeFileSync(tmp, Buffer.concat([Buffer.from('ENC1'), safeStorage.encryptString(json)]));
+      fs.writeFileSync(tmp, Buffer.concat([Buffer.from('ENC1'), this.crypto.encryptString(json)]));
       this.encrypted = true;
     } else {
       fs.writeFileSync(tmp, json, { mode: 0o600 });

src/renderer/app.js

@@ -5,9 +5,12 @@
 const $ = (sel, root = document) => root.querySelector(sel);
 const $$ = (sel, root = document) => [...root.querySelectorAll(sel)];
 const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-const uid = () => crypto.randomUUID();
+// crypto.randomUUID gibt es nur in sicheren Kontexten (HTTPS/localhost) – die Web-Version läuft oft per http://<server>
+const uid = () => (crypto.randomUUID ? crypto.randomUUID() : ([1e7] + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (c ^ (crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (c / 4)))).toString(16)));
 function h(html) { const t = document.createElement('template'); t.innerHTML = html.trim(); return t.content.firstElementChild; }
 const T = I18N.t;
+// Web-Version (Docker, src/web): gleiche Oberfläche im Browser; ohne RDP, VPN, Port-Forwarding und lokale Dateien
+const WEB = api.platform === 'web';
 
 const ICONS = {
   search: '<svg viewBox="0 0 24 24"><circle cx="11" cy="11" r="7"/><path d="M20 20l-4-4"/></svg>',
@@ -43,6 +46,7 @@ const ICONS = {
   docker: '<svg viewBox="0 0 24 24"><path d="M2 12h19c-.6 4.5-4 8-10 8-5 0-8-3-9-8z"/><path d="M5 12V9h3v3M8 12V9h3v3M11 12V9h3v3M8 9V6h3v3M21 12c.5-1.5 0-3-1-3.5"/></svg>',
   wall: '<svg viewBox="0 0 24 24"><rect x="3" y="4" width="18" height="16" rx="1"/><path d="M3 9.3h18M3 14.7h18M9 4v5.3M15 4v5.3M6 9.3v5.4M12 9.3v5.4M18 9.3v5.4M9 14.7V20M15 14.7V20"/></svg>',
   network: '<svg viewBox="0 0 24 24"><rect x="9" y="3" width="6" height="5" rx="1"/><rect x="3" y="16" width="6" height="5" rx="1"/><rect x="15" y="16" width="6" height="5" rx="1"/><path d="M12 8v4M6 16v-4h12v4"/></svg>',
+  ai: '<svg viewBox="0 0 24 24"><path d="M4 5h16v11H9l-5 4z"/><path d="M9 10h.01M12 10h.01M15 10h.01"/></svg>',
   logs: '<svg viewBox="0 0 24 24"><path d="M5 4h14v16H5zM8 8h8M8 12h8M8 16h5"/></svg>',
 };
 const COLORS = ['#6e7bff', '#3ecf8e', '#ff5f6d', '#ffb454', '#c792ea', '#56d6d6', '#ff79c6', '#8b91a5', '#4f9dff', '#e0a100'];
@@ -407,6 +411,7 @@ function connectHost(hst) {
 }
 
 async function openRdp(hst) {
+  if (WEB) return toast(T('RDP is not available in the web version.'), 'error');
   if (settings().rdpEmbed !== false) {
     const s = await api.call('rdp:embedSupported').catch((e) => ({ ok: false, reason: e.message }));
     if (s.ok) return new RdpSession(hst);
@@ -654,7 +659,7 @@ function viewSnippets(page) {
   page.append(toolbar(T('Search snippets …'), [{ label: T('New snippet'), icon: 'plus', cls: 'primary', run: () => editSnippet() }]));
   const c = h('<div class="content"></div>'); page.append(c);
   const list = S.vault.snippets.filter((s) => matches(s.label, s.command));
-  if (!list.length) return c.append(emptyState('code', T('No snippets'), T('Save frequently used commands and send them to a terminal with one click.'), T('New snippet'), () => editSnippet()));
+  if (!list.length) { c.append(emptyState('code', T('No snippets'), T('Save frequently used commands and send them to a terminal with one click.'), T('New snippet'), () => editSnippet())); c.append(templateList()); return; }
   const l = h('<div class="list"></div>');
   for (const s of list) {
     const card = h(`<div class="card"><div class="avatar" style="background:var(--icon-bg);color:var(--green)">${ICONS.code}</div><div class="meta"><div class="title">${esc(s.label)}</div><div class="sub mono">${esc(s.command.split('\n')[0])}${s.command.includes('\n') ? ' …' : ''}</div></div><div class="actions"><button data-a="run" title="${T('Run in active terminal')}">${ICONS.play}</button><button data-a="copy" title="${T('Copy')}">${ICONS.copy}</button><button data-a="del" title="${T('Delete')}">${ICONS.trash}</button></div></div>`);
@@ -667,7 +672,7 @@ function viewSnippets(page) {
     };
     l.append(card);
   }
-  c.append(l);
+  c.append(l, templateList());
 }
 function editSnippet(s = {}) {
   const form = openDrawer(s.id ? T('Edit snippet') : T('New snippet'), [
@@ -681,6 +686,86 @@ function editSnippet(s = {}) {
     reload();
   });
 }
+// Eingebaute Vorlagen (nicht im Vault). Parameter werden vor dem Ausführen abgefragt; build() liefert eine Zeile.
+// $S = sudo, außer man ist bereits root.
+const shq = (v) => `'${String(v).replace(/'/g, `'\\''`)}'`;
+const SUDO = 'S=$([ "$(id -u)" = 0 ] || echo sudo);';
+const SNIPPET_TEMPLATES = [
+  {
+    label: () => T('Authorize SSH key for a user'),
+    desc: () => T('Adds a public key from the keychain to ~/.ssh/authorized_keys of the user.'),
+    params: () => [
+      S.vault.keys.some((k) => k.publicKey)
+        ? field(T('Key'), 'key', '', { type: 'select', options: S.vault.keys.filter((k) => k.publicKey).map((k) => [k.id, k.label]) })
+        : field('Public Key', 'pub', '', { type: 'textarea', placeholder: 'ssh-ed25519 AAAA…' }),
+      field(T('User'), 'user', 'root'),
+    ],
+    build: (v) => {
+      const pub = (v.key ? S.vault.keys.find((k) => k.id === v.key)?.publicKey : v.pub || '').trim();
+      if (!pub) throw new Error(T('Public key is missing.'));
+      if (!v.user.trim()) throw new Error(T('User is missing.'));
+      return `${SUDO} u=${shq(v.user.trim())}; k=${shq(pub)}; d="$(getent passwd "$u" | cut -d: -f6)/.ssh"; `
+        + `$S install -d -m 700 -o "$u" -g "$(id -gn "$u")" "$d" && { $S grep -qxF "$k" "$d/authorized_keys" 2>/dev/null || echo "$k" | $S tee -a "$d/authorized_keys" >/dev/null; } `
+        + `&& $S chown "$u": "$d/authorized_keys" && $S chmod 600 "$d/authorized_keys" && echo "OK: $d/authorized_keys"`;
+    },
+  },
+  {
+    label: () => T('Install QEMU guest agent'),
+    desc: () => T('Installs and starts qemu-guest-agent (apt, dnf, yum, pacman, zypper or apk).'),
+    build: () => `${SUDO} if command -v apt-get >/dev/null; then $S apt-get update && $S apt-get install -y qemu-guest-agent; `
+      + 'elif command -v dnf >/dev/null; then $S dnf install -y qemu-guest-agent; elif command -v yum >/dev/null; then $S yum install -y qemu-guest-agent; '
+      + 'elif command -v pacman >/dev/null; then $S pacman -S --needed --noconfirm qemu-guest-agent; elif command -v zypper >/dev/null; then $S zypper -n install qemu-guest-agent; '
+      + 'elif command -v apk >/dev/null; then $S apk add qemu-guest-agent && $S rc-update add qemu-guest-agent && $S rc-service qemu-guest-agent start; fi; '
+      + 'command -v systemctl >/dev/null && { $S systemctl enable --now qemu-guest-agent 2>/dev/null || $S systemctl start qemu-guest-agent; }; '
+      + 'command -v systemctl >/dev/null && systemctl is-active qemu-guest-agent',
+  },
+  {
+    label: () => T('Use APT cache server'),
+    desc: () => T('Routes APT downloads through a cache proxy such as apt-cacher-ng (/etc/apt/apt.conf.d/00proxy).'),
+    params: () => [field(T('Proxy URL'), 'url', 'http://', { placeholder: 'http://192.168.1.10:3142' })],
+    build: (v) => {
+      const url = v.url.trim();
+      if (!/^https?:\/\/[^\s/]+/.test(url)) throw new Error(T('Invalid URL.'));
+      return `${SUDO} echo ${shq(`Acquire::http::Proxy "${url}";`)} | $S tee /etc/apt/apt.conf.d/00proxy && $S apt-get update`;
+    },
+  },
+  {
+    label: () => T('Remove APT cache server'),
+    desc: () => T('Removes the APT proxy setting again.'),
+    build: () => `${SUDO} $S rm -f /etc/apt/apt.conf.d/00proxy && $S apt-get update`,
+  },
+  {
+    label: () => T('System update'),
+    desc: () => T('Updates all packages with the system package manager.'),
+    build: () => `${SUDO} if command -v apt-get >/dev/null; then $S apt-get update && $S apt-get -y full-upgrade; elif command -v dnf >/dev/null; then $S dnf -y upgrade; `
+      + 'elif command -v pacman >/dev/null; then $S pacman -Syu --noconfirm; elif command -v zypper >/dev/null; then $S zypper -n update; elif command -v apk >/dev/null; then $S apk upgrade --update; fi',
+  },
+];
+
+// Fragt die Parameter einer Vorlage ab und schickt den Befehl ins Terminal
+async function runTemplate(t, session) {
+  const params = t.params ? t.params() : [];
+  let v = {};
+  if (params.length) {
+    const body = `<p style="margin-top:0;color:var(--muted)">${esc(t.desc())}</p>${params.map((el) => el.outerHTML).join('')}`;
+    v = await modal({ title: t.label(), body, buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Run'), value: 'form', cls: 'primary' }] });
+    if (!v) return;
+  }
+  let command;
+  try { command = t.build(v); } catch (e) { return toast(e.message, 'error'); }
+  runSnippet({ command, autoRun: true }, session);
+}
+
+function templateList(session) {
+  const d = h(`<details class="snip-tpl"><summary>${T('Templates')}</summary><div class="tpl-items"></div></details>`);
+  for (const t of SNIPPET_TEMPLATES) {
+    const it = h(`<div class="it"><div>${esc(t.label())}</div><div class="hint">${esc(t.desc())}</div></div>`);
+    it.onclick = () => runTemplate(t, session);
+    $('.tpl-items', d).append(it);
+  }
+  return d;
+}
+
 function runSnippet(s, session) {
   const t = session || S.tabs.find((x) => x.id === S.active && x.kind === 'ssh') || [...S.tabs].reverse().find((x) => x.kind === 'ssh');
   if (!t) return toast(T('No open terminal'), 'error');
@@ -863,6 +948,60 @@ function viewHistory(page) {
 }
 
 // ============================================================ Einstellungen
+// ---------- Web-Version: Konto und Benutzerverwaltung (HTTP-API des Web-Servers)
+async function webApi(path, body) {
+  const r = await fetch(path, { method: body === undefined ? 'GET' : 'POST', headers: { 'Content-Type': 'application/json', 'X-MrTerm': '1' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(T(j.error || r.statusText));
+  return j;
+}
+function webAccountCard() {
+  const card = h(`<div class="settings-card"><h3>${T('Account')}</h3><div class="acc"></div></div>`);
+  const draw = async () => {
+    const box = $('.acc', card);
+    let me;
+    try { me = await webApi('/api/me'); } catch (e) { box.textContent = e.message; return; }
+    box.innerHTML = `<p style="color:var(--muted);margin-top:0">${esc(T('Signed in as {name}', { name: me.name }))}${me.admin ? ` · ${esc(T('Administrator'))}` : ''}</p><div class="row" style="flex-wrap:wrap"></div>`;
+    const pw = h(`<button class="btn">${esc(T('Change password'))}</button>`);
+    pw.onclick = async () => {
+      const r = await modal({ title: T('Change password'), body: `<div class="field"><label>${esc(T('Current password'))}</label><input name="old" type="password"/></div><div class="field"><label>${esc(T('New password'))}</label><input name="a" type="password"/></div><div class="field"><label>${esc(T('Repeat password'))}</label><input name="b" type="password"/></div>`,
+        buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Save'), value: 'form', cls: 'primary' }] });
+      if (!r) return;
+      if (r.a !== r.b) return toast(T('The passwords do not match.'), 'error');
+      try { await webApi('/api/password', { old: r.old, password: r.a }); toast(T('Saved'), 'ok'); } catch (e) { toast(e.message, 'error'); }
+    };
+    const out = h(`<button class="btn">${esc(T('Sign out'))}</button>`);
+    out.onclick = async () => { await webApi('/api/logout', {}).catch(() => {}); location.href = '/'; };
+    $('.row', box).append(pw, out);
+    if (!me.admin) return;
+    const users = await webApi('/api/users').catch(() => ({ users: [] }));
+    const list = h(`<div style="margin-top:16px"><h4 style="margin:0 0 8px">${esc(T('Users'))}</h4></div>`);
+    for (const u of users.users) {
+      const row = h(`<div class="lock-row"><div class="grow"><b>${esc(u.name)}</b><div class="sub">${u.admin ? esc(T('Administrator')) : esc(T('User'))}</div></div></div>`);
+      if (u.id !== me.id) {
+        const del = h(`<button class="btn ghost" title="${esc(T('Delete'))}">${ICONS.trash}</button>`);
+        del.onclick = async () => {
+          if (!(await confirmBox(T('Delete user?'), T('“{name}” and their vault will be permanently deleted.', { name: u.name })))) return;
+          try { await webApi('/api/users/delete', { id: u.id }); draw(); } catch (e) { toast(e.message, 'error'); }
+        };
+        row.append(del);
+      }
+      list.append(row);
+    }
+    const add = h(`<button class="btn" style="margin-top:10px">${ICONS.plus}${esc(T('Add user'))}</button>`);
+    add.onclick = async () => {
+      const r = await modal({ title: T('Add user'), body: `<div class="field"><label>${esc(T('Username'))}</label><input name="name" autocomplete="off"/></div><div class="field"><label>${esc(T('Password'))}</label><input name="password" type="password" autocomplete="new-password"/></div><label class="check"><input type="checkbox" name="admin"/>${esc(T('Administrator'))}</label>`,
+        buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Add user'), value: 'form', cls: 'primary' }] });
+      if (!r) return;
+      try { await webApi('/api/users', r); toast(T('Saved'), 'ok'); draw(); } catch (e) { toast(e.message, 'error'); }
+    };
+    list.append(add);
+    box.append(list);
+  };
+  draw();
+  return card;
+}
+
 async function viewSettings(page) {
   const st = settings();
   page.append(h(`<div class="toolbar"><h2 style="margin:0;font-size:18px">${T('Settings')}</h2></div>`));
@@ -913,6 +1052,28 @@ async function viewSettings(page) {
     save({ ...v, fontSize: Number(v.fontSize) || 14, scrollback: Number(v.scrollback) || 10000, keepAlive: Number(v.keepAlive) || 0 });
   });
 
+  // ---- Support-Assistent (Ollama)
+  const aiCard = h(`<div class="settings-card"><h3>${T('Support assistant')}</h3><p style="color:var(--muted);margin-top:0">${T('Helps with errors in the Linux console via a local <b>Ollama</b> instance. Open it in a terminal tab with the <i>Assistant</i> button. The latest terminal output is sent to the Ollama server as context.')}</p></div>`);
+  const aiUrl = field(T('Ollama server'), 'aiUrl', st.aiUrl || 'http://localhost:11434', { placeholder: 'http://localhost:11434' });
+  const aiModel = field(T('Model'), 'aiModel', st.aiModel, { type: 'select', options: [[st.aiModel || '', st.aiModel || T('– select –')]] });
+  const loadModels = async () => {
+    const sel = $('select', aiModel);
+    try {
+      const list = await api.call('ai:models', $('input', aiUrl).value.trim());
+      sel.innerHTML = '';
+      if (!list.length) sel.append(new Option(T('No models installed (ollama pull …)'), ''));
+      list.forEach((m) => sel.append(new Option(m, m)));
+      sel.value = list.includes(st.aiModel) ? st.aiModel : list[0] || '';
+      if (sel.value !== (settings().aiModel || '')) save({ aiModel: sel.value });
+    } catch (e) { toast(e.message, 'error'); }
+  };
+  const aiReload = h(`<button class="btn">${ICONS.refresh}${T('Load models')}</button>`);
+  aiReload.onclick = loadModels;
+  $('input', aiUrl).onchange = () => save({ aiUrl: $('input', aiUrl).value.trim() }).then(loadModels);
+  $('select', aiModel).onchange = () => save({ aiModel: $('select', aiModel).value });
+  aiCard.append(aiUrl, aiModel, aiReload);
+  if (st.aiModel) loadModels();
+
   const rdpCard = h(`<div class="settings-card"><h3>RDP</h3><div class="hint rdp-info" style="color:var(--muted);margin-bottom:12px">${T('Checking …')}</div></div>`);
   const emb = check(T('Show RDP connections as tabs in MrTerm'), 'rdpEmbed', st.rdpEmbed !== false);
   emb.onchange = async () => {
@@ -931,11 +1092,20 @@ async function viewSettings(page) {
     if (!d.available) $('.rdp-info', rdpCard).style.color = 'var(--orange)';
   }).catch(() => {});
 
-  const dataCard = h(`<div class="settings-card"><h3>${T('Data')}</h3><p style="color:var(--muted);margin-top:0">${S.vault.encrypted ? T('The vault is encrypted with the operating system keyring (Windows DPAPI / libsecret or KWallet).') : T('The vault is not encrypted because no keyring is available. On Arch/CachyOS: install <code>gnome-keyring</code> or <code>kwallet</code>.')}</p><div class="row" style="flex-wrap:wrap"></div></div>`);
+  const dockerCard = h(`<div class="settings-card"><h3>Docker Compose</h3></div>`);
+  const dockerFields = h('<div></div>');
+  dockerFields.append(
+    field(T('Stacks folder'), 'dockerStacksDir', st.dockerStacksDir || '/opt/stacks', { hint: T('Folder on the host in which each stack gets its own subfolder') }),
+    field(T('Template source'), 'dockerTemplatesUrl', st.dockerTemplatesUrl || '', { placeholder: 'https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json', hint: T('URL of a templates.json in Portainer format. Empty = Lissy93/portainer-templates.') }),
+  );
+  dockerFields.addEventListener('change', () => save(formValues(dockerFields)));
+  dockerCard.append(dockerFields);
+
+  const dataCard = h(`<div class="settings-card"><h3>${T('Data')}</h3><p style="color:var(--muted);margin-top:0">${WEB ? T('Your vault is stored on the server, encrypted with a key that only your login password can unlock.') : S.vault.encrypted ? T('The vault is encrypted with the operating system keyring (Windows DPAPI / libsecret or KWallet).') : T('The vault is not encrypted because no keyring is available. On Arch/CachyOS: install <code>gnome-keyring</code> or <code>kwallet</code>.')}</p><div class="row" style="flex-wrap:wrap"></div></div>`);
   const btns = [
-    [T('Import ~/.ssh/config'), importSshConfig],
-    [T('Export backup'), async () => { const p = await call('vault:export'); if (p) toast(T('Exported to {path}', { path: p }), 'ok'); }],
-    [T('Import backup'), async () => { if (await call('vault:import')) { toast(T('Import complete'), 'ok'); reload(); } }],
+    ...(WEB ? [] : [[T('Import ~/.ssh/config'), importSshConfig]]),
+    [T('Export backup'), exportBackup],
+    [T('Import backup'), importBackup],
   ];
   btns.forEach(([l, fn]) => { const b = h(`<button class="btn">${esc(l)}</button>`); b.onclick = fn; $('.row', dataCard).append(b); });
 
@@ -985,7 +1155,8 @@ async function viewSettings(page) {
     <span>${C}+<kbd>Shift</kbd>+<kbd>F</kbd></span><span>${T('Search in terminal')}</span>
     <span>${C}+<kbd>+/−/0</kbd></span><span>${T('Font size')}</span>
     <span>${C}+<kbd>Shift</kbd>+<kbd>L</kbd></span><span>${T('Lock now')}</span></div></div>`);
-  c.append(langCard, secCard, syncCard, designCard, themeCard, termCard, rdpCard, importCard, dataCard, updCard, keysCard);
+  if (WEB) c.append(langCard, webAccountCard(), designCard, themeCard, termCard, aiCard, dockerCard, importCard, dataCard, keysCard);
+  else c.append(langCard, secCard, syncCard, designCard, themeCard, termCard, aiCard, rdpCard, dockerCard, importCard, dataCard, updCard, keysCard);
 }
 
 // ============================================================ App-Sperre
@@ -1277,13 +1448,75 @@ async function importRdm() {
   $('[data-view=hosts]').click();
 }
 
+// ============================================================ Backup
+const BACKUP_ERRORS = () => ({ INVALID: T('This file is not a MrTerm backup.'), WRONG_PASSWORD: T('Wrong password.'), PASSWORD_REQUIRED: T('This backup is encrypted. Please enter the password.') });
+const backupError = (e) => BACKUP_ERRORS()[e.message] || e.message;
+
+async function exportBackup() {
+  let err = '';
+  for (;;) {
+    const r = await modal({
+      title: T('Export backup'),
+      body: `<p style="margin-top:0;color:var(--muted)">${T('Exports all hosts, groups, SSH keys, passwords, snippets, port forwards, VPNs, known hosts and settings.')}</p>
+        ${err ? `<p style="color:var(--red)">${esc(err)}</p>` : ''}
+        ${field(T('Password'), 'pw', '', { type: 'password', hint: T('Recommended. Without a password, keys and passwords are stored in plain text in the file.') }).outerHTML}
+        ${field(T('Repeat password'), 'pw2', '', { type: 'password' }).outerHTML}
+        ${check(T('Include settings'), 'settings', true).outerHTML}`,
+      buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Export'), value: 'form', cls: 'primary' }],
+    });
+    if (!r) return;
+    if (r.pw !== r.pw2) { err = T('The passwords do not match.'); continue; }
+    if (r.pw && r.pw.length < 8) { err = T('The password must be at least 8 characters long.'); continue; }
+    if (!r.pw && !(await confirmBox(T('Export without password?'), T('Private keys and passwords will be readable by anyone who gets the file.'), T('Export')))) continue;
+    try {
+      const content = await api.call('backup:export', { password: r.pw, settings: r.settings });
+      const name = `mrterm-backup-${new Date().toISOString().slice(0, 10)}${r.pw ? '-encrypted' : ''}.json`;
+      const p = await call('backup:saveFile', content, name);
+      if (p) toast(T('Exported to {path}', { path: p }), 'ok');
+    } catch (e) { toast(backupError(e), 'error'); }
+    return;
+  }
+}
+
+async function importBackup() {
+  const f = await call('import:pickFile', 'MrTerm Backup', ['json']);
+  if (!f) return;
+  let info;
+  try { info = await api.call('backup:inspect', f.content); } catch (e) { return toast(backupError(e), 'error'); }
+  const c = info.counts;
+  const summary = c ? T('{hosts} hosts, {keys} keys, {snippets} snippets, {vpns} VPNs', c) : T('Contents are encrypted.');
+  let err = '';
+  for (;;) {
+    const r = await modal({
+      title: T('Import backup'),
+      body: `<p style="margin-top:0;color:var(--muted)">${esc(f.name)}${info.createdAt ? ' · ' + esc(new Date(info.createdAt).toLocaleString()) : ''}<br>${esc(summary)}</p>
+        ${err ? `<p style="color:var(--red)">${esc(err)}</p>` : ''}
+        ${info.encrypted ? field(T('Password'), 'pw', '', { type: 'password' }).outerHTML : ''}
+        ${check(T('Import settings'), 'settings', false).outerHTML}
+        ${check(T('Replace existing data (entries not contained in the backup are deleted)'), 'replace', false).outerHTML}`,
+      buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Import'), value: 'form', cls: 'primary' }],
+    });
+    if (!r) return;
+    if (r.replace && !(await confirmBox(T('Replace existing data?'), T('Hosts, keys, snippets and other entries that are not in the backup will be deleted.'), T('Replace')))) continue;
+    try {
+      const n = await api.call('backup:import', f.content, r.pw || '', { replace: r.replace, settings: r.settings });
+      toast(T('Import complete: {hosts} hosts, {keys} keys, {snippets} snippets', n), 'ok');
+      reload();
+      return;
+    } catch (e) { err = backupError(e); }
+  }
+}
+
 // ============================================================ Updates
 let updateInfo = null;
+let updateDialogOpen = false; // Auto-Prüfung beim Start und manuelle Prüfung sollen keine zwei Dialoge stapeln
 async function showUpdate(info) {
   updateInfo = info;
   const b = $('#updateBadge');
   b.style.display = '';
   b.querySelector('span').textContent = `Update ${info.version}`;
+  if (updateDialogOpen) return;
+  updateDialogOpen = true;
   const r = await modal({
     title: T('MrTerm {v} is available', { v: info.version }),
     text: T('Installed: {v}', { v: info.current }) + (info.asset ? ' · ' + T('Package: {name} ({size})', { name: info.asset.name, size: fmtSize(info.asset.size) }) : ''),
@@ -1291,7 +1524,7 @@ async function showUpdate(info) {
       ${info.kind === 'dev' ? `<p>${T('Development mode: please update via <code>git pull</code>.')}</p>` : !info.asset ? `<p>${T('The release contains no package for this system.')}</p>` : ''}
       <div class="upd-prog" style="display:none"><div class="transfer" style="padding:6px 0"><span class="nm">${T('Downloading …')}</span><span class="pct"></span><div class="bar"><i></i></div></div></div>`,
     buttons: [{ label: T('Later'), value: false, cls: 'ghost' }, { label: T('Release page'), value: 'web', cls: '' }, ...(info.asset && info.kind !== 'dev' ? [{ label: T('Install now'), value: true, cls: 'primary' }] : [])],
-  });
+  }).finally(() => { updateDialogOpen = false; });
   if (r === 'web') return api.call('shell:open', info.url);
   if (r !== true) return;
   toast(T('Downloading update …'));
@@ -1359,13 +1592,20 @@ class TerminalSession {
         <button class="btn ghost sm" data-a="sftp" title="${T('SFTP for this host')}">${ICONS.folder}SFTP</button>
         ${host.execCommand ? '' : `<button class="btn ghost sm" data-a="docker" title="${T('Docker containers')}">${ICONS.docker}Docker</button><button class="btn ghost sm" data-a="firewall" title="${T('Firewall')}">${ICONS.wall}${T('Firewall')}</button><button class="btn ghost sm" data-a="network" title="${T('Network')}">${ICONS.network}${T('Network')}</button>`}
         <button class="btn ghost sm" data-a="snip" title="Snippets">${ICONS.code}Snippets</button>
+        <button class="btn ghost sm" data-a="ai" title="${T('Support assistant (Ollama)')}">${ICONS.ai}${T('Assistant')}</button>
         <button class="btn ghost sm" data-a="find" title="${T('Search (Ctrl+Shift+F)')}">${ICONS.search}</button>
       </div>
       <div class="term-wrap"><div class="term"></div>
         <div class="findbar"><input placeholder="${T('Search …')}"/><button class="btn ghost sm" data-f="prev">↑</button><button class="btn ghost sm" data-f="next">↓</button><button class="btn ghost sm" data-f="close">${ICONS.close}</button></div>
         <div class="snip-panel"><div class="head">Snippets<button class="btn ghost sm" data-a="snipnew">${ICONS.plus}</button></div><div class="items"></div></div>
+        <div class="ai-panel"><div class="head">${T('Support assistant')}<span><button class="btn ghost sm" data-a="aiclear" title="${T('New chat')}">${ICONS.refresh}</button><button class="btn ghost sm" data-a="ai">${ICONS.close}</button></span></div>
+          <div class="msgs"></div>
+          <form class="ask"><label class="check"><input type="checkbox" name="ctx" checked/>${T('Include terminal output')}</label>
+            <textarea rows="3" placeholder="${T('Describe the problem … (Enter = send)')}"></textarea>
+            <div class="row"><button type="button" class="btn sm" data-a="aierr">${T('Explain last error')}</button><button class="btn primary sm" type="submit">${T('Send')}</button></div></form></div>
       </div></div>`);
     this.overlay = null;
+    this.chat = [];
     this.alive = false;
     this.initTerm();
     this.bindUi();
@@ -1420,6 +1660,9 @@ class TerminalSession {
       if (a === 'network') openNetwork(this.host);
       if (a === 'snip') { $('.snip-panel', this.el).classList.toggle('open'); this.renderSnips(); this.doFit(); }
       if (a === 'snipnew') editSnippet();
+      if (a === 'ai') { $('.ai-panel', this.el).classList.toggle('open'); this.doFit(); if ($('.ai-panel', this.el).classList.contains('open')) $('.ai-panel textarea', this.el).focus(); }
+      if (a === 'aiclear') { api.call('ai:stop', this.id); this.chat = []; $('.ai-panel .msgs', this.el).innerHTML = ''; }
+      if (a === 'aierr') this.askAi(T('Explain the last error in the terminal output and how to fix it.'));
       if (a === 'find') this.toggleFind();
       const f = e.target.closest('[data-f]')?.dataset.f;
       const inp = $('.findbar input', this.el);
@@ -1427,6 +1670,16 @@ class TerminalSession {
       if (f === 'prev') this.search.findPrevious(inp.value);
       if (f === 'close') this.toggleFind(false);
     });
+    const ta = $('.ai-panel textarea', this.el);
+    $('.ai-panel form', this.el).onsubmit = (e) => { e.preventDefault(); if (ta.value.trim()) { this.askAi(ta.value.trim()); ta.value = ''; } };
+    ta.addEventListener('keydown', (e) => { if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); $('.ai-panel form', this.el).requestSubmit(); } });
+    $('.ai-panel .msgs', this.el).addEventListener('click', (e) => {
+      const b = e.target.closest('[data-cmd]'); if (!b) return;
+      const code = b.closest('.code').querySelector('code').textContent.replace(/\n+$/, '');
+      if (b.dataset.cmd === 'copy') { api.call('clipboard:write', code); toast(T('Copied')); }
+      // Nur einfügen, nicht ausführen – der Nutzer prüft und bestätigt mit Enter
+      else { this.term.paste(code); this.term.focus(); }
+    });
     $('.findbar input', this.el).addEventListener('keydown', (e) => {
       if (e.key === 'Enter') (e.shiftKey ? this.search.findPrevious : this.search.findNext).call(this.search, e.target.value);
       if (e.key === 'Escape') this.toggleFind(false);
@@ -1442,6 +1695,39 @@ class TerminalSession {
       it.onclick = () => runSnippet(s, this);
       box.append(it);
     });
+    box.append(templateList(this));
+  }
+
+  // Letzte Zeilen des Terminals als Kontext für den Assistenten
+  termContext(lines = 120) {
+    const b = this.term.buffer.active, out = [];
+    for (let i = Math.max(0, b.length - lines); i < b.length; i++) out.push(b.getLine(i)?.translateToString(true) ?? '');
+    return out.join('\n').replace(/\n{3,}/g, '\n\n').trim();
+  }
+
+  async askAi(text) {
+    const panel = $('.ai-panel', this.el), box = $('.msgs', panel);
+    if (!panel.classList.contains('open')) { panel.classList.add('open'); this.doFit(); }
+    if (!settings().aiModel) { toast(T('Please select an Ollama model in the settings first.'), 'error'); return; }
+    this.chat.push({ role: 'user', content: text });
+    box.append(h(`<div class="m user">${esc(text)}</div>`));
+    const out = h('<div class="m bot"><div class="spinner"></div></div>'); box.append(out);
+    box.scrollTop = box.scrollHeight;
+    const reply = { role: 'assistant', content: '' };
+    this.aiUnsub?.();
+    this.aiUnsub = api.on('ai:event', (cid, type, payload) => {
+      if (cid !== this.id) return;
+      const stick = box.scrollHeight - box.scrollTop - box.clientHeight < 40;
+      if (type === 'data') { reply.content += payload; out.innerHTML = aiMarkdown(reply.content); }
+      else {
+        this.aiUnsub(); this.aiUnsub = null;
+        if (type === 'error') { out.classList.add('err'); out.textContent = payload; this.chat.pop(); }
+        else this.chat.push(reply);
+      }
+      if (stick) box.scrollTop = box.scrollHeight;
+    });
+    try { await api.call('ai:chat', this.id, this.chat.slice(-20), $('[name=ctx]', panel).checked ? this.termContext() : ''); }
+    catch (e) { this.aiUnsub?.(); this.aiUnsub = null; out.classList.add('err'); out.textContent = e.message; this.chat.pop(); }
   }
 
   toggleFind(open) {
@@ -1516,7 +1802,17 @@ class TerminalSession {
       this.term.write(`\r\n\x1b[90m${T('Connection closed. Press [Enter] to reconnect.')}\x1b[0m\r\n`);
     }
   }
-  dispose() { this.unsub(); this.ro.disconnect(); api.ssh.close(this.id); this.term.dispose(); }
+  dispose() { this.unsub(); this.aiUnsub?.(); api.call('ai:stop', this.id).catch(() => {}); this.ro.disconnect(); api.ssh.close(this.id); this.term.dispose(); }
+}
+// Minimales Markdown für Assistenten-Antworten: Codeblöcke (mit Kopieren/Einfügen), Inline-Code, Fett
+function aiMarkdown(md) {
+  return md.split(/```/).map((part, i) => {
+    if (i % 2) {
+      const code = part.replace(/^[\w-]*\n/, '');
+      return `<div class="code"><div class="acts"><button class="btn ghost sm" data-cmd="copy">${T('Copy')}</button><button class="btn ghost sm" data-cmd="paste" title="${T('Insert into terminal (not executed)')}">${T('Insert')}</button></div><pre><code>${esc(code)}</code></pre></div>`;
+    }
+    return esc(part).replace(/`([^`\n]+)`/g, '<code>$1</code>').replace(/\*\*([^*]+)\*\*/g, '<b>$1</b>').replace(/\n/g, '<br>');
+  }).join('');
 }
 function openTerminal(host) { return new TerminalSession(host); }
 
@@ -1643,7 +1939,7 @@ class FilePane {
       <input class="path" spellcheck="false"/>
       <button class="btn ghost sm" data-p="refresh" title="${T('Refresh')}">${ICONS.refresh}</button>
       <button class="btn ghost sm" data-p="mkdir" title="${T('New folder')}">${ICONS.newdir}</button>
-      <button class="btn ghost sm" data-p="xfer" title="${side === 'local' ? T('Upload →') : T('← Download')}">${side === 'local' ? ICONS.arrowR : ICONS.arrowL}</button></div>
+      ${WEB ? `<button class="btn ghost sm" data-p="upload" title="${T('Upload')}">${ICONS.upload}</button><button class="btn ghost sm" data-p="xfer" title="${T('Download')}">${ICONS.download}</button>` : `<button class="btn ghost sm" data-p="xfer" title="${side === 'local' ? T('Upload →') : T('← Download')}">${side === 'local' ? ICONS.arrowR : ICONS.arrowL}</button>`}</div>
       <div class="files"></div></div>`);
     this.el.addEventListener('click', (e) => {
       const p = e.target.closest('[data-p]')?.dataset.p;
@@ -1652,16 +1948,34 @@ class FilePane {
       if (p === 'refresh') this.go(this.cwd);
       if (p === 'mkdir') this.mkdir();
       if (p === 'xfer') this.transferSelected();
+      if (p === 'upload') this.pickUpload();
     });
     $('.path', this.el).addEventListener('keydown', (e) => { if (e.key === 'Enter') this.go(e.target.value); });
     const files = $('.files', this.el);
     files.addEventListener('contextmenu', (e) => { if (!e.target.closest('tr[data-i]')) { e.preventDefault(); ctxMenu(e.clientX, e.clientY, [{ label: T('New folder'), icon: 'newdir', run: () => this.mkdir() }, { label: T('Refresh'), icon: 'refresh', run: () => this.go(this.cwd) }]); } });
     // Drag & Drop zwischen den Panes
-    this.el.addEventListener('dragover', (e) => { if (S.drag && S.drag.pane !== this) { e.preventDefault(); this.el.classList.add('dragover'); } });
+    // Web-Version: Dateien aus dem Betriebssystem in den Server-Bereich ziehen = hochladen
+    const osFiles = (e) => WEB && [...(e.dataTransfer?.types || [])].includes('Files');
+    this.el.addEventListener('dragover', (e) => { if ((S.drag && S.drag.pane !== this) || osFiles(e)) { e.preventDefault(); this.el.classList.add('dragover'); } });
     this.el.addEventListener('dragleave', (e) => { if (!this.el.contains(e.relatedTarget)) this.el.classList.remove('dragover'); });
-    this.el.addEventListener('drop', (e) => { e.preventDefault(); this.el.classList.remove('dragover'); if (S.drag && S.drag.pane !== this) S.drag.pane.transferSelected(); S.drag = null; });
+    this.el.addEventListener('drop', (e) => {
+      e.preventDefault(); this.el.classList.remove('dragover');
+      if (osFiles(e)) return this.uploadFiles([...e.dataTransfer.files]);
+      if (S.drag && S.drag.pane !== this) S.drag.pane.transferSelected();
+      S.drag = null;
+    });
   }
   get other() { return this.side === 'local' ? this.sftp.remote : this.sftp.local; }
+  pickUpload() {
+    const inp = h('<input type="file" multiple style="display:none"/>');
+    inp.onchange = () => { this.uploadFiles([...inp.files]); inp.remove(); };
+    document.body.append(inp);
+    inp.click();
+  }
+  async uploadFiles(files) {
+    for (const f of files) await this.sftp.webTransfer('upload', f, `${this.cwd.replace(/\/$/, '')}/${f.name}`, f.name);
+    this.go(this.cwd);
+  }
   async join(...p) { return this.side === 'local' ? api.call('local:join', ...p) : p.join('/').replace(/\/+/g, '/'); }
   async parent(p) { return this.side === 'local' ? api.call('local:parent', p) : (p.replace(/\/[^/]+\/?$/, '') || '/'); }
   async list(dir) { return this.side === 'local' ? api.call('local:list', dir) : api.call('sftp:list', this.sftp.id, dir); }
@@ -1756,6 +2070,14 @@ class FilePane {
   async transferSelected() {
     const names = [...this.sel];
     if (!names.length) return toast(T('Nothing selected'));
+    if (WEB) {
+      for (const n of names) {
+        const f = this.files.find((x) => x.name === n);
+        if (f?.isDir) { toast(T('Folders cannot be downloaded in the browser: {name}', { name: n })); continue; }
+        this.sftp.webTransfer('download', null, await this.join(this.cwd, n), n);
+      }
+      return;
+    }
     const target = this.other;
     for (const n of names) {
       const src = await this.join(this.cwd, n), dst = await target.join(target.cwd, n);
@@ -1771,17 +2093,18 @@ class SftpSession {
     this.kind = 'sftp'; this.id = uid(); this.host = host;
     this.title = `SFTP · ${host.label || host.address}`;
     this.el = h(`<div class="session"><div class="sftp"></div><div class="transfers"></div></div>`);
-    this.local = new FilePane(this, 'local');
+    this.local = WEB ? null : new FilePane(this, 'local');
     this.remote = new FilePane(this, 'remote');
     const wrap = $('.sftp', this.el);
-    wrap.append(this.local.el, h(`<div class="pane"><div class="pane-empty"><div class="spinner" style="width:30px;height:30px;border:3px solid var(--border);border-top-color:var(--accent);border-radius:50%;animation:spin .9s linear infinite"></div><div>${esc(T('Connecting to {host} …', { host: host.address }))}</div></div></div>`));
+    if (this.local) wrap.append(this.local.el);
+    wrap.append(h(`<div class="pane"><div class="pane-empty"><div class="spinner" style="width:30px;height:30px;border:3px solid var(--border);border-top-color:var(--accent);border-radius:50%;animation:spin .9s linear infinite"></div><div>${esc(T('Connecting to {host} …', { host: host.address }))}</div></div></div>`));
     this.unsub = api.on('sftp:progress', (tid, done, total) => this.progress(tid, done, total));
     this.xfers = new Map();
     addTab(this);
     this.open();
   }
   async open() {
-    this.local.init(await api.call('local:home'));
+    if (this.local) this.local.init(await api.call('local:home'));
     try {
       const { home } = await api.call('sftp:open', this.id, this.host.id || this.host);
       $('.sftp', this.el).lastElementChild.replaceWith(this.remote.el);
@@ -1810,6 +2133,32 @@ class SftpSession {
       setTimeout(() => row.remove(), 10000);
     }
   }
+  // Web-Version: Upload per HTTP (mit Fortschritt), Download als Browser-Download
+  webTransfer(dir, file, remotePath, name) {
+    const q = `sid=${encodeURIComponent(this.id)}&path=${encodeURIComponent(remotePath)}`;
+    if (dir === 'download') {
+      const a = h(`<a href="/web/download?${q}" download="${esc(name)}" style="display:none"></a>`);
+      document.body.append(a); a.click(); a.remove();
+      return Promise.resolve();
+    }
+    const tid = uid();
+    const row = h(`<div class="transfer"><span>${ICONS.upload}</span><span class="nm">${esc(name)}</span><span class="pct">0%</span><div class="bar"><i></i></div></div>`);
+    $('.transfers', this.el).prepend(row);
+    this.xfers.set(tid, row);
+    return new Promise((resolve) => {
+      const x = new XMLHttpRequest();
+      x.open('POST', `/web/upload?${q}`);
+      x.setRequestHeader('X-MrTerm', '1');
+      x.upload.onprogress = (e) => this.progress(tid, e.loaded, e.total);
+      x.onload = () => {
+        if (x.status < 300) { row.classList.add('done'); $('.bar i', row).style.width = '100%'; $('.pct', row).textContent = T('done'); setTimeout(() => row.remove(), 5000); }
+        else { row.classList.add('fail'); $('.pct', row).textContent = T('Error'); const m = (() => { try { return JSON.parse(x.responseText).error; } catch { return x.statusText; } })(); toast(`${name}: ${m}`, 'error'); setTimeout(() => row.remove(), 10000); }
+        resolve();
+      };
+      x.onerror = () => { row.classList.add('fail'); $('.pct', row).textContent = T('Error'); resolve(); };
+      x.send(file);
+    });
+  }
   progress(tid, done, total) {
     const row = this.xfers.get(tid); if (!row) return;
     const p = total ? Math.round((done / total) * 100) : 0;
@@ -1831,14 +2180,25 @@ class DockerSession {
     this.containers = []; this.stats = {}; this.filter = ''; this.showStopped = true;
     this.el = h(`<div class="session docker">
       <div class="sbar"><div class="info">${avatar(host, 22)}<span>${esc(hostSub(host))}</span><span class="rt"></span></div>
-        <label class="search sm">${ICONS.search}<input placeholder="${esc(T('Search containers …'))}"/></label>
-        <label class="check" style="margin:0 6px"><input type="checkbox" data-a="stopped" checked/>${T('Show stopped')}</label>
+        <div class="seg sm"><button class="active" data-v="containers">${T('Containers')}</button><button data-v="stacks">Stacks</button></div>
+        <label class="search sm">${ICONS.search}<input placeholder="${esc(T('Search …'))}"/></label>
+        <label class="check stopped-opt" style="margin:0 6px"><input type="checkbox" data-a="stopped" checked/>${T('Show stopped')}</label>
         <button class="btn ghost sm" data-a="refresh" title="${T('Refresh')}">${ICONS.refresh}</button>
       </div>
       <div class="docker-body"><div class="pane-empty"><div class="spinner" style="width:30px;height:30px;border:3px solid var(--border);border-top-color:var(--accent);border-radius:50%;animation:spin .9s linear infinite"></div><div>${esc(T('Connecting to {host} …', { host: host.address }))}</div></div></div></div>`);
     this.body = $('.docker-body', this.el);
     $('.search input', this.el).oninput = (e) => { this.filter = e.target.value.toLowerCase(); this.draw(); };
-    this.el.addEventListener('click', (e) => { if (e.target.closest('[data-a=refresh]')) this.refresh(true); });
+    this.view = 'containers'; this.stackInfo = null; this.editing = null;
+    this.el.addEventListener('click', (e) => {
+      if (e.target.closest('[data-a=refresh]')) this.refresh(true);
+      const v = e.target.closest('.seg [data-v]')?.dataset.v;
+      if (v && v !== this.view) {
+        this.view = v; this.editing = null;
+        $$('.seg [data-v]', this.el).forEach((b) => b.classList.toggle('active', b.dataset.v === v));
+        $('.stopped-opt', this.el).style.display = v === 'containers' ? '' : 'none';
+        if (v === 'stacks') this.loadStacks(true); else this.draw();
+      }
+    });
     $('[data-a=stopped]', this.el).onchange = (e) => { this.showStopped = e.target.checked; this.draw(); };
     this.unsub = api.on('docker:closed', (sid) => { if (sid === this.id) { setTabState(this, 'err'); this.error(T('Connection closed.')); } });
     addTab(this);
@@ -1873,7 +2233,11 @@ class DockerSession {
   async refresh(withStats) {
     if (this.busy) return;
     this.busy = true;
-    try { this.apply(await api.call('docker:list', this.id)); if (withStats) this.loadStats(); } catch (e) { if (withStats) toast(e.message, 'error'); }
+    try {
+      this.apply(await api.call('docker:list', this.id));
+      if (withStats) this.loadStats();
+      if (this.view === 'stacks' && !this.editing) await this.loadStacks();
+    } catch (e) { if (withStats) toast(e.message, 'error'); }
     this.busy = false;
   }
 
@@ -1882,6 +2246,7 @@ class DockerSession {
   }
 
   draw() {
+    if (this.view === 'stacks') return this.editing ? null : this.drawStacks();
     const running = (c) => c.state === 'running';
     const list = this.containers
       .filter((c) => (this.showStopped || running(c)) && (!this.filter || [c.name, c.image, c.id, c.ports].some((f) => String(f || '').toLowerCase().includes(this.filter))))
@@ -1934,6 +2299,206 @@ class DockerSession {
     await this.refresh(true);
   }
 
+  // ---------- Compose-Stacks
+  get stacksDir() { return settings().dockerStacksDir || '/opt/stacks'; }
+
+  async loadStacks(showErrors) {
+    try { this.stackInfo = await api.call('docker:stacks', this.id, this.stacksDir); this.stackError = ''; }
+    catch (e) { this.stackError = e.message; if (showErrors) this.stackInfo = null; }
+    if (this.view === 'stacks' && !this.editing) this.drawStacks();
+  }
+
+  drawStacks() {
+    const info = this.stackInfo;
+    if (!info) {
+      this.body.innerHTML = `<div class="pane-empty">${this.stackError ? `<div style="color:var(--red);max-width:520px;text-align:center">${esc(this.stackError)}</div>` : '<span class="spinner sm"></span>'}</div>`;
+      return;
+    }
+    const list = info.stacks.filter((x) => !this.filter || [x.name, x.file, typeof x.git === 'string' ? x.git : ''].some((f) => String(f).toLowerCase().includes(this.filter)));
+    const scroll = this.body.scrollTop;
+    const needSetup = !info.exists || !info.writable;
+    this.body.innerHTML = `<div class="stack-bar">
+        <span class="muted">${T('Folder')}: <code>${esc(info.dir)}</code></span>
+        <button class="btn ghost sm" data-s="dir" title="${T('Change folder')}">${ICONS.edit}</button>
+        ${needSetup ? `<button class="btn sm" data-s="setup" title="${esc(T('Creates the folder with sudo and makes it writable for {user}.', { user: this.host.username || '$USER' }))}">${ICONS.newdir}${T('Set up folder')}</button>` : ''}
+        <span style="flex:1"></span>
+        <button class="btn sm" data-s="templates">${ICONS.download}${T('Templates')}</button>
+        <button class="btn sm" data-s="git">${ICONS.code}${T('From Git')}</button>
+        <button class="btn primary sm" data-s="new">${ICONS.plus}${T('New stack')}</button>
+      </div>
+      ${list.length ? `<table class="docker-table"><thead><tr><th></th><th>${T('Name')}</th><th>${T('Status')}</th><th>${T('Compose file')}</th><th></th></tr></thead><tbody>
+      ${list.map((x, i) => {
+        const on = /running/.test(x.status);
+        return `<tr data-i="${i}"><td><span class="dot ${on ? 'on' : x.status ? '' : 'none'}"></span></td>
+          <td class="name"><div><b>${esc(x.name)}${x.git ? ` <span class="badge" title="${esc(typeof x.git === 'string' ? x.git : 'git')}">git</span>` : ''}${x.managed ? '' : ` <span class="badge" title="${esc(T('Found via docker compose ls, outside the stacks folder'))}">${T('external')}</span>`}</b></div></td>
+          <td class="muted">${esc(x.status || T('not deployed'))}</td><td class="muted ports" title="${esc(x.file)}">${esc(x.file || T('no compose file found'))}</td>
+          <td class="acts">${x.file ? `
+            <button class="btn ghost sm" data-k="edit" title="${T('Edit')}">${ICONS.edit}</button>
+            <button class="btn ghost sm" data-k="up" title="${T('Deploy (up -d)')}">${ICONS.play}</button>
+            ${on ? `<button class="btn ghost sm" data-k="restart" title="${T('Restart')}">${ICONS.refresh}</button><button class="btn ghost sm" data-k="stop" title="${T('Stop')}">${ICONS.stop}</button>` : ''}
+            <button class="btn ghost sm" data-k="logs" title="${T('Logs')}">${ICONS.logs}</button>` : ''}
+            ${x.managed ? `<button class="btn ghost sm" data-k="delete" title="${T('Delete')}">${ICONS.trash}</button>` : ''}
+          </td></tr>`;
+      }).join('')}</tbody></table>`
+        : `<div class="pane-empty" style="height:auto;padding:60px 0"><div style="color:var(--muted)">${this.filter ? T('No matches.') : T('No stacks yet. Create one, clone it from Git or start from a template.')}</div></div>`}`;
+    this.body.scrollTop = scroll;
+    $$('[data-s]', this.body).forEach((b) => { b.onclick = () => this.stackBar(b.dataset.s); });
+    $$('tr[data-i]', this.body).forEach((tr) => {
+      const x = list[+tr.dataset.i];
+      tr.onclick = (e) => { const k = e.target.closest('[data-k]')?.dataset.k; if (k) this.stackAct(k, x); };
+      tr.ondblclick = (e) => { if (!e.target.closest('[data-k]') && x.file) this.stackAct('edit', x); };
+      tr.oncontextmenu = (e) => ctxMenu(e.clientX, e.clientY, [
+        ...(x.file ? [
+          { label: T('Edit'), icon: 'edit', run: () => this.stackAct('edit', x) },
+          { label: T('Deploy (up -d)'), icon: 'play', run: () => this.stackAct('up', x) },
+          { label: T('Update images (pull + up)'), icon: 'download', run: () => this.stackAct('pull', x) },
+          ...(x.git ? [{ label: T('Git pull + redeploy'), icon: 'code', run: () => this.stackAct('gitpull', x) }] : []),
+          { label: T('Restart'), icon: 'refresh', run: () => this.stackAct('restart', x) },
+          { label: T('Stop'), icon: 'stop', run: () => this.stackAct('stop', x) },
+          { label: T('Down (remove containers)'), icon: 'close', run: () => this.stackAct('down', x) },
+          { label: T('Logs'), icon: 'logs', run: () => this.stackAct('logs', x) },
+          '-', { label: T('Copy path'), icon: 'copy', run: () => api.call('clipboard:write', x.file) },
+        ] : []),
+        ...(x.managed ? ['-', { label: T('Delete'), icon: 'trash', danger: true, run: () => this.stackAct('delete', x) }] : []),
+      ]);
+    });
+  }
+
+  // Befehl in einem Terminal-Tab ausführen (Live-Ausgabe, sudo/git-Abfragen möglich)
+  async stackTerminal(action, st, opts, label) {
+    const cmd = await call('docker:stackCommand', this.id, action, st, opts);
+    openTerminal({ ...this.host, execCommand: cmd, label: `${label} · ${st.name || st.dir}` });
+  }
+
+  async stackBar(a) {
+    if (a === 'new') return this.editStack({ name: '', compose: 'services:\n  app:\n    image: nginx:alpine\n    restart: unless-stopped\n    ports:\n      - "8080:80"\n', env: '' });
+    if (a === 'dir') {
+      const d = await promptBox(T('Stacks folder'), T('Folder on the host in which each stack gets its own subfolder'), this.stacksDir);
+      if (!d || !d.startsWith('/')) return;
+      await call('vault:settings', { dockerStacksDir: d.replace(/\/+$/, '') || '/' });
+      S.vault.settings.dockerStacksDir = d.replace(/\/+$/, '') || '/';
+      return this.loadStacks(true);
+    }
+    if (a === 'setup') return this.stackTerminal('setup', { dir: this.stacksDir }, {}, T('Set up folder'));
+    if (a === 'git') {
+      const r = await modal({
+        title: T('Stack from Git'),
+        body: `${field(T('Repository URL'), 'url', '', { placeholder: 'https://github.com/user/repo.git' }).outerHTML}
+          ${row(field(T('Stack name'), 'name', '', { placeholder: 'my-app' }), field(T('Branch (optional)'), 'branch', '')).outerHTML}
+          ${field(T('Compose file in the repository (optional)'), 'path', '', { placeholder: 'docker-compose.yml', hint: T('If empty, the first compose file found is used.') }).outerHTML}
+          ${check(T('Deploy right after cloning'), 'deploy', true).outerHTML}
+          <div class="hint" style="color:var(--muted);font-size:12px">${T('The repository is cloned on the host into the stacks folder. Git asks for credentials in the terminal if needed; for private repos an SSH deploy key or a token in the URL also works.')}</div>`,
+        buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Clone'), value: 'form', cls: 'primary' }],
+      });
+      if (!r) return;
+      const name = (r.name || r.url.split('/').pop().replace(/\.git$/, '')).toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+      return this.stackTerminal('clone', { name, stacksDir: this.stacksDir }, { url: r.url.trim(), branch: r.branch.trim(), path: r.path.trim(), deploy: r.deploy }, 'git clone').catch(() => {});
+    }
+    if (a === 'templates') return this.pickTemplate();
+  }
+
+  async pickTemplate() {
+    const tplUrl = settings().dockerTemplatesUrl || '';
+    const done = modal({
+      title: T('App templates'),
+      body: `<div class="tpl-top"><label class="search sm" style="flex:1">${ICONS.search}<input class="tpl-q" placeholder="${esc(T('Search templates …'))}"/></label><select class="tpl-cat"></select></div>
+        <div class="tpl-list"><div class="pane-empty" style="padding:40px 0"><span class="spinner sm"></span></div></div>
+        <div class="hint" style="color:var(--faint);font-size:11px;margin-top:6px">${T('Source: {url} (Portainer template format, changeable in the settings).', { url: esc(tplUrl || 'Lissy93/portainer-templates') })}</div>`,
+      buttons: [{ label: T('Close'), value: null, cls: 'ghost' }],
+      noEnter: true,
+    });
+    const root = $$('#modalRoot .modal-bg').pop();
+    $('.modal', root).classList.add('wide');
+    let list = [];
+    try { list = await api.call('docker:templates', tplUrl); } catch (e) { $('.tpl-list', root).innerHTML = `<div style="color:var(--red);padding:20px">${esc(e.message)}</div>`; return done; }
+    const cats = [...new Set(list.flatMap((t) => t.categories))].sort();
+    $('.tpl-cat', root).innerHTML = `<option value="">${T('All categories')}</option>${cats.map((c) => `<option>${esc(c)}</option>`).join('')}`;
+    const render = () => {
+      const q = $('.tpl-q', root).value.toLowerCase(), cat = $('.tpl-cat', root).value;
+      const f = list.filter((t) => (!cat || t.categories.includes(cat)) && (!q || `${t.title} ${t.description}`.toLowerCase().includes(q))).slice(0, 200);
+      $('.tpl-list', root).innerHTML = f.map((t) => `<div class="tpl-it" data-i="${t.i}"><div><b>${esc(t.title)}</b> <span class="badge">${t.kind === 'stack' ? 'Stack' : 'Container'}</span></div><div class="d">${esc(t.description)}</div></div>`).join('') || `<div style="color:var(--muted);padding:20px">${T('No matches.')}</div>`;
+    };
+    $('.tpl-q', root).oninput = render;
+    $('.tpl-cat', root).onchange = render;
+    $('.tpl-list', root).onclick = async (e) => {
+      const it = e.target.closest('.tpl-it');
+      if (!it) return;
+      it.style.opacity = '.5';
+      try {
+        const t = await api.call('docker:template', +it.dataset.i, tplUrl);
+        $('.mfoot .btn', root).click();
+        this.editStack({ name: t.name, compose: t.compose, env: t.env, note: t.note });
+      } catch (err) { it.style.opacity = ''; toast(err.message, 'error'); }
+    };
+    render();
+    $('.tpl-q', root).focus();
+    return done;
+  }
+
+  async stackAct(k, x) {
+    try {
+      if (k === 'edit') {
+        const r = await call('docker:stackRead', this.id, x.file);
+        return this.editStack({ ...x, ...r });
+      }
+      if (k === 'delete') {
+        const r = await modal({
+          title: T('Delete stack?'),
+          text: T('The stack “{name}” is stopped (down) and its folder {dir} is deleted.', { name: x.name, dir: x.dir }),
+          body: check(T('Also delete named volumes (data!)'), 'volumes', false).outerHTML,
+          buttons: [{ label: T('Cancel'), value: null, cls: 'ghost' }, { label: T('Delete'), value: 'form', cls: 'danger' }],
+        });
+        if (!r) return;
+        return await this.stackTerminal('delete', x, { volumes: r.volumes }, T('Delete'));
+      }
+      if (k === 'down' && !(await confirmBox(T('Remove containers?'), T('docker compose down stops and removes the containers of “{name}”. Volumes and files are kept.', { name: x.name }), T('Down')))) return;
+      const labels = { up: 'up', pull: 'pull', gitpull: 'git pull', restart: 'restart', stop: 'stop', down: 'down', logs: T('Logs') };
+      await this.stackTerminal(k, x, {}, labels[k] || k);
+    } catch {}
+  }
+
+  // Editor für compose.yaml und .env; st.file fehlt bei neuen Stacks
+  editStack(st) {
+    this.editing = st;
+    const isNew = !st.file;
+    this.body.innerHTML = `<div class="stack-editor">
+      <div class="se-head">
+        <button class="btn ghost sm" data-e="back">← ${T('Back')}</button>
+        ${isNew ? `<input class="se-name" placeholder="${esc(T('Stack name'))}" value="${esc(st.name || '')}" spellcheck="false"/>` : `<b>${esc(st.name)}</b><span class="muted mono" style="font-size:12px">${esc(st.file)}</span>`}
+        <span style="flex:1"></span>
+        <button class="btn sm" data-e="save">${T('Save')}</button>
+        <button class="btn primary sm" data-e="deploy">${ICONS.play}${T('Save & deploy')}</button>
+      </div>
+      ${st.note ? `<div class="se-note">${esc(st.note)}</div>` : ''}
+      <div class="se-grid">
+        <div class="se-col"><label>${isNew ? 'compose.yaml' : esc(st.file.split('/').pop())}</label><textarea class="se-compose mono" spellcheck="false"></textarea></div>
+        <div class="se-col env"><label>.env <span class="muted">${T('(variables, used as ${NAME} in the compose file)')}</span></label><textarea class="se-env mono" spellcheck="false" placeholder="KEY=value"></textarea></div>
+      </div></div>`;
+    const ta = $('.se-compose', this.body), env = $('.se-env', this.body);
+    ta.value = st.compose || ''; env.value = st.env || '';
+    for (const t of [ta, env]) t.addEventListener('keydown', (e) => {
+      if (e.key === 'Tab' && !e.shiftKey) { e.preventDefault(); t.setRangeText('  ', t.selectionStart, t.selectionEnd, 'end'); }
+      if (e.key === 's' && (e.ctrlKey || e.metaKey)) { e.preventDefault(); save(false); }
+    });
+    const save = async (deploy) => {
+      const name = isNew ? $('.se-name', this.body).value.trim() : st.name;
+      const btns = $$('[data-e]', this.body); btns.forEach((b) => { b.disabled = true; });
+      try {
+        const r = await call('docker:stackSave', this.id, { stacksDir: this.stacksDir, name, file: st.file, compose: ta.value, env: env.value });
+        if (r.warning) toast(T('Saved, but the compose file has an error: {msg}', { msg: r.warning }), 'error');
+        else toast(T('Saved'), 'ok');
+        Object.assign(st, { file: r.file, name, dir: r.file.replace(/\/[^/]*$/, ''), managed: true, compose: ta.value, env: env.value });
+        if (deploy && !r.warning) await this.stackTerminal('up', st, {}, 'up');
+        if (isNew || deploy) { this.editing = null; await this.loadStacks(true); return; }
+      } catch {}
+      btns.forEach((b) => { b.disabled = false; });
+    };
+    $('[data-e=back]', this.body).onclick = () => { this.editing = null; this.loadStacks(true); };
+    $('[data-e=save]', this.body).onclick = () => save(false);
+    $('[data-e=deploy]', this.body).onclick = () => save(true);
+    (isNew && !st.name ? $('.se-name', this.body) : ta).focus();
+  }
+
   onShow() { if (this.containers.length) this.refresh(); }
   dispose() { clearInterval(this.timer); this.unsub(); api.call('docker:close', this.id).catch(() => {}); }
 }
@@ -2466,6 +3031,19 @@ document.addEventListener('keydown', (e) => {
   }
 });
 
+// Web-Version: Hostschlüssel bestätigen (in Electron zeigt der Hauptprozess dafür einen Systemdialog)
+api.on('hostkey:request', async (req) => {
+  const changed = !!req.previous;
+  const r = await modal({
+    title: changed ? T('Host key has changed!') : T('Unknown host'),
+    body: `<p style="margin-top:0">${esc(changed ? T('WARNING: The host key of {target} has changed. This may indicate a man-in-the-middle attack.', { target: req.host }) : T('The authenticity of {target} cannot be verified.', { target: req.host }))}</p>
+      <div class="mono" style="word-break:break-all;background:var(--panel);padding:8px 10px;border-radius:8px">${esc(req.fingerprint)}</div>
+      ${changed ? `<p>${esc(T('Previously stored:'))}</p><div class="mono" style="word-break:break-all;background:var(--panel);padding:8px 10px;border-radius:8px">${esc(req.previous)}</div>` : ''}`,
+    buttons: [{ label: T('Cancel'), value: false, cls: 'ghost' }, { label: changed ? T('Connect anyway & replace') : T('Trust & connect'), value: true, cls: changed ? 'danger' : 'primary' }],
+    noEnter: changed,
+  });
+  api.replySecret(req.reqId, r === true);
+});
 api.on('secret:request', async (req) => {
   const r = await modal({
     title: req.title || T('Authentication'),

src/renderer/styles.css

@@ -191,7 +191,31 @@ body.in-session #sidebar { display: none; }
 .snip-panel .items { overflow: auto; padding: 8px; display: flex; flex-direction: column; gap: 6px; }
 .snip-panel .it { background: var(--card); border-radius: 8px; padding: 9px 10px; cursor: pointer; }
 .snip-panel .it:hover { background: var(--card-hover); }
+.snip-tpl { margin-top: 10px; }
+.snip-tpl summary { cursor: pointer; color: var(--muted); font-weight: 600; padding: 6px 2px; user-select: none; }
+.snip-tpl .tpl-items { display: flex; flex-direction: column; gap: 6px; margin-top: 4px; }
+.snip-tpl .it { background: var(--card); border-radius: 8px; padding: 9px 10px; cursor: pointer; }
+.snip-tpl .it:hover { background: var(--card-hover); }
+.snip-tpl .hint { color: var(--muted); font-size: 12px; margin-top: 3px; }
 .snip-panel .it .mono { color: var(--muted); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; margin-top: 3px; }
+/* Support-Assistent */
+.ai-panel { width: 380px; border-left: 1px solid var(--border); background: var(--bg-2); display: none; flex-direction: column; flex: none; min-height: 0; }
+.ai-panel.open { display: flex; }
+.ai-panel .head { padding: 8px 12px; font-weight: 600; border-bottom: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+.ai-panel .msgs { flex: 1; overflow: auto; padding: 10px; display: flex; flex-direction: column; gap: 8px; user-select: text; }
+.ai-panel .m { border-radius: 8px; padding: 8px 10px; line-height: 1.45; overflow-wrap: anywhere; }
+.ai-panel .m.user { background: var(--accent); color: #fff; align-self: flex-end; max-width: 90%; white-space: pre-wrap; }
+.ai-panel .m.bot { background: var(--card); }
+.ai-panel .m.err { color: var(--red, #ff6b6b); }
+.ai-panel .m code { font-family: var(--mono, monospace); font-size: 12px; background: var(--bg); padding: 1px 4px; border-radius: 4px; }
+.ai-panel .code { margin: 6px 0; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; }
+.ai-panel .code .acts { display: flex; justify-content: flex-end; gap: 2px; padding: 2px; border-bottom: 1px solid var(--border); }
+.ai-panel .code pre { margin: 0; padding: 8px; overflow: auto; }
+.ai-panel .code pre code { background: none; padding: 0; }
+.ai-panel .ask { border-top: 1px solid var(--border); padding: 8px; display: flex; flex-direction: column; gap: 6px; }
+.ai-panel .ask textarea { background: var(--bg); border: 1px solid var(--border); border-radius: 6px; padding: 6px 8px; resize: vertical; color: inherit; font: inherit; outline: none; }
+.ai-panel .ask .row { justify-content: space-between; }
+.ai-panel .spinner { width: 16px; height: 16px; }
 .findbar { position: absolute; top: 8px; right: 24px; z-index: 4; display: none; gap: 4px; align-items: center; background: var(--panel); border: 1px solid var(--border); border-radius: 8px; padding: 4px; box-shadow: 0 8px 24px #0008; }
 .findbar.open { display: flex; }
 .findbar input { background: var(--bg); border: 1px solid var(--border); border-radius: 6px; padding: 5px 8px; outline: none; width: 200px; }
@@ -330,6 +354,29 @@ kbd { background: var(--card); border: 1px solid var(--border); border-bottom-wi
 
 /* Firewall */
 .seg.sm button { padding: 4px 10px; font-size: 12px; }
+.session.docker .sbar .seg { margin: 0 6px 0 0; flex: none; }
+.docker-table .dot.none { background: transparent; border: 1px solid var(--faint); }
+.docker-table .badge, .tpl-it .badge { font-size: 10px; font-weight: 600; padding: 1px 6px; border-radius: 6px; background: var(--icon-bg); color: var(--muted); margin-left: 4px; vertical-align: middle; }
+.stack-bar { display: flex; align-items: center; gap: 6px; padding: 8px 10px; border-bottom: 1px solid var(--border); flex-wrap: wrap; position: sticky; top: 0; background: var(--bg); z-index: 2; }
+.stack-bar .muted { color: var(--muted); font-size: 12px; }
+.stack-bar + .docker-table th { top: 45px; }
+.stack-editor { display: flex; flex-direction: column; height: 100%; }
+.stack-editor .se-head { display: flex; align-items: center; gap: 8px; padding: 8px 10px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
+.stack-editor .se-name { background: var(--panel); border: 1px solid var(--border); border-radius: 6px; color: var(--text); padding: 5px 8px; width: 200px; font: inherit; }
+.stack-editor .se-note { padding: 8px 12px; color: var(--muted); font-size: 12px; border-bottom: 1px solid var(--border); max-height: 80px; overflow: auto; }
+.stack-editor .se-grid { flex: 1; display: grid; grid-template-columns: 2fr 1fr; gap: 10px; padding: 10px; min-height: 0; }
+.stack-editor .se-col { display: flex; flex-direction: column; min-height: 0; gap: 6px; }
+.stack-editor .se-col label { font-size: 12px; color: var(--muted); font-weight: 600; }
+.stack-editor textarea { flex: 1; resize: none; background: var(--panel); color: var(--text); border: 1px solid var(--border); border-radius: 8px; padding: 10px; font-size: 13px; line-height: 1.45; tab-size: 2; white-space: pre; min-height: 200px; }
+@media (max-width: 800px) { .stack-editor .se-grid { grid-template-columns: 1fr; } }
+.modal.wide { width: min(760px, 94vw); max-width: none; }
+.tpl-top { display: flex; gap: 8px; margin-bottom: 8px; }
+.tpl-top .search { margin: 0; }
+.tpl-top select { background: var(--panel); color: var(--text); border: 1px solid var(--border); border-radius: 8px; padding: 0 8px; }
+.tpl-list { max-height: 55vh; overflow: auto; display: flex; flex-direction: column; gap: 6px; }
+.tpl-it { background: var(--card); border-radius: 8px; padding: 9px 11px; cursor: pointer; }
+.tpl-it:hover { background: var(--card-hover); }
+.tpl-it .d { color: var(--muted); font-size: 12px; margin-top: 3px; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
 .fw-head { display: flex; align-items: center; gap: 12px; padding: 14px 16px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
 .fw-def { display: flex; align-items: center; gap: 8px; color: var(--muted); font-size: 12px; margin-left: 8px; }
 .fw-def select { background: var(--panel); border: 1px solid var(--border); border-radius: 6px; padding: 4px 8px; color: var(--text); }
@@ -406,3 +453,6 @@ kbd { background: var(--card); border: 1px solid var(--border); border-bottom-wi
 [data-theme='macos'] .btn.primary { background: linear-gradient(rgba(40, 145, 255, .92), rgba(0, 110, 240, .92)); border-color: rgba(255, 255, 255, .45); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .55), 0 4px 14px rgba(0, 122, 255, .3); }
 [data-theme='macos'] .modal-bg { -webkit-backdrop-filter: blur(6px); backdrop-filter: blur(6px); }
 [data-theme='macos'] .nav.active { box-shadow: inset 0 1px 0 rgba(255, 255, 255, .9), 0 2px 8px rgba(30, 40, 80, .08); }
+
+/* Web-Version (Browser): Desktop-Funktionen ausblenden */
+.web .win-ctrls, .web #lockBtn, .web .nav[data-view='vpns'], .web .nav[data-view='forwards'], .web #updateBadge { display: none !important; }

src/web/public/login.css

@@ -0,0 +1,16 @@
+* { box-sizing: border-box; }
+html, body { margin: 0; min-height: 100%; }
+body { background: var(--bg); color: var(--text); font-family: var(--font); display: grid; place-items: center; min-height: 100vh; padding: 16px; }
+.box { width: 100%; max-width: 380px; background: var(--card); border: 1px solid var(--border); border-radius: 16px; padding: 32px 28px 22px; text-align: center; box-shadow: 0 20px 60px #0006; }
+.logo { width: 72px; height: 72px; border-radius: 18px; }
+h1 { margin: 10px 0 4px; font-size: 26px; }
+h1 span { color: var(--green); }
+p { color: var(--muted); margin: 0 0 22px; font-size: 14px; }
+form { display: flex; flex-direction: column; gap: 14px; text-align: left; }
+label span { display: block; font-size: 11px; font-weight: 700; letter-spacing: .5px; text-transform: uppercase; color: var(--muted); margin-bottom: 6px; }
+input { width: 100%; background: var(--panel); color: var(--text); border: 1px solid var(--border); border-radius: 10px; padding: 11px 12px; font: inherit; outline: none; }
+input:focus { border-color: var(--accent); }
+button { margin-top: 6px; background: var(--accent); color: var(--on-accent); border: 0; border-radius: 10px; padding: 12px; font: 600 15px var(--font); cursor: pointer; }
+button:disabled { opacity: .6; }
+.err { color: var(--red); font-size: 13px; }
+.ver { margin-top: 18px; color: var(--faint); font-size: 11px; }

src/web/public/login.html

@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>MrTerm</title>
+  <link rel="icon" href="/favicon.png" />
+  <link rel="stylesheet" href="/app/src/renderer/app-themes.css" />
+  <link rel="stylesheet" href="/web/login.css" />
+</head>
+<body>
+  <main class="box">
+    <img src="/favicon.png" alt="" class="logo" />
+    <h1>Mr<span>Term</span></h1>
+    <p id="intro"></p>
+    <form id="form" autocomplete="on">
+      <label><span data-t="Username">Username</span><input name="name" autocomplete="username" required autofocus /></label>
+      <label><span data-t="Password">Password</span><input name="password" type="password" autocomplete="current-password" required /></label>
+      <label id="repeatRow" hidden><span data-t="Repeat password">Repeat password</span><input name="repeat" type="password" autocomplete="new-password" /></label>
+      <div id="err" class="err" hidden></div>
+      <button id="submit" type="submit"></button>
+    </form>
+    <div class="ver" id="ver"></div>
+  </main>
+  <script src="/app/src/i18n.js"></script>
+  <script src="/web/login.js"></script>
+</body>
+</html>

src/web/public/login.js

@@ -0,0 +1,36 @@
+// Anmeldung bzw. Ersteinrichtung (Admin-Konto) der Web-Version
+(async () => {
+  'use strict';
+  I18N.setLanguage('auto', navigator.language);
+  const T = I18N.t;
+  const $ = (s) => document.querySelector(s);
+  document.querySelectorAll('[data-t]').forEach((e) => { e.textContent = T(e.dataset.t); });
+
+  const st = await fetch('/api/state').then((r) => r.json());
+  if (st.user) { location.href = '/app/src/renderer/index.html'; return; }
+  const setup = st.setup;
+  $('#ver').textContent = `MrTerm Web ${st.version}`;
+  $('#intro').textContent = setup ? T('Welcome! Create the administrator account for this MrTerm server.') : T('Sign in to your MrTerm server.');
+  $('#submit').textContent = setup ? T('Create account') : T('Sign in');
+  $('#repeatRow').hidden = !setup;
+  if (setup) $('[name=password]').autocomplete = 'new-password';
+
+  $('#form').onsubmit = async (e) => {
+    e.preventDefault();
+    const f = Object.fromEntries(new FormData(e.target));
+    const err = $('#err');
+    err.hidden = true;
+    if (setup && f.password !== f.repeat) { err.textContent = T('The passwords do not match.'); err.hidden = false; return; }
+    $('#submit').disabled = true;
+    try {
+      const r = await fetch(setup ? '/api/setup' : '/api/login', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-MrTerm': '1' }, body: JSON.stringify({ name: f.name, password: f.password }) });
+      const j = await r.json().catch(() => ({}));
+      if (!r.ok) throw new Error(j.error || r.statusText);
+      location.href = '/app/src/renderer/index.html';
+    } catch (ex) {
+      err.textContent = T(ex.message);
+      err.hidden = false;
+      $('#submit').disabled = false;
+    }
+  };
+})();

src/web/public/web-api.js

@@ -0,0 +1,108 @@
+// window.api für die Web-Version: gleiche Schnittstelle wie src/preload.js (Electron),
+// aber über einen WebSocket zum MrTerm-Web-Server. Dateidialoge, Zwischenablage und Links laufen im Browser.
+(() => {
+  'use strict';
+  const listeners = new Map();
+  const waits = new Map();
+  let ws, seq = 0, queue = [], retry = 0, banner;
+  const emit = (ch, args) => listeners.get(ch)?.forEach((fn) => { try { fn(...args); } catch (e) { console.error(e); } });
+
+  function showBanner(text) {
+    if (!document.body) return;
+    if (!banner) {
+      banner = document.createElement('div');
+      banner.style.cssText = 'position:fixed;left:50%;top:10px;transform:translateX(-50%);z-index:9999;background:var(--card,#222);color:var(--text,#eee);border:1px solid var(--border,#444);border-radius:10px;padding:8px 14px;font:13px system-ui;box-shadow:0 6px 24px #0006';
+      document.body.append(banner);
+    }
+    banner.textContent = text;
+    banner.hidden = !text;
+  }
+
+  function connect() {
+    ws = new WebSocket(`${location.protocol === 'https:' ? 'wss' : 'ws'}://${location.host}/ws`);
+    ws.onopen = () => { retry = 0; showBanner(''); for (const m of queue) ws.send(m); queue = []; };
+    ws.onmessage = (e) => {
+      const m = JSON.parse(e.data);
+      if (m.t === 'reply') {
+        const w = waits.get(m.id);
+        if (!w) return;
+        waits.delete(m.id);
+        m.ok ? w.resolve(m.v) : w.reject(new Error(m.v));
+      } else if (m.t === 'evt') emit(m.ch, m.args || []);
+    };
+    ws.onclose = (e) => {
+      for (const w of waits.values()) w.reject(new Error('Connection to the MrTerm server lost.'));
+      waits.clear();
+      if (e.code === 4001) { location.href = '/'; return; }
+      // Sitzung abgelaufen? Dann zur Anmeldung, sonst neu verbinden
+      fetch('/api/me', { headers: { 'X-MrTerm': '1' } }).then((r) => {
+        if (r.status === 401) { location.href = '/'; return; }
+        showBanner(window.I18N ? I18N.t('Connection lost – reconnecting …') : 'Connection lost – reconnecting …');
+        setTimeout(connect, Math.min(1000 * 2 ** retry++, 15000));
+      }).catch(() => { showBanner(window.I18N ? I18N.t('Connection lost – reconnecting …') : 'Connection lost – reconnecting …'); setTimeout(connect, Math.min(1000 * 2 ** retry++, 15000)); });
+    };
+  }
+  const post = (m) => { const s = JSON.stringify(m); if (ws.readyState === 1) ws.send(s); else queue.push(s); };
+  const remote = (ch, args) => new Promise((resolve, reject) => { const id = ++seq; waits.set(id, { resolve, reject }); post({ t: 'call', id, ch, args }); });
+
+  // Datei im Browser auswählen und als Text lesen
+  function pickFile(accept) {
+    return new Promise((resolve) => {
+      const inp = document.createElement('input');
+      inp.type = 'file';
+      if (accept) inp.accept = accept;
+      inp.style.display = 'none';
+      inp.onchange = async () => { const f = inp.files[0]; inp.remove(); resolve(f ? { name: f.name, content: await f.text() } : null); };
+      inp.addEventListener('cancel', () => { inp.remove(); resolve(null); });
+      document.body.append(inp);
+      inp.click();
+    });
+  }
+  function downloadText(name, text) {
+    const url = URL.createObjectURL(new Blob([text], { type: 'application/json' }));
+    const a = Object.assign(document.createElement('a'), { href: url, download: name });
+    document.body.append(a); a.click(); a.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
+  }
+
+  // Kanäle, die im Browser selbst erledigt werden
+  const local = {
+    // Ohne HTTPS gibt es navigator.clipboard nicht: Kopieren per execCommand, Einfügen dann nur per Strg+V
+    'clipboard:write': (t) => {
+      if (navigator.clipboard && window.isSecureContext) return navigator.clipboard.writeText(String(t));
+      const ta = Object.assign(document.createElement('textarea'), { value: String(t) });
+      ta.style.cssText = 'position:fixed;opacity:0';
+      document.body.append(ta); ta.select(); document.execCommand('copy'); ta.remove();
+    },
+    'clipboard:read': () => {
+      if (navigator.clipboard && window.isSecureContext) return navigator.clipboard.readText();
+      throw new Error('Pasting from the menu needs HTTPS. Use Ctrl+Shift+V or Ctrl+V instead.');
+    },
+    'shell:open': (url) => { if (/^https?:\/\//i.test(url)) window.open(url, '_blank', 'noopener'); },
+    'backup:saveFile': (content, name) => { downloadText(name, content); return name; },
+    'key:pickFile': async () => { const f = await pickFile(); return f ? { name: f.name, content: f.content, publicKey: '' } : null; },
+    'import:pickFile': async () => pickFile(),
+    'vault:importSshConfig': () => { throw new Error('Not available in the web version.'); },
+  };
+
+  window.api = {
+    platform: 'web',
+    call: (ch, ...args) => (local[ch] ? Promise.resolve().then(() => local[ch](...args)) : remote(ch, args)),
+    on(ch, fn) {
+      if (!listeners.has(ch)) listeners.set(ch, new Set());
+      listeners.get(ch).add(fn);
+      return () => listeners.get(ch).delete(fn);
+    },
+    win: { min() {}, max() {}, close() {} },
+    ssh: {
+      write: (id, d) => post({ t: 'send', ch: 'ssh:write', args: [id, d] }),
+      resize: (id, c, r) => post({ t: 'send', ch: 'ssh:resize', args: [id, c, r] }),
+      close: (id) => post({ t: 'send', ch: 'ssh:close', args: [id] }),
+    },
+    rdp: { bounds() {}, show() {}, hide() {}, focus() {}, close() {} },
+    replySecret: (reqId, v) => post({ t: 'send', ch: 'secret:reply', args: [reqId, v] }),
+    pairReply: (reqId, ok) => post({ t: 'send', ch: 'sync:pairReply', args: [reqId, ok] }),
+  };
+  document.documentElement.classList.add('web');
+  connect();
+})();

src/web/server.js

@@ -0,0 +1,376 @@
+// MrTerm Web: die Desktop-Oberfläche im Browser, selbst gehostet (Docker).
+// - Benutzerkonten; jeder Tresor ist mit einem eigenen Datenschlüssel (DEK) verschlüsselt,
+//   den nur das Login-Passwort des Benutzers entpackt (scrypt → AES-256-GCM).
+// - Oberfläche ↔ Server über WebSocket (/ws), gleiche Kanäle wie Electron/Android (src/core/backend.js).
+// - SFTP-Up-/Downloads über HTTP (/web/upload, /web/download).
+//
+// Umgebung: PORT (8080), DATA_DIR (/data), TRUST_PROXY=1 (X-Forwarded-Proto/-For auswerten, z. B. hinter Traefik)
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { WebSocketServer } = require('ws');
+const { Store } = require('../main/store');
+const { createBackend } = require('../core/backend');
+const i18n = require('../i18n');
+
+const ROOT = process.env.MRTERM_ROOT || path.resolve(__dirname, '..', '..');
+const DATA = path.resolve(process.env.DATA_DIR || path.join(ROOT, 'web-data'));
+const PORT = Number(process.env.PORT) || 8080;
+const TRUST_PROXY = process.env.TRUST_PROXY === '1';
+const VERSION = (() => { try { return JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version; } catch { return '0.0.0'; } })();
+const SESSION_IDLE = 12 * 3600e3;
+const SESSION_MAX = 7 * 24 * 3600e3;
+const COOKIE = 'mrterm_sid';
+
+process.on('uncaughtException', (e) => console.error('Uncaught exception:', e));
+process.on('unhandledRejection', (e) => console.error('Unhandled rejection:', e));
+fs.mkdirSync(path.join(DATA, 'users'), { recursive: true, mode: 0o700 });
+
+// ============================================================ Krypto-Helfer
+const scrypt = (pw, salt, N = 2 ** 15) => new Promise((resolve, reject) =>
+  crypto.scrypt(String(pw), salt, 32, { N, r: 8, p: 1, maxmem: 256 * N * 8 }, (e, k) => (e ? reject(e) : resolve(k))));
+function box(key, plain) {
+  const iv = crypto.randomBytes(12);
+  const c = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const ct = Buffer.concat([c.update(plain), c.final()]);
+  return { iv: iv.toString('base64'), tag: c.getAuthTag().toString('base64'), ct: ct.toString('base64') };
+}
+function unbox(key, b) {
+  const d = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(b.iv, 'base64'));
+  d.setAuthTag(Buffer.from(b.tag, 'base64'));
+  return Buffer.concat([d.update(Buffer.from(b.ct, 'base64')), d.final()]);
+}
+// Verschlüsselung des Tresors mit dem DEK (Schnittstelle wie Electrons safeStorage)
+const vaultCrypto = (dek) => ({
+  isEncryptionAvailable: () => true,
+  encryptString(s) {
+    const iv = crypto.randomBytes(12);
+    const c = crypto.createCipheriv('aes-256-gcm', dek, iv);
+    const ct = Buffer.concat([c.update(String(s), 'utf8'), c.final()]);
+    return Buffer.concat([iv, c.getAuthTag(), ct]);
+  },
+  decryptString(buf) {
+    const d = crypto.createDecipheriv('aes-256-gcm', dek, buf.subarray(0, 12));
+    d.setAuthTag(buf.subarray(12, 28));
+    return Buffer.concat([d.update(buf.subarray(28)), d.final()]).toString('utf8');
+  },
+});
+
+// ============================================================ Benutzer
+const USERS_FILE = path.join(DATA, 'users.json');
+let users = (() => { try { return JSON.parse(fs.readFileSync(USERS_FILE, 'utf8')).users || []; } catch { return []; } })();
+function saveUsers() {
+  fs.writeFileSync(USERS_FILE + '.tmp', JSON.stringify({ users }, null, 2), { mode: 0o600 });
+  fs.renameSync(USERS_FILE + '.tmp', USERS_FILE);
+}
+const validName = (n) => /^[A-Za-z0-9._@-]{1,64}$/.test(String(n || ''));
+const validPw = (p) => typeof p === 'string' && p.length >= 8 && p.length <= 1024;
+const publicUser = (u) => ({ id: u.id, name: u.name, admin: !!u.admin });
+
+async function createUser(name, password, admin) {
+  if (!validName(name)) throw new Error('Usernames may contain letters, digits and . _ @ - (max. 64).');
+  if (!validPw(password)) throw new Error('The password must be at least 8 characters long.');
+  if (users.some((u) => u.name.toLowerCase() === name.toLowerCase())) throw new Error('This username is already taken.');
+  const authSalt = crypto.randomBytes(16), kekSalt = crypto.randomBytes(16);
+  const dek = crypto.randomBytes(32);
+  const u = {
+    id: crypto.randomUUID(), name, admin: !!admin, createdAt: Date.now(),
+    auth: { salt: authSalt.toString('base64'), hash: (await scrypt(password, authSalt)).toString('base64') },
+    kek: { salt: kekSalt.toString('base64') },
+    dek: box(await scrypt(password, kekSalt), dek),
+  };
+  users.push(u);
+  saveUsers();
+  return u;
+}
+// Prüft das Passwort und liefert den entpackten DEK (oder null)
+async function verify(u, password) {
+  const hash = await scrypt(password, Buffer.from(u.auth.salt, 'base64'));
+  if (!crypto.timingSafeEqual(hash, Buffer.from(u.auth.hash, 'base64'))) return null;
+  try { return unbox(await scrypt(password, Buffer.from(u.kek.salt, 'base64')), u.dek); } catch { return null; }
+}
+async function setPassword(u, dek, password) {
+  if (!validPw(password)) throw new Error('The password must be at least 8 characters long.');
+  const authSalt = crypto.randomBytes(16), kekSalt = crypto.randomBytes(16);
+  u.auth = { salt: authSalt.toString('base64'), hash: (await scrypt(password, authSalt)).toString('base64') };
+  u.kek = { salt: kekSalt.toString('base64') };
+  u.dek = box(await scrypt(password, kekSalt), dek);
+  saveUsers();
+}
+
+// ============================================================ Sitzungen
+const sessions = new Map(); // token -> { userId, dek, created, last }
+function newSession(u, dek) {
+  const token = crypto.randomBytes(32).toString('base64url');
+  sessions.set(token, { userId: u.id, dek, created: Date.now(), last: Date.now() });
+  return token;
+}
+function sessionOf(req) {
+  const m = String(req.headers.cookie || '').match(new RegExp(`(?:^|;\\s*)${COOKIE}=([A-Za-z0-9_-]+)`));
+  const s = m && sessions.get(m[1]);
+  if (!s) return null;
+  const now = Date.now();
+  if (now - s.last > SESSION_IDLE || now - s.created > SESSION_MAX || !users.some((u) => u.id === s.userId)) { sessions.delete(m[1]); return null; }
+  s.last = now;
+  return { token: m[1], ...s, user: users.find((u) => u.id === s.userId) };
+}
+setInterval(() => { for (const [t, s] of sessions) if (Date.now() - s.last > SESSION_IDLE || Date.now() - s.created > SESSION_MAX) sessions.delete(t); }, 600e3).unref();
+
+const secure = (req) => req.socket.encrypted || (TRUST_PROXY && String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim() === 'https');
+const cookie = (req, token, maxAge) => `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure(req) ? '; Secure' : ''}`;
+const clientIp = (req) => (TRUST_PROXY && String(req.headers['x-forwarded-for'] || '').split(',')[0].trim()) || req.socket.remoteAddress || '';
+
+// Anmeldeversuche begrenzen: 10 Fehlversuche je IP in 15 Minuten
+const failures = new Map();
+const blocked = (ip) => { const f = failures.get(ip); return f && f.n >= 10 && Date.now() - f.first < 900e3; };
+const fail = (ip) => { const f = failures.get(ip); if (!f || Date.now() - f.first > 900e3) failures.set(ip, { n: 1, first: Date.now() }); else f.n++; };
+
+// ============================================================ Laufzeit je Benutzer (Tresor + Backend)
+const runtimes = new Map(); // userId -> { store, be, sockets, timer }
+function runtimeFor(sess) {
+  let rt = runtimes.get(sess.userId);
+  if (rt) { clearTimeout(rt.timer); return rt; }
+  const dir = path.join(DATA, 'users', sess.userId);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const store = new Store({ dir, crypto: vaultCrypto(sess.dek) });
+  store.load();
+  const sockets = new Set();
+  const send = (ch, ...args) => { const msg = JSON.stringify({ t: 'evt', ch, args }); for (const ws of sockets) if (ws.readyState === 1) ws.send(msg); };
+  const be = createBackend({ store, send, platform: 'web', version: VERSION });
+  // Desktop-Funktionen, die es im Browser nicht gibt: neutrale Antworten, damit die Oberfläche nicht stolpert
+  be.handle('vpn:status', () => ({}));
+  be.handle('fw:active', () => []);
+  be.handle('rdp:detect', () => ({}));
+  be.handle('rdp:embedSupported', () => ({ ok: false, reason: 'web' }));
+  be.handle('update:check', () => ({ available: false }));
+  be.handle('sync:status', () => ({ enabled: false, running: false, peers: [], nearby: [], share: { keys: [], hosts: [], vpns: [] } }));
+  rt = { store, be, sockets, timer: null };
+  runtimes.set(sess.userId, rt);
+  return rt;
+}
+// Letzter Browser-Tab zu: SSH-Verbindungen nach kurzer Zeit schließen und den Tresor aus dem Speicher nehmen
+function release(userId) {
+  const rt = runtimes.get(userId);
+  if (!rt || rt.sockets.size) return;
+  rt.timer = setTimeout(() => { if (!rt.sockets.size) { rt.be.close(); runtimes.delete(userId); } }, 60e3);
+}
+function dropUser(userId) {
+  for (const [t, s] of sessions) if (s.userId === userId) sessions.delete(t);
+  const rt = runtimes.get(userId);
+  if (rt) { for (const ws of rt.sockets) ws.close(4001, 'signed out'); rt.be.close(); runtimes.delete(userId); }
+}
+
+// ============================================================ HTTP
+const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.png': 'image/png', '.svg': 'image/svg+xml', '.json': 'application/json', '.ico': 'image/x-icon', '.woff2': 'font/woff2' };
+const CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'";
+function headers(extra = {}) {
+  return { 'Content-Security-Policy': CSP, 'X-Content-Type-Options': 'nosniff', 'X-Frame-Options': 'DENY', 'Referrer-Policy': 'no-referrer', 'Cache-Control': 'no-store', ...extra };
+}
+const json = (res, code, obj, extra = {}) => { res.writeHead(code, headers({ 'Content-Type': 'application/json', ...extra })); res.end(JSON.stringify(obj)); };
+const redirect = (res, to) => { res.writeHead(302, headers({ Location: to })); res.end(); };
+
+// Freigegebene statische Dateien: URL-Präfix → Verzeichnis
+const STATIC = [
+  ['/app/src/renderer/', path.join(ROOT, 'src', 'renderer')],
+  ['/app/src/i18n.js', path.join(ROOT, 'src', 'i18n.js')],
+  ['/app/node_modules/@xterm/', path.join(ROOT, 'node_modules', '@xterm')],
+  ['/web/', path.join(ROOT, 'src', 'web', 'public')],
+];
+function staticFile(urlPath) {
+  for (const [prefix, dir] of STATIC) {
+    if (urlPath === prefix && !prefix.endsWith('/')) return dir;
+    if (!prefix.endsWith('/') || !urlPath.startsWith(prefix)) continue;
+    const file = path.resolve(dir, '.' + path.posix.normalize('/' + decodeURIComponent(urlPath.slice(prefix.length))));
+    if (!file.startsWith(dir + path.sep)) return null;
+    if (dir.endsWith('@xterm') && !/[\\/](lib|css)[\\/][^\\/]+$/.test(file)) return null;
+    if (dir.endsWith('renderer') && /\.(rdm|md)$/.test(file)) return null;
+    return file;
+  }
+  return null;
+}
+function serveFile(res, file, transform) {
+  fs.stat(file, (err, st) => {
+    if (err || !st.isFile()) return json(res, 404, { error: 'Not found' });
+    const type = MIME[path.extname(file)] || 'application/octet-stream';
+    const cache = type.startsWith('text/html') ? 'no-store' : 'private, max-age=300';
+    if (transform) {
+      const body = transform(fs.readFileSync(file, 'utf8'));
+      res.writeHead(200, headers({ 'Content-Type': type, 'Cache-Control': cache }));
+      return res.end(body);
+    }
+    res.writeHead(200, headers({ 'Content-Type': type, 'Content-Length': st.size, 'Cache-Control': cache }));
+    fs.createReadStream(file).pipe(res);
+  });
+}
+function readJson(req, limit = 64 * 1024) {
+  return new Promise((resolve, reject) => {
+    let size = 0; const parts = [];
+    req.on('data', (c) => { size += c.length; if (size > limit) { reject(new Error('Request too large')); req.destroy(); } else parts.push(c); });
+    req.on('end', () => { try { resolve(parts.length ? JSON.parse(Buffer.concat(parts).toString('utf8')) : {}); } catch { reject(new Error('Invalid JSON')); } });
+    req.on('error', reject);
+  });
+}
+
+const APP_URL = '/app/src/renderer/index.html';
+
+async function api(req, res, url, sess) {
+  const p = url.pathname;
+  // Schreibende Anfragen nur mit eigenem Header (Browser senden ihn nicht seitenübergreifend ohne CORS-Freigabe)
+  if (req.method === 'POST' && req.headers['x-mrterm'] !== '1') return json(res, 403, { error: 'Forbidden' });
+  if (p === '/api/state' && req.method === 'GET') return json(res, 200, { setup: !users.length, user: sess ? publicUser(sess.user) : null, version: VERSION });
+  if (p === '/api/setup' && req.method === 'POST') {
+    if (users.length) return json(res, 409, { error: 'Setup is already complete.' });
+    const b = await readJson(req);
+    const u = await createUser(b.name, b.password, true);
+    const dek = await verify(u, b.password);
+    return json(res, 200, { ok: true }, { 'Set-Cookie': cookie(req, newSession(u, dek), SESSION_MAX / 1000) });
+  }
+  if (p === '/api/login' && req.method === 'POST') {
+    const ip = clientIp(req);
+    if (blocked(ip)) return json(res, 429, { error: 'Too many failed attempts. Try again in 15 minutes.' });
+    const b = await readJson(req);
+    const u = users.find((x) => x.name.toLowerCase() === String(b.name || '').toLowerCase());
+    const dek = u ? await verify(u, String(b.password || '')) : (await scrypt('x', crypto.randomBytes(16)), null);
+    if (!dek) { fail(ip); return json(res, 401, { error: 'Wrong username or password.' }); }
+    failures.delete(ip);
+    return json(res, 200, { ok: true }, { 'Set-Cookie': cookie(req, newSession(u, dek), SESSION_MAX / 1000) });
+  }
+  if (!sess) return json(res, 401, { error: 'Not signed in' });
+  if (p === '/api/me') return json(res, 200, publicUser(sess.user));
+  if (p === '/api/logout' && req.method === 'POST') {
+    sessions.delete(sess.token);
+    return json(res, 200, { ok: true }, { 'Set-Cookie': cookie(req, '', 0) });
+  }
+  if (p === '/api/password' && req.method === 'POST') {
+    const b = await readJson(req);
+    if (!(await verify(sess.user, String(b.old || '')))) return json(res, 400, { error: 'The current password is wrong.' });
+    await setPassword(sess.user, sess.dek, b.password);
+    for (const [t, s] of sessions) if (s.userId === sess.userId && t !== sess.token) sessions.delete(t);
+    return json(res, 200, { ok: true });
+  }
+  if (p.startsWith('/api/users')) {
+    if (!sess.user.admin) return json(res, 403, { error: 'Administrators only.' });
+    if (p === '/api/users' && req.method === 'GET') return json(res, 200, { users: users.map(publicUser) });
+    if (p === '/api/users' && req.method === 'POST') {
+      const b = await readJson(req);
+      return json(res, 200, publicUser(await createUser(b.name, b.password, !!b.admin)));
+    }
+    if (p === '/api/users/delete' && req.method === 'POST') {
+      const b = await readJson(req);
+      const u = users.find((x) => x.id === b.id);
+      if (!u) return json(res, 404, { error: 'User not found.' });
+      if (u.id === sess.userId) return json(res, 400, { error: 'You cannot delete yourself.' });
+      if (u.admin && users.filter((x) => x.admin).length === 1) return json(res, 400, { error: 'The last administrator cannot be deleted.' });
+      dropUser(u.id);
+      users = users.filter((x) => x.id !== u.id);
+      saveUsers();
+      fs.rmSync(path.join(DATA, 'users', u.id), { recursive: true, force: true });
+      return json(res, 200, { ok: true });
+    }
+  }
+  return json(res, 404, { error: 'Not found' });
+}
+
+// SFTP-Dateien des angemeldeten Benutzers streamen
+function sftpFor(sess, url) {
+  const rt = runtimes.get(sess.userId);
+  const sid = url.searchParams.get('sid') || '';
+  const file = url.searchParams.get('path') || '';
+  if (!rt || !file.startsWith('/')) throw new Error('Invalid request');
+  return { sftp: rt.be.ssh.sftpOf(sid), file };
+}
+function download(req, res, sess, url) {
+  let t;
+  try { t = sftpFor(sess, url); } catch (e) { return json(res, 400, { error: e.message }); }
+  t.sftp.stat(t.file, (err, st) => {
+    if (err) return json(res, 404, { error: err.message });
+    const name = path.posix.basename(t.file);
+    res.writeHead(200, headers({
+      'Content-Type': 'application/octet-stream', 'Content-Length': st.size, 'Cache-Control': 'no-store',
+      'Content-Disposition': `attachment; filename="${name.replace(/[^\x20-\x7e]|["\\]/g, '_')}"; filename*=UTF-8''${encodeURIComponent(name)}`,
+    }));
+    const rs = t.sftp.createReadStream(t.file);
+    rs.on('error', () => res.destroy());
+    rs.pipe(res);
+  });
+}
+function upload(req, res, sess, url) {
+  let t;
+  try { t = sftpFor(sess, url); } catch (e) { return json(res, 400, { error: e.message }); }
+  const ws = t.sftp.createWriteStream(t.file);
+  let done = false;
+  const finish = (err) => { if (done) return; done = true; err ? json(res, 500, { error: err.message }) : json(res, 200, { ok: true }); };
+  ws.on('error', finish);
+  ws.on('close', () => finish());
+  req.on('error', finish);
+  req.pipe(ws);
+}
+
+const server = http.createServer(async (req, res) => {
+  try {
+    const url = new URL(req.url, 'http://x');
+    const p = url.pathname;
+    const sess = sessionOf(req);
+    if (p === '/healthz') return json(res, 200, { ok: true });
+    if (p.startsWith('/api/')) return await api(req, res, url, sess);
+    if (p === '/web/download' && req.method === 'GET') return sess ? download(req, res, sess, url) : json(res, 401, { error: 'Not signed in' });
+    if (p === '/web/upload' && req.method === 'POST') {
+      if (!sess) return json(res, 401, { error: 'Not signed in' });
+      if (req.headers['x-mrterm'] !== '1') return json(res, 403, { error: 'Forbidden' });
+      return upload(req, res, sess, url);
+    }
+    if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'Method not allowed' });
+    if (p === '/' || p === '/login') return sess && p === '/' ? redirect(res, APP_URL) : serveFile(res, path.join(ROOT, 'src', 'web', 'public', 'login.html'));
+    if (p === '/favicon.ico' || p === '/favicon.png') return serveFile(res, path.join(ROOT, 'src', 'renderer', 'logo.png'));
+    if (p === APP_URL) {
+      if (!sess) return redirect(res, '/');
+      // Browser-Anbindung (window.api) vor den übrigen Skripten laden
+      return serveFile(res, staticFile(p), (html) => html.replace('<script ', '<script src="/web/web-api.js"></script>\n  <script '));
+    }
+    const file = staticFile(p);
+    if (!file) return json(res, 404, { error: 'Not found' });
+    // Nur die Anmeldeseite und ihre Dateien sind ohne Sitzung erreichbar
+    const PUBLIC = ['/web/login.js', '/web/login.css', '/app/src/i18n.js', '/app/src/renderer/app-themes.css', '/app/src/renderer/logo.png'];
+    if (!sess && !PUBLIC.includes(p)) return json(res, 401, { error: 'Not signed in' });
+    return serveFile(res, file);
+  } catch (e) {
+    console.error(e);
+    if (!res.headersSent) json(res, 500, { error: e.message || 'Server error' });
+  }
+});
+
+// ============================================================ WebSocket
+const wss = new WebSocketServer({ noServer: true, maxPayload: 8 * 1024 * 1024 });
+server.on('upgrade', (req, socket, head) => {
+  const url = new URL(req.url, 'http://x');
+  const sess = sessionOf(req);
+  // Nur Verbindungen von der eigenen Seite (Schutz vor Cross-Site-WebSocket-Hijacking)
+  const origin = req.headers.origin ? new URL(req.headers.origin).host : '';
+  const host = (TRUST_PROXY && req.headers['x-forwarded-host']) || req.headers.host;
+  if (url.pathname !== '/ws' || !sess || origin !== host) { socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n'); return socket.destroy(); }
+  wss.handleUpgrade(req, socket, head, (ws) => {
+    const rt = runtimeFor(sess);
+    rt.sockets.add(ws);
+    const lang = String(req.headers['accept-language'] || 'en').split(',')[0];
+    ws.on('message', async (raw) => {
+      let m;
+      try { m = JSON.parse(raw.toString('utf8')); } catch { return; }
+      if (!sessions.has(sess.token)) return ws.close(4001, 'signed out');
+      if (m.t === 'send') return rt.be.notify(String(m.ch), Array.isArray(m.args) ? m.args : []);
+      if (m.t !== 'call') return;
+      try {
+        i18n.setLanguage(rt.store.get().settings.language, lang);
+        const v = await rt.be.call(String(m.ch), Array.isArray(m.args) ? m.args : []);
+        ws.send(JSON.stringify({ t: 'reply', id: m.id, ok: true, v: v === undefined ? null : v }));
+      } catch (e) {
+        if (ws.readyState === 1) ws.send(JSON.stringify({ t: 'reply', id: m.id, ok: false, v: e?.message || String(e) }));
+      }
+    });
+    ws.on('close', () => { rt.sockets.delete(ws); release(sess.userId); });
+    ws.send(JSON.stringify({ t: 'hello', user: publicUser(sess.user), version: VERSION }));
+  });
+});
+
+server.on('error', (e) => { console.error(`Cannot listen on port ${PORT}: ${e.message}`); process.exit(1); });
+server.listen(PORT, () => console.log(`MrTerm Web ${VERSION} on port ${PORT} (data: ${DATA})${users.length ? '' : ' – open it in the browser to create the admin account'}`));