feat: close buttons as a red cross in a square; static files revalidated by content, so a release reaches the browser at once

This reverts commit cf855fdc23.

README.md

@@ -1,8 +1,8 @@
-# LPRA — LongPolling Remote Access
+# LPRA - LongPolling Remote Access
 
 Лёгкий self-hosted сервис для доступа к Linux-машинам **без белого IP** (за NAT).
 Агент на клиенте сам исходяще подключается к серверу по HTTP long-polling; админ
-в веб-панели видит список машин и открывает по каждой **root-терминал в браузере**.
+в веб-панели видит список машин и открывает по каждой **терминал в браузере** (по умолчанию от root, пользователя можно сменить).
 
 ```
 браузер ──WS──> [nginx :8445 TLS] ──> [Go server 127.0.0.1:8091] <──long-poll── агент (root, за NAT)
@@ -11,9 +11,9 @@
 ```
 
 ## Компоненты
-- **Сервер** (`cmd/server`) — админ-панель + точка встречи для агентов. За nginx (TLS).
-- **Агент** (`cmd/agent`) — Linux-бинарь, systemd-сервис от root, PTY по запросу.
-- **install.sh** — интерактивный установщик, отдаётся сервером как статика.
+- **Сервер** (`cmd/server`) - админ-панель + точка встречи для агентов. За nginx (TLS).
+- **Агент** (`cmd/agent`) - Linux-бинарь, systemd-сервис от root, PTY по запросу.
+- **install.sh** - интерактивный установщик, отдаётся сервером как статика.
 
 ## Сборка
 ```sh
@@ -28,7 +28,7 @@
 Поставьте перед ним nginx по `deploy/nginx.conf.example` (TLS, long-poll/WS).
 Локально без TLS можно добавить `-insecure-cookies`.
 
-Первый запуск: откройте `/setup` — мастер создаст администратора. Дальше `/settings`:
+Первый запуск: откройте `/setup` - мастер создаст администратора. Дальше `/settings`:
 адрес хоста (по умолчанию `https://localhost:8445`), enroll-секрет и готовая
 команда установки.
 
@@ -37,15 +37,38 @@
 ```sh
 curl -fsSL https://localhost:8445/install.sh | sudo HOST=https://localhost:8445 ENROLL_SECRET=<секрет> sh
 ```
-Или интерактивно (спросит секрет, а если агент уже стоит — предложит удалить):
+Или интерактивно (спросит секрет, а если агент уже стоит - предложит удалить):
 ```sh
 curl -fsSL https://localhost:8445/install.sh | sudo sh
 ```
 
+## Проброс портов и прямой туннель
+Правила проброса создаются на странице машины. Режим `http` идёт через адрес панели (long-poll),
+режимы `tcp`/`udp` - через прямой туннель: агент держит исходящее соединение к порту туннеля хоста
+(флаг `-tunnel` / `LPRA_TUNNEL_ADDR`).
+
+Порт туннеля и хост, к которому для него подключаются агенты (например, IP вместо домена панели),
+меняются в `/settings` → «Прямой туннель». Агенты забирают адрес с панели сами - при подключении и
+при каждом опросе, переустановка не нужна. Локальные `TUNNEL_ADDR` / `TUNNEL_PORT` в окружении агента
+имеют приоритет над настройкой панели (`TUNNEL_ADDR=off` отключает туннель).
+
+Если на хосте активен ufw и сервер запущен от root, панель сама открывает порт хоста правила
+(tcp для `http`/`tcp`, udp для `udp`) и порт туннеля для прямых режимов, а при удалении правила - закрывает.
+При `ProtectSystem=strict` в systemd-юните ufw нужны права на запись: `ReadWritePaths=/etc/ufw /run`.
+
+## Версия
+Версия задаётся в одном месте - `VERSION.txt`; файл вшивается в сервер и агент при сборке.
+
+## Пользователь терминала
+По умолчанию терминал открывается от пользователя, под которым запущен агент (на Linux - root).
+В окне «Изменить машину» можно выбрать другого пользователя машины или создать нового
+(имя, пароль, опционально - добавить в sudo). Смена и создание работают, только если агент запущен от root.
+Файловый менеджер по-прежнему работает от пользователя агента.
+
 ## Безопасность
-- Пароли админов — bcrypt; сессии в HttpOnly/Secure/SameSite куках; CSRF на формах; rate-limit логина.
+- Пароли админов - bcrypt; сессии в HttpOnly/Secure/SameSite куках; CSRF на формах; rate-limit логина.
 - Агенты: общий enroll-секрет → индивидуальный токен (хранится хешем, сверка constant-time).
-- Открытие терминала пишется в таблицу `audit` (терминал даёт root-доступ).
+- Открытие терминала пишется в таблицу `audit` (терминал даёт root-доступ), как и смена/создание пользователя.
 
 ## Скриншоты
 <img width="1256" height="709" alt="image" src="https://github.com/user-attachments/assets/5f0b30f1-d5e3-4b62-817e-4041641df6e3" />

VERSION.txt

@@ -1 +1 @@
-0.0.1
+0.0.7

build.sh

@@ -5,10 +5,9 @@ set -eu
 
 cd "$(dirname "$0")"
 
-VERSION="${VERSION:-$(cat VERSION.txt 2>/dev/null || echo 0.0.0)}"
-PKG="github.com/x-grk/longpolling-remote-access"
-LDFLAGS="-s -w -X $PKG/internal/server.Version=$VERSION -X $PKG/internal/agent.Version=$VERSION"
-echo ">> version $VERSION"
+# The version comes from VERSION.txt, which is embedded into every binary.
+LDFLAGS="-s -w"
+echo ">> version $(cat VERSION.txt)"
 
 mkdir -p dist bin
 

cmd/agent/main.go

@@ -10,9 +10,11 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 
 	"github.com/x-grk/longpolling-remote-access/internal/agent"
+	"github.com/x-grk/longpolling-remote-access/internal/tunnel"
 )
 
 func main() {
@@ -23,6 +25,8 @@ func main() {
 		Name:         os.Getenv("AGENT_NAME"),
 		StatePath:    envOr("STATE_PATH", "/etc/lpagent/state.json"),
 		TunnelAddr:   tunnelAddr(host),
+		// A locally set address wins over the one from the panel settings.
+		TunnelPinned: os.Getenv("TUNNEL_ADDR") != "" || os.Getenv("TUNNEL_PORT") != "",
 	}
 	if cfg.EnrollSecret == "" {
 		// Only required for the very first run (before enrollment).
@@ -46,9 +50,10 @@ func envOr(key, def string) string {
 	return def
 }
 
-// tunnelAddr derives the direct-tunnel address (host:8446) from the server URL.
-// TUNNEL_ADDR overrides it entirely; TUNNEL_PORT overrides just the port.
-// Set TUNNEL_ADDR=off to disable the direct tunnel.
+// tunnelAddr derives the direct-tunnel address (host:port) from the server URL.
+// It is only the starting point: the agent follows the host and port set in
+// the panel settings, unless TUNNEL_ADDR (the whole address) or TUNNEL_PORT
+// (just the port) pins it here. Set TUNNEL_ADDR=off to disable the tunnel.
 func tunnelAddr(hostURL string) string {
 	if v := os.Getenv("TUNNEL_ADDR"); v != "" {
 		if v == "off" {
@@ -60,5 +65,5 @@ func tunnelAddr(hostURL string) string {
 	if err != nil || u.Hostname() == "" {
 		return ""
 	}
-	return net.JoinHostPort(u.Hostname(), envOr("TUNNEL_PORT", "8446"))
+	return net.JoinHostPort(u.Hostname(), envOr("TUNNEL_PORT", strconv.Itoa(tunnel.DefaultPort)))
 }

cmd/server/main.go

@@ -10,16 +10,18 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strconv"
 	"time"
 
 	"github.com/x-grk/longpolling-remote-access/internal/server"
+	"github.com/x-grk/longpolling-remote-access/internal/tunnel"
 )
 
 func main() {
 	addr := flag.String("addr", envOr("LPRA_ADDR", "127.0.0.1:8091"), "listen address (behind nginx)")
 	dbPath := flag.String("db", envOr("LPRA_DB", "lpra.db"), "path to SQLite database")
 	distDir := flag.String("dist", envOr("LPRA_DIST", "dist"), "directory with agent binaries served at /download/")
-	tunnelAddr := flag.String("tunnel", envOr("LPRA_TUNNEL_ADDR", ":8446"), "listen address for the direct TCP+UDP forward tunnel (empty disables)")
+	tunnelAddr := flag.String("tunnel", envOr("LPRA_TUNNEL_ADDR", ":"+strconv.Itoa(tunnel.DefaultPort)), "listen address for the direct TCP+UDP forward tunnel (empty disables)")
 	insecureCookies := flag.Bool("insecure-cookies", envOr("LPRA_INSECURE_COOKIES", "") == "1",
 		"do not mark cookies Secure (plain-HTTP local testing only)")
 	flag.Parse()

deploy/lpra-server.service

@@ -1,24 +1,24 @@
 # systemd unit for the LPRA host (server).
 #
-# Unlike the agent, the server does NOT need root: it listens on a high local
-# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
+# The server runs as root so that the panel can open forwarded ports in ufw;
+# it listens on a high local port (127.0.0.1:8091) behind nginx.
 #
 # Install:
-#   sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
-#   sudo mkdir -p /opt/lpra /var/lib/lpra
+#   sudo mkdir -p /opt/lpra
 #   sudo cp bin/lpra-server /opt/lpra/
 #   sudo cp -r dist /opt/lpra/dist           # agent binaries served at /download/
-#   sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
 #   sudo cp deploy/lpra-server.service /etc/systemd/system/
 #   sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
 #
-# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
-# e.g.  LPRA_ADDR=127.0.0.1:8091
+# Direct port forwarding (tcp/udp modes) uses the tunnel port on the host, which
+# has to be open in the firewall for tcp and udp. (The "http" forward mode and
+# terminal/files go through nginx :8445 and need nothing extra.) Set the tunnel
+# address with LPRA_TUNNEL_ADDR, or set it empty to disable.
+# The port, and the host agents dial for it, can also be changed in the panel
+# settings; agents pick the new address up from the panel by themselves.
 #
-# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
-# the firewall:  ufw allow 8446/tcp ; ufw allow 8446/udp
-# (The "http" forward mode and terminal/files go through nginx :8445 and need
-# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.
+# ufw integration (the panel opening forwarded ports itself) needs root and a
+# writable /etc/ufw and /run - see ReadWritePaths below.
 
 [Unit]
 Description=LPRA remote access host (admin panel + agent rendezvous)
@@ -26,17 +26,11 @@ After=network-online.target
 Wants=network-online.target
 
 [Service]
-Type=simple
-User=lpra
-Group=lpra
 WorkingDirectory=/opt/lpra
 
-# Optional environment overrides; "-" means the file is not required.
-EnvironmentFile=-/etc/lpra-server.env
-
 ExecStart=/opt/lpra/lpra-server \
     -addr 127.0.0.1:8091 \
-    -db /var/lib/lpra/lpra.db \
+    -db /opt/lpra/lpra.db \
     -dist /opt/lpra/dist
 
 Restart=always
@@ -51,8 +45,11 @@ PrivateDevices=true
 ProtectKernelTunables=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
-# The server only needs to write its SQLite database here.
-ReadWritePaths=/var/lib/lpra
+# The SQLite database, plus what ufw writes: its rules in /etc/ufw and the
+# ufw/xtables locks in /run. Without the last two "ufw status" works but
+# "ufw allow" fails with "'/etc/ufw/user.rules' is not writable".
+ReadWritePaths=/opt/lpra /etc/ufw /run
+ReadWritePaths-=/etc/ufw /run
 
 [Install]
 WantedBy=multi-user.target

deploy/nginx.conf.example

@@ -21,7 +21,8 @@ server {
     include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
-    # Agent binaries can be large; allow the download.
+    # Files go through the panel in 4 MB pieces; 64m leaves room for a client
+    # that predates the pieces, which takes a file of up to 32 MB in one request.
     client_max_body_size 64m;
 
     location / {
@@ -36,7 +37,10 @@ server {
         # Long-poll behaviour: no buffering, generous read timeout.
         proxy_buffering     off;
         proxy_cache         off;
-        proxy_read_timeout  120s;
-        proxy_send_timeout  120s;
+        # Pass uploads on as they arrive: the speed test through the browser
+        # times them on the client.
+        proxy_request_buffering off;
+        proxy_read_timeout  300s;
+        proxy_send_timeout  300s;
     }
 }

go.mod

@@ -5,6 +5,7 @@ go 1.26
 require (
 	github.com/creack/pty v1.1.21
 	golang.org/x/crypto v0.31.0
+	golang.org/x/sys v0.28.0
 	modernc.org/sqlite v1.24.0
 )
 
@@ -13,7 +14,6 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/sys v0.28.0 // indirect
 	modernc.org/libc v1.22.5 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
 	modernc.org/memory v1.5.0 // indirect

internal/agent/client.go

@@ -13,17 +13,19 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"runtime"
+	"sync"
 	"time"
 
+	lpra "github.com/x-grk/longpolling-remote-access"
 	"github.com/x-grk/longpolling-remote-access/internal/proto"
 )
 
-// Version is the agent build version, injected at compile time via -ldflags
-// (-X .../internal/agent.Version=...).
-var Version = "dev"
+// Version is the agent build version (see VERSION.txt).
+var Version = lpra.Version
 
 // Config is the agent's runtime configuration (from env / config.env).
 type Config struct {
@@ -31,7 +33,10 @@ type Config struct {
 	EnrollSecret string
 	Name         string // optional friendly name
 	StatePath    string // where the enrolled id+token are persisted
-	TunnelAddr   string // host:port for the direct forward tunnel (e.g. REDACTED:8446); empty disables
+	TunnelAddr   string // host:port for the direct forward tunnel (e.g. panel.example:port); empty disables
+	// TunnelPinned keeps TunnelAddr as configured locally (TUNNEL_ADDR /
+	// TUNNEL_PORT) instead of following the address set in the panel.
+	TunnelPinned bool
 }
 
 type state struct {
@@ -43,8 +48,14 @@ type state struct {
 type Agent struct {
 	cfg       Config
 	http      *http.Client
+	stream    *http.Client
 	state     state
 	pollCount int
+
+	// Direct tunnel currently running (see setTunnelAddr).
+	tunMu     sync.Mutex
+	tunAddr   string
+	tunCancel context.CancelFunc
 }
 
 // New builds an agent. It does not perform any network I/O.
@@ -71,6 +82,8 @@ func New(cfg Config) *Agent {
 		cfg: cfg,
 		// Timeout must exceed the server's long-poll hold (25s) plus slack.
 		http: &http.Client{Timeout: 60 * time.Second, Transport: tr},
+		// File streams take as long as the file needs.
+		stream: &http.Client{Transport: tr},
 	}
 }
 
@@ -87,10 +100,11 @@ func (a *Agent) Run(ctx context.Context) error {
 	}
 	log.Printf("agent %s connected to %s", a.state.AgentID, a.cfg.Host)
 
-	// Direct forward tunnel (low-latency TCP mux + UDP) on 8446, if configured.
-	if a.cfg.TunnelAddr != "" {
-		go a.runTunnel(ctx)
-		go a.runUDP(ctx)
+	// Direct forward tunnel (low-latency TCP mux + UDP). Its address comes
+	// from the panel; fall back to the configured one when the server sends
+	// none (tunnel port left at the default on an older server).
+	if a.cfg.TunnelPinned || !a.fetchConfig(ctx) {
+		a.setTunnelAddr(ctx, a.cfg.TunnelAddr)
 	}
 
 	backoff := time.Second
@@ -120,6 +134,7 @@ func (a *Agent) enroll(ctx context.Context) error {
 		OS:       runtime.GOOS,
 		Arch:     runtime.GOARCH,
 		Version:  Version,
+		User:     currentUser(),
 	})
 	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, a.cfg.Host+"/api/agent/enroll", bytes.NewReader(body))
 	req.Header.Set("X-Enroll-Secret", a.cfg.EnrollSecret)
@@ -145,11 +160,12 @@ func (a *Agent) enroll(ctx context.Context) error {
 func (a *Agent) pollOnce(ctx context.Context) error {
 	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, a.cfg.Host+"/api/agent/poll", nil)
 	a.authHeaders(req)
-	// Report the version occasionally (not every poll), so the panel can flag
-	// outdated agents without extra traffic.
+	// Report the version and our OS user occasionally (not every poll), so the
+	// panel can flag outdated agents without extra traffic.
 	a.pollCount++
 	if a.pollCount%20 == 1 {
 		req.Header.Set("X-Agent-Version", Version)
+		req.Header.Set("X-Agent-User", currentUser())
 	}
 	resp, err := a.http.Do(req)
 	if err != nil {
@@ -166,10 +182,11 @@ func (a *Agent) pollOnce(ctx context.Context) error {
 	if err := json.NewDecoder(resp.Body).Decode(&msg); err != nil {
 		return err
 	}
+	a.applyTunnelHeader(ctx, resp.Header)
 	// Dispatch in the background so we keep polling for more work.
 	switch msg.Type {
 	case proto.CtrlOpenTerminal:
-		go a.runTerminal(ctx, msg.SessionID)
+		go a.runTerminal(ctx, msg.SessionID, msg.User)
 	case proto.CtrlOpenForward:
 		go a.runForward(ctx, msg.SessionID, msg.Port)
 	case proto.CtrlTask:
@@ -178,6 +195,66 @@ func (a *Agent) pollOnce(ctx context.Context) error {
 	return nil
 }
 
+// fetchConfig asks the server for the settings it hands to agents and reports
+// whether it named a tunnel address.
+func (a *Agent) fetchConfig(ctx context.Context) bool {
+	ctx2, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	req, _ := http.NewRequestWithContext(ctx2, http.MethodGet, a.cfg.Host+"/api/agent/config", nil)
+	a.authHeaders(req)
+	resp, err := a.http.Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+	return a.applyTunnelHeader(ctx, resp.Header)
+}
+
+// applyTunnelHeader follows the tunnel address the server advertises as
+// "host:port"; an empty host means the host we already reach the server on.
+func (a *Agent) applyTunnelHeader(ctx context.Context, h http.Header) bool {
+	v := h.Get("X-Tunnel-Addr")
+	if v == "" || a.cfg.TunnelPinned {
+		return false
+	}
+	host, port, err := net.SplitHostPort(v)
+	if err != nil {
+		return false
+	}
+	if host == "" {
+		u, err := url.Parse(a.cfg.Host)
+		if err != nil || u.Hostname() == "" {
+			return false
+		}
+		host = u.Hostname()
+	}
+	a.setTunnelAddr(ctx, net.JoinHostPort(host, port))
+	return true
+}
+
+// setTunnelAddr points the direct tunnel at addr, restarting it if it was
+// running against another address. An empty addr stops it.
+func (a *Agent) setTunnelAddr(ctx context.Context, addr string) {
+	a.tunMu.Lock()
+	defer a.tunMu.Unlock()
+	if addr == a.tunAddr {
+		return
+	}
+	if a.tunCancel != nil {
+		a.tunCancel()
+		a.tunCancel = nil
+	}
+	a.tunAddr = addr
+	if addr == "" {
+		return
+	}
+	log.Printf("tunnel: using %s", addr)
+	tctx, cancel := context.WithCancel(ctx)
+	a.tunCancel = cancel
+	go a.runTunnel(tctx, addr)
+	go a.runUDP(tctx, addr)
+}
+
 func (a *Agent) authHeaders(req *http.Request) {
 	req.Header.Set("X-Agent-Id", a.state.AgentID)
 	req.Header.Set("Authorization", "Bearer "+a.state.Token)

internal/agent/fs.go

@@ -9,7 +9,9 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"os/user"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strings"
 	"unicode/utf8"
@@ -17,8 +19,8 @@ import (
 	"github.com/x-grk/longpolling-remote-access/internal/proto"
 )
 
-// fsReadCap bounds how many bytes a view/read returns (5 MiB).
-const fsReadCap = 5 * 1024 * 1024
+// fsReadCap bounds how many bytes a view/read returns.
+const fsReadCap = proto.FSReadCap
 
 // fsDownloadCap bounds a browser download (kept under the 64 MiB result/body
 // limit once base64-encoded).
@@ -79,8 +81,18 @@ func fsList(path string) (proto.FSListResult, error) {
 	if path == "" {
 		path = "/"
 	}
+	// "~" / "~name" is where the file manager starts: the home directory, or
+	// the root when there is none to open.
+	home := strings.HasPrefix(path, "~") && !strings.Contains(path, "/")
+	if home {
+		path = homeDir(path[1:])
+	}
 	abs, _ := filepath.Abs(path)
 	entries, err := os.ReadDir(abs)
+	if err != nil && home && abs != "/" {
+		abs = "/"
+		entries, err = os.ReadDir(abs)
+	}
 	if err != nil {
 		return proto.FSListResult{}, err
 	}
@@ -222,3 +234,30 @@ func fsZip(paths []string, dest string) (any, error) {
 	}
 	return map[string]string{"dest": dest}, nil
 }
+
+// homeDir returns the home directory of the named user ("" = the user the
+// agent runs as), or "/" when it cannot be told.
+func homeDir(name string) string {
+	if name != "" {
+		if validUserName(name) {
+			if u, err := user.Lookup(name); err == nil && u.HomeDir != "" {
+				return u.HomeDir
+			}
+		}
+		return "/"
+	}
+	if u, err := user.Current(); err == nil && u.HomeDir != "" {
+		return u.HomeDir
+	}
+	if h := os.Getenv("HOME"); h != "" {
+		return h
+	}
+	// A root service often has neither a passwd entry we can read nor $HOME.
+	if os.Geteuid() == 0 {
+		if runtime.GOOS == "darwin" {
+			return "/var/root"
+		}
+		return "/root"
+	}
+	return "/"
+}

internal/agent/fsstream.go

@@ -0,0 +1,291 @@
+package agent
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+// Files go to and from the browser in pieces, each a request of its own
+// through the server: small enough for any proxy in front, and sent again
+// alone when the link drops it. A few go at once, so a good link is kept as
+// busy as by one long stream.
+
+const (
+	// xferWorkers is how many pieces are in flight at once.
+	xferWorkers = 4
+	// xferPieceTimeout bounds one piece's request: a link that slow, or
+	// stuck, gets the piece sent again.
+	xferPieceTimeout = 5 * time.Minute
+	// xferTries bounds how often a piece is tried over a failing link.
+	xferTries = 30
+)
+
+// errXferGone is the server saying the transfer is over: the browser left
+// or gave up.
+type errXferGone string
+
+func (e errXferGone) Error() string { return string(e) }
+
+func (a *Agent) xferURL(id string, i int) string {
+	return a.cfg.Host + "/api/agent/fs/xfer/" + id + "/" + strconv.Itoa(i)
+}
+
+// xferRequest makes one request for a piece, trying again over a failing link.
+// A 503 is the server waiting on the other side: asked again at once.
+func (a *Agent) xferRequest(ctx context.Context, newReq func(context.Context) (*http.Request, error), keep func(*http.Response) error) error {
+	fails := 0
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		rctx, cancel := context.WithTimeout(ctx, xferPieceTimeout)
+		req, err := newReq(rctx)
+		if err != nil {
+			cancel()
+			return err
+		}
+		a.authHeaders(req)
+		resp, err := a.stream.Do(req)
+		if err == nil {
+			switch {
+			case resp.StatusCode == http.StatusGone:
+				msg, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+				resp.Body.Close()
+				cancel()
+				return errXferGone(strings.TrimSpace(string(msg)))
+			case resp.StatusCode == http.StatusServiceUnavailable:
+				io.Copy(io.Discard, resp.Body)
+				resp.Body.Close()
+				cancel()
+				continue
+			case resp.StatusCode < 300:
+				err = keep(resp)
+				resp.Body.Close()
+				cancel()
+				if err == nil {
+					return nil
+				}
+			default:
+				io.Copy(io.Discard, resp.Body)
+				resp.Body.Close()
+				err = errStatus(resp.StatusCode)
+			}
+		}
+		cancel()
+		if fails++; fails >= xferTries {
+			return fmt.Errorf("сеть не держит передачу: %w", err)
+		}
+		select {
+		case <-time.After(min(time.Duration(fails)*time.Second, 10*time.Second)):
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+// pieces runs fn for every piece, xferWorkers at a time, until one fails.
+func pieces(ctx context.Context, n int, fn func(ctx context.Context, i int) error) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	var (
+		mu    sync.Mutex
+		next  int
+		first error
+		wg    sync.WaitGroup
+	)
+	for w := 0; w < min(xferWorkers, n); w++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				mu.Lock()
+				if first != nil || next >= n {
+					mu.Unlock()
+					return
+				}
+				i := next
+				next++
+				mu.Unlock()
+				if err := fn(ctx, i); err != nil {
+					mu.Lock()
+					if first == nil {
+						first = err
+						cancel()
+					}
+					mu.Unlock()
+					return
+				}
+			}
+		}()
+	}
+	wg.Wait()
+	return first
+}
+
+func pieceCount(size int64, chunk int) int {
+	if size <= 0 {
+		return 1
+	}
+	return int((size + int64(chunk) - 1) / int64(chunk))
+}
+
+// doFSPut writes the file the browser is uploading. It lands in a temporary
+// file next to the target first, so a broken upload leaves the old file as it
+// was.
+func (a *Agent) doFSPut(ctx context.Context, env proto.TaskEnvelope) proto.TaskResult {
+	var args proto.FSXferArgs
+	if err := json.Unmarshal(env.Args, &args); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	if args.Size < 0 || args.Size > proto.FSFileCap || args.Chunk <= 0 {
+		return proto.TaskResult{Error: "файл больше 512 МБ"}
+	}
+	dir, base := filepath.Split(args.Path)
+	if dir == "" {
+		dir = "."
+	}
+	if info, err := os.Stat(args.Path); err == nil && info.IsDir() {
+		return proto.TaskResult{Error: "это каталог"}
+	}
+	tmp, err := os.CreateTemp(dir, "."+base+".lpra-*")
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	done := false
+	defer func() {
+		if !done {
+			tmp.Close()
+			os.Remove(tmp.Name())
+		}
+	}()
+
+	// Pieces written so far, to tell the server which it can let go.
+	n := pieceCount(args.Size, args.Chunk)
+	var (
+		mu     sync.Mutex
+		got    = make([]bool, n)
+		contig int
+	)
+	err = pieces(ctx, n, func(ctx context.Context, i int) error {
+		want := min(int64(args.Chunk), args.Size-int64(i)*int64(args.Chunk))
+		mu.Lock()
+		ack := contig
+		mu.Unlock()
+		var data []byte
+		err := a.xferRequest(ctx, func(ctx context.Context) (*http.Request, error) {
+			return http.NewRequestWithContext(ctx, http.MethodGet, a.xferURL(args.Xfer, i)+"?ack="+strconv.Itoa(ack), nil)
+		}, func(resp *http.Response) error {
+			b, err := io.ReadAll(io.LimitReader(resp.Body, int64(args.Chunk)+1))
+			if err == nil && int64(len(b)) != want {
+				err = errors.New("кусок не той длины")
+			}
+			data = b
+			return err
+		})
+		if err != nil {
+			return err
+		}
+		if _, err := tmp.WriteAt(data, int64(i)*int64(args.Chunk)); err != nil {
+			return err
+		}
+		mu.Lock()
+		got[i] = true
+		for contig < n && got[contig] {
+			contig++
+		}
+		mu.Unlock()
+		return nil
+	})
+	if err != nil {
+		var gone errXferGone
+		if errors.As(err, &gone) {
+			return proto.TaskResult{Error: "загрузка прервана: " + string(gone)}
+		}
+		return proto.TaskResult{Error: "загрузка прервана: " + err.Error()}
+	}
+	if err := tmp.Truncate(args.Size); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	if err := tmp.Close(); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	// A file that is being replaced keeps its mode and owner.
+	mode := os.FileMode(0o644)
+	if info, err := os.Stat(args.Path); err == nil {
+		mode = info.Mode().Perm()
+		if st, ok := info.Sys().(*syscall.Stat_t); ok {
+			_ = os.Chown(tmp.Name(), int(st.Uid), int(st.Gid))
+		}
+	}
+	if err := os.Chmod(tmp.Name(), mode); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	if err := os.Rename(tmp.Name(), args.Path); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	done = true
+	data, _ := json.Marshal(map[string]any{"path": args.Path, "size": args.Size})
+	return proto.TaskResult{OK: true, Data: data}
+}
+
+// doFSSend sends a file to the browser that asked for it.
+func (a *Agent) doFSSend(ctx context.Context, env proto.TaskEnvelope) proto.TaskResult {
+	var args proto.FSXferArgs
+	if err := json.Unmarshal(env.Args, &args); err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	if args.Chunk <= 0 {
+		return proto.TaskResult{Error: "не задан размер куска"}
+	}
+	f, err := os.Open(args.Path)
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	if info.IsDir() {
+		return proto.TaskResult{Error: "это каталог"}
+	}
+	size := info.Size()
+	if size > proto.FSFileCap {
+		return proto.TaskResult{Error: "файл больше 512 МБ"}
+	}
+	sizeHdr := strconv.FormatInt(size, 10)
+	err = pieces(ctx, pieceCount(size, args.Chunk), func(ctx context.Context, i int) error {
+		off := int64(i) * int64(args.Chunk)
+		buf := make([]byte, min(int64(args.Chunk), size-off))
+		if _, err := f.ReadAt(buf, off); err != nil && err != io.EOF {
+			return err
+		}
+		return a.xferRequest(ctx, func(ctx context.Context) (*http.Request, error) {
+			req, err := http.NewRequestWithContext(ctx, http.MethodPost, a.xferURL(args.Xfer, i), bytes.NewReader(buf))
+			if err == nil {
+				req.Header.Set("X-Size", sizeHdr)
+				req.Header.Set("Content-Type", "application/octet-stream")
+			}
+			return req, err
+		}, func(*http.Response) error { return nil })
+	})
+	if err != nil {
+		return proto.TaskResult{Error: "передача прервана: " + err.Error()}
+	}
+	data, _ := json.Marshal(map[string]any{"path": args.Path, "size": size})
+	return proto.TaskResult{OK: true, Data: data}
+}

internal/agent/session.go

@@ -15,14 +15,17 @@ import (
 )
 
 // runTerminal spawns a PTY and bridges it to the session.
-func (a *Agent) runTerminal(parent context.Context, sid string) {
-	term, err := StartPTY()
+// user is the OS user to run the shell as ("" = the agent's own user).
+func (a *Agent) runTerminal(parent context.Context, sid, user string) {
+	term, err := StartPTY(user)
 	if err != nil {
 		log.Printf("term %s: start pty: %v", sid, err)
+		// Show the reason in the browser terminal before closing it.
+		a.postOut(context.Background(), sid, proto.OutMessage{Data: b64.EncodeToString([]byte("lpra: " + err.Error() + "\r\n"))})
 		a.postOut(context.Background(), sid, proto.OutMessage{Exit: true})
 		return
 	}
-	log.Printf("term %s: shell started", sid)
+	log.Printf("term %s: shell started (user %q)", sid, user)
 	a.bridgeStream(parent, sid, term, term.Resize)
 	log.Printf("term %s: ended", sid)
 }

internal/agent/speed.go

@@ -0,0 +1,167 @@
+package agent
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+const (
+	// speedWindow is how long each direction is measured for, unless the
+	// server asks for another window; speedWindowMax bounds what it may ask.
+	speedWindow    = 3 * time.Second
+	speedWindowMax = 30 * time.Second
+	// speedWait is how long the download may take to start: in a relayed test
+	// its bytes come from the browser.
+	speedWait = 10 * time.Second
+	// speedUpCap bounds the upload, whatever the link does in the window.
+	speedUpCap = 48 << 20
+)
+
+// doSpeed measures the agent's HTTP link to the server: round-trip time of an
+// empty request, then how much flows each way in the window. In a relayed
+// test the server pipes both streams to the browser, so they run end to end.
+func (a *Agent) doSpeed(ctx context.Context, env proto.TaskEnvelope) proto.TaskResult {
+	var args proto.SysSpeedArgs
+	if len(env.Args) > 0 {
+		_ = json.Unmarshal(env.Args, &args)
+	}
+	window := speedWindow
+	if args.WindowMs > 0 {
+		window = min(time.Duration(args.WindowMs)*time.Millisecond, speedWindowMax)
+	}
+	res, err := a.measureSpeed(ctx, args.Relay, window)
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	data, _ := json.Marshal(res)
+	return proto.TaskResult{OK: true, Data: data}
+}
+
+func (a *Agent) measureSpeed(ctx context.Context, relay bool, window time.Duration) (proto.SysSpeedResult, error) {
+	res := proto.SysSpeedResult{Relay: relay}
+	streams := "/api/agent/speed"
+	if relay {
+		streams += "/relay"
+	}
+	// Ping: the first request may pay for a new connection, so keep the best.
+	for i := 0; i < 4; i++ {
+		start := time.Now()
+		resp, err := a.speedRequest(ctx, http.MethodGet, "/api/agent/speed/down?bytes=0", nil)
+		if err != nil {
+			return res, err
+		}
+		io.Copy(io.Discard, resp.Body)
+		resp.Body.Close()
+		ms := float64(time.Since(start).Microseconds()) / 1000
+		if i == 0 || ms < res.PingMs {
+			res.PingMs = ms
+		}
+	}
+
+	down, err := a.speedDown(ctx, streams+"/down", window)
+	if err != nil {
+		return res, err
+	}
+	res.DownBps = down
+
+	// Up: send until the window closes or the cap is hit.
+	body := &speedSource{deadline: time.Now().Add(window), left: speedUpCap}
+	start := time.Now()
+	resp, err := a.speedRequest(ctx, http.MethodPost, streams+"/up", body)
+	if err != nil {
+		return res, err
+	}
+	io.Copy(io.Discard, resp.Body)
+	resp.Body.Close()
+	res.UpBps = bps(int64(speedUpCap-body.left), time.Since(start))
+	return res, nil
+}
+
+// speedDown reads what the server streams for the window, counted from the
+// first byte, and returns the rate.
+func (a *Agent) speedDown(ctx context.Context, path string, window time.Duration) (float64, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	t := time.AfterFunc(speedWait, cancel)
+	defer t.Stop()
+	resp, err := a.speedRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+	var (
+		n     int64
+		start time.Time
+		buf   = make([]byte, 64<<10)
+	)
+	for {
+		k, err := resp.Body.Read(buf)
+		if k > 0 && start.IsZero() {
+			start = time.Now()
+			t.Reset(window)
+		}
+		n += int64(k)
+		if err != nil {
+			break
+		}
+	}
+	if start.IsZero() {
+		return 0, errors.New("нет данных для замера")
+	}
+	return bps(n, time.Since(start)), nil
+}
+
+func (a *Agent) speedRequest(ctx context.Context, method, path string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, method, a.cfg.Host+path, body)
+	if err != nil {
+		return nil, err
+	}
+	a.authHeaders(req)
+	resp, err := a.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		resp.Body.Close()
+		return nil, errStatus(resp.StatusCode)
+	}
+	return resp, nil
+}
+
+func bps(n int64, d time.Duration) float64 {
+	if d <= 0 {
+		return 0
+	}
+	return float64(n) * 8 / d.Seconds()
+}
+
+// speedSource is an upload body of incompressible bytes that ends at the
+// deadline or after `left` bytes.
+type speedSource struct {
+	deadline time.Time
+	left     int
+	block    []byte
+}
+
+func (s *speedSource) Read(p []byte) (int, error) {
+	if s.left <= 0 || !time.Now().Before(s.deadline) {
+		return 0, io.EOF
+	}
+	if s.block == nil {
+		s.block = make([]byte, 64<<10)
+		rand.Read(s.block)
+	}
+	n := copy(p, s.block)
+	if n > s.left {
+		n = s.left
+	}
+	s.left -= n
+	return n, nil
+}

internal/agent/stat.go

@@ -0,0 +1,45 @@
+package agent
+
+import (
+	"runtime"
+	"sync"
+	"syscall"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+// statMu serializes samples: the CPU figure is a delta against the last one.
+var statMu sync.Mutex
+
+// sysStat samples the machine's load. It costs nothing while nobody asks: the
+// panel requests it only for an open status page.
+func sysStat() (proto.SysStatResult, error) {
+	statMu.Lock()
+	defer statMu.Unlock()
+	res := proto.SysStatResult{NCPU: runtime.NumCPU()}
+	cpu, err := cpuPercent()
+	if err != nil {
+		return res, err
+	}
+	res.CPU = cpu
+	if res.MemTotal, res.MemUsed, err = memUsage(); err != nil {
+		return res, err
+	}
+	var fs syscall.Statfs_t
+	if err := syscall.Statfs("/", &fs); err != nil {
+		return res, err
+	}
+	res.DiskTotal = uint64(fs.Blocks) * uint64(fs.Bsize)
+	res.DiskFree = uint64(fs.Bavail) * uint64(fs.Bsize)
+	return res, nil
+}
+
+func clampPercent(v float64) float64 {
+	if v < 0 {
+		return 0
+	}
+	if v > 100 {
+		return 100
+	}
+	return v
+}

internal/agent/stat_darwin.go

@@ -0,0 +1,43 @@
+package agent
+
+import (
+	"bytes"
+	"os/exec"
+	"runtime"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+)
+
+// cpuPercent sums the per-process CPU shares ps reports. macOS exposes the
+// host CPU ticks only through Mach calls, which need cgo.
+func cpuPercent() (float64, error) {
+	out, err := exec.Command("/bin/ps", "-A", "-o", "%cpu=").Output()
+	if err != nil {
+		return 0, err
+	}
+	var sum float64
+	for _, f := range bytes.Fields(out) {
+		// Some locales print a decimal comma.
+		v, _ := strconv.ParseFloat(string(bytes.Replace(f, []byte(","), []byte("."), 1)), 64)
+		sum += v
+	}
+	return clampPercent(sum / float64(runtime.NumCPU())), nil
+}
+
+// memUsage takes the kernel's own share of memory still available
+// (kern.memorystatus_level, what `memory_pressure` prints).
+func memUsage() (total, used uint64, err error) {
+	total, err = unix.SysctlUint64("hw.memsize")
+	if err != nil {
+		return 0, 0, err
+	}
+	level, err := unix.SysctlUint32("kern.memorystatus_level")
+	if err != nil {
+		return 0, 0, err
+	}
+	if level > 100 {
+		level = 100
+	}
+	return total, total / 100 * uint64(100-level), nil
+}

internal/agent/stat_linux.go

@@ -0,0 +1,121 @@
+package agent
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"strconv"
+	"time"
+)
+
+// Previous /proc/stat reading; the load is the busy share of the ticks since.
+var (
+	cpuPrevIdle, cpuPrevTotal uint64
+	cpuPrevAt                 time.Time
+)
+
+// cpuStaleAfter is how old the previous reading may be: past it the delta
+// would average over a stretch nobody was watching, so take a fresh pair.
+const cpuStaleAfter = 15 * time.Second
+
+func cpuPercent() (float64, error) {
+	if time.Since(cpuPrevAt) > cpuStaleAfter {
+		idle, total, err := readCPUTicks()
+		if err != nil {
+			return 0, err
+		}
+		cpuPrevIdle, cpuPrevTotal = idle, total
+		time.Sleep(200 * time.Millisecond)
+	}
+	idle, total, err := readCPUTicks()
+	if err != nil {
+		return 0, err
+	}
+	dIdle, dTotal := idle-cpuPrevIdle, total-cpuPrevTotal
+	cpuPrevIdle, cpuPrevTotal, cpuPrevAt = idle, total, time.Now()
+	if dTotal == 0 || dIdle > dTotal {
+		return 0, nil
+	}
+	return clampPercent(100 * float64(dTotal-dIdle) / float64(dTotal)), nil
+}
+
+// readCPUTicks parses the aggregate "cpu" line of /proc/stat:
+// user nice system idle iowait irq softirq steal ...
+func readCPUTicks() (idle, total uint64, err error) {
+	var buf [512]byte
+	f, err := os.Open("/proc/stat")
+	if err != nil {
+		return 0, 0, err
+	}
+	n, _ := f.Read(buf[:])
+	f.Close()
+	line := buf[:n]
+	if i := bytes.IndexByte(line, '\n'); i >= 0 {
+		line = line[:i]
+	}
+	fields := bytes.Fields(line)
+	if len(fields) < 5 || string(fields[0]) != "cpu" {
+		return 0, 0, errors.New("unexpected /proc/stat")
+	}
+	for i, f := range fields[1:] {
+		if i >= 8 { // guest time is already counted in user/nice
+			break
+		}
+		v, _ := strconv.ParseUint(string(f), 10, 64)
+		total += v
+		if i == 3 || i == 4 { // idle, iowait
+			idle += v
+		}
+	}
+	return idle, total, nil
+}
+
+// memUsage reads /proc/meminfo; used is everything not available to new
+// processes (so page cache does not count as used).
+func memUsage() (total, used uint64, err error) {
+	data, err := os.ReadFile("/proc/meminfo")
+	if err != nil {
+		return 0, 0, err
+	}
+	var avail, free uint64
+	var haveAvail bool
+	for len(data) > 0 {
+		line := data
+		if i := bytes.IndexByte(data, '\n'); i >= 0 {
+			line, data = data[:i], data[i+1:]
+		} else {
+			data = nil
+		}
+		switch {
+		case bytes.HasPrefix(line, []byte("MemTotal:")):
+			total = meminfoKB(line)
+		case bytes.HasPrefix(line, []byte("MemFree:")):
+			free = meminfoKB(line)
+		case bytes.HasPrefix(line, []byte("MemAvailable:")):
+			avail, haveAvail = meminfoKB(line), true
+		}
+		if haveAvail && total > 0 {
+			break
+		}
+	}
+	if total == 0 {
+		return 0, 0, errors.New("unexpected /proc/meminfo")
+	}
+	if !haveAvail {
+		avail = free
+	}
+	if avail > total {
+		avail = total
+	}
+	return total, total - avail, nil
+}
+
+// meminfoKB returns the value of a "Key:   123 kB" line in bytes.
+func meminfoKB(line []byte) uint64 {
+	f := bytes.Fields(line)
+	if len(f) < 2 {
+		return 0
+	}
+	v, _ := strconv.ParseUint(string(f[1]), 10, 64)
+	return v * 1024
+}

internal/agent/task.go

@@ -17,9 +17,16 @@ func (a *Agent) runTask(ctx context.Context, taskID string) {
 		return
 	}
 	var res proto.TaskResult
-	if env.Type == proto.TaskSysUpdate {
+	switch env.Type {
+	case proto.TaskSysUpdate:
 		res = a.doUpdate()
-	} else {
+	case proto.TaskSysSpeed:
+		res = a.doSpeed(ctx, env)
+	case proto.TaskFSPut:
+		res = a.doFSPut(ctx, env)
+	case proto.TaskFSSend:
+		res = a.doFSSend(ctx, env)
+	default:
 		res = a.execTask(env)
 	}
 	a.postResult(ctx, taskID, res)
@@ -54,9 +61,10 @@ func (a *Agent) postResult(ctx context.Context, taskID string, res proto.TaskRes
 	resp.Body.Close()
 }
 
-// execTask runs a single file-manager operation natively and returns a result.
+// execTask runs a single file-manager or user-management operation natively
+// and returns a result.
 func (a *Agent) execTask(env proto.TaskEnvelope) proto.TaskResult {
-	data, err := dispatchFS(env)
+	data, err := dispatchTask(env)
 	if err != nil {
 		return proto.TaskResult{Error: err.Error()}
 	}

internal/agent/terminal.go

@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 
@@ -13,15 +14,44 @@ type PTY struct {
 	f   *os.File
 }
 
-// StartPTY launches the shell attached to a new PTY. The agent runs as root
-// (systemd User=root), so this is a root shell by design.
-func StartPTY() (*PTY, error) {
-	shell := "/bin/bash"
-	if _, err := os.Stat(shell); err != nil {
-		shell = "/bin/sh"
+// StartPTY launches a login shell attached to a new PTY. With user empty (or
+// equal to the agent's own user) it is the agent's shell - root by default,
+// since the agent runs as a root systemd service. Any other user is entered via
+// `su -l`, which only a root agent can do without a password.
+func StartPTY(user string) (*PTY, error) {
+	var cmd *exec.Cmd
+	env := append(os.Environ(), "TERM=xterm-256color")
+	if user == "" || user == currentUser() {
+		cmd = exec.Command(defaultShell(), "-l")
+		// A login shell does not change directory by itself: it would start
+		// where the service runs, "/". Start it at home, and say where home
+		// is, as a root service often has no $HOME.
+		if home := homeDir(""); isDir(home) {
+			cmd.Dir = home
+			env = append(env, "HOME="+home)
+		}
+	} else {
+		if !validUserName(user) {
+			return nil, fmt.Errorf("недопустимое имя пользователя %q", user)
+		}
+		if os.Geteuid() != 0 {
+			return nil, fmt.Errorf("агент запущен от %s и не может открыть сессию от %s", currentUser(), user)
+		}
+		if !userExists(user) {
+			return nil, fmt.Errorf("пользователь %s не найден", user)
+		}
+		su, err := exec.LookPath("su")
+		if err != nil {
+			return nil, fmt.Errorf("su не найден: %w", err)
+		}
+		cmd = exec.Command(su, "-l", user)
+		// su -l goes to the user's home; starting there too keeps the shell
+		// out of "/" should it not.
+		if home := homeDir(user); isDir(home) {
+			cmd.Dir = home
+		}
 	}
-	cmd := exec.Command(shell, "-l")
-	cmd.Env = append(os.Environ(), "TERM=xterm-256color")
+	cmd.Env = env
 	f, err := pty.Start(cmd)
 	if err != nil {
 		return nil, err
@@ -29,6 +59,11 @@ func StartPTY() (*PTY, error) {
 	return &PTY{cmd: cmd, f: f}, nil
 }
 
+func isDir(p string) bool {
+	info, err := os.Stat(p)
+	return err == nil && info.IsDir()
+}
+
 // Read reads terminal output.
 func (p *PTY) Read(b []byte) (int, error) { return p.f.Read(b) }
 

internal/agent/tunnel.go

@@ -15,12 +15,12 @@ import (
 
 // --- direct TCP mux tunnel ---
 
-// runTunnel keeps a persistent connection to the host's 8446 tunnel, dialing
-// client-side ports on demand for "tcp" forward rules.
-func (a *Agent) runTunnel(ctx context.Context) {
+// runTunnel keeps a persistent connection to the host's tunnel at addr, dialing
+// client-side ports on demand for "tcp" forward rules, until ctx is cancelled.
+func (a *Agent) runTunnel(ctx context.Context, addr string) {
 	backoff := time.Second
 	for ctx.Err() == nil {
-		if err := a.tunnelOnce(ctx); err != nil {
+		if err := a.tunnelOnce(ctx, addr); err != nil {
 			select {
 			case <-time.After(backoff):
 			case <-ctx.Done():
@@ -35,13 +35,15 @@ func (a *Agent) runTunnel(ctx context.Context) {
 	}
 }
 
-func (a *Agent) tunnelOnce(ctx context.Context) error {
+func (a *Agent) tunnelOnce(ctx context.Context, addr string) error {
 	d := net.Dialer{Timeout: 10 * time.Second}
-	conn, err := d.DialContext(ctx, "tcp", a.cfg.TunnelAddr)
+	conn, err := d.DialContext(ctx, "tcp", addr)
 	if err != nil {
 		return err
 	}
 	defer conn.Close()
+	// Unblock the read loop when the tunnel is stopped or moved.
+	defer context.AfterFunc(ctx, func() { conn.Close() })()
 	if tc, ok := conn.(*net.TCPConn); ok {
 		_ = tc.SetNoDelay(true)
 	}
@@ -65,7 +67,7 @@ func (a *Agent) tunnelOnce(ctx context.Context) error {
 		return err
 	}
 	_ = conn.SetDeadline(time.Time{})
-	log.Printf("tunnel: connected to %s", a.cfg.TunnelAddr)
+	log.Printf("tunnel: connected to %s", addr)
 
 	tc := &tunClient{conn: conn, streams: map[uint32]*agentStream{}}
 	return tc.readLoop()
@@ -194,12 +196,12 @@ func (t *tunClient) shutdown() {
 
 // --- direct UDP forwarding ---
 
-// runUDP maintains the agent's UDP endpoint on the host's 8446 channel and
+// runUDP maintains the agent's UDP endpoint on the host's tunnel at addr and
 // relays datagrams to/from client-side UDP ports for "udp" forward rules.
-func (a *Agent) runUDP(ctx context.Context) {
+func (a *Agent) runUDP(ctx context.Context, addr string) {
 	backoff := time.Second
 	for ctx.Err() == nil {
-		if err := a.udpOnce(ctx); err != nil {
+		if err := a.udpOnce(ctx, addr); err != nil {
 			select {
 			case <-time.After(backoff):
 			case <-ctx.Done():
@@ -214,8 +216,8 @@ func (a *Agent) runUDP(ctx context.Context) {
 	}
 }
 
-func (a *Agent) udpOnce(ctx context.Context) error {
-	raddr, err := net.ResolveUDPAddr("udp", a.cfg.TunnelAddr)
+func (a *Agent) udpOnce(ctx context.Context, addr string) error {
+	raddr, err := net.ResolveUDPAddr("udp", addr)
 	if err != nil {
 		return err
 	}
@@ -224,6 +226,8 @@ func (a *Agent) udpOnce(ctx context.Context) error {
 		return err
 	}
 	defer conn.Close()
+	// Unblock the read loop when the tunnel is stopped or moved.
+	defer context.AfterFunc(ctx, func() { conn.Close() })()
 
 	key := tunnel.AuthKey(a.state.Token)
 	register := func() {
@@ -268,7 +272,7 @@ func (a *Agent) udpOnce(ctx context.Context) error {
 }
 
 type udpClient struct {
-	server *net.UDPConn // connection back to host:8446
+	server *net.UDPConn // connection back to the host tunnel
 	mu     sync.Mutex
 	dials  map[uint32]*net.UDPConn // sid -> client-side socket
 }

internal/agent/update.go

@@ -17,7 +17,7 @@ import (
 
 // doUpdate downloads the latest agent binary for this platform, atomically
 // replaces the running executable, and schedules a service restart. It never
-// uninstalls — only updates.
+// uninstalls - only updates.
 func (a *Agent) doUpdate() proto.TaskResult {
 	exe, err := os.Executable()
 	if err != nil {

internal/agent/users.go

@@ -0,0 +1,237 @@
+package agent
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"regexp"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+// userNameRe is the login name shape accepted for existing users; it keeps a
+// name from ever being parsed as an option by su. newUserNameRe is the stricter
+// shape useradd accepts everywhere.
+var (
+	userNameRe    = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_.-]{0,31}$`)
+	newUserNameRe = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,31}$`)
+)
+
+func validUserName(name string) bool { return userNameRe.MatchString(name) }
+
+// dispatchTask runs one task: user management here, everything else is a
+// file-manager operation.
+func dispatchTask(env proto.TaskEnvelope) (any, error) {
+	switch env.Type {
+	case proto.TaskSysUsers:
+		return sysUsers(), nil
+	case proto.TaskSysStat:
+		return sysStat()
+	case proto.TaskSysUserAdd:
+		var a proto.SysUserAddArgs
+		_ = json.Unmarshal(env.Args, &a)
+		return nil, addUser(a)
+	}
+	return dispatchFS(env)
+}
+
+// currentUser is the OS user the agent process runs as.
+func currentUser() string {
+	if u, err := user.Current(); err == nil && u.Username != "" {
+		return u.Username
+	}
+	if os.Geteuid() == 0 {
+		return "root"
+	}
+	if n := os.Getenv("USER"); n != "" {
+		return n
+	}
+	return strconv.Itoa(os.Geteuid())
+}
+
+func userExists(name string) bool {
+	if _, err := user.Lookup(name); err == nil {
+		return true
+	}
+	// Without cgo, os/user only reads /etc/passwd, which macOS doesn't use.
+	if runtime.GOOS == "darwin" {
+		for _, n := range darwinUsers() {
+			if n == name {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func defaultShell() string {
+	if _, err := os.Stat("/bin/bash"); err == nil {
+		return "/bin/bash"
+	}
+	return "/bin/sh"
+}
+
+// sysUsers reports who the agent is and which users a terminal can be opened as.
+func sysUsers() proto.SysUsersResult {
+	cur := currentUser()
+	res := proto.SysUsersResult{Current: cur, CanSwitch: os.Geteuid() == 0, Users: []string{cur}}
+	if !res.CanSwitch {
+		return res
+	}
+	seen := map[string]bool{cur: true}
+	for _, n := range loginUsers() {
+		if !seen[n] && validUserName(n) {
+			seen[n] = true
+			res.Users = append(res.Users, n)
+		}
+	}
+	sort.Strings(res.Users[1:])
+	return res
+}
+
+// loginUsers lists root plus the regular (non-system) accounts with a real shell.
+func loginUsers() []string {
+	if runtime.GOOS == "darwin" {
+		return darwinUsers()
+	}
+	b, err := os.ReadFile("/etc/passwd")
+	if err != nil {
+		return nil
+	}
+	var out []string
+	for _, line := range strings.Split(string(b), "\n") {
+		// name:passwd:uid:gid:gecos:home:shell
+		f := strings.Split(line, ":")
+		if len(f) < 7 || strings.HasPrefix(line, "#") {
+			continue
+		}
+		uid, err := strconv.Atoi(f[2])
+		if err != nil || (uid != 0 && (uid < 1000 || uid == 65534)) {
+			continue
+		}
+		if sh := f[6]; strings.HasSuffix(sh, "/nologin") || strings.HasSuffix(sh, "/false") {
+			continue
+		}
+		out = append(out, f[0])
+	}
+	return out
+}
+
+func darwinUsers() []string {
+	b, err := exec.Command("dscl", ".", "-list", "/Users", "UniqueID").Output()
+	if err != nil {
+		return nil
+	}
+	var out []string
+	for _, line := range strings.Split(string(b), "\n") {
+		f := strings.Fields(line)
+		if len(f) != 2 {
+			continue
+		}
+		if uid, err := strconv.Atoi(f[1]); err == nil && (uid == 0 || uid >= 500) {
+			out = append(out, f[0])
+		}
+	}
+	return out
+}
+
+// addUser creates an OS user with a home directory, optionally sets its
+// password and adds it to the sudo group.
+func addUser(a proto.SysUserAddArgs) error {
+	if runtime.GOOS != "linux" {
+		return errors.New("создание пользователей поддерживается только на Linux")
+	}
+	if os.Geteuid() != 0 {
+		return errors.New("агент запущен не от root и не может создавать пользователей")
+	}
+	if !newUserNameRe.MatchString(a.Name) {
+		return errors.New("недопустимое имя: строчные латинские буквы, цифры, '_' и '-', до 32 символов")
+	}
+	if strings.ContainsAny(a.Password, "\r\n") {
+		return errors.New("пароль не должен содержать перевод строки")
+	}
+	if userExists(a.Name) {
+		return fmt.Errorf("пользователь %s уже существует", a.Name)
+	}
+	// Resolve the sudo group up front so we don't leave a half-configured user.
+	group := ""
+	if a.Sudo {
+		if group = sudoGroup(); group == "" {
+			return errors.New("на машине нет группы sudo или wheel")
+		}
+	}
+
+	switch {
+	case hasCmd("useradd"):
+		if err := run(nil, "useradd", "-m", "-s", defaultShell(), a.Name); err != nil {
+			return err
+		}
+	case hasCmd("adduser"): // BusyBox / Alpine
+		if err := run(nil, "adduser", "-D", "-s", defaultShell(), a.Name); err != nil {
+			return err
+		}
+	default:
+		return errors.New("не найдены useradd/adduser")
+	}
+
+	if a.Password != "" {
+		if err := run([]byte(a.Name+":"+a.Password+"\n"), "chpasswd"); err != nil {
+			return fmt.Errorf("пользователь создан, но пароль не задан: %w", err)
+		}
+	}
+	if group != "" {
+		var err error
+		switch {
+		case hasCmd("usermod"):
+			err = run(nil, "usermod", "-aG", group, a.Name)
+		case hasCmd("gpasswd"):
+			err = run(nil, "gpasswd", "-a", a.Name, group)
+		default: // BusyBox: adduser USER GROUP
+			err = run(nil, "adduser", a.Name, group)
+		}
+		if err != nil {
+			return fmt.Errorf("пользователь создан, но не добавлен в %s: %w", group, err)
+		}
+	}
+	return nil
+}
+
+// sudoGroup returns the group that grants sudo on this distro, or "".
+func sudoGroup() string {
+	for _, g := range []string{"sudo", "wheel"} {
+		if _, err := user.LookupGroup(g); err == nil {
+			return g
+		}
+	}
+	return ""
+}
+
+func hasCmd(name string) bool {
+	_, err := exec.LookPath(name)
+	return err == nil
+}
+
+// run executes a command (optionally feeding stdin) and folds its output into
+// the error so the panel can show why it failed.
+func run(stdin []byte, name string, args ...string) error {
+	cmd := exec.Command(name, args...)
+	if stdin != nil {
+		cmd.Stdin = bytes.NewReader(stdin)
+	}
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		if msg := strings.TrimSpace(string(out)); msg != "" {
+			return fmt.Errorf("%s: %s", name, msg)
+		}
+		return fmt.Errorf("%s: %w", name, err)
+	}
+	return nil
+}

internal/proto/proto.go

@@ -27,6 +27,7 @@ type EnrollRequest struct {
 	OS       string `json:"os"`
 	Arch     string `json:"arch"`
 	Version  string `json:"version"`
+	User     string `json:"user,omitempty"` // OS user the agent runs as
 }
 
 // EnrollResponse carries the identity the agent persists and uses from then on.
@@ -41,6 +42,7 @@ type ControlMessage struct {
 	SessionID string `json:"session_id,omitempty"`
 	Port      int    `json:"port,omitempty"`    // CtrlOpenForward: client-side port to dial
 	TaskID    string `json:"task_id,omitempty"` // CtrlTask
+	User      string `json:"user,omitempty"`    // CtrlOpenTerminal: OS user for the shell ("" = the agent's own)
 }
 
 // Terminal / stream frame types on the session "in" channel (server -> agent).
@@ -83,10 +85,33 @@ const (
 	TaskFSZip      = "fs.zip"      // zip selected paths (native archive/zip)
 	TaskFSMove     = "fs.move"     // move/rename
 	TaskFSDownload = "fs.download" // read a whole file (larger cap) for browser download
+	TaskFSPut      = "fs.put"      // write a file the browser sends in pieces
+	TaskFSSend     = "fs.send"     // send a file to the browser in pieces
 
-	TaskSysUpdate = "sys.update" // download the latest agent binary and restart
+	TaskSysUpdate  = "sys.update"  // download the latest agent binary and restart
+	TaskSysUsers   = "sys.users"   // report the agent's user and the login-capable users
+	TaskSysUserAdd = "sys.useradd" // create a new OS user
+	TaskSysStat    = "sys.stat"    // CPU load, RAM and disk usage right now
+	TaskSysSpeed   = "sys.speed"   // measure the link to the server (ping, down, up)
 )
 
+// FSReadCap bounds how many bytes TaskFSRead returns (5 MiB). The panel lets a
+// file be edited only when it fits, so that a save never cuts it short.
+const FSReadCap = 5 * 1024 * 1024
+
+// FSFileCap bounds a file sent either way in pieces (TaskFSPut, TaskFSSend).
+const FSFileCap = 512 << 20
+
+// FSXferArgs are the arguments of TaskFSPut and TaskFSSend: the file, and the
+// transfer on the server whose pieces carry it - GET them for a put, POST them
+// for a send, Chunk bytes each. Size is a put's length; -1 for a send.
+type FSXferArgs struct {
+	Path  string `json:"path"`
+	Xfer  string `json:"xfer"`
+	Size  int64  `json:"size"`
+	Chunk int    `json:"chunk"`
+}
+
 // TaskEnvelope is what the agent fetches for a task id.
 type TaskEnvelope struct {
 	Type string          `json:"type"`
@@ -144,3 +169,49 @@ type FSReadResult struct {
 	Truncated bool   `json:"truncated"`
 	Binary    bool   `json:"binary"`
 }
+
+// SysUsersResult is returned for TaskSysUsers.
+type SysUsersResult struct {
+	Current   string   `json:"current"`    // user the agent runs as
+	CanSwitch bool     `json:"can_switch"` // agent is root, so it can open shells as (and create) other users
+	Users     []string `json:"users"`
+}
+
+// SysUserAddArgs are the arguments of TaskSysUserAdd.
+type SysUserAddArgs struct {
+	Name     string `json:"name"`
+	Password string `json:"password,omitempty"` // empty leaves the account without a password
+	Sudo     bool   `json:"sudo"`               // add to the sudo/wheel group
+}
+
+// SysStatResult is returned for TaskSysStat. Sizes are in bytes.
+type SysStatResult struct {
+	CPU       float64 `json:"cpu"` // load across all cores, 0..100
+	NCPU      int     `json:"ncpu"`
+	MemTotal  uint64  `json:"mem_total"`
+	MemUsed   uint64  `json:"mem_used"`
+	DiskTotal uint64  `json:"disk_total"` // filesystem holding "/"
+	DiskFree  uint64  `json:"disk_free"`
+}
+
+// SysSpeedArgs are the arguments of TaskSysSpeed.
+type SysSpeedArgs struct {
+	// Relay makes the agent use the relayed streams, which the server pipes
+	// to and from the browser.
+	Relay bool `json:"relay,omitempty"`
+	// WindowMs is how long to measure each direction for; 0 leaves it to the
+	// agent (3 s, all an agent that predates this argument does).
+	WindowMs int `json:"window_ms,omitempty"`
+}
+
+// SysSpeedResult is returned for TaskSysSpeed: the agent's HTTP link to the
+// server as the agent measured it. Down is server -> agent.
+type SysSpeedResult struct {
+	PingMs  float64 `json:"ping_ms"`
+	DownBps float64 `json:"down_bps"` // bits per second
+	UpBps   float64 `json:"up_bps"`
+	Relay   bool    `json:"relay,omitempty"` // the streams went through the relay
+	// Partial marks a test the server cut short: the numbers are what it had
+	// counted on its own side by then.
+	Partial bool `json:"partial,omitempty"`
+}

internal/server/agents.go

@@ -24,6 +24,16 @@ func (s *Server) authenticateAgent(r *http.Request) *Agent {
 	return a
 }
 
+// online reports whether the agent is connected right now: the hub knows from
+// its control polls. Right after a start it cannot tell yet, so the last poll
+// recorded in the database decides.
+func (s *Server) online(a *Agent) bool {
+	if on, ok := s.hub.Online(a.ID); ok {
+		return on
+	}
+	return a.recentlySeen()
+}
+
 func bearerToken(r *http.Request) string {
 	h := r.Header.Get("Authorization")
 	if strings.HasPrefix(h, "Bearer ") {
@@ -34,7 +44,7 @@ func bearerToken(r *http.Request) string {
 
 // enroll creates a new agent record for a valid enroll secret and returns the
 // generated id plus a one-time plaintext token (only the hash is stored).
-func (s *Server) enroll(name, hostname, os, arch, version string) (id, token string, err error) {
+func (s *Server) enroll(name, hostname, os, arch, version, runUser string) (id, token string, err error) {
 	id = randToken()[:16]
 	token = randToken()
 	a := Agent{
@@ -44,6 +54,7 @@ func (s *Server) enroll(name, hostname, os, arch, version string) (id, token str
 		OS:        os,
 		Arch:      arch,
 		Version:   version,
+		RunUser:   runUser,
 		TokenHash: hashToken(token),
 	}
 	if err = s.db.CreateAgent(a); err != nil {

internal/server/config.go

@@ -3,6 +3,9 @@ package server
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"strconv"
+
+	lpra "github.com/x-grk/longpolling-remote-access"
 )
 
 // Config keys stored in the config table.
@@ -12,15 +15,17 @@ const (
 	cfgSetupDone    = "setup_done"
 	cfgInstallCode  = "install_code"
 	cfgUfwEnabled   = "ufw_enabled"
+	cfgTunnelHost   = "tunnel_host"
+	cfgTunnelPort   = "tunnel_port"
 )
 
 // DefaultHostAddress is the public URL agents dial by default. It is baked into
 // the rendered install.sh and can be changed from the settings page.
 const DefaultHostAddress = "https://REDACTED:8445"
 
-// Version is the server build version, injected at compile time via -ldflags
-// (-X .../internal/server.Version=...). It is the newest version agents update to.
-var Version = "dev"
+// Version is the server build version (see VERSION.txt). It is the newest
+// version agents update to.
+var Version = lpra.Version
 
 // ensureDefaults seeds the host address and a random enroll secret on first boot.
 func (db *DB) ensureDefaults() error {
@@ -86,6 +91,24 @@ func (db *DB) SetUfwEnabled(on bool) error {
 	return db.SetConfig(cfgUfwEnabled, "0")
 }
 
+// TunnelHost is the host agents dial for the direct tunnel. Empty means the
+// host of the URL they already reach the panel on.
+func (db *DB) TunnelHost() string {
+	v, _ := db.GetConfig(cfgTunnelHost)
+	return v
+}
+
+// TunnelPort is the direct-tunnel port set in Settings, or 0 when it is left
+// at the port of the server's -tunnel address.
+func (db *DB) TunnelPort() int {
+	v, _ := db.GetConfig(cfgTunnelPort)
+	n, _ := strconv.Atoi(v)
+	if n < 1 || n > 65535 {
+		return 0
+	}
+	return n
+}
+
 func (db *DB) SetupDone() bool {
 	v, _ := db.GetConfig(cfgSetupDone)
 	return v == "1"

internal/server/db.go

@@ -59,6 +59,8 @@ CREATE TABLE IF NOT EXISTS agents (
     arch        TEXT NOT NULL,
     token_hash  TEXT NOT NULL,
     version     TEXT NOT NULL DEFAULT '',
+    run_user    TEXT NOT NULL DEFAULT '',
+    login_user  TEXT NOT NULL DEFAULT '',
     enrolled_at INTEGER NOT NULL,
     last_seen   INTEGER NOT NULL
 );
@@ -101,6 +103,10 @@ CREATE TABLE IF NOT EXISTS forward_rules (
 		`ALTER TABLE forward_rules ADD COLUMN proto TEXT NOT NULL DEFAULT 'http'`,
 		`ALTER TABLE agents ADD COLUMN version TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE ufw_rules ADD COLUMN rule_id INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE agents ADD COLUMN run_user TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE agents ADD COLUMN login_user TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE forward_rules ADD COLUMN no_ufw INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE forward_rules ADD COLUMN label TEXT NOT NULL DEFAULT ''`,
 	} {
 		if _, err := db.sql.Exec(alter); err != nil && !strings.Contains(err.Error(), "duplicate column") {
 			return err
@@ -222,20 +228,30 @@ type Agent struct {
 	Arch      string
 	TokenHash string
 	Version   string
+	RunUser   string // OS user the agent process runs as (reported by the agent)
+	LoginUser string // OS user terminals are opened as; "" = RunUser
 	LastSeen  time.Time
 }
 
-// Online reports whether the agent polled recently enough to be considered up.
-func (a Agent) Online() bool {
+// TerminalUser is the OS user a terminal on this agent runs as. Agents are
+// installed as a root systemd service, so that is the fallback for agents too
+// old to report their user.
+func (a Agent) TerminalUser() string {
+	return firstNonEmpty(a.LoginUser, a.RunUser, "root")
+}
+
+// recentlySeen is the fallback for "online" right after a server start, while
+// the hub has not seen the agents' polls yet (see Server.online).
+func (a Agent) recentlySeen() bool {
 	return time.Since(a.LastSeen) < 45*time.Second
 }
 
 func (db *DB) CreateAgent(a Agent) error {
 	now := time.Now().Unix()
 	_, err := db.sql.Exec(
-		`INSERT INTO agents(id, name, hostname, os, arch, token_hash, version, enrolled_at, last_seen)
-		 VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		a.ID, a.Name, a.Hostname, a.OS, a.Arch, a.TokenHash, a.Version, now, now)
+		`INSERT INTO agents(id, name, hostname, os, arch, token_hash, version, run_user, enrolled_at, last_seen)
+		 VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		a.ID, a.Name, a.Hostname, a.OS, a.Arch, a.TokenHash, a.Version, a.RunUser, now, now)
 	return err
 }
 
@@ -243,8 +259,8 @@ func (db *DB) GetAgent(id string) (*Agent, error) {
 	a := &Agent{}
 	var last int64
 	err := db.sql.QueryRow(
-		`SELECT id, name, hostname, os, arch, token_hash, version, last_seen FROM agents WHERE id = ?`, id).
-		Scan(&a.ID, &a.Name, &a.Hostname, &a.OS, &a.Arch, &a.TokenHash, &a.Version, &last)
+		`SELECT id, name, hostname, os, arch, token_hash, version, run_user, login_user, last_seen FROM agents WHERE id = ?`, id).
+		Scan(&a.ID, &a.Name, &a.Hostname, &a.OS, &a.Arch, &a.TokenHash, &a.Version, &a.RunUser, &a.LoginUser, &last)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -257,7 +273,7 @@ func (db *DB) GetAgent(id string) (*Agent, error) {
 
 func (db *DB) ListAgents() ([]Agent, error) {
 	rows, err := db.sql.Query(
-		`SELECT id, name, hostname, os, arch, version, last_seen FROM agents ORDER BY name`)
+		`SELECT id, name, hostname, os, arch, version, run_user, login_user, last_seen FROM agents ORDER BY name`)
 	if err != nil {
 		return nil, err
 	}
@@ -266,7 +282,7 @@ func (db *DB) ListAgents() ([]Agent, error) {
 	for rows.Next() {
 		var a Agent
 		var last int64
-		if err := rows.Scan(&a.ID, &a.Name, &a.Hostname, &a.OS, &a.Arch, &a.Version, &last); err != nil {
+		if err := rows.Scan(&a.ID, &a.Name, &a.Hostname, &a.OS, &a.Arch, &a.Version, &a.RunUser, &a.LoginUser, &last); err != nil {
 			return nil, err
 		}
 		a.LastSeen = time.Unix(last, 0)
@@ -280,10 +296,16 @@ func (db *DB) TouchAgent(id string) error {
 	return err
 }
 
-// TouchAgentVersion updates last_seen and the reported version together.
-func (db *DB) TouchAgentVersion(id, version string) error {
-	_, err := db.sql.Exec(`UPDATE agents SET last_seen = ?, version = ? WHERE id = ?`,
-		time.Now().Unix(), version, id)
+// TouchAgentInfo updates last_seen together with the reported version and OS user.
+func (db *DB) TouchAgentInfo(id, version, runUser string) error {
+	_, err := db.sql.Exec(`UPDATE agents SET last_seen = ?, version = ?, run_user = ? WHERE id = ?`,
+		time.Now().Unix(), version, runUser, id)
+	return err
+}
+
+// SetAgentLoginUser sets the OS user terminals are opened as ("" = the agent's own).
+func (db *DB) SetAgentLoginUser(id, user string) error {
+	_, err := db.sql.Exec(`UPDATE agents SET login_user = ? WHERE id = ?`, user, id)
 	return err
 }
 
@@ -308,6 +330,8 @@ type ForwardRule struct {
 	HostPort   int
 	ListenAddr string
 	Proto      string
+	NoUfw      bool   // the panel opens no ufw rule for this forward
+	Label      string // optional note shown next to the rule
 }
 
 func (db *DB) CreateForwardRule(r ForwardRule) (int64, error) {
@@ -315,9 +339,9 @@ func (db *DB) CreateForwardRule(r ForwardRule) (int64, error) {
 		r.Proto = "http"
 	}
 	res, err := db.sql.Exec(
-		`INSERT INTO forward_rules(agent_id, client_port, host_port, listen_addr, proto, created_at)
-		 VALUES(?, ?, ?, ?, ?, ?)`,
-		r.AgentID, r.ClientPort, r.HostPort, r.ListenAddr, r.Proto, time.Now().Unix())
+		`INSERT INTO forward_rules(agent_id, client_port, host_port, listen_addr, proto, no_ufw, label, created_at)
+		 VALUES(?, ?, ?, ?, ?, ?, ?, ?)`,
+		r.AgentID, r.ClientPort, r.HostPort, r.ListenAddr, r.Proto, r.NoUfw, r.Label, time.Now().Unix())
 	if err != nil {
 		return 0, err
 	}
@@ -326,7 +350,7 @@ func (db *DB) CreateForwardRule(r ForwardRule) (int64, error) {
 
 func (db *DB) ListForwardRules() ([]ForwardRule, error) {
 	rows, err := db.sql.Query(
-		`SELECT id, agent_id, client_port, host_port, listen_addr, proto FROM forward_rules ORDER BY id`)
+		`SELECT id, agent_id, client_port, host_port, listen_addr, proto, no_ufw, label FROM forward_rules ORDER BY id`)
 	if err != nil {
 		return nil, err
 	}
@@ -334,7 +358,7 @@ func (db *DB) ListForwardRules() ([]ForwardRule, error) {
 	var out []ForwardRule
 	for rows.Next() {
 		var r ForwardRule
-		if err := rows.Scan(&r.ID, &r.AgentID, &r.ClientPort, &r.HostPort, &r.ListenAddr, &r.Proto); err != nil {
+		if err := rows.Scan(&r.ID, &r.AgentID, &r.ClientPort, &r.HostPort, &r.ListenAddr, &r.Proto, &r.NoUfw, &r.Label); err != nil {
 			return nil, err
 		}
 		out = append(out, r)
@@ -359,8 +383,8 @@ func (db *DB) ListForwardRulesByAgent(agentID string) ([]ForwardRule, error) {
 func (db *DB) GetForwardRule(id int64) (*ForwardRule, error) {
 	r := &ForwardRule{}
 	err := db.sql.QueryRow(
-		`SELECT id, agent_id, client_port, host_port, listen_addr, proto FROM forward_rules WHERE id = ?`, id).
-		Scan(&r.ID, &r.AgentID, &r.ClientPort, &r.HostPort, &r.ListenAddr, &r.Proto)
+		`SELECT id, agent_id, client_port, host_port, listen_addr, proto, no_ufw, label FROM forward_rules WHERE id = ?`, id).
+		Scan(&r.ID, &r.AgentID, &r.ClientPort, &r.HostPort, &r.ListenAddr, &r.Proto, &r.NoUfw, &r.Label)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -378,7 +402,20 @@ type UfwRule struct {
 	ID     int64
 	Port   int
 	Proto  string
-	RuleID int64 // bound forward rule id, or 0 for shared/manual (e.g. tunnel 8446)
+	RuleID int64 // bound forward rule id, 0 for shared (the tunnel port), ufwManual for one added in Settings
+}
+
+// ufwManual is the RuleID of a ufw rule the admin added by hand: no forward
+// owns it, so only the admin removes it.
+const ufwManual = -1
+
+// Manual reports whether the admin added the rule by hand.
+func (r UfwRule) Manual() bool { return r.RuleID == ufwManual }
+
+// SetUfwRuleManual hands a tracked rule over to the admin.
+func (db *DB) SetUfwRuleManual(port int, proto string) error {
+	_, err := db.sql.Exec(`UPDATE ufw_rules SET rule_id = ? WHERE port = ? AND proto = ?`, ufwManual, port, proto)
+	return err
 }
 
 func (db *DB) AddUfwRule(port int, proto string, ruleID int64) error {

internal/server/forward.go

@@ -14,8 +14,8 @@ import (
 // supports three transports:
 //   - "http": tunneled over the HTTP long-poll channel (works anywhere nginx
 //     reaches, highest latency);
-//   - "tcp":  direct TCP multiplexed over the 8446 tunnel (low latency);
-//   - "udp":  direct UDP over the 8446 channel.
+//   - "tcp":  direct TCP multiplexed over the tunnel port (low latency);
+//   - "udp":  direct UDP over the tunnel port.
 type forwardManager struct {
 	hub *Hub
 	tun *tunnelHub
@@ -92,11 +92,11 @@ func (m *forwardManager) acceptTCP(rule ForwardRule, ln net.Listener) {
 	}
 }
 
-// bridgeDirect wires a connection to the agent's low-latency 8446 tunnel.
+// bridgeDirect wires a connection to the agent's low-latency direct tunnel.
 func (m *forwardManager) bridgeDirect(rule ForwardRule, conn net.Conn) {
 	at := m.tun.get(rule.AgentID)
 	if at == nil {
-		// No direct tunnel (agent offline or 8446 unreachable).
+		// No direct tunnel (agent offline or the tunnel port unreachable).
 		conn.Close()
 		return
 	}

internal/server/fsstream.go

@@ -0,0 +1,623 @@
+package server
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"path"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+// Files go between the browser and the agent in pieces. Each piece is a
+// request of its own, small enough for any proxy in front (Cloudflare takes
+// 100 MB a request at most), and one that fails is sent again instead of the
+// whole file. Several pieces are in flight at once, so a good link stays as
+// busy as it would with one long stream. The server holds only a few pieces
+// of a transfer: whoever sends waits while they wait to be taken.
+//
+// A download keeps one plain response towards the browser, which a proxy
+// passes on whatever its size: links, previews and the hex editor read it.
+
+const (
+	// xferChunk is the size of a piece.
+	xferChunk = 4 << 20
+	// xferBuffer is how many pieces of a transfer the server holds.
+	xferBuffer = 8
+	// xferWait is how long a request waits for its piece, or for room for it,
+	// before it is told to ask again: well under a proxy's timeout.
+	xferWait = 50 * time.Second
+	// xferIdle ends a transfer nobody has touched for this long.
+	xferIdle = 10 * time.Minute
+	// xferTimeout bounds one transfer, however slow the links.
+	xferTimeout = 2 * time.Hour
+)
+
+// fsLegacyCap is the most an agent that predates the pieces can take in or
+// hand over: the file goes base64 inside a task then.
+const fsLegacyCap = 32 << 20
+
+// xfer is one file on its way.
+type xfer struct {
+	id, agentID string
+
+	mu      sync.Mutex
+	changed chan struct{} // closed and replaced on every change
+	size    int64         // -1 until known
+	n       int           // pieces in all, once the size is known
+	chunks  map[int][]byte
+	// low is the first piece still to go: the ones below it were written by
+	// the agent (upload) or to the browser (download).
+	low    int
+	sized  chan struct{} // closed once the size is known
+	err    string        // why the transfer failed
+	done   bool
+	result proto.TaskResult
+	last   time.Time
+}
+
+func pieces(size int64) int {
+	if size <= 0 {
+		return 1 // an empty file is one empty piece
+	}
+	return int((size + xferChunk - 1) / xferChunk)
+}
+
+// pieceLen is how long piece i of the file is.
+func (x *xfer) pieceLen(i int) int64 {
+	return min(int64(xferChunk), x.size-int64(i)*xferChunk)
+}
+
+// notify wakes whoever waits on the transfer; x.mu is held.
+func (x *xfer) notify() {
+	x.last = time.Now()
+	close(x.changed)
+	x.changed = make(chan struct{})
+}
+
+// await waits until ready() holds and returns true with x.mu held; false,
+// with it free, when the wait ran out or ctx ended.
+func (x *xfer) await(ctx context.Context, d time.Duration, ready func() bool) bool {
+	t := time.NewTimer(d)
+	defer t.Stop()
+	for {
+		x.mu.Lock()
+		if ready() {
+			return true
+		}
+		ch := x.changed
+		x.mu.Unlock()
+		select {
+		case <-ch:
+		case <-t.C:
+			return false
+		case <-ctx.Done():
+			return false
+		}
+	}
+}
+
+func (x *xfer) fail(msg string) {
+	x.mu.Lock()
+	if x.err == "" && !x.done {
+		x.err = msg
+		x.chunks = nil
+		x.notify()
+	}
+	x.mu.Unlock()
+}
+
+func (x *xfer) finish(res proto.TaskResult) {
+	x.mu.Lock()
+	x.done, x.result, x.chunks = true, res, nil
+	x.notify()
+	x.mu.Unlock()
+}
+
+// setSize records the file's size; false when it differs from the one known.
+func (x *xfer) setSize(size int64) bool {
+	x.mu.Lock()
+	defer x.mu.Unlock()
+	if x.size >= 0 {
+		return x.size == size
+	}
+	x.size, x.n = size, pieces(size)
+	close(x.sized)
+	x.notify()
+	return true
+}
+
+// put stores piece i once there is room for it, and answers with the HTTP
+// status for its sender. A piece already taken or held is accepted again: it
+// is a retry.
+func (x *xfer) put(ctx context.Context, i int, data []byte) (int, string) {
+	if !x.await(ctx, xferWait, func() bool { return x.err != "" || x.done || i < x.low+xferBuffer }) {
+		return http.StatusServiceUnavailable, "нет места, повторите"
+	}
+	defer x.mu.Unlock()
+	if x.err != "" || x.done {
+		return http.StatusGone, x.gone()
+	}
+	if i < 0 || i >= x.n || int64(len(data)) != x.pieceLen(i) {
+		return http.StatusBadRequest, "не тот кусок"
+	}
+	if i >= x.low && x.chunks[i] == nil {
+		x.chunks[i] = data
+		x.notify()
+	}
+	return http.StatusNoContent, ""
+}
+
+// take hands over piece i, the next one in order, and lets it go.
+func (x *xfer) take(ctx context.Context, i int, d time.Duration) ([]byte, error) {
+	if !x.await(ctx, d, func() bool { return x.err != "" || x.chunks[i] != nil }) {
+		return nil, errors.New("кусок не пришёл вовремя")
+	}
+	defer x.mu.Unlock()
+	if x.err != "" {
+		return nil, errors.New(x.err)
+	}
+	data := x.chunks[i]
+	delete(x.chunks, i)
+	x.low = i + 1
+	x.notify()
+	return data, nil
+}
+
+func (x *xfer) gone() string {
+	if x.err != "" {
+		return x.err
+	}
+	return "передача закончена"
+}
+
+// Read makes an upload a plain reader, for an agent that takes a file whole.
+type xferReader struct {
+	ctx context.Context
+	x   *xfer
+	i   int
+	buf []byte
+}
+
+func (r *xferReader) Read(p []byte) (int, error) {
+	for len(r.buf) == 0 {
+		if r.i >= r.x.n {
+			return 0, io.EOF
+		}
+		data, err := r.x.take(r.ctx, r.i, xferIdle)
+		if err != nil {
+			return 0, err
+		}
+		r.buf, r.i = data, r.i+1
+	}
+	n := copy(p, r.buf)
+	r.buf = r.buf[n:]
+	return n, nil
+}
+
+type xfers struct {
+	mu sync.Mutex
+	m  map[string]*xfer
+}
+
+func (c *xfers) open(agentID string, size int64) *xfer {
+	x := &xfer{
+		id: randToken()[:24], agentID: agentID, size: -1,
+		changed: make(chan struct{}), chunks: map[int][]byte{},
+		sized: make(chan struct{}), last: time.Now(),
+	}
+	if size >= 0 {
+		x.size, x.n = size, pieces(size)
+		close(x.sized)
+	}
+	c.mu.Lock()
+	if c.m == nil {
+		c.m = map[string]*xfer{}
+	}
+	// Forget the ones left behind: a closed tab, a client gone for good.
+	for id, old := range c.m {
+		old.mu.Lock()
+		stale := time.Since(old.last) > xferIdle
+		old.mu.Unlock()
+		if stale {
+			old.fail("передача брошена")
+			delete(c.m, id)
+		}
+	}
+	c.m[x.id] = x
+	c.mu.Unlock()
+	return x
+}
+
+func (c *xfers) get(id string) *xfer {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.m[id]
+}
+
+// forAgent returns the transfer if it is the asking agent's.
+func (c *xfers) forAgent(id, agentID string) *xfer {
+	if x := c.get(id); x != nil && x.agentID == agentID {
+		return x
+	}
+	return nil
+}
+
+func (c *xfers) drop(id string) {
+	c.mu.Lock()
+	delete(c.m, id)
+	c.mu.Unlock()
+}
+
+// waitTask runs a task on the agent and waits for its result, or for ctx to
+// end.
+func (s *Server) waitTask(ctx context.Context, agentID, typ string, args any, timeout time.Duration) (proto.TaskResult, error) {
+	raw, _ := json.Marshal(args)
+	taskID, ch := s.hub.CreateTask(agentID, typ, raw)
+	defer s.hub.DiscardTask(taskID)
+	t := time.NewTimer(timeout)
+	defer t.Stop()
+	select {
+	case res := <-ch:
+		return res, nil
+	case <-ctx.Done():
+		return proto.TaskResult{}, ctx.Err()
+	case <-t.C:
+		return proto.TaskResult{}, errors.New("таймаут ожидания агента")
+	}
+}
+
+// unknownOp tells an agent that predates the task.
+func unknownOp(res proto.TaskResult) bool {
+	return !res.OK && strings.Contains(res.Error, "неизвестная операция")
+}
+
+// fsAgent answers the request itself and returns false when the agent is
+// unknown or offline.
+func (s *Server) fsAgent(w http.ResponseWriter, agentID string, asJSON bool) bool {
+	a, err := s.db.GetAgent(agentID)
+	if err != nil || a == nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return false
+	}
+	if !s.online(a) {
+		if asJSON {
+			writeJSON(w, proto.TaskResult{Error: "машина офлайн"})
+		} else {
+			http.Error(w, "машина офлайн", http.StatusServiceUnavailable)
+		}
+		return false
+	}
+	return true
+}
+
+// readPiece reads a piece's body into a buffer of its own size, so pieces
+// leave no trail of grown buffers behind.
+func readPiece(w http.ResponseWriter, r *http.Request) ([]byte, error) {
+	if r.ContentLength >= 0 && r.ContentLength <= xferChunk {
+		data := make([]byte, r.ContentLength)
+		_, err := io.ReadFull(r.Body, data)
+		return data, err
+	}
+	return io.ReadAll(http.MaxBytesReader(w, r.Body, xferChunk))
+}
+
+// ---------- upload: browser -> agent ----------
+
+// POST /api/panel/agents/{id}/fs/upload?path=...&size=N - start writing a
+// file. The answer names the transfer and the piece size; the browser then
+// PUTs the pieces and asks for the result.
+func (s *Server) handleFSUploadStart(w http.ResponseWriter, r *http.Request) {
+	agentID, p := r.PathValue("id"), r.URL.Query().Get("path")
+	if !s.fsAgent(w, agentID, true) {
+		return
+	}
+	size, err := strconv.ParseInt(r.URL.Query().Get("size"), 10, 64)
+	if p == "" || err != nil || size < 0 {
+		writeJSON(w, proto.TaskResult{Error: "не указан путь или размер"})
+		return
+	}
+	if size > proto.FSFileCap {
+		writeJSON(w, proto.TaskResult{Error: "файл больше 512 МБ"})
+		return
+	}
+	x := s.xfers.open(agentID, size)
+	go s.runUpload(x, p)
+	data, _ := json.Marshal(map[string]any{"id": x.id, "chunk": xferChunk})
+	writeJSON(w, proto.TaskResult{OK: true, Data: data})
+}
+
+// runUpload has the agent write the file and keeps the result for the
+// browser to collect.
+func (s *Server) runUpload(x *xfer, p string) {
+	ctx, cancel := context.WithTimeout(context.Background(), xferTimeout)
+	defer cancel()
+	args := proto.FSXferArgs{Path: p, Xfer: x.id, Size: x.size, Chunk: xferChunk}
+	res, err := s.waitTask(ctx, x.agentID, proto.TaskFSPut, args, xferTimeout)
+	if err == nil && unknownOp(res) {
+		res = s.legacyUpload(ctx, x, p)
+	}
+	if err != nil {
+		res = proto.TaskResult{Error: err.Error()}
+	}
+	if !res.OK {
+		x.fail(res.Error)
+	}
+	x.finish(res)
+	// The result waits a while for the browser to come for it.
+	time.AfterFunc(xferIdle, func() { s.xfers.drop(x.id) })
+}
+
+// legacyUpload writes a file through an agent that predates the pieces.
+func (s *Server) legacyUpload(ctx context.Context, x *xfer, p string) proto.TaskResult {
+	if x.size > fsLegacyCap {
+		return proto.TaskResult{Error: "клиент принимает файлы до 32 МБ - обновите его"}
+	}
+	data, err := io.ReadAll(&xferReader{ctx: ctx, x: x})
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	args := proto.FSWriteArgs{Path: p, Data: base64.StdEncoding.EncodeToString(data)}
+	res, err := s.waitTask(ctx, x.agentID, proto.TaskFSWrite, args, fsTaskTimeout)
+	if err != nil {
+		return proto.TaskResult{Error: err.Error()}
+	}
+	return res
+}
+
+// PUT /api/panel/fs/xfer/{xid}/{i} - piece i of a file being uploaded. 503:
+// no room yet, send it again; 410: the transfer is over.
+func (s *Server) handleXferPut(w http.ResponseWriter, r *http.Request) {
+	x := s.xfers.get(r.PathValue("xid"))
+	i, err := strconv.Atoi(r.PathValue("i"))
+	if x == nil || err != nil {
+		http.Error(w, "передача не найдена", http.StatusGone)
+		return
+	}
+	data, err := readPiece(w, r)
+	if err != nil {
+		http.Error(w, "кусок не дошёл", http.StatusBadRequest)
+		return
+	}
+	code, msg := x.put(r.Context(), i, data)
+	if code == http.StatusNoContent {
+		w.WriteHeader(code)
+		return
+	}
+	http.Error(w, msg, code)
+}
+
+// POST /api/panel/fs/xfer/{xid}/cancel - the browser gives the upload up.
+func (s *Server) handleXferCancel(w http.ResponseWriter, r *http.Request) {
+	if x := s.xfers.get(r.PathValue("xid")); x != nil {
+		x.fail("отменено")
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// GET /api/panel/fs/xfer/{xid}/result - the upload's result, once the agent
+// has written the file; {"done":false} means ask again.
+func (s *Server) handleXferResult(w http.ResponseWriter, r *http.Request) {
+	x := s.xfers.get(r.PathValue("xid"))
+	if x == nil {
+		writeJSON(w, map[string]any{"done": true, "result": proto.TaskResult{Error: "передача не найдена"}})
+		return
+	}
+	if !x.await(r.Context(), xferWait, func() bool { return x.done }) {
+		writeJSON(w, map[string]any{"done": false})
+		return
+	}
+	res := x.result
+	x.mu.Unlock()
+	writeJSON(w, map[string]any{"done": true, "result": res})
+}
+
+// GET /api/agent/fs/xfer/{xid}/{i}?ack=K - piece i of the upload, for the
+// agent to write. K says the agent has written every piece below it, so
+// those are let go. 503: not here yet, ask again; 410: the transfer is over.
+func (s *Server) handleAgentXferGet(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	x := s.xfers.forAgent(r.PathValue("xid"), a.ID)
+	i, err := strconv.Atoi(r.PathValue("i"))
+	if x == nil || err != nil {
+		http.Error(w, "передача не найдена", http.StatusGone)
+		return
+	}
+	if ack, err := strconv.Atoi(r.URL.Query().Get("ack")); err == nil {
+		x.mu.Lock()
+		if ack > x.low {
+			for k := x.low; k < ack; k++ {
+				delete(x.chunks, k)
+			}
+			x.low = ack
+			x.notify()
+		}
+		x.mu.Unlock()
+	}
+	if !x.await(r.Context(), xferWait, func() bool { return x.err != "" || x.chunks[i] != nil }) {
+		http.Error(w, "кусок ещё не пришёл", http.StatusServiceUnavailable)
+		return
+	}
+	if x.err != "" {
+		msg := x.err
+		x.mu.Unlock()
+		http.Error(w, msg, http.StatusGone)
+		return
+	}
+	data := x.chunks[i]
+	x.mu.Unlock()
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
+	_, _ = w.Write(data)
+}
+
+// ---------- download: agent -> browser ----------
+
+// inlineTypes are the files the panel shows in place rather than downloads.
+var inlineTypes = map[string]string{
+	".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif",
+	".webp": "image/webp", ".bmp": "image/bmp", ".ico": "image/x-icon", ".avif": "image/avif",
+	".svg": "image/svg+xml",
+	".mp4": "video/mp4", ".m4v": "video/mp4", ".webm": "video/webm", ".ogv": "video/ogg", ".mov": "video/quicktime",
+	".mp3": "audio/mpeg", ".wav": "audio/wav", ".ogg": "audio/ogg", ".oga": "audio/ogg", ".m4a": "audio/mp4",
+	".aac": "audio/aac", ".flac": "audio/flac", ".opus": "audio/ogg",
+	".pdf": "application/pdf",
+}
+
+// fileHeaders sets what the browser needs to download or show the file. A
+// file shown in place runs nothing: no scripts in an SVG, whatever it holds.
+// A PDF is the exception, as the browser's viewer will not open in a sandbox;
+// it runs in that viewer, not in the panel's page.
+func fileHeaders(w http.ResponseWriter, p string, inline bool) {
+	name := path.Base(p)
+	ctype := "application/octet-stream"
+	if t, ok := inlineTypes[strings.ToLower(path.Ext(name))]; ok && inline {
+		ctype = t
+	}
+	disp := "attachment"
+	if inline {
+		disp = "inline"
+	}
+	w.Header().Set("Content-Type", ctype)
+	w.Header().Set("Content-Disposition", disp+"; filename=\""+strings.ReplaceAll(name, "\"", "")+"\"")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	if ctype != "application/pdf" {
+		w.Header().Set("Content-Security-Policy", "sandbox; default-src 'none'; img-src data:; style-src 'unsafe-inline'")
+	}
+	w.Header().Set("Cache-Control", "no-store")
+}
+
+// GET /api/panel/agents/{id}/fs/download?path=...[&inline=1] - the file, as
+// one response fed by the pieces the agent sends. inline=1 serves pictures,
+// video and sound for the page to show.
+func (s *Server) handleFSDownload(w http.ResponseWriter, r *http.Request) {
+	agentID, p := r.PathValue("id"), r.URL.Query().Get("path")
+	inline := r.URL.Query().Get("inline") != ""
+	if !s.fsAgent(w, agentID, false) {
+		return
+	}
+	x := s.xfers.open(agentID, -1)
+	defer s.xfers.drop(x.id)
+	defer x.fail("браузер ушёл") // stops the agent if the response ends early
+
+	raw, _ := json.Marshal(proto.FSXferArgs{Path: p, Xfer: x.id, Size: -1, Chunk: xferChunk})
+	taskID, ch := s.hub.CreateTask(agentID, proto.TaskFSSend, raw)
+	defer s.hub.DiscardTask(taskID)
+	// The agent's result: an error ends the transfer wherever it stands.
+	results := make(chan proto.TaskResult, 1)
+	go func() {
+		select {
+		case res := <-ch:
+			if !res.OK && !unknownOp(res) {
+				x.fail(res.Error)
+			}
+			results <- res
+		case <-r.Context().Done():
+		}
+	}()
+
+	select {
+	case <-x.sized:
+	case res := <-results:
+		if unknownOp(res) {
+			s.legacyDownload(w, r, agentID, p, inline)
+			return
+		}
+		msg := res.Error
+		if msg == "" {
+			msg = "агент не отдал файл"
+		}
+		http.Error(w, msg, http.StatusBadGateway)
+		return
+	case <-r.Context().Done():
+		return
+	case <-time.After(fsTaskTimeout):
+		http.Error(w, "таймаут ожидания агента", http.StatusGatewayTimeout)
+		return
+	}
+
+	fileHeaders(w, p, inline)
+	w.Header().Set("Content-Length", strconv.FormatInt(x.size, 10))
+	rc := http.NewResponseController(w)
+	for i := 0; i < x.n; i++ {
+		data, err := x.take(r.Context(), i, xferIdle)
+		if err == nil {
+			_, err = w.Write(data)
+		}
+		if err != nil {
+			// Cut the response off, so the browser does not take a part of
+			// the file for all of it.
+			x.fail(err.Error())
+			panic(http.ErrAbortHandler)
+		}
+		_ = rc.Flush()
+	}
+}
+
+// legacyDownload gets a file from an agent that predates the pieces.
+func (s *Server) legacyDownload(w http.ResponseWriter, r *http.Request, agentID, p string, inline bool) {
+	res, err := s.waitTask(r.Context(), agentID, proto.TaskFSDownload, proto.FSPathArgs{Path: p}, fsTaskTimeout)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusGatewayTimeout)
+		return
+	}
+	if !res.OK {
+		http.Error(w, res.Error, http.StatusBadGateway)
+		return
+	}
+	var rr proto.FSReadResult
+	if err := json.Unmarshal(res.Data, &rr); err != nil {
+		http.Error(w, "bad result", http.StatusBadGateway)
+		return
+	}
+	data, _ := base64.StdEncoding.DecodeString(rr.Content)
+	fileHeaders(w, p, inline)
+	if rr.Truncated {
+		w.Header().Set("X-Truncated", "1")
+	}
+	_, _ = w.Write(data)
+}
+
+// POST /api/agent/fs/xfer/{xid}/{i} - piece i of the file the browser asked
+// for, X-Size its whole size. 503: no room yet, send it again; 410: the
+// browser is gone.
+func (s *Server) handleAgentXferPost(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	x := s.xfers.forAgent(r.PathValue("xid"), a.ID)
+	i, err := strconv.Atoi(r.PathValue("i"))
+	if x == nil || err != nil {
+		http.Error(w, "передача не найдена", http.StatusGone)
+		return
+	}
+	size, err := strconv.ParseInt(r.Header.Get("X-Size"), 10, 64)
+	if err != nil || size < 0 || size > proto.FSFileCap || !x.setSize(size) {
+		http.Error(w, "не тот размер", http.StatusBadRequest)
+		return
+	}
+	data, err := readPiece(w, r)
+	if err != nil {
+		http.Error(w, "кусок не дошёл", http.StatusBadRequest)
+		return
+	}
+	code, msg := x.put(r.Context(), i, data)
+	if code == http.StatusNoContent {
+		w.WriteHeader(code)
+		return
+	}
+	http.Error(w, msg, code)
+}

internal/server/handlers_agent.go

@@ -16,7 +16,7 @@ func writeJSON(w http.ResponseWriter, v any) {
 	_ = json.NewEncoder(w).Encode(v)
 }
 
-// POST /api/agent/enroll — exchange the shared enroll secret for a per-agent id+token.
+// POST /api/agent/enroll - exchange the shared enroll secret for a per-agent id+token.
 func (s *Server) handleEnroll(w http.ResponseWriter, r *http.Request) {
 	secret := r.Header.Get("X-Enroll-Secret")
 	if !constantTimeEqual(secret, s.db.EnrollSecret()) {
@@ -28,7 +28,7 @@ func (s *Server) handleEnroll(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad request", http.StatusBadRequest)
 		return
 	}
-	id, token, err := s.enroll(req.Name, req.Hostname, req.OS, req.Arch, req.Version)
+	id, token, err := s.enroll(req.Name, req.Hostname, req.OS, req.Arch, req.Version, req.User)
 	if err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
@@ -36,23 +36,50 @@ func (s *Server) handleEnroll(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, proto.EnrollResponse{AgentID: id, Token: token})
 }
 
-// GET /api/agent/poll — control channel. Held until a job is queued or timeout.
+// GET /api/agent/poll - control channel. Held until a job is queued or timeout.
 func (s *Server) handlePoll(w http.ResponseWriter, r *http.Request) {
 	a := s.authenticateAgent(r)
 	if a == nil {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
 	}
-	// The agent sends its version occasionally; record it when present.
-	if v := r.Header.Get("X-Agent-Version"); v != "" && v != a.Version {
-		_ = s.db.TouchAgentVersion(a.ID, v)
+	// The agent sends its version and OS user occasionally; record them when
+	// present. Agents older than 0.0.2 send no user, so keep what we have.
+	v := r.Header.Get("X-Agent-Version")
+	u := firstNonEmpty(r.Header.Get("X-Agent-User"), a.RunUser)
+	if v != "" && (v != a.Version || u != a.RunUser) {
+		_ = s.db.TouchAgentInfo(a.ID, v, u)
 	} else {
 		_ = s.db.TouchAgent(a.ID)
 	}
-	writeJSON(w, s.hub.WaitControl(a.ID, pollHold))
+	msg := s.hub.WaitControl(r.Context().Done(), a.ID, pollHold)
+	// Set after the hold so a port changed meanwhile reaches the agent now.
+	s.setTunnelHeader(w)
+	writeJSON(w, msg)
 }
 
-// GET /api/agent/task/{id} — the agent fetches the task to run.
+// tunnelAddrHeader carries the direct-tunnel address ("host:port", host empty
+// = the panel's host) to agents, on every poll and on /api/agent/config.
+const tunnelAddrHeader = "X-Tunnel-Addr"
+
+func (s *Server) setTunnelHeader(w http.ResponseWriter) {
+	if addr := s.tunnelAdvert(); addr != "" {
+		w.Header().Set(tunnelAddrHeader, addr)
+	}
+}
+
+// GET /api/agent/config - settings an agent picks up when it connects, without
+// waiting out a poll hold.
+func (s *Server) handleAgentConfig(w http.ResponseWriter, r *http.Request) {
+	if s.authenticateAgent(r) == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	s.setTunnelHeader(w)
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// GET /api/agent/task/{id} - the agent fetches the task to run.
 func (s *Server) handleTaskFetch(w http.ResponseWriter, r *http.Request) {
 	if s.authenticateAgent(r) == nil {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
@@ -66,7 +93,7 @@ func (s *Server) handleTaskFetch(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, env)
 }
 
-// POST /api/agent/task/{id}/result — the agent returns the task result.
+// POST /api/agent/task/{id}/result - the agent returns the task result.
 func (s *Server) handleTaskResult(w http.ResponseWriter, r *http.Request) {
 	if s.authenticateAgent(r) == nil {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
@@ -81,7 +108,7 @@ func (s *Server) handleTaskResult(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
-// GET /api/agent/term/{sid}/in — downstream (panel -> agent) long-poll.
+// GET /api/agent/term/{sid}/in - downstream (panel -> agent) long-poll.
 func (s *Server) handleTermIn(w http.ResponseWriter, r *http.Request) {
 	if s.authenticateAgent(r) == nil {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
@@ -100,7 +127,7 @@ func (s *Server) handleTermIn(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, proto.InBatch{Frames: frames})
 }
 
-// POST /api/agent/term/{sid}/out — upstream (agent PTY -> panel).
+// POST /api/agent/term/{sid}/out - upstream (agent PTY -> panel).
 func (s *Server) handleTermOut(w http.ResponseWriter, r *http.Request) {
 	if s.authenticateAgent(r) == nil {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
@@ -121,7 +148,11 @@ func (s *Server) handleTermOut(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if msg.Exit {
-		s.hub.CloseSession(sess.ID)
+		// End the stream now, but keep the session reachable for a moment so
+		// the panel can still collect the last output (e.g. why the shell
+		// failed to start).
+		sess.close()
+		time.AfterFunc(pollHold, func() { s.hub.CloseSession(sess.ID) })
 	}
 	w.WriteHeader(http.StatusNoContent)
 }

internal/server/handlers_panel.go

@@ -1,9 +1,14 @@
 package server
 
 import (
+	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
+	"net"
 	"net/http"
+	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -113,7 +118,8 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	}
 	rows := make([]row, 0, len(agents))
 	for _, a := range agents {
-		rows = append(rows, row{Agent: a, Online: a.Online(), Seen: humanSince(a.LastSeen)})
+		on := s.online(&a)
+		rows = append(rows, row{Agent: a, Online: on, Seen: seenText(on, a.LastSeen)})
 	}
 	s.render(w, "dashboard.html", map[string]any{
 		"Admin":  s.currentAdmin(r),
@@ -122,6 +128,36 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// seenText is the "activity" cell: a connected agent is active now, whatever
+// the time of its last recorded poll.
+func seenText(online bool, lastSeen time.Time) string {
+	if online {
+		return "сейчас"
+	}
+	return humanSince(lastSeen)
+}
+
+// GET /api/panel/agents/presence - who is online, for the dashboard to keep
+// its status column live without reloading.
+func (s *Server) handlePresence(w http.ResponseWriter, r *http.Request) {
+	agents, err := s.db.ListAgents()
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	type item struct {
+		ID     string `json:"id"`
+		Online bool   `json:"online"`
+		Seen   string `json:"seen"`
+	}
+	out := make([]item, 0, len(agents))
+	for _, a := range agents {
+		on := s.online(&a)
+		out = append(out, item{ID: a.ID, Online: on, Seen: seenText(on, a.LastSeen)})
+	}
+	writeJSON(w, out)
+}
+
 func (s *Server) handleTerminalPage(w http.ResponseWriter, r *http.Request) {
 	id := r.PathValue("id")
 	a, err := s.db.GetAgent(id)
@@ -141,7 +177,16 @@ func (s *Server) handleAgentDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	id := r.PathValue("id")
+	// Its forward rules go with it: left behind they would keep their host
+	// ports bound and busy with no page to remove them from.
+	rules, _ := s.db.ListForwardRulesByAgent(id)
+	for _, rule := range rules {
+		s.removeForward(rule.ID)
+	}
 	_ = s.db.DeleteAgent(id)
+	s.stats.drop(id)
+	s.relays.drop(id, nil)
+	s.hub.Forget(id)
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
@@ -152,13 +197,135 @@ func (s *Server) handleAgentEdit(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	s.render(w, "edit.html", map[string]any{
+	data := map[string]any{
 		"Agent":         a,
 		"CSRF":          csrfToken(r),
 		"ServerVersion": Version,
 		"Outdated":      a.Version != "" && a.Version != Version,
 		"Updated":       r.URL.Query().Get("updated") == "1",
+		"UserOK":        r.URL.Query().Get("uok"),
+		"UserErr":       r.URL.Query().Get("uerr"),
+	}
+	// The user list lives on the machine, so it is only known while it is online.
+	if s.online(a) {
+		if users, err := s.agentUsers(id); err == nil {
+			data["Users"] = users
+		} else {
+			data["UsersErr"] = err.Error()
+		}
+	}
+	s.render(w, "edit.html", data)
+}
+
+// usersTaskTimeout bounds how long the edit page waits for the agent.
+const usersTaskTimeout = 8 * time.Second
+
+// agentUsers asks the agent who it runs as and which users it can log in as.
+func (s *Server) agentUsers(agentID string) (*proto.SysUsersResult, error) {
+	taskID, ch := s.hub.CreateTask(agentID, proto.TaskSysUsers, nil)
+	defer s.hub.DiscardTask(taskID)
+	select {
+	case res := <-ch:
+		if !res.OK {
+			// Agents older than 0.0.2 don't know this task.
+			return nil, errors.New("клиент не поддерживает выбор пользователя - обновите его")
+		}
+		var out proto.SysUsersResult
+		if err := json.Unmarshal(res.Data, &out); err != nil {
+			return nil, errors.New("некорректный ответ клиента")
+		}
+		return &out, nil
+	case <-time.After(usersTaskTimeout):
+		return nil, errors.New("таймаут ожидания клиента")
+	}
+}
+
+// editUserRedirect returns to the edit page with a result banner.
+func editUserRedirect(w http.ResponseWriter, r *http.Request, id, key, msg string) {
+	http.Redirect(w, r, "/agents/"+id+"/edit?"+key+"="+url.QueryEscape(msg), http.StatusSeeOther)
+}
+
+// handleAgentSetUser picks the OS user terminals on this machine run as.
+func (s *Server) handleAgentSetUser(w http.ResponseWriter, r *http.Request) {
+	if !checkCSRF(r) {
+		http.Error(w, "bad csrf", http.StatusForbidden)
+		return
+	}
+	id := r.PathValue("id")
+	a, err := s.db.GetAgent(id)
+	if err != nil || a == nil {
+		http.NotFound(w, r)
+		return
+	}
+	name := strings.TrimSpace(r.FormValue("user"))
+	if !s.online(a) {
+		editUserRedirect(w, r, id, "uerr", "Машина офлайн - сменить пользователя нельзя.")
+		return
+	}
+	// Only accept a user the machine itself reports, so a typo (or an agent too
+	// old to honour the choice) can't silently leave the terminal as root.
+	users, err := s.agentUsers(id)
+	if err != nil {
+		editUserRedirect(w, r, id, "uerr", err.Error())
+		return
+	}
+	if !slices.Contains(users.Users, name) {
+		editUserRedirect(w, r, id, "uerr", "Пользователя "+name+" нет на машине.")
+		return
+	}
+	if name == users.Current {
+		name = "" // follow the agent's own user
+	}
+	if err := s.db.SetAgentLoginUser(id, name); err != nil {
+		editUserRedirect(w, r, id, "uerr", "Не удалось сохранить.")
+		return
+	}
+	if admin := s.currentAdmin(r); admin != nil {
+		s.db.Audit(admin.ID, id, "set_user:"+firstNonEmpty(name, users.Current))
+	}
+	editUserRedirect(w, r, id, "uok", "Терминал будет открываться от "+firstNonEmpty(name, users.Current)+".")
+}
+
+// handleAgentAddUser creates a new OS user on the machine and switches the
+// terminal to it.
+func (s *Server) handleAgentAddUser(w http.ResponseWriter, r *http.Request) {
+	if !checkCSRF(r) {
+		http.Error(w, "bad csrf", http.StatusForbidden)
+		return
+	}
+	id := r.PathValue("id")
+	a, err := s.db.GetAgent(id)
+	if err != nil || a == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if !s.online(a) {
+		editUserRedirect(w, r, id, "uerr", "Машина офлайн - создать пользователя нельзя.")
+		return
+	}
+	name := strings.TrimSpace(r.FormValue("name"))
+	args, _ := json.Marshal(proto.SysUserAddArgs{
+		Name:     name,
+		Password: r.FormValue("password"),
+		Sudo:     r.FormValue("sudo") == "1",
 	})
+	taskID, ch := s.hub.CreateTask(id, proto.TaskSysUserAdd, args)
+	defer s.hub.DiscardTask(taskID)
+	select {
+	case res := <-ch:
+		if !res.OK {
+			editUserRedirect(w, r, id, "uerr", "Не удалось создать пользователя: "+res.Error)
+			return
+		}
+	case <-time.After(30 * time.Second):
+		editUserRedirect(w, r, id, "uerr", "Таймаут ожидания клиента.")
+		return
+	}
+	_ = s.db.SetAgentLoginUser(id, name)
+	if admin := s.currentAdmin(r); admin != nil {
+		s.db.Audit(admin.ID, id, "create_user:"+name)
+	}
+	editUserRedirect(w, r, id, "uok", "Пользователь "+name+" создан и выбран для терминала.")
 }
 
 // handleAgentUpdate asks the agent to download the latest binary and restart.
@@ -173,7 +340,7 @@ func (s *Server) handleAgentUpdate(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	if !a.Online() {
+	if !s.online(a) {
 		http.Redirect(w, r, "/agents/"+id+"/edit?updated=0", http.StatusSeeOther)
 		return
 	}
@@ -223,9 +390,80 @@ func (s *Server) handleSettings(w http.ResponseWriter, r *http.Request) {
 		"UfwRunnable":   ufwRunnable,
 		"UfwEnabled":    s.db.UfwEnabled(),
 		"UfwRules":      ufwRules,
+		"UfwError":      s.ufw.LastError(),
+		"TunnelPort":    s.TunnelPort(),
+		"TunnelDefault": s.tunnelDefault,
+		"TunnelHost":    s.db.TunnelHost(),
+		"TunnelCustom":  s.db.TunnelPort() > 0,
+		"Error": map[string]string{
+			"tunnel_host":   "Некорректный хост туннеля: нужен IP или имя без схемы и порта.",
+			"tunnel_port":   "Некорректный порт туннеля.",
+			"ufw_port":      "Некорректное правило ufw: нужен порт 1-65535 и протокол tcp или udp.",
+			"ufw_off":       "Правило ufw не добавлено: ufw выключен или интеграция с ним отключена.",
+			"ufw_failed":    "Правило ufw не добавлено: команда ufw завершилась ошибкой.",
+			"ufw_exists":    "Этот порт уже открыт в ufw не панелью - правило осталось как было, панель его не отслеживает.",
+			"tunnel_listen": "Не удалось занять новый порт туннеля на хосте (возможно, уже используется). Порт не изменён.",
+		}[r.URL.Query().Get("err")],
 	})
 }
 
+// POST /settings/tunnel - host and port agents use for the direct tunnel.
+func (s *Server) handleSetTunnel(w http.ResponseWriter, r *http.Request) {
+	if !checkCSRF(r) {
+		http.Error(w, "bad csrf", http.StatusForbidden)
+		return
+	}
+	if s.tunnelDefault == 0 {
+		http.Redirect(w, r, "/settings", http.StatusSeeOther)
+		return
+	}
+	host := strings.TrimSpace(r.FormValue("tunnel_host"))
+	host = strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
+	if !validTunnelHost(host) {
+		http.Redirect(w, r, "/settings?err=tunnel_host", http.StatusSeeOther)
+		return
+	}
+	// An empty port goes back to the one the server was started with.
+	port, custom := s.tunnelDefault, ""
+	if v := strings.TrimSpace(r.FormValue("tunnel_port")); v != "" {
+		n, err := strconv.Atoi(v)
+		if err != nil || n < 1 || n > 65535 {
+			http.Redirect(w, r, "/settings?err=tunnel_port", http.StatusSeeOther)
+			return
+		}
+		port = n
+		if n != s.tunnelDefault {
+			custom = v
+		}
+	}
+	if err := s.setTunnelPort(port); err != nil {
+		log.Printf("tunnel: move to port %d: %v", port, err)
+		http.Redirect(w, r, "/settings?err=tunnel_listen", http.StatusSeeOther)
+		return
+	}
+	_ = s.db.SetConfig(cfgTunnelPort, custom)
+	_ = s.db.SetConfig(cfgTunnelHost, host)
+	http.Redirect(w, r, "/settings", http.StatusSeeOther)
+}
+
+// validTunnelHost accepts an empty value, an IP, or a bare host name.
+func validTunnelHost(host string) bool {
+	if host == "" || net.ParseIP(host) != nil {
+		return true
+	}
+	if len(host) > 253 {
+		return false
+	}
+	for _, c := range host {
+		switch {
+		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9', c == '-', c == '.', c == '_':
+		default:
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) handleSetHost(w http.ResponseWriter, r *http.Request) {
 	if !checkCSRF(r) {
 		http.Error(w, "bad csrf", http.StatusForbidden)
@@ -282,10 +520,33 @@ func (s *Server) handleUfwToggle(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad csrf", http.StatusForbidden)
 		return
 	}
-	_ = s.db.SetUfwEnabled(r.FormValue("enabled") == "1")
+	on := r.FormValue("enabled") == "1"
+	_ = s.db.SetUfwEnabled(on)
+	if on {
+		// Open what forwards created while the integration was off need.
+		s.ufw.sync()
+	}
 	http.Redirect(w, r, "/settings", http.StatusSeeOther)
 }
 
+func (s *Server) handleUfwAdd(w http.ResponseWriter, r *http.Request) {
+	if !checkCSRF(r) {
+		http.Error(w, "bad csrf", http.StatusForbidden)
+		return
+	}
+	port, _ := strconv.Atoi(strings.TrimSpace(r.FormValue("port")))
+	proto := r.FormValue("proto")
+	if port < 1 || port > 65535 || (proto != "tcp" && proto != "udp") {
+		http.Redirect(w, r, "/settings?err=ufw_port", http.StatusSeeOther)
+		return
+	}
+	target := "/settings"
+	if key := s.ufw.allowManual(port, proto); key != "" {
+		target += "?err=" + key
+	}
+	http.Redirect(w, r, target, http.StatusSeeOther)
+}
+
 func (s *Server) handleUfwRevoke(w http.ResponseWriter, r *http.Request) {
 	if !checkCSRF(r) {
 		http.Error(w, "bad csrf", http.StatusForbidden)

internal/server/handlers_panel_fs.go

@@ -1,11 +1,8 @@
 package server
 
 import (
-	"encoding/base64"
-	"encoding/json"
 	"io"
 	"net/http"
-	"path"
 	"time"
 
 	"github.com/x-grk/longpolling-remote-access/internal/proto"
@@ -34,10 +31,10 @@ func (s *Server) handleFilesPage(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	s.render(w, "files.html", map[string]any{"Agent": a})
+	s.render(w, "files.html", map[string]any{"Agent": a, "EditLimit": proto.FSReadCap})
 }
 
-// POST /api/panel/agents/{id}/fs/{op} — run a file-manager operation on the
+// POST /api/panel/agents/{id}/fs/{op} - run a file-manager operation on the
 // agent and return its result. The request body is the op's JSON args and is
 // forwarded verbatim to the agent.
 func (s *Server) handleFSOp(w http.ResponseWriter, r *http.Request) {
@@ -53,7 +50,7 @@ func (s *Server) handleFSOp(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	if !a.Online() {
+	if !s.online(a) {
 		writeJSON(w, proto.TaskResult{Error: "машина офлайн"})
 		return
 	}
@@ -73,44 +70,3 @@ func (s *Server) handleFSOp(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, proto.TaskResult{Error: "таймаут ожидания агента"})
 	}
 }
-
-// GET /api/panel/agents/{id}/fs/download?path=... — stream a file as a download.
-func (s *Server) handleFSDownload(w http.ResponseWriter, r *http.Request) {
-	agentID := r.PathValue("id")
-	p := r.URL.Query().Get("path")
-	a, err := s.db.GetAgent(agentID)
-	if err != nil || a == nil {
-		http.NotFound(w, r)
-		return
-	}
-	if !a.Online() {
-		http.Error(w, "машина офлайн", http.StatusServiceUnavailable)
-		return
-	}
-	args, _ := json.Marshal(proto.FSPathArgs{Path: p})
-	taskID, ch := s.hub.CreateTask(agentID, proto.TaskFSDownload, args)
-	defer s.hub.DiscardTask(taskID)
-
-	select {
-	case res := <-ch:
-		if !res.OK {
-			http.Error(w, res.Error, http.StatusBadGateway)
-			return
-		}
-		var rr proto.FSReadResult
-		if err := json.Unmarshal(res.Data, &rr); err != nil {
-			http.Error(w, "bad result", http.StatusBadGateway)
-			return
-		}
-		data, _ := base64.StdEncoding.DecodeString(rr.Content)
-		name := path.Base(p)
-		w.Header().Set("Content-Type", "application/octet-stream")
-		w.Header().Set("Content-Disposition", "attachment; filename=\""+name+"\"")
-		if rr.Truncated {
-			w.Header().Set("X-Truncated", "1")
-		}
-		_, _ = w.Write(data)
-	case <-time.After(fsTaskTimeout):
-		http.Error(w, "таймаут ожидания агента", http.StatusGatewayTimeout)
-	}
-}

internal/server/handlers_panel_fwd.go

@@ -3,6 +3,7 @@ package server
 import (
 	"log"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 )
@@ -17,18 +18,37 @@ func (s *Server) handleForwardsPage(w http.ResponseWriter, r *http.Request) {
 	rules, _ := s.db.ListForwardRulesByAgent(id)
 	errMsg := map[string]string{
 		"busy":   "Этот порт хоста уже занят другим правилом.",
+		"tunnel": "Этот порт занят прямым туннелем панели (см. Настройки).",
 		"port":   "Некорректный номер порта.",
 		"listen": "Не удалось занять порт на хосте (возможно, уже используется).",
 		"db":     "Ошибка базы данных.",
 	}[r.URL.Query().Get("err")]
 	s.render(w, "forwards.html", map[string]any{
-		"Agent": a,
-		"Rules": rules,
-		"CSRF":  csrfToken(r),
-		"Error": errMsg,
+		"Agent":      a,
+		"Rules":      rules,
+		"CSRF":       csrfToken(r),
+		"Error":      errMsg,
+		"TunnelPort": s.TunnelPort(),
+		"PanelPort":  panelPort(s.db.HostAddress()),
+		"UfwEnabled": s.ufw.enabled(),
 	})
 }
 
+// panelPort is the port of the panel URL agents dial, for the mode hints.
+func panelPort(host string) string {
+	u, err := url.Parse(host)
+	if err != nil {
+		return ""
+	}
+	if p := u.Port(); p != "" {
+		return p
+	}
+	if u.Scheme == "http" {
+		return "80"
+	}
+	return "443"
+}
+
 // POST /agents/{id}/forwards/add
 func (s *Server) handleForwardAdd(w http.ResponseWriter, r *http.Request) {
 	if !checkCSRF(r) {
@@ -57,12 +77,17 @@ func (s *Server) handleForwardAdd(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/agents/"+id+"/forwards?err=port", http.StatusSeeOther)
 		return
 	}
-	// Reject a host port already bound by another forward rule.
+	// Reject a host port already bound by another forward rule or the tunnel.
+	if hostPort == s.TunnelPort() {
+		http.Redirect(w, r, "/agents/"+id+"/forwards?err=tunnel", http.StatusSeeOther)
+		return
+	}
 	if s.db.HostPortUsed(hostPort) {
 		http.Redirect(w, r, "/agents/"+id+"/forwards?err=busy", http.StatusSeeOther)
 		return
 	}
-	rule := ForwardRule{AgentID: id, ClientPort: clientPort, HostPort: hostPort, ListenAddr: listenAddr, Proto: protoKind}
+	rule := ForwardRule{AgentID: id, ClientPort: clientPort, HostPort: hostPort, ListenAddr: listenAddr, Proto: protoKind,
+		NoUfw: r.FormValue("no_ufw") != "", Label: forwardLabel(r.FormValue("label"))}
 	ruleID, err := s.db.CreateForwardRule(rule)
 	if err != nil {
 		http.Redirect(w, r, "/agents/"+id+"/forwards?err=db", http.StatusSeeOther)
@@ -89,13 +114,31 @@ func (s *Server) handleForwardDelete(w http.ResponseWriter, r *http.Request) {
 	}
 	rid, _ := strconv.ParseInt(r.PathValue("rid"), 10, 64)
 	rule, _ := s.db.GetForwardRule(rid)
-	s.fwd.close(rid)
-	_ = s.db.DeleteForwardRule(rid)
-	// Remove the ufw rule bound to this forward rule (shared 8446 stays).
-	s.ufw.revokeForRule(rid)
+	s.removeForward(rid)
 	dest := "/"
 	if rule != nil {
 		dest = "/agents/" + rule.AgentID + "/forwards"
 	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }
+
+// removeForward closes a forward rule's listener and deletes the rule, along
+// with the ufw rule bound to it (the shared tunnel port stays while another
+// direct forward needs it).
+func (s *Server) removeForward(rid int64) {
+	s.fwd.close(rid)
+	_ = s.db.DeleteForwardRule(rid)
+	s.ufw.revokeForRule(rid)
+}
+
+// forwardLabelMax bounds a rule's label, in characters.
+const forwardLabelMax = 80
+
+// forwardLabel tidies the optional note of a rule: one line, bounded length.
+func forwardLabel(v string) string {
+	v = strings.Join(strings.Fields(v), " ")
+	if r := []rune(v); len(r) > forwardLabelMax {
+		v = string(r[:forwardLabelMax])
+	}
+	return v
+}

internal/server/handlers_panel_stat.go

@@ -0,0 +1,542 @@
+package server
+
+import (
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/x-grk/longpolling-remote-access/internal/proto"
+)
+
+const (
+	// statTaskTimeout bounds how long a status request waits for the agent.
+	statTaskTimeout = 8 * time.Second
+	// statCacheFor is how long one sample answers every open status page, so
+	// several tabs cost the agent a single reading.
+	statCacheFor = 2 * time.Second
+	// speedWindow is how long the agent is asked to measure each direction
+	// for. An agent that predates the argument keeps to its own 3 s.
+	speedWindow = 7 * time.Second
+	// speedTaskTimeout is how long a speed test may take. One that is not done
+	// by then is answered with what the server has counted itself.
+	speedTaskTimeout = 35 * time.Second
+	// speedDownCap bounds one download stream; speedDownFor ends it if the
+	// agent does not hang up first.
+	speedDownCap = 1 << 30
+	speedDownFor = 2 * speedWindow
+	speedUpCap   = 64 << 20
+	// speedRelayUpFor is how long the agent's upload is passed on to the
+	// browser: the agent's own window with slack.
+	speedRelayUpFor = speedWindow + time.Second
+)
+
+// statCache holds the last sample per agent and serializes its refresh.
+type statCache struct {
+	mu sync.Mutex
+	m  map[string]*statEntry
+}
+
+type statEntry struct {
+	mu  sync.Mutex
+	at  time.Time
+	res proto.TaskResult
+}
+
+func (c *statCache) entry(agentID string) *statEntry {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.m == nil {
+		c.m = map[string]*statEntry{}
+	}
+	e := c.m[agentID]
+	if e == nil {
+		e = &statEntry{}
+		c.m[agentID] = e
+	}
+	return e
+}
+
+func (c *statCache) drop(agentID string) {
+	c.mu.Lock()
+	delete(c.m, agentID)
+	c.mu.Unlock()
+}
+
+func (s *Server) handleStatusPage(w http.ResponseWriter, r *http.Request) {
+	a, err := s.db.GetAgent(r.PathValue("id"))
+	if err != nil || a == nil {
+		http.NotFound(w, r)
+		return
+	}
+	s.render(w, "status.html", map[string]any{"Agent": a, "RelayUpMs": speedRelayUpFor.Milliseconds()})
+}
+
+// runTask runs a one-shot task on the agent and waits for its result.
+func (s *Server) runTask(agentID, typ string, args []byte, timeout time.Duration) (proto.TaskResult, error) {
+	taskID, ch := s.hub.CreateTask(agentID, typ, args)
+	defer s.hub.DiscardTask(taskID)
+	t := time.NewTimer(timeout)
+	defer t.Stop()
+	select {
+	case res := <-ch:
+		return res, nil
+	case <-t.C:
+		return proto.TaskResult{}, errors.New("таймаут ожидания клиента")
+	}
+}
+
+// onlineAgent answers the request itself and returns false when the agent is
+// unknown or offline.
+func (s *Server) onlineAgent(w http.ResponseWriter, r *http.Request) (string, bool) {
+	id := r.PathValue("id")
+	a, err := s.db.GetAgent(id)
+	if err != nil || a == nil {
+		http.NotFound(w, r)
+		return "", false
+	}
+	if !s.online(a) {
+		writeJSON(w, proto.TaskResult{Error: "машина офлайн"})
+		return "", false
+	}
+	return id, true
+}
+
+// oldAgentError replaces the "unknown task" answer of an agent that predates
+// the task.
+func oldAgentError(res proto.TaskResult) proto.TaskResult {
+	if !res.OK && strings.Contains(res.Error, "неизвестная операция") {
+		res.Error = "клиент не поддерживает эту функцию - обновите его (нужен 0.0.5+)"
+	}
+	return res
+}
+
+// GET /api/panel/agents/{id}/stat - CPU, RAM and disk of the machine right now.
+func (s *Server) handleAgentStat(w http.ResponseWriter, r *http.Request) {
+	id, ok := s.onlineAgent(w, r)
+	if !ok {
+		return
+	}
+	e := s.stats.entry(id)
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if time.Since(e.at) > statCacheFor {
+		res, err := s.runTask(id, proto.TaskSysStat, nil, statTaskTimeout)
+		if err != nil {
+			// Cached too, so pages queued behind this one don't each wait it out.
+			res = proto.TaskResult{Error: err.Error()}
+		}
+		e.res, e.at = oldAgentError(res), time.Now()
+	}
+	writeJSON(w, e.res)
+}
+
+// POST /api/panel/agents/{id}/speed - have the agent measure its link to us.
+// With relay=1 its streams run through the relay opened for it, to and from
+// the browser.
+func (s *Server) handleAgentSpeed(w http.ResponseWriter, r *http.Request) {
+	id, ok := s.onlineAgent(w, r)
+	if !ok {
+		return
+	}
+	relay := r.URL.Query().Get("relay") != ""
+	m := s.meters.start(id)
+	defer s.meters.stop(id, m)
+	if relay {
+		rl := s.relays.get(id)
+		if rl == nil {
+			writeJSON(w, proto.TaskResult{Error: "замер через браузер не открыт"})
+			return
+		}
+		defer s.relays.drop(id, rl)
+	}
+	args, _ := json.Marshal(proto.SysSpeedArgs{Relay: relay, WindowMs: int(speedWindow.Milliseconds())})
+	res, err := s.runTask(id, proto.TaskSysSpeed, args, speedTaskTimeout)
+	if err != nil {
+		part, ok := m.result()
+		if !ok {
+			writeJSON(w, proto.TaskResult{Error: err.Error()})
+			return
+		}
+		part.Relay = relay
+		data, _ := json.Marshal(part)
+		res = proto.TaskResult{OK: true, Data: data}
+	}
+	res = oldAgentError(res)
+	if relay && res.OK {
+		// An agent that predates the relay ignores the argument and measures
+		// its own link.
+		var d proto.SysSpeedResult
+		if json.Unmarshal(res.Data, &d) != nil || !d.Relay {
+			res = proto.TaskResult{Error: "клиент не умеет замер через браузер - обновите его (нужен 0.0.6+)"}
+		}
+	}
+	writeJSON(w, res)
+}
+
+// speedMeter counts what flows through the streams of one speed test as the
+// server sees it: for the live reading on the page, and for the result of a
+// test that ran out of time.
+type speedMeter struct {
+	mu     sync.Mutex
+	start  time.Time
+	phase  string // "ping", "down", "up"
+	pingAt time.Time
+	pingMs float64
+	down   speedCount
+	up     speedCount
+}
+
+// speedCount is the bytes of one direction and when they went through. The
+// first piece only starts the clock.
+type speedCount struct {
+	n, skip     int64
+	first, last time.Time
+}
+
+func (c *speedCount) add(n int) {
+	now := time.Now()
+	if c.first.IsZero() {
+		c.first, c.skip = now, int64(n)
+	}
+	c.n += int64(n)
+	c.last = now
+}
+
+func (c *speedCount) bps() float64 {
+	d := c.last.Sub(c.first).Seconds()
+	if d <= 0 {
+		return 0
+	}
+	return float64(c.n-c.skip) * 8 / d
+}
+
+// ping notes one of the agent's ping probes: they come one right after
+// another, so the gap between two is its round trip.
+func (m *speedMeter) ping() {
+	if m == nil {
+		return
+	}
+	m.mu.Lock()
+	now := time.Now()
+	if !m.pingAt.IsZero() {
+		if ms := float64(now.Sub(m.pingAt).Microseconds()) / 1000; m.pingMs == 0 || ms < m.pingMs {
+			m.pingMs = ms
+		}
+	}
+	m.pingAt = now
+	m.mu.Unlock()
+}
+
+func (m *speedMeter) add(up bool, n int) {
+	if m == nil || n <= 0 {
+		return
+	}
+	m.mu.Lock()
+	if up {
+		m.phase = "up"
+		m.up.add(n)
+	} else {
+		m.phase = "down"
+		m.down.add(n)
+	}
+	m.mu.Unlock()
+}
+
+// result is the test as counted so far; false with nothing measured yet.
+func (m *speedMeter) result() (proto.SysSpeedResult, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	res := proto.SysSpeedResult{PingMs: m.pingMs, DownBps: m.down.bps(), UpBps: m.up.bps(), Partial: true}
+	return res, res.DownBps > 0
+}
+
+// meterWriter counts what it passes on; a nil meter counts nothing.
+type meterWriter struct {
+	w  io.Writer
+	m  *speedMeter
+	up bool
+}
+
+func (c meterWriter) Write(p []byte) (int, error) {
+	n, err := c.w.Write(p)
+	c.m.add(c.up, n)
+	return n, err
+}
+
+// speedMeters holds the meter of each agent under test.
+type speedMeters struct {
+	mu sync.Mutex
+	m  map[string]*speedMeter
+}
+
+func (c *speedMeters) start(agentID string) *speedMeter {
+	m := &speedMeter{start: time.Now(), phase: "ping"}
+	c.mu.Lock()
+	if c.m == nil {
+		c.m = map[string]*speedMeter{}
+	}
+	c.m[agentID] = m
+	c.mu.Unlock()
+	return m
+}
+
+func (c *speedMeters) get(agentID string) *speedMeter {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.m[agentID]
+}
+
+// stop forgets the agent's meter if it is still m.
+func (c *speedMeters) stop(agentID string, m *speedMeter) {
+	c.mu.Lock()
+	if c.m[agentID] == m {
+		delete(c.m, agentID)
+	}
+	c.mu.Unlock()
+}
+
+// GET /api/panel/agents/{id}/speed/progress - the bytes counted so far in the
+// agent's running speed test, for the page to turn into a live rate. An empty
+// phase means no test is running.
+func (s *Server) handleSpeedProgress(w http.ResponseWriter, r *http.Request) {
+	var out struct {
+		Phase string `json:"phase"`
+		Down  int64  `json:"down"`
+		Up    int64  `json:"up"`
+		Ms    int64  `json:"ms"` // since the test began, by the server's clock
+	}
+	if m := s.meters.get(r.PathValue("id")); m != nil {
+		m.mu.Lock()
+		out.Phase, out.Down, out.Up = m.phase, m.down.n, m.up.n
+		out.Ms = time.Since(m.start).Milliseconds()
+		m.mu.Unlock()
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, out)
+}
+
+// speedBlock is one chunk of incompressible bytes, made once and sent over and
+// over, so a speed test costs the server no CPU beyond the copy.
+var speedBlock = sync.OnceValue(func() []byte {
+	b := make([]byte, 64<<10)
+	rand.Read(b)
+	return b
+})
+
+func speedStreamHeaders(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Cache-Control", "no-store")
+	// Keep a proxy in front from buffering or compressing the stream.
+	w.Header().Set("X-Accel-Buffering", "no")
+}
+
+// GET /api/agent/speed/down?bytes=N - stream N bytes (default: as much as fits
+// in the time window) for the agent to time. bytes=0 is the ping probe.
+func (s *Server) handleSpeedDown(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	m := s.meters.get(a.ID)
+	left := speedDownCap
+	if v := r.URL.Query().Get("bytes"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n >= 0 && n < left {
+			left = n
+		}
+	}
+	if left == 0 {
+		m.ping()
+	}
+	speedStreamHeaders(w)
+	block := speedBlock()
+	deadline := time.Now().Add(speedDownFor)
+	for left > 0 && time.Now().Before(deadline) && r.Context().Err() == nil {
+		chunk := block
+		if len(chunk) > left {
+			chunk = chunk[:left]
+		}
+		n, err := w.Write(chunk)
+		if err != nil {
+			return
+		}
+		m.add(false, n)
+		left -= n
+	}
+}
+
+// POST /api/agent/speed/up - swallow the agent's upload.
+func (s *Server) handleSpeedUp(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	sink := meterWriter{w: io.Discard, m: s.meters.get(a.ID), up: true}
+	_, _ = io.Copy(sink, http.MaxBytesReader(w, r.Body, speedUpCap))
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// speedRelay joins the agent's speed test streams to the browser's, so the
+// bytes travel browser - panel - client. Both pipes are unbuffered: a slow
+// reader holds its writer back, and the rate is that of the whole path.
+type speedRelay struct {
+	downR *io.PipeReader // browser -> agent
+	downW *io.PipeWriter
+	upR   *io.PipeReader // agent -> browser
+	upW   *io.PipeWriter
+}
+
+func (rl *speedRelay) close() {
+	rl.downR.CloseWithError(io.ErrClosedPipe)
+	rl.downW.CloseWithError(io.ErrClosedPipe)
+	rl.upR.CloseWithError(io.ErrClosedPipe)
+	rl.upW.CloseWithError(io.ErrClosedPipe)
+}
+
+// speedRelays holds the relay of each agent under test, one per agent.
+type speedRelays struct {
+	mu sync.Mutex
+	m  map[string]*speedRelay
+}
+
+// open starts a fresh relay for the agent, ending the one it had.
+func (c *speedRelays) open(agentID string) {
+	rl := &speedRelay{}
+	rl.downR, rl.downW = io.Pipe()
+	rl.upR, rl.upW = io.Pipe()
+	c.mu.Lock()
+	if c.m == nil {
+		c.m = map[string]*speedRelay{}
+	}
+	old := c.m[agentID]
+	c.m[agentID] = rl
+	c.mu.Unlock()
+	if old != nil {
+		old.close()
+	}
+}
+
+func (c *speedRelays) get(agentID string) *speedRelay {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.m[agentID]
+}
+
+// drop ends the agent's relay; with rl given, only if it is still that one.
+func (c *speedRelays) drop(agentID string, rl *speedRelay) {
+	c.mu.Lock()
+	cur := c.m[agentID]
+	if cur != nil && (rl == nil || rl == cur) {
+		delete(c.m, agentID)
+	} else {
+		cur = nil
+	}
+	c.mu.Unlock()
+	if cur != nil {
+		cur.close()
+	}
+}
+
+// GET /api/panel/ping - an empty answer for the browser to time.
+func (s *Server) handlePanelPing(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// POST /api/panel/agents/{id}/speed/relay - open the relay of a speed test
+// that runs through the browser. The test itself ends it.
+func (s *Server) handleSpeedRelayOpen(w http.ResponseWriter, r *http.Request) {
+	id, ok := s.onlineAgent(w, r)
+	if !ok {
+		return
+	}
+	s.relays.open(id)
+	writeJSON(w, proto.TaskResult{OK: true})
+}
+
+// POST /api/panel/agents/{id}/speed/down - a piece of the browser's upload,
+// passed on to the agent. 204 asks for the next piece, 200 says the agent has
+// stopped reading.
+func (s *Server) handleSpeedRelayFeed(w http.ResponseWriter, r *http.Request) {
+	body := http.MaxBytesReader(w, r.Body, speedUpCap)
+	rl := s.relays.get(r.PathValue("id"))
+	if rl != nil {
+		if _, err := io.Copy(rl.downW, body); err == nil {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+	}
+	// Take the rest of the piece before answering: an answer sent over an
+	// unread body makes Go drop the connection, which a proxy in front turns
+	// into a 502.
+	_, _ = io.Copy(io.Discard, body)
+	w.Header().Set("Cache-Control", "no-store")
+	_, _ = io.WriteString(w, "done")
+}
+
+// GET /api/panel/agents/{id}/speed/up - the agent's upload, for the browser to
+// time. Ends when the agent is done sending.
+func (s *Server) handleSpeedRelayDrain(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	rl := s.relays.get(id)
+	if rl == nil {
+		http.Error(w, "gone", http.StatusGone)
+		return
+	}
+	speedStreamHeaders(w)
+	_, _ = io.Copy(meterWriter{w: w, m: s.meters.get(id), up: true}, rl.upR)
+	// The browser may have left: don't let the agent keep sending to nobody.
+	rl.upR.CloseWithError(io.ErrClosedPipe)
+}
+
+// GET /api/agent/speed/relay/down - what the browser uploads, for the agent to
+// time.
+func (s *Server) handleSpeedRelayDown(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	rl := s.relays.get(a.ID)
+	if rl == nil {
+		http.NotFound(w, r)
+		return
+	}
+	speedStreamHeaders(w)
+	// The agent waits on the headers, the browser may not have sent a byte yet.
+	_ = http.NewResponseController(w).Flush()
+	_, _ = io.Copy(meterWriter{w: w, m: s.meters.get(a.ID)}, rl.downR)
+	// The agent hung up at the end of its window: stop the browser's upload.
+	rl.downR.CloseWithError(io.ErrClosedPipe)
+}
+
+// POST /api/agent/speed/relay/up - the agent's upload, passed on to the browser.
+func (s *Server) handleSpeedRelayUp(w http.ResponseWriter, r *http.Request) {
+	a := s.authenticateAgent(r)
+	if a == nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	rl := s.relays.get(a.ID)
+	if rl == nil {
+		http.NotFound(w, r)
+		return
+	}
+	body := http.MaxBytesReader(w, r.Body, speedUpCap)
+	// A proxy in front may hand over the whole upload at once: pass on only
+	// what the browser takes in the window, or the agent would wait for the
+	// rest to trickle through a slower link.
+	t := time.AfterFunc(speedRelayUpFor, func() { rl.upW.Close() })
+	_, _ = io.Copy(rl.upW, body)
+	t.Stop()
+	rl.upW.Close()
+	_, _ = io.Copy(io.Discard, body)
+	w.WriteHeader(http.StatusNoContent)
+}

internal/server/handlers_panel_term.go

@@ -12,7 +12,7 @@ import (
 // same transport the agent uses), so it works through any reverse proxy without
 // WebSocket upgrade support.
 
-// POST /api/panel/term/{agentID}/open — create a terminal session.
+// POST /api/panel/term/{agentID}/open - create a terminal session.
 func (s *Server) handlePanelOpen(w http.ResponseWriter, r *http.Request) {
 	agentID := r.PathValue("agentID")
 	agent, err := s.db.GetAgent(agentID)
@@ -21,14 +21,14 @@ func (s *Server) handlePanelOpen(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	sess := s.hub.CreateSession(agentID)
+	sess := s.hub.CreateSession(agentID, agent.LoginUser)
 	if admin := s.currentAdmin(r); admin != nil {
-		s.db.Audit(admin.ID, agentID, "open_terminal")
+		s.db.Audit(admin.ID, agentID, "open_terminal:"+agent.TerminalUser())
 	}
 	writeJSON(w, map[string]string{"session_id": sess.ID})
 }
 
-// GET /api/panel/term/{sid}/out — long-poll for PTY output.
+// GET /api/panel/term/{sid}/out - long-poll for PTY output.
 func (s *Server) handlePanelOut(w http.ResponseWriter, r *http.Request) {
 	sess := s.hub.Session(r.PathValue("sid"))
 	if sess == nil {
@@ -49,9 +49,12 @@ type panelInMsg struct {
 	D    string `json:"d,omitempty"`
 	Cols uint16 `json:"cols,omitempty"`
 	Rows uint16 `json:"rows,omitempty"`
+	// Seq numbers the messages of a session from 1; 0 from a page that
+	// predates it.
+	Seq uint64 `json:"seq,omitempty"`
 }
 
-// POST /api/panel/term/{sid}/in — send keystrokes/resize to the agent PTY.
+// POST /api/panel/term/{sid}/in - send keystrokes/resize to the agent PTY.
 func (s *Server) handlePanelIn(w http.ResponseWriter, r *http.Request) {
 	sess := s.hub.Session(r.PathValue("sid"))
 	if sess == nil {
@@ -63,6 +66,10 @@ func (s *Server) handlePanelIn(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad request", http.StatusBadRequest)
 		return
 	}
+	if m.Seq > 0 && !sess.TakeSeq(m.Seq) {
+		w.WriteHeader(http.StatusNoContent) // a repeat of one already taken
+		return
+	}
 	switch m.T {
 	case "i":
 		sess.PushIn(proto.InFrame{Type: proto.FrameStdin, Data: m.D})
@@ -72,7 +79,7 @@ func (s *Server) handlePanelIn(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
-// POST /api/panel/term/{sid}/close — tear the session down.
+// POST /api/panel/term/{sid}/close - tear the session down.
 func (s *Server) handlePanelClose(w http.ResponseWriter, r *http.Request) {
 	s.hub.CloseSession(r.PathValue("sid"))
 	w.WriteHeader(http.StatusNoContent)

internal/server/hub.go

@@ -22,6 +22,12 @@ type Hub struct {
 
 	sessions map[string]*Session
 	tasks    map[string]*taskEntry
+
+	// Presence: control polls held open right now per agent, and when each
+	// agent's last one ended. started is when this hub came up.
+	polls    map[string]int
+	lastPoll map[string]time.Time
+	started  time.Time
 }
 
 // taskEntry is a pending one-shot task awaiting the agent's result.
@@ -31,7 +37,7 @@ type taskEntry struct {
 }
 
 // Session is one live byte stream between the panel and an agent (a PTY terminal
-// or a raw TCP forward — the hub treats both identically).
+// or a raw TCP forward - the hub treats both identically).
 type Session struct {
 	ID      string
 	AgentID string
@@ -39,6 +45,7 @@ type Session struct {
 	mu       sync.Mutex
 	inBuf    []proto.InFrame
 	inSignal chan struct{} // size-1; pulsed when inBuf gains data
+	inSeq    uint64        // number of the last browser message taken
 
 	out chan proto.OutMessage // agent -> panel
 
@@ -52,6 +59,9 @@ func NewHub() *Hub {
 		ctrlWaiters: map[string]chan struct{}{},
 		sessions:    map[string]*Session{},
 		tasks:       map[string]*taskEntry{},
+		polls:       map[string]int{},
+		lastPoll:    map[string]time.Time{},
+		started:     time.Now(),
 	}
 }
 
@@ -82,10 +92,11 @@ func (h *Hub) newSession(agentID string) *Session {
 	return s
 }
 
-// CreateSession registers a terminal session and queues it for the agent.
-func (h *Hub) CreateSession(agentID string) *Session {
+// CreateSession registers a terminal session and queues it for the agent. user
+// is the OS user to run the shell as ("" = the agent's own user).
+func (h *Hub) CreateSession(agentID, user string) *Session {
 	s := h.newSession(agentID)
-	h.enqueueJob(agentID, proto.ControlMessage{Type: proto.CtrlOpenTerminal, SessionID: s.ID})
+	h.enqueueJob(agentID, proto.ControlMessage{Type: proto.CtrlOpenTerminal, SessionID: s.ID, User: user})
 	return s
 }
 
@@ -96,9 +107,56 @@ func (h *Hub) CreateForward(agentID string, port int) *Session {
 	return s
 }
 
-// WaitControl blocks until a job is queued for agentID or timeout elapses.
-func (h *Hub) WaitControl(agentID string, timeout time.Duration) proto.ControlMessage {
-	deadline := time.After(timeout)
+// pollGrace is how long an agent stays online between two control polls: it
+// re-polls at once, so this only has to cover a slow round trip or one retry.
+const pollGrace = 10 * time.Second
+
+// Online reports whether the agent is connected: it holds a control poll open
+// or has just finished one. ok is false while that cannot be told yet (right
+// after a start, before agents had time to come back).
+func (h *Hub) Online(agentID string) (online, ok bool) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.polls[agentID] > 0 {
+		return true, true
+	}
+	if t, seen := h.lastPoll[agentID]; seen {
+		return time.Since(t) < pollGrace, true
+	}
+	return false, time.Since(h.started) > pollHold+pollGrace
+}
+
+// Forget drops what the hub keeps about a deleted agent.
+func (h *Hub) Forget(agentID string) {
+	h.mu.Lock()
+	delete(h.jobs, agentID)
+	delete(h.ctrlWaiters, agentID)
+	delete(h.lastPoll, agentID)
+	h.mu.Unlock()
+}
+
+// WaitControl blocks until a job is queued for agentID, the timeout elapses
+// or the agent hangs up (done). The agent counts as online meanwhile.
+func (h *Hub) WaitControl(done <-chan struct{}, agentID string, timeout time.Duration) proto.ControlMessage {
+	h.mu.Lock()
+	h.polls[agentID]++
+	h.mu.Unlock()
+	defer func() {
+		h.mu.Lock()
+		if h.polls[agentID]--; h.polls[agentID] <= 0 {
+			delete(h.polls, agentID)
+		}
+		// A poll cut off by the agent is not a sign of life.
+		select {
+		case <-done:
+		default:
+			h.lastPoll[agentID] = time.Now()
+		}
+		h.mu.Unlock()
+	}()
+	t := time.NewTimer(timeout)
+	defer t.Stop()
+	deadline := t.C
 	for {
 		h.mu.Lock()
 		if q := h.jobs[agentID]; len(q) > 0 {
@@ -118,6 +176,9 @@ func (h *Hub) WaitControl(agentID string, timeout time.Duration) proto.ControlMe
 		case <-w:
 		case <-deadline:
 			return proto.ControlMessage{Type: proto.CtrlIdle}
+		case <-done:
+			// The job, if one comes, stays queued for the next poll.
+			return proto.ControlMessage{Type: proto.CtrlIdle}
 		}
 	}
 }
@@ -190,6 +251,19 @@ func (s *Session) close() { s.closeOnce.Do(func() { close(s.closed) }) }
 // Done returns a channel closed when the session ends.
 func (s *Session) Done() <-chan struct{} { return s.closed }
 
+// TakeSeq reports whether the browser message numbered seq is new, and takes
+// note of it. The browser sends them one at a time in rising order and sends
+// one again when it got no answer, so a number not above the last is a repeat.
+func (s *Session) TakeSeq(seq uint64) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if seq <= s.inSeq {
+		return false
+	}
+	s.inSeq = seq
+	return true
+}
+
 // PushIn appends a downstream frame (panel -> agent) and wakes the agent poll.
 func (s *Session) PushIn(f proto.InFrame) {
 	s.mu.Lock()
@@ -245,7 +319,14 @@ func (s *Session) PollOut(timeout time.Duration) ([]proto.OutMessage, bool) {
 	case <-time.After(timeout):
 		return nil, true
 	case <-s.closed:
-		return nil, false
+		// Hand over output queued before the close (e.g. the reason a shell
+		// failed to start) instead of dropping it.
+		select {
+		case m := <-s.out:
+			batch = append(batch, m)
+		default:
+			return nil, false
+		}
 	}
 	for {
 		select {

internal/server/server.go

@@ -1,7 +1,9 @@
 package server
 
 import (
+	"crypto/sha256"
 	"embed"
+	"encoding/hex"
 	"html/template"
 	"io/fs"
 	"log"
@@ -9,6 +11,8 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"sync"
+	"sync/atomic"
 	texttemplate "text/template"
 )
 
@@ -24,7 +28,8 @@ type Options struct {
 	// nginx TLS); set false only for plain-HTTP local testing.
 	SecureCookies bool
 	// TunnelAddr is the listen address for the direct TCP+UDP forward tunnel
-	// (default ":8446"). Empty disables direct forwarding.
+	// Empty disables direct forwarding. The port can be overridden from the
+	// settings page.
 	TunnelAddr string
 }
 
@@ -33,12 +38,27 @@ type Server struct {
 	db            *DB
 	hub           *Hub
 	fwd           *forwardManager
+	tun           *tunnelHub
+	udp           *udpRelay
 	ufw           *ufwManager
 	tmpl          *template.Template
 	limiter       *loginLimiter
 	distDir       string
 	secureCookies bool
 	installTmpl   *texttemplate.Template
+
+	// Direct tunnel: bind host and port of the -tunnel address, and the port
+	// currently listened on (the settings override, else the default).
+	// tunnelDefault 0 means the tunnel is disabled.
+	tunnelBind    string
+	tunnelDefault int
+	tunnelMu      sync.Mutex // serializes port changes
+	tunnelPort    atomic.Int64
+
+	stats  statCache   // last load sample per agent, for the status page
+	relays speedRelays // speed tests that run through the browser
+	meters speedMeters // byte counts of the speed tests under way
+	xfers  xfers       // files on their way between a browser and an agent
 }
 
 // New builds the server, parsing embedded templates.
@@ -65,26 +85,81 @@ func New(opts Options) (*Server, error) {
 		db:            opts.DB,
 		hub:           hub,
 		fwd:           newForwardManager(hub, tun, udp),
-		ufw:           newUfwManager(opts.DB, portFromAddr(opts.TunnelAddr)),
+		tun:           tun,
+		udp:           udp,
 		tmpl:          tmpl,
 		limiter:       newLoginLimiter(),
 		distDir:       opts.DistDir,
 		secureCookies: opts.SecureCookies,
 		installTmpl:   installTmpl,
 	}
-	// Start the direct forward tunnel (TCP mux + UDP) on 8446.
+	s.ufw = newUfwManager(opts.DB, s.TunnelPort)
+	// Start the direct forward tunnel (TCP mux + UDP), on the port from the
+	// settings page if one is set there.
 	if opts.TunnelAddr != "" {
-		if err := tun.listen(opts.TunnelAddr); err != nil {
-			log.Printf("tunnel tcp listen %s: %v", opts.TunnelAddr, err)
+		s.tunnelBind, s.tunnelDefault = splitAddr(opts.TunnelAddr)
+	}
+	if s.tunnelDefault > 0 {
+		port := s.tunnelDefault
+		if p := s.db.TunnelPort(); p > 0 {
+			port = p
 		}
-		if err := udp.listen(opts.TunnelAddr); err != nil {
-			log.Printf("tunnel udp listen %s: %v", opts.TunnelAddr, err)
+		s.tunnelPort.Store(int64(port))
+		addr := s.tunnelListenAddr(port)
+		if err := tun.listen(addr); err != nil {
+			log.Printf("tunnel tcp listen %s: %v", addr, err)
+		}
+		if err := udp.listen(addr); err != nil {
+			log.Printf("tunnel udp listen %s: %v", addr, err)
 		}
 	}
 	s.restoreForwards()
+	go s.ufw.sync()
 	return s, nil
 }
 
+// TunnelPort is the port the direct tunnel listens on (0 = disabled).
+func (s *Server) TunnelPort() int { return int(s.tunnelPort.Load()) }
+
+func (s *Server) tunnelListenAddr(port int) string {
+	return net.JoinHostPort(s.tunnelBind, strconv.Itoa(port))
+}
+
+// tunnelAdvert is the tunnel address handed to agents as "host:port". The host
+// is empty unless one is set in Settings; agents then use the panel's host.
+func (s *Server) tunnelAdvert() string {
+	port := s.TunnelPort()
+	if port == 0 {
+		return ""
+	}
+	return net.JoinHostPort(s.db.TunnelHost(), strconv.Itoa(port))
+}
+
+// setTunnelPort moves the direct tunnel to another port. Connected agents are
+// dropped and redial the new port once their next poll tells them about it.
+func (s *Server) setTunnelPort(port int) error {
+	s.tunnelMu.Lock()
+	defer s.tunnelMu.Unlock()
+	old := s.TunnelPort()
+	if old == 0 || port == old {
+		return nil
+	}
+	addr := s.tunnelListenAddr(port)
+	if err := s.tun.listen(addr); err != nil {
+		return err
+	}
+	if err := s.udp.listen(addr); err != nil {
+		// Keep TCP and UDP on the same port: go back to the old one.
+		if rerr := s.tun.listen(s.tunnelListenAddr(old)); rerr != nil {
+			log.Printf("tunnel tcp listen %s: %v", s.tunnelListenAddr(old), rerr)
+		}
+		return err
+	}
+	s.tunnelPort.Store(int64(port))
+	go s.ufw.sync()
+	return nil
+}
+
 // restoreForwards re-opens the host listeners for all saved forward rules.
 func (s *Server) restoreForwards() {
 	rules, err := s.db.ListForwardRules()
@@ -93,6 +168,12 @@ func (s *Server) restoreForwards() {
 		return
 	}
 	for _, r := range rules {
+		// Rules of an agent deleted by an older version: drop them.
+		if a, err := s.db.GetAgent(r.AgentID); err == nil && a == nil {
+			log.Printf("forward rule %d: agent %s is gone, removing", r.ID, r.AgentID)
+			s.removeForward(r.ID)
+			continue
+		}
 		if err := s.fwd.open(r); err != nil {
 			log.Printf("restore forward rule %d (%s:%d): %v", r.ID, r.ListenAddr, r.HostPort, err)
 		}
@@ -105,7 +186,7 @@ func (s *Server) Handler() http.Handler {
 
 	// Static assets (xterm.js etc.) from the embedded FS.
 	staticFS, _ := fs.Sub(webFS, "web/static")
-	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))
+	mux.Handle("GET /static/", http.StripPrefix("/static/", staticHandler(staticFS)))
 
 	// Public: install script + agent binary downloads.
 	mux.HandleFunc("GET /install.sh", s.handleInstallScript)
@@ -126,16 +207,21 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /agents/{id}/terminal", s.requireAdmin(s.handleTerminalPage))
 	mux.Handle("GET /agents/{id}/files", s.requireAdmin(s.handleFilesPage))
 	mux.Handle("GET /agents/{id}/forwards", s.requireAdmin(s.handleForwardsPage))
+	mux.Handle("GET /agents/{id}/status", s.requireAdmin(s.handleStatusPage))
 	mux.Handle("GET /agents/{id}/edit", s.requireAdmin(s.handleAgentEdit))
 	mux.Handle("POST /agents/{id}/rename", s.requireAdmin(s.handleAgentRename))
 	mux.Handle("POST /agents/{id}/update", s.requireAdmin(s.handleAgentUpdate))
+	mux.Handle("POST /agents/{id}/user", s.requireAdmin(s.handleAgentSetUser))
+	mux.Handle("POST /agents/{id}/users/add", s.requireAdmin(s.handleAgentAddUser))
 	mux.Handle("POST /agents/{id}/delete", s.requireAdmin(s.handleAgentDelete))
 	mux.Handle("GET /settings", s.requireAdmin(s.handleSettings))
 	mux.Handle("POST /settings/host", s.requireAdmin(s.handleSetHost))
+	mux.Handle("POST /settings/tunnel", s.requireAdmin(s.handleSetTunnel))
 	mux.Handle("POST /settings/secret/rotate", s.requireAdmin(s.handleRotateSecret))
 	mux.Handle("POST /settings/admins/add", s.requireAdmin(s.handleAddAdmin))
 	mux.Handle("POST /settings/admins/delete", s.requireAdmin(s.handleDeleteAdmin))
 	mux.Handle("POST /settings/ufw/toggle", s.requireAdmin(s.handleUfwToggle))
+	mux.Handle("POST /settings/ufw/add", s.requireAdmin(s.handleUfwAdd))
 	mux.Handle("POST /settings/ufw/revoke", s.requireAdmin(s.handleUfwRevoke))
 
 	// Panel terminal over HTTP long-polling (admin-only).
@@ -146,8 +232,22 @@ func (s *Server) Handler() http.Handler {
 
 	// Panel file manager (admin-only).
 	mux.Handle("GET /api/panel/agents/{id}/fs/download", s.requireAdmin(s.handleFSDownload))
+	mux.Handle("POST /api/panel/agents/{id}/fs/upload", s.requireAdmin(s.handleFSUploadStart))
+	mux.Handle("PUT /api/panel/fs/xfer/{xid}/{i}", s.requireAdmin(s.handleXferPut))
+	mux.Handle("POST /api/panel/fs/xfer/{xid}/cancel", s.requireAdmin(s.handleXferCancel))
+	mux.Handle("GET /api/panel/fs/xfer/{xid}/result", s.requireAdmin(s.handleXferResult))
 	mux.Handle("POST /api/panel/agents/{id}/fs/{op}", s.requireAdmin(s.handleFSOp))
 
+	// Machine status (admin).
+	mux.Handle("GET /api/panel/agents/presence", s.requireAdmin(s.handlePresence))
+	mux.Handle("GET /api/panel/agents/{id}/stat", s.requireAdmin(s.handleAgentStat))
+	mux.Handle("POST /api/panel/agents/{id}/speed", s.requireAdmin(s.handleAgentSpeed))
+	mux.Handle("GET /api/panel/agents/{id}/speed/progress", s.requireAdmin(s.handleSpeedProgress))
+	mux.Handle("GET /api/panel/ping", s.requireAdmin(s.handlePanelPing))
+	mux.Handle("POST /api/panel/agents/{id}/speed/relay", s.requireAdmin(s.handleSpeedRelayOpen))
+	mux.Handle("POST /api/panel/agents/{id}/speed/down", s.requireAdmin(s.handleSpeedRelayFeed))
+	mux.Handle("GET /api/panel/agents/{id}/speed/up", s.requireAdmin(s.handleSpeedRelayDrain))
+
 	// Panel port forwarding (admin-only).
 	mux.Handle("POST /agents/{id}/forwards/add", s.requireAdmin(s.handleForwardAdd))
 	mux.Handle("POST /forwards/{rid}/delete", s.requireAdmin(s.handleForwardDelete))
@@ -155,10 +255,17 @@ func (s *Server) Handler() http.Handler {
 	// Agent API (token/secret auth inside handlers).
 	mux.HandleFunc("POST /api/agent/enroll", s.handleEnroll)
 	mux.HandleFunc("GET /api/agent/poll", s.handlePoll)
+	mux.HandleFunc("GET /api/agent/config", s.handleAgentConfig)
 	mux.HandleFunc("GET /api/agent/term/{sid}/in", s.handleTermIn)
 	mux.HandleFunc("POST /api/agent/term/{sid}/out", s.handleTermOut)
 	mux.HandleFunc("GET /api/agent/task/{id}", s.handleTaskFetch)
 	mux.HandleFunc("POST /api/agent/task/{id}/result", s.handleTaskResult)
+	mux.HandleFunc("GET /api/agent/speed/down", s.handleSpeedDown)
+	mux.HandleFunc("POST /api/agent/speed/up", s.handleSpeedUp)
+	mux.HandleFunc("GET /api/agent/speed/relay/down", s.handleSpeedRelayDown)
+	mux.HandleFunc("POST /api/agent/speed/relay/up", s.handleSpeedRelayUp)
+	mux.HandleFunc("GET /api/agent/fs/xfer/{xid}/{i}", s.handleAgentXferGet)
+	mux.HandleFunc("POST /api/agent/fs/xfer/{xid}/{i}", s.handleAgentXferPost)
 
 	return s.logRequests(mux)
 }
@@ -200,17 +307,15 @@ func (s *Server) render(w http.ResponseWriter, name string, data map[string]any)
 	}
 }
 
-// portFromAddr extracts the numeric port from a "host:port" or ":port" address.
-func portFromAddr(addr string) int {
-	if addr == "" {
-		return 0
-	}
-	_, p, err := net.SplitHostPort(addr)
+// splitAddr splits a "host:port" or ":port" listen address. The port is 0 when
+// the address has none.
+func splitAddr(addr string) (host string, port int) {
+	h, p, err := net.SplitHostPort(addr)
 	if err != nil {
-		return 0
+		return "", 0
 	}
 	n, _ := strconv.Atoi(p)
-	return n
+	return h, n
 }
 
 func clientIP(r *http.Request) string {
@@ -230,3 +335,33 @@ func clientIP(r *http.Request) string {
 	}
 	return host
 }
+
+// staticHandler serves the embedded assets with a content hash as ETag. The
+// browser asks each time whether a file changed (no-cache) and gets a 304
+// when it did not, so a new release reaches it at once without reloading
+// what stayed the same.
+func staticHandler(fsys fs.FS) http.Handler {
+	files := http.FileServer(http.FS(fsys))
+	var mu sync.Mutex
+	etags := map[string]string{}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := strings.TrimPrefix(r.URL.Path, "/")
+		mu.Lock()
+		tag, ok := etags[name]
+		mu.Unlock()
+		if !ok {
+			if data, err := fs.ReadFile(fsys, name); err == nil {
+				sum := sha256.Sum256(data)
+				tag = `"` + hex.EncodeToString(sum[:8]) + `"`
+			}
+			mu.Lock()
+			etags[name] = tag
+			mu.Unlock()
+		}
+		if tag != "" {
+			w.Header().Set("ETag", tag)
+		}
+		w.Header().Set("Cache-Control", "no-cache")
+		files.ServeHTTP(w, r)
+	})
+}

internal/server/tunnelserver.go

@@ -39,6 +39,7 @@ func readLine(r io.Reader, max int) (string, error) {
 type tunnelHub struct {
 	db     *DB
 	mu     sync.Mutex
+	ln     net.Listener
 	agents map[string]*agentTunnel
 }
 
@@ -57,12 +58,30 @@ type agentTunnel struct {
 	streams map[uint32]net.Conn
 }
 
-// listen runs the 8446 TCP tunnel acceptor until the listener closes.
+// listen runs the TCP tunnel acceptor until the listener closes. Listening
+// again moves the tunnel: the previous listener is closed and its agents are
+// dropped, so they redial the new address.
 func (h *tunnelHub) listen(addr string) error {
 	ln, err := net.Listen("tcp", addr)
 	if err != nil {
 		return err
 	}
+	h.mu.Lock()
+	old := h.ln
+	h.ln = ln
+	var stale []*agentTunnel
+	if old != nil {
+		for _, at := range h.agents {
+			stale = append(stale, at)
+		}
+	}
+	h.mu.Unlock()
+	if old != nil {
+		old.Close()
+	}
+	for _, at := range stale {
+		at.conn.Close()
+	}
 	log.Printf("tunnel: listening on %s (direct TCP forwarding)", addr)
 	go func() {
 		for {

internal/server/udp.go

@@ -11,18 +11,19 @@ import (
 	"github.com/x-grk/longpolling-remote-access/internal/tunnel"
 )
 
-// udpRelay carries UDP forwards over the direct 8446 UDP channel. The agent
+// udpRelay carries UDP forwards over the direct UDP channel. The agent
 // registers its UDP return address; end-user datagrams arriving on a rule's
 // host port are relayed to the agent and replies are sent back.
 //
-// Datagram framing on the 8446 control socket:
+// Datagram framing on the tunnel control socket:
 //
 //	registration (agent->server): "R <agentID> <sig>"
 //	data         (both):          'D' | sid(4) | port(2) | payload
 type udpRelay struct {
-	db   *DB
-	mu   sync.Mutex
-	ctrl *net.UDPConn
+	db     *DB
+	mu     sync.Mutex
+	ctrl   *net.UDPConn
+	gcOnce sync.Once
 
 	agentAddr map[string]*net.UDPAddr // agentID -> last registered addr
 	sessions  map[uint32]*udpSession
@@ -48,7 +49,8 @@ func newUDPRelay(db *DB) *udpRelay {
 	}
 }
 
-// listen opens the shared 8446 UDP control socket.
+// listen opens the shared UDP control socket. Listening again moves it: the
+// previous socket is closed and agents register anew on the new address.
 func (u *udpRelay) listen(addr string) error {
 	ua, err := net.ResolveUDPAddr("udp", addr)
 	if err != nil {
@@ -58,17 +60,26 @@ func (u *udpRelay) listen(addr string) error {
 	if err != nil {
 		return err
 	}
+	u.mu.Lock()
+	old := u.ctrl
 	u.ctrl = c
+	if old != nil {
+		u.agentAddr = map[string]*net.UDPAddr{}
+	}
+	u.mu.Unlock()
+	if old != nil {
+		old.Close()
+	}
 	log.Printf("tunnel: listening on %s/udp (direct UDP forwarding)", addr)
-	go u.ctrlLoop()
-	go u.gc()
+	go u.ctrlLoop(c)
+	u.gcOnce.Do(func() { go u.gc() })
 	return nil
 }
 
-func (u *udpRelay) ctrlLoop() {
+func (u *udpRelay) ctrlLoop(ctrl *net.UDPConn) {
 	buf := make([]byte, 65535)
 	for {
-		n, src, err := u.ctrl.ReadFromUDP(buf)
+		n, src, err := ctrl.ReadFromUDP(buf)
 		if err != nil {
 			return
 		}
@@ -171,6 +182,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		}
 		u.mu.Lock()
 		aAddr := u.agentAddr[rule.AgentID]
+		ctrl := u.ctrl
 		// Find existing session for this (rule, user).
 		var sess *udpSession
 		for _, s := range u.sessions {
@@ -190,7 +202,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		sess.last = time.Now()
 		u.mu.Unlock()
 
-		if aAddr == nil {
+		if aAddr == nil || ctrl == nil {
 			continue // agent has not registered its UDP endpoint yet
 		}
 		// 'D' | sid(4) | clientPort(2) | payload
@@ -199,7 +211,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		binary.BigEndian.PutUint32(out[1:5], sess.id)
 		binary.BigEndian.PutUint16(out[5:7], uint16(rule.ClientPort))
 		copy(out[7:], buf[:n])
-		_, _ = u.ctrl.WriteToUDP(out, aAddr)
+		_, _ = ctrl.WriteToUDP(out, aAddr)
 	}
 }
 

internal/server/ufw.go

@@ -3,8 +3,11 @@ package server
 import (
 	"fmt"
 	"log"
+	"net"
+	"os"
 	"os/exec"
 	"strings"
+	"sync"
 )
 
 // ufwManager integrates with the host firewall (ufw) when it is installed and
@@ -14,31 +17,53 @@ import (
 // ufw requires root, so this only works when the server process can run ufw
 // (e.g. running as root). When it cannot, integration is simply inactive.
 type ufwManager struct {
-	db         *DB
-	tunnelPort int
+	db *DB
+	// tunnelPort returns the current direct-tunnel port (0 = tunnel disabled).
+	tunnelPort func() int
+
+	mu      sync.Mutex
+	lastErr string // last failed ufw command, shown in Settings
 }
 
-func newUfwManager(db *DB, tunnelPort int) *ufwManager {
+func newUfwManager(db *DB, tunnelPort func() int) *ufwManager {
 	return &ufwManager{db: db, tunnelPort: tunnelPort}
 }
 
+// ufwRun runs ufw with a fixed C locale: its output is translated, and we
+// match on the English text.
+func ufwRun(args ...string) (string, error) {
+	cmd := exec.Command("ufw", args...)
+	cmd.Env = append(os.Environ(), "LC_ALL=C", "LANG=C", "LANGUAGE=C")
+	out, err := cmd.CombinedOutput()
+	return strings.TrimSpace(string(out)), err
+}
+
 // status reports whether ufw is installed, active, and runnable by this process.
 func (u *ufwManager) status() (installed, active, runnable bool) {
-	path, err := exec.LookPath("ufw")
-	if err != nil {
+	if _, err := exec.LookPath("ufw"); err != nil {
 		return false, false, false
 	}
 	installed = true
-	out, err := exec.Command(path, "status").CombinedOutput()
+	out, err := ufwRun("status")
 	if err != nil {
 		// Typically a permission error (not root) -> not runnable.
 		return true, false, false
 	}
 	runnable = true
-	active = strings.Contains(string(out), "Status: active")
+	active = strings.Contains(out, "Status: active")
 	return installed, active, runnable
 }
 
+// enabled reports whether the integration is switched on and ufw is there to
+// drive. Unlike available it runs nothing, so pages can ask it freely.
+func (u *ufwManager) enabled() bool {
+	if !u.db.UfwEnabled() {
+		return false
+	}
+	_, err := exec.LookPath("ufw")
+	return err == nil
+}
+
 // available reports whether we can and should drive ufw now.
 func (u *ufwManager) available() bool {
 	if !u.db.UfwEnabled() {
@@ -48,30 +73,70 @@ func (u *ufwManager) available() bool {
 	return installed && active && runnable
 }
 
-// allow opens port/proto in ufw (if integration is available) and records it,
-// bound to the given forward rule id (0 = shared/manual).
-func (u *ufwManager) allow(port int, proto string, ruleID int64) {
-	if !u.available() {
-		return
-	}
+func (u *ufwManager) setErr(msg string) {
+	u.mu.Lock()
+	u.lastErr = msg
+	u.mu.Unlock()
+}
+
+// LastError returns the last failed ufw command ("" when the last one worked).
+func (u *ufwManager) LastError() string {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.lastErr
+}
+
+// allow opens port/proto in ufw and records it, bound to the given forward
+// rule id (0 = shared, ufwManual = added in Settings). It reports whether the
+// panel now tracks the rule. The caller has checked available().
+func (u *ufwManager) allow(port int, proto string, ruleID int64) bool {
 	if u.db.HasUfwRule(port, proto) {
-		return
+		return true
 	}
 	spec := fmt.Sprintf("%d/%s", port, proto)
-	if out, err := exec.Command("ufw", "allow", spec).CombinedOutput(); err != nil {
-		log.Printf("ufw allow %s: %v: %s", spec, err, strings.TrimSpace(string(out)))
-		return
+	out, err := ufwRun("allow", spec)
+	if err != nil {
+		log.Printf("ufw allow %s: %v: %s", spec, err, out)
+		u.setErr(fmt.Sprintf("ufw allow %s: %v: %s", spec, err, out))
+		return false
+	}
+	u.setErr("")
+	if strings.Contains(out, "Skipping") {
+		// The rule was there before the panel asked for it, so it is not ours
+		// to track (and later delete).
+		return false
 	}
 	_ = u.db.AddUfwRule(port, proto, ruleID)
 	log.Printf("ufw: allowed %s", spec)
+	return true
+}
+
+// allowManual opens a port the admin asked for in Settings. A port the panel
+// already opened for a forward or the tunnel becomes the admin's, so it stays
+// when they no longer need it. It returns the error key for the settings page
+// ("" on success).
+func (u *ufwManager) allowManual(port int, proto string) string {
+	if !u.available() {
+		return "ufw_off"
+	}
+	if !u.allow(port, proto, ufwManual) {
+		if u.LastError() != "" {
+			return "ufw_failed"
+		}
+		return "ufw_exists"
+	}
+	_ = u.db.SetUfwRuleManual(port, proto)
+	return ""
 }
 
 // revokeRule deletes one tracked ufw rule from ufw and the tracking table.
 func (u *ufwManager) revokeRule(r UfwRule) {
 	spec := fmt.Sprintf("%d/%s", r.Port, r.Proto)
-	if out, err := exec.Command("ufw", "delete", "allow", spec).CombinedOutput(); err != nil {
-		log.Printf("ufw delete allow %s: %v: %s", spec, err, strings.TrimSpace(string(out)))
+	if out, err := ufwRun("delete", "allow", spec); err != nil {
+		log.Printf("ufw delete allow %s: %v: %s", spec, err, out)
+		u.setErr(fmt.Sprintf("ufw delete allow %s: %v: %s", spec, err, out))
 	} else {
+		u.setErr("")
 		log.Printf("ufw: revoked %s", spec)
 	}
 	_ = u.db.DeleteUfwRule(r.ID)
@@ -86,8 +151,8 @@ func (u *ufwManager) revoke(id int64) {
 	u.revokeRule(*r)
 }
 
-// revokeForRule removes the ufw rules bound to a specific forward rule. The
-// shared tunnel port (rule_id 0) is left alone, since other forwards use it.
+// revokeForRule removes the ufw rules bound to a specific forward rule, and
+// the shared tunnel port once no forward needs it any more.
 func (u *ufwManager) revokeForRule(ruleID int64) {
 	rules, err := u.db.ListUfwRulesByRule(ruleID)
 	if err != nil {
@@ -96,24 +161,77 @@ func (u *ufwManager) revokeForRule(ruleID int64) {
 	for _, r := range rules {
 		u.revokeRule(r)
 	}
+	u.pruneShared()
+}
+
+// pruneShared revokes shared (rule_id 0) ufw rules that nothing uses: anything
+// but the current tunnel port, and the tunnel port itself for a protocol that
+// has no direct forward left.
+func (u *ufwManager) pruneShared() {
+	shared, err := u.db.ListUfwRulesByRule(0)
+	if err != nil || len(shared) == 0 {
+		return
+	}
+	forwards, err := u.db.ListForwardRules()
+	if err != nil {
+		return
+	}
+	used := map[string]bool{}
+	for _, f := range forwards {
+		if !f.NoUfw {
+			used[f.Proto] = true
+		}
+	}
+	port := u.tunnelPort()
+	for _, r := range shared {
+		if r.Port != port || !used[r.Proto] {
+			u.revokeRule(r)
+		}
+	}
 }
 
 // allowForward opens the host ports a forward rule needs: its host port (bound
-// to the rule so it is revoked with it) plus the shared 8446 tunnel port for
-// direct tcp/udp modes (bound to 0 — shared across rules).
+// to the rule so it is revoked with it) plus the shared tunnel port for direct
+// tcp/udp modes (bound to 0 - shared across rules). A rule made "without ufw"
+// opens nothing, so nothing is revoked with it either.
 func (u *ufwManager) allowForward(rule ForwardRule) {
-	switch rule.Proto {
-	case "udp":
-		u.allow(rule.HostPort, "udp", rule.ID)
-		if u.tunnelPort > 0 {
-			u.allow(u.tunnelPort, "udp", 0)
-		}
-	case "tcp":
-		u.allow(rule.HostPort, "tcp", rule.ID)
-		if u.tunnelPort > 0 {
-			u.allow(u.tunnelPort, "tcp", 0)
-		}
-	default: // http long-poll listener is TCP
-		u.allow(rule.HostPort, "tcp", rule.ID)
+	if !u.available() {
+		return
+	}
+	u.allowForwardPorts(rule)
+}
+
+func (u *ufwManager) allowForwardPorts(rule ForwardRule) {
+	if rule.NoUfw {
+		return
+	}
+	// "http" (long-poll) and "tcp" forwards both listen on TCP on the host.
+	hostProto, direct := "tcp", rule.Proto == "tcp"
+	if rule.Proto == "udp" {
+		hostProto, direct = "udp", true
+	}
+	// A listener bound to loopback is not reachable from outside anyway.
+	if ip := net.ParseIP(rule.ListenAddr); ip == nil || !ip.IsLoopback() {
+		u.allow(rule.HostPort, hostProto, rule.ID)
+	}
+	if port := u.tunnelPort(); direct && port > 0 {
+		u.allow(port, hostProto, 0)
 	}
 }
+
+// sync brings ufw in line with the saved forward rules: it opens what is
+// missing (rules made while ufw or the integration was off, or a tunnel port
+// that has since changed) and drops shared rules nothing uses.
+func (u *ufwManager) sync() {
+	if !u.available() {
+		return
+	}
+	forwards, err := u.db.ListForwardRules()
+	if err != nil {
+		return
+	}
+	for _, f := range forwards {
+		u.allowForwardPorts(f)
+	}
+	u.pruneShared()
+}

internal/server/web/static/app.css

@@ -10,6 +10,8 @@
   --ok: #37c871;
 }
 * { box-sizing: border-box; }
+/* The hidden attribute wins over any display set by a class. */
+[hidden] { display: none !important; }
 body {
   margin: 0;
   background: var(--bg);
@@ -34,10 +36,24 @@ header.topbar nav a:hover { color: var(--text); }
 h1 { font-size: 22px; margin: 0 0 18px; }
 h2 { font-size: 17px; margin: 0 0 14px; }
 label { display: block; margin: 12px 0 4px; color: var(--muted); font-size: 13px; }
-input[type=text], input[type=password] {
+input[type=text], input[type=password], input[type=number] {
   width: 100%; padding: 10px 12px; border-radius: 8px;
   border: 1px solid var(--border); background: #0c0f13; color: var(--text); font-size: 14px;
 }
+/* No native spinner: it is drawn light and breaks the dark field. */
+input[type=number] { -moz-appearance: textfield; appearance: textfield; }
+input[type=number]::-webkit-inner-spin-button,
+input[type=number]::-webkit-outer-spin-button { -webkit-appearance: none; margin: 0; }
+/* Sized and shaped like .btn.ghost so it lines up with the buttons next to it. */
+select {
+  -webkit-appearance: none; appearance: none; cursor: pointer;
+  min-width: 180px; padding: 10px 38px 10px 14px; border-radius: 8px;
+  border: 1px solid var(--border); color: var(--text);
+  font: inherit; font-size: 14px; font-weight: 500; line-height: 1.5;
+  background: #0c0f13 url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%238b95a5' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E") no-repeat right 14px center;
+}
+select:hover, select:focus { border-color: var(--accent); outline: none; }
+select:disabled, button:disabled { opacity: .5; cursor: not-allowed; }
 button, .btn {
   display: inline-block; cursor: pointer; border: 0; border-radius: 8px;
   padding: 10px 16px; font-size: 14px; font-weight: 500;
@@ -46,13 +62,33 @@ button, .btn {
 button:hover, .btn:hover { background: var(--accent-hover); text-decoration: none; }
 .btn.ghost { background: transparent; border: 1px solid var(--border); color: var(--text); }
 .btn.danger { background: var(--danger); }
+/* Close buttons: red text and border on the ghost button. */
+.btn.close, .btn.ghost.close { background: transparent; border: 1px solid rgba(255, 92, 92, .6); color: var(--danger); }
+.btn.close:hover, .btn.ghost.close:hover { background: #3a1d1d; border-color: var(--danger); }
+/* A close button that is just a cross: square, the height of the buttons by it. */
+.btn.close.x { width: 32px; height: 32px; padding: 0; display: inline-flex; align-items: center; justify-content: center; }
+.btn.small.close.x { width: 28px; height: 28px; }
 .btn.small { padding: 6px 10px; font-size: 13px; }
 .btn.icon { width: 30px; height: 30px; padding: 0; display: inline-flex;
   align-items: center; justify-content: center; font-size: 14px; line-height: 1; text-decoration: none; }
+/* Name of an icon button, shown at once on hover or keyboard focus. */
+[data-tip] { position: relative; }
+[data-tip]::after {
+  content: attr(data-tip); position: absolute; bottom: calc(100% + 6px); left: 50%;
+  transform: translateX(-50%); padding: 4px 8px; border-radius: 6px; white-space: nowrap;
+  background: #0c0f13; border: 1px solid var(--border); color: var(--text);
+  font-size: 12px; font-weight: 400; line-height: 1.4;
+  opacity: 0; visibility: hidden; pointer-events: none; z-index: 10;
+}
+[data-tip]:hover::after, [data-tip]:focus-visible::after { opacity: 1; visibility: visible; }
 .err { background: #3a1d1d; border: 1px solid #6b2b2b; color: #ffb3b3; padding: 10px 12px; border-radius: 8px; margin-bottom: 14px; font-size: 14px; }
 table { width: 100%; border-collapse: collapse; }
 th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid var(--border); font-size: 14px; }
 th { color: var(--muted); font-weight: 500; }
+.nowrap { white-space: nowrap; }
+/* Row buttons stay on one line; the column is only as wide as they need. */
+td.actions { width: 1%; white-space: nowrap; }
+td.actions .row { flex-wrap: nowrap; justify-content: flex-end; }
 .dot { display: inline-block; width: 9px; height: 9px; border-radius: 50%; margin-right: 6px; }
 .dot.on { background: var(--ok); }
 .dot.off { background: #555d6a; }
@@ -66,7 +102,31 @@ pre { padding: 12px; overflow-x: auto; font-size: 13px; white-space: pre-wrap; w
 .row { display: flex; gap: 10px; align-items: center; flex-wrap: wrap; }
 .spacer { flex: 1; }
 #terminal { width: 100%; height: calc(100vh - 150px); }
-@media (max-width: 600px) {
-  header.topbar { padding: 12px 16px; }
-  header.topbar nav a { margin-left: 12px; }
+/* Phones. A table marked .stack turns each row into a block of
+   "label: value" lines, the labels coming from data-l on the cells; a cell
+   marked .lead goes first, as the row's title. */
+@media (max-width: 640px) {
+  header.topbar { flex-wrap: wrap; gap: 6px 12px; padding: 10px 12px; }
+  header.topbar .brand { max-width: 100%; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: 14px; }
+  header.topbar nav { display: flex; align-items: center; gap: 16px; max-width: 100%;
+    overflow-x: auto; white-space: nowrap; scrollbar-width: none; }
+  header.topbar nav::-webkit-scrollbar { display: none; }
+  header.topbar nav > * { margin-left: 0 !important; flex: none; }
+  .wrap { padding: 16px 12px; }
+  .card { padding: 16px; border-radius: 8px; }
+  h1 { font-size: 20px; }
+  code { word-break: break-all; }
+  /* 16px and up, or iOS zooms the page into a field on focus. */
+  input[type=text], input[type=password], input[type=number], select, textarea { font-size: 16px; }
+  table.stack thead { display: none; }
+  table.stack, table.stack tbody { display: block; }
+  table.stack tr { display: flex; flex-direction: column; gap: 2px; padding: 12px 0; border-bottom: 1px solid var(--border); }
+  table.stack tr:first-child { padding-top: 0; }
+  table.stack tr:last-child { border-bottom: 0; padding-bottom: 0; }
+  table.stack td { display: flex; justify-content: flex-start; align-items: center; gap: 0;
+    width: auto; padding: 2px 0; border: 0; text-align: right !important; overflow-wrap: anywhere; }
+  table.stack td[data-l]::before { content: attr(data-l); flex: none; margin-right: auto; padding-right: 12px; color: var(--muted); font-size: 13px; text-align: left; }
+  table.stack td.lead { order: -1; justify-content: flex-start; text-align: left !important; font-size: 16px; font-weight: 600; }
+  table.stack td.actions { width: auto; padding-top: 8px; justify-content: flex-start; }
+  table.stack td:empty { display: none; }
 }

internal/server/web/static/codemirror/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (C) 2017 by Marijn Haverbeke <marijn@haverbeke.berlin> and others
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

internal/server/web/static/codemirror/codemirror.css

@@ -0,0 +1 @@
+.CodeMirror{font-family:monospace;height:300px;color:#000;direction:ltr}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-gutter-filler,.CodeMirror-scrollbar-filler{background-color:#fff}.CodeMirror-gutters{border-right:1px solid #ddd;background-color:#f7f7f7;white-space:nowrap}.CodeMirror-linenumber{padding:0 3px 0 5px;min-width:20px;text-align:right;color:#999;white-space:nowrap}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{border-left:1px solid #000;border-right:none;width:0}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;border:0!important;background:#7e7}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor .CodeMirror-line::-moz-selection,.cm-fat-cursor .CodeMirror-line>span::-moz-selection,.cm-fat-cursor .CodeMirror-line>span>span::-moz-selection{background:0 0}.cm-fat-cursor{caret-color:transparent}@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}.cm-tab{display:inline-block;text-decoration:inherit}.CodeMirror-rulers{position:absolute;left:0;right:0;top:-50px;bottom:0;overflow:hidden}.CodeMirror-ruler{border-left:1px solid #ccc;top:0;bottom:0;position:absolute}.cm-s-default .cm-header{color:#00f}.cm-s-default .cm-quote{color:#090}.cm-negative{color:#d44}.cm-positive{color:#292}.cm-header,.cm-strong{font-weight:700}.cm-em{font-style:italic}.cm-link{text-decoration:underline}.cm-strikethrough{text-decoration:line-through}.cm-s-default .cm-keyword{color:#708}.cm-s-default .cm-atom{color:#219}.cm-s-default .cm-number{color:#164}.cm-s-default .cm-def{color:#00f}.cm-s-default .cm-variable-2{color:#05a}.cm-s-default .cm-type,.cm-s-default .cm-variable-3{color:#085}.cm-s-default .cm-comment{color:#a50}.cm-s-default .cm-string{color:#a11}.cm-s-default .cm-string-2{color:#f50}.cm-s-default .cm-meta{color:#555}.cm-s-default .cm-qualifier{color:#555}.cm-s-default .cm-builtin{color:#30a}.cm-s-default .cm-bracket{color:#997}.cm-s-default .cm-tag{color:#170}.cm-s-default .cm-attribute{color:#00c}.cm-s-default .cm-hr{color:#999}.cm-s-default .cm-link{color:#00c}.cm-s-default .cm-error{color:red}.cm-invalidchar{color:red}.CodeMirror-composing{border-bottom:2px solid}div.CodeMirror span.CodeMirror-matchingbracket{color:#0b0}div.CodeMirror span.CodeMirror-nonmatchingbracket{color:#a22}.CodeMirror-matchingtag{background:rgba(255,150,0,.3)}.CodeMirror-activeline-background{background:#e8f2ff}.CodeMirror{position:relative;overflow:hidden;background:#fff}.CodeMirror-scroll{overflow:scroll!important;margin-bottom:-50px;margin-right:-50px;padding-bottom:50px;height:100%;outline:0;position:relative;z-index:0}.CodeMirror-sizer{position:relative;border-right:50px solid transparent}.CodeMirror-gutter-filler,.CodeMirror-hscrollbar,.CodeMirror-scrollbar-filler,.CodeMirror-vscrollbar{position:absolute;z-index:6;display:none;outline:0}.CodeMirror-vscrollbar{right:0;top:0;overflow-x:hidden;overflow-y:scroll}.CodeMirror-hscrollbar{bottom:0;left:0;overflow-y:hidden;overflow-x:scroll}.CodeMirror-scrollbar-filler{right:0;bottom:0}.CodeMirror-gutter-filler{left:0;bottom:0}.CodeMirror-gutters{position:absolute;left:0;top:0;min-height:100%;z-index:3}.CodeMirror-gutter{white-space:normal;height:100%;display:inline-block;vertical-align:top;margin-bottom:-50px}.CodeMirror-gutter-wrapper{position:absolute;z-index:4;background:0 0!important;border:none!important}.CodeMirror-gutter-background{position:absolute;top:0;bottom:0;z-index:4}.CodeMirror-gutter-elt{position:absolute;cursor:default;z-index:4}.CodeMirror-gutter-wrapper ::selection{background-color:transparent}.CodeMirror-gutter-wrapper ::-moz-selection{background-color:transparent}.CodeMirror-lines{cursor:text;min-height:1px}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{-moz-border-radius:0;-webkit-border-radius:0;border-radius:0;border-width:0;background:0 0;font-family:inherit;font-size:inherit;margin:0;white-space:pre;word-wrap:normal;line-height:inherit;color:inherit;z-index:2;position:relative;overflow:visible;-webkit-tap-highlight-color:transparent;-webkit-font-variant-ligatures:contextual;font-variant-ligatures:contextual}.CodeMirror-wrap pre.CodeMirror-line,.CodeMirror-wrap pre.CodeMirror-line-like{word-wrap:break-word;white-space:pre-wrap;word-break:normal}.CodeMirror-linebackground{position:absolute;left:0;right:0;top:0;bottom:0;z-index:0}.CodeMirror-linewidget{position:relative;z-index:2;padding:.1px}.CodeMirror-rtl pre{direction:rtl}.CodeMirror-code{outline:0}.CodeMirror-gutter,.CodeMirror-gutters,.CodeMirror-linenumber,.CodeMirror-scroll,.CodeMirror-sizer{-moz-box-sizing:contentLine truncated

internal/server/web/static/codemirror/codemirror.js

@@ -0,0 +1,27 @@
+/* CodeMirror 5.65.16 (MIT, see LICENSE) with the addons and language modes the file editor uses, joined into one file. */
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).CodeMirror=t()}(this,function(){"use strict";var e=navigator.userAgent,l=navigator.platform,d=/gecko\/\d/i.test(e),s=/MSIE \d/.test(e),a=/Trident\/(?:[7-9]|\d{2,})\..*rv:(\d+)/.exec(e),u=/Edge\/(\d+)/.exec(e),w=s||a||u,v=w&&(s?document.documentMode||6:+(u||a)[1]),x=!u&&/WebKit\//.test(e),s=x&&/Qt\/\d+\.\d+/.test(e),m=!u&&/Chrome\/(\d+)/.exec(e),V=m&&+m[1],K=/Opera\//.test(e),j=/Apple Computer/.test(navigator.vendor),c=/Mac OS X 1\d\D([8-9]|\d\d)\D/.test(e),X=/PhantomJS/.test(e),Y=j&&(/Mobile\/\w+/.test(e)||2<navigator.maxTouchPoints),$=/Android/.test(e),_=Y||$||/webOS|BlackBerry|Opera Mini|Opera Mobi|IEMobile/i.test(e),C=Y||/Mac/.test(l),q=/\bCrOS\b/.test(e),a=/win/i.test(l),u=K&&e.match(/Version\/(\d*\.\d*)/),Z=((u=u&&Number(u[1]))&&15<=u&&(x=!(K=!1)),C&&(s||K&&(null==u||u<12.11))),Q=d||w&&9<=v;function J(e){return new RegExp("(^|\\s)"+e+"(?:$|\\s)\\s*")}var ee=function(e,t){var n,r=e.className,t=J(t).exec(r);t&&(n=r.slice(t.index+t[0].length),e.className=r.slice(0,t.index)+(n?t[1]+n:""))};function te(e){for(var t=e.childNodes.length;0<t;--t)e.removeChild(e.firstChild);return e}function y(e,t){return te(e).appendChild(t)}function M(e,t,n,r){var i=document.createElement(e);if(n&&(i.className=n),r&&(i.style.cssText=r),"string"==typeof t)i.appendChild(document.createTextNode(t));else if(t)for(var o=0;o<t.length;++o)i.appendChild(t[o]);return i}function ne(e,t,n,r){e=M(e,t,n,r);return e.setAttribute("role","presentation"),e}function re(e,t){if(3==t.nodeType&&(t=t.parentNode),e.contains)return e.contains(t);do{if((t=11==t.nodeType?t.host:t)==e)return!0}while(t=t.parentNode)}function N(e){var t,n=e.ownerDocument||e;try{t=e.activeElement}catch(e){t=n.body||null}for(;t&&t.shadowRoot&&t.shadowRoot.activeElement;)t=t.shadowRoot.activeElement;return t}function ie(e,t){var n=e.className;J(t).test(n)||(e.className+=(n?" ":"")+t)}function oe(e,t){for(var n=e.split(" "),r=0;r<n.length;r++)n[r]&&!J(n[r]).test(t)&&(t+=" "+n[r]);return t}var le=document.createRange?function(e,t,n,r){var i=document.createRange();return i.setEnd(r||e,n),i.setStart(e,t),i}:function(e,t,n){var r=document.body.createTextRange();try{r.moveToElementText(e.parentNode)}catch(e){return r}return r.collapse(!0),r.moveEnd("character",n),r.moveStart("character",t),r},se=function(e){e.select()};function ae(e){return e.display.wrapper.ownerDocument}function ue(e){return ce(e.display.wrapper)}function ce(e){return e.getRootNode?e.getRootNode():e.ownerDocument}function he(e){return ae(e).defaultView}function de(e){var t=Array.prototype.slice.call(arguments,1);return function(){return e.apply(null,t)}}function fe(e,t,n){for(var r in t=t||{},e)!e.hasOwnProperty(r)||!1===n&&t.hasOwnProperty(r)||(t[r]=e[r]);return t}function S(e,t,n,r,i){null==t&&-1==(t=e.search(/[^\s\u00a0]/))&&(t=e.length);for(var o=r||0,l=i||0;;){var s=e.indexOf("\t",o);if(s<0||t<=s)return l+(t-o);l=(l+=s-o)+(n-l%n),o=s+1}}Y?se=function(e){e.selectionStart=0,e.selectionEnd=e.value.length}:w&&(se=function(e){try{e.select()}catch(e){}});function pe(){this.id=null,this.f=null,this.time=0,this.handler=de(this.onTimeout,this)}function L(e,t){for(var n=0;n<e.length;++n)if(e[n]==t)return n;return-1}pe.prototype.onTimeout=function(e){e.id=0,e.time<=+new Date?e.f():setTimeout(e.handler,e.time-+new Date)};var ge=50,me={toString:function(){return"CodeMirror.Pass"}},ve={scroll:!(pe.prototype.set=function(e,t){this.f=t;t=+new Date+e;(!this.id||t<this.time)&&(clearTimeout(this.id),this.id=setTimeout(this.handler,e),this.time=t)})},ye={origin:"*mouse"},be={origin:"+move"};function we(e,t,n){for(var r=0,i=0;;){var o=e.indexOf("\t",r),l=(o=-1==o?e.length:o)-r;if(o==e.length||t<=i+l)return r+Math.min(l,t-i);if(i+=o-r,r=o+1,t<=(i+=n-i%n))return r}}var xe=[""];function Ce(e){for(;xe.length<=e;)xe.push(z(xe)+" ");return xe[e]}function z(e){return e[e.length-1]}function Se(e,t){for(var n=[],r=0;r<e.length;r++)n[r]=t(e[r],r);return n}function Le(){}function ke(e,t){e=Object.create?Object.create(e):(Le.prototype=e,new Le);return t&&fe(t,e),e}var Te=/[\u00df\u0587\u0590-\u05f4\u0600-\u06ff\u3040-\u309f\u30a0-\u30ff\u3400-\u4db5\u4e00-\u9fcc\uac00-\ud7af]/;function Me(e){return/\w/.test(e)||"€"<e&&(e.toUpperCase()!=e.toLowerCase()||Te.test(e))}function Ne(e,t){return t?!!(-1<t.source.indexOf("\\w")&&Me(e))||t.test(e):Me(e)}function Oe(e){for(var t in e)if(e.hasOwnProperty(t)&&e[t])return;return 1}var Ae=/[\u0300-\u036f\u0483-\u0489\u0591-\u05bd\u05bf\u05c1\u05c2\u05c4\u05c5\u05c7\u0610-\u061a\u064b-\u065e\u0670\u06d6-\u06dc\u06de-\u06e4\u06e7\u06e8\u06ea-\u06ed\u0711\u0730-\u074a\u07a6-\u07b0\u07eb-\u07f3\u0816-\u0819\u081b-\u0823\u0825-\u0827\u0829-\u082d\u0900-\u0902\u093c\u0941-\u0948\u094d\u0951-\u0955\u0962\u0963\u0981\u09bc\u09be\u09c1-\u09c4\u09cd\u09d7\u09e2\u09e3\u0a01\u0a02\u0a3c\u0a41\u0a42\u0a47\u0a48\u0a4b-\u0a4d\u0a51\u0a70\u0a71\u0a75\u0a81\u0a82\u0abc\u0acLine truncated
+!function(t){"object"==typeof exports&&"object"==typeof module?t(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],t):t(CodeMirror)}(function(r){"use strict";var p,v,x=r.Pos;function m(t,e){for(var n,i=null!=(i=(n=t).flags)?i:(n.ignoreCase?"i":"")+(n.global?"g":"")+(n.multiline?"m":""),r=i,o=0;o<e.length;o++)-1==r.indexOf(e.charAt(o))&&(r+=e.charAt(o));return i==r?t:new RegExp(t.source,r)}function d(t){return/\\s|\\n|\n|\\W|\\D|\[\^/.test(t.source)}function a(t,e,n){e=m(e,"g");for(var i=n.line,r=n.ch,o=t.lastLine();i<=o;i++,r=0){e.lastIndex=r;var h=t.getLine(i),h=e.exec(h);if(h)return{from:x(i,h.index),to:x(i,h.index+h[0].length),match:h}}}function o(t,e,n){if(!d(e))return a(t,e,n);e=m(e,"gm");for(var i=1,r=n.line,o=t.lastLine();r<=o;){for(var h=0;h<i&&!(o<r);h++)var l=t.getLine(r++),c=null==c?l:c+"\n"+l;i*=2,e.lastIndex=n.ch;var s,f,g,u=e.exec(c);if(u)return g=c.slice(0,u.index).split("\n"),s=u[0].split("\n"),f=n.line+g.length-1,g=g[g.length-1].length,{from:x(f,g),to:x(f+s.length-1,1==s.length?g+s[0].length:s[s.length-1].length),match:u}}}function L(t,e,n){for(var i,r=0;r<=t.length;){e.lastIndex=r;var o=e.exec(t);if(!o)break;var h=o.index+o[0].length;if(h>t.length-n)break;(!i||h>i.index+i[0].length)&&(i=o),r=o.index+1}return i}function O(t,e,n){e=m(e,"g");for(var i=n.line,r=n.ch,o=t.firstLine();o<=i;i--,r=-1){var h=t.getLine(i),h=L(h,e,r<0?0:h.length-r);if(h)return{from:x(i,h.index),to:x(i,h.index+h[0].length),match:h}}}function h(t,e,n){if(!d(e))return O(t,e,n);e=m(e,"gm");for(var i=1,r=t.getLine(n.line).length-n.ch,o=n.line,h=t.firstLine();h<=o;){for(var l=0;l<i&&h<=o;l++)var c=t.getLine(o--),s=null==s?c:c+"\n"+s;i*=2;var f,g,u,a=L(s,e,r);if(a)return u=s.slice(0,a.index).split("\n"),f=a[0].split("\n"),g=o+u.length,u=u[u.length-1].length,{from:x(g,u),to:x(g+f.length-1,1==f.length?u+f[0].length:f[f.length-1].length),match:a}}}function y(t,e,n,i){if(t.length==e.length)return n;for(var r=0,o=n+Math.max(0,t.length-e.length);;){if(r==o)return r;var h=r+o>>1,l=i(t.slice(0,h)).length;if(l==n)return h;n<l?o=h:r=1+h}}function l(t,e,n,i){if(!e.length)return null;var r=i?p:v,o=r(e).split(/\r|\n\r?/);t:for(var h=n.line,l=n.ch,c=t.lastLine()+1-o.length;h<=c;h++,l=0){var s=t.getLine(h).slice(l),f=r(s);if(1==o.length){var g=f.indexOf(o[0]);if(-1==g);else return n=y(s,f,g,r)+l,{from:x(h,y(s,f,g,r)+l),to:x(h,y(s,f,g+o[0].length,r)+l)}}else{g=f.length-o[0].length;if(f.slice(g)==o[0]){for(var u=1;u<o.length-1;u++)if(r(t.getLine(h+u))!=o[u])continue t;var a=t.getLine(h+o.length-1),m=r(a),d=o[o.length-1];if(m.slice(0,d.length)==d)return{from:x(h,y(s,f,g,r)+l),to:x(h+o.length-1,y(a,m,d.length,r))}}}}}function c(t,e,n,i){if(!e.length)return null;var r=i?p:v,o=r(e).split(/\r|\n\r?/);t:for(var h=n.line,l=n.ch,c=t.firstLine()-1+o.length;c<=h;h--,l=-1){var s=t.getLine(h),f=r(s=-1<l?s.slice(0,l):s);if(1==o.length){var g=f.lastIndexOf(o[0]);if(-1!=g)return{from:x(h,y(s,f,g,r)),to:x(h,y(s,f,g+o[0].length,r))}}else{g=o[o.length-1];if(f.slice(0,g.length)==g){for(var u=1,n=h-o.length+1;u<o.length-1;u++)if(r(t.getLine(n+u))!=o[u])continue t;var a=t.getLine(h+1-o.length),m=r(a);if(m.slice(m.length-o[0].length)==o[0])return{from:x(h+1-o.length,y(a,m,a.length-o[0].length,r)),to:x(h,y(s,f,g.length,r))}}}}}function i(n,i,t,e){var r;this.atOccurrence=!1,this.afterEmptyMatch=!1,this.doc=n,t=t?n.clipPos(t):x(0,0),this.pos={from:t,to:t},"object"==typeof e?r=e.caseFold:(r=e,e=null),"string"==typeof i?(null==r&&(r=!1),this.matches=function(t,e){return(t?c:l)(n,i,e,r)}):(i=m(i,"gm"),e&&!1===e.multiline?this.matches=function(t,e){return(t?O:a)(n,i,e)}:this.matches=function(t,e){return(t?h:o)(n,i,e)})}v=String.prototype.normalize?(p=function(t){return t.normalize("NFD").toLowerCase()},function(t){return t.normalize("NFD")}):(p=function(t){return t.toLowerCase()},function(t){return t}),i.prototype={findNext:function(){return this.find(!1)},findPrevious:function(){return this.find(!0)},find:function(t){var e=this.doc.clipPos(t?this.pos.from:this.pos.to);if(this.afterEmptyMatch&&this.atOccurrence&&(e=x(e.line,e.ch),t?(e.ch--,e.ch<0&&(e.line--,e.ch=(this.doc.getLine(e.line)||"").length)):(e.ch++,e.ch>(this.doc.getLine(e.line)||"").length&&(e.ch=0,e.line++)),0!=r.cmpPos(e,this.doc.clipPos(e))))return this.atOccurrence=!1;var e=this.matches(t,e);return this.afterEmptyMatch=e&&0==r.cmpPos(e.from,e.to),e?(this.pos=e,this.atOccurrence=!0,this.pos.match||!0):(e=x(t?this.doc.firstLine():this.doc.lastLine()+1,0),this.pos={from:e,to:e},this.atOccurrence=!1)},from:function(){if(this.atOccurrence)return this.pos.from},to:function(){if(this.atOccurrence)return this.pos.to},replace:function(t,e){this.atOccurrence&&(t=r.splitLines(t),this.doc.replaceRange(t,this.pos.from,this.pos.to,e),this.pos.to=x(this.pos.from.line+t.length-1,t[t.length-1].length+(1==t.length?this.pos.from.ch:0)))}},r.defineExtension("getSearchCursor",function(t,e,n){return new i(this.doc,t,e,n)}),r.defineDocExtension("getSearchCursor",function(t,Line truncated
+!function(t){"object"==typeof exports&&"object"==typeof module?t(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],t):t(CodeMirror)}(function(r){var u=/MSIE \d/.test(navigator.userAgent)&&(null==document.documentMode||document.documentMode<8),k=r.Pos,p={"(":")>",")":"(<","[":"]>","]":"[<","{":"}>","}":"{<","<":">>",">":"<<"};function y(t){return t&&t.bracketRegex||/[(){}[\]]/}function f(t,e,n){var r=t.getLineHandle(e.line),i=e.ch-1,c=n&&n.afterCursor,a=(null==c&&(c=/(^| )cm-fat-cursor($| )/.test(t.getWrapperElement().className)),y(n)),c=!c&&0<=i&&a.test(r.text.charAt(i))&&p[r.text.charAt(i)]||a.test(r.text.charAt(i+1))&&p[r.text.charAt(++i)];if(!c)return null;a=">"==c.charAt(1)?1:-1;if(n&&n.strict&&0<a!=(i==e.ch))return null;r=t.getTokenTypeAt(k(e.line,i+1)),t=o(t,k(e.line,i+(0<a?1:0)),a,r,n);return null==t?null:{from:k(e.line,i),to:t&&t.pos,match:t&&t.ch==c.charAt(0),forward:0<a}}function o(t,e,n,r,i){for(var c=i&&i.maxScanLineLength||1e4,a=i&&i.maxScanLines||1e3,o=[],h=y(i),l=0<n?Math.min(e.line+a,t.lastLine()+1):Math.max(t.firstLine()-1,e.line-a),s=e.line;s!=l;s+=n){var u=t.getLine(s);if(u){var f=0<n?0:u.length-1,m=0<n?u.length:-1;if(!(u.length>c))for(s==e.line&&(f=e.ch-(n<0?1:0));f!=m;f+=n){var g=u.charAt(f);if(h.test(g)&&(void 0===r||(t.getTokenTypeAt(k(s,f+1))||"")==(r||""))){var d=p[g];if(d&&">"==d.charAt(1)==0<n)o.push(g);else{if(!o.length)return{pos:k(s,f),ch:g};o.pop()}}}}}return s-n!=(0<n?t.lastLine():t.firstLine())&&null}function e(t,e,n){for(var r=t.state.matchBrackets.maxHighlightLineLength||1e3,i=n&&n.highlightNonMatching,c=[],a=t.listSelections(),o=0;o<a.length;o++){var h,l=a[o].empty()&&f(t,a[o].head,n);l&&(l.match||!1!==i)&&t.getLine(l.from.line).length<=r&&(h=l.match?"CodeMirror-matchingbracket":"CodeMirror-nonmatchingbracket",c.push(t.markText(l.from,k(l.from.line,l.from.ch+1),{className:h})),l.to&&t.getLine(l.to.line).length<=r&&c.push(t.markText(l.to,k(l.to.line,l.to.ch+1),{className:h})))}if(c.length){u&&t.state.focused&&t.focus();function s(){t.operation(function(){for(var t=0;t<c.length;t++)c[t].clear()})}if(!e)return s;setTimeout(s,800)}}function i(t){t.operation(function(){t.state.matchBrackets.currentlyHighlighted&&(t.state.matchBrackets.currentlyHighlighted(),t.state.matchBrackets.currentlyHighlighted=null),t.state.matchBrackets.currentlyHighlighted=e(t,!1,t.state.matchBrackets)})}function c(t){t.state.matchBrackets&&t.state.matchBrackets.currentlyHighlighted&&(t.state.matchBrackets.currentlyHighlighted(),t.state.matchBrackets.currentlyHighlighted=null)}r.defineOption("matchBrackets",!1,function(t,e,n){n&&n!=r.Init&&(t.off("cursorActivity",i),t.off("focus",i),t.off("blur",c),c(t)),e&&(t.state.matchBrackets="object"==typeof e?e:{},t.on("cursorActivity",i),t.on("focus",i),t.on("blur",c))}),r.defineExtension("matchBrackets",function(){e(this,!0)}),r.defineExtension("findMatchingBracket",function(t,e,n){return f(this,t,e=!n&&"boolean"!=typeof e?e:n?(n.strict=e,n):e?{strict:!0}:null)}),r.defineExtension("scanForBracket",function(t,e,n,r){return o(this,t,e,n,r)})});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(v){"use strict";function h(e,t){if(!e.hasOwnProperty(t))throw new Error("Undefined state "+t+" in simple mode")}function k(e,t){if(!e)return/(?:)/;var n="";return e=e instanceof RegExp?(e.ignoreCase&&(n="i"),e.unicode&&(n+="u"),e.source):String(e),new RegExp((!1===t?"":"^")+"(?:"+e+")",n)}function g(e,t){(e.next||e.push)&&h(t,e.next||e.push),this.regex=k(e.regex),this.token=function(e){if(!e)return null;if(e.apply)return e;if("string"==typeof e)return e.replace(/\./g," ");for(var t=[],n=0;n<e.length;n++)t.push(e[n]&&e[n].replace(/\./g," "));return t}(e.token),this.data=e}v.defineSimpleMode=function(e,t){v.defineMode(e,function(e){return v.simpleMode(e,t)})},v.simpleMode=function(e,t){h(t,"start");var n,a={},o=t.meta||{},r=!1;for(n in t)if(n!=o&&t.hasOwnProperty(n))for(var i=a[n]=[],l=t[n],s=0;s<l.length;s++){var d=l[s];i.push(new g(d,t)),(d.indent||d.dedent)&&(r=!0)}var c,p,S,m,u={startState:function(){return{state:"start",pending:null,local:null,localState:null,indent:r?[]:null}},copyState:function(e){var t={state:e.state,pending:e.pending,local:e.local,localState:null,indent:e.indent&&e.indent.slice(0)};e.localState&&(t.localState=v.copyState(e.local.mode,e.localState)),e.stack&&(t.stack=e.stack.slice(0));for(var n=e.persistentStates;n;n=n.next)t.persistentStates={mode:n.mode,spec:n.spec,state:n.state==e.localState?t.localState:v.copyState(n.mode,n.state),next:t.persistentStates};return t},token:(m=e,function(e,t){var n,a;if(t.pending)return a=t.pending.shift(),0==t.pending.length&&(t.pending=null),e.pos+=a.text.length,a.token;if(t.local)return t.local.end&&e.match(t.local.end)?(n=t.local.endToken||null,t.local=t.localState=null):(n=t.local.mode.token(e,t.localState),t.local.endScan&&(a=t.local.endScan.exec(e.current()))&&(e.pos=e.start+a.index)),n;for(var o=S[t.state],r=0;r<o.length;r++){var i=o[r],l=(!i.data.sol||e.sol())&&e.match(i.regex);if(l){if(i.data.next?t.state=i.data.next:i.data.push?((t.stack||(t.stack=[])).push(t.state),t.state=i.data.push):i.data.pop&&t.stack&&t.stack.length&&(t.state=t.stack.pop()),i.data.mode){h=d=f=s=u=p=c=d=void 0;var s,d=m,c=t,p=i.data.mode,u=i.token;if(p.persistent)for(var f=c.persistentStates;f&&!s;f=f.next)(p.spec?function e(t,n){if(t===n)return!0;if(!t||"object"!=typeof t||!n||"object"!=typeof n)return!1;var a=0;for(var o in t)if(t.hasOwnProperty(o)){if(!n.hasOwnProperty(o)||!e(t[o],n[o]))return!1;a++}for(var o in n)n.hasOwnProperty(o)&&a--;return 0==a}(p.spec,f.spec):p.mode==f.mode)&&(s=f);var d=s?s.mode:p.mode||v.getMode(d,p.spec),h=s?s.state:v.startState(d);p.persistent&&!s&&(c.persistentStates={mode:d,spec:p.spec,state:h,next:c.persistentStates}),c.localState=h,c.local={mode:d,end:p.end&&k(p.end),endScan:p.end&&!1!==p.forceEnd&&k(p.end,!1),endToken:u&&u.join?u[u.length-1]:u}}i.data.indent&&t.indent.push(e.indentation()+m.indentUnit),i.data.dedent&&t.indent.pop();h=i.token;if(h&&h.apply&&(h=h(l)),2<l.length&&i.token&&"string"!=typeof i.token){for(var g=2;g<l.length;g++)l[g]&&(t.pending||(t.pending=[])).push({text:l[g],token:i.token[g-1]});return e.backUp(l[0].length-(l[1]?l[1].length:0)),h[0]}return h&&h.join?h[0]:h}}return e.next(),null}),innerMode:function(e){return e.local&&{mode:e.local.mode,state:e.localState}},indent:(c=S=a,function(e,t,n){if(e.local&&e.local.mode.indent)return e.local.mode.indent(e.localState,t,n);if(null==e.indent||e.local||p.dontIndentStates&&-1<function(e,t){for(var n=0;n<t.length;n++)if(t[n]===e)return!0}(e.state,p.dontIndentStates))return v.Pass;var a=e.indent.length-1,o=c[e.state];e:for(;;){for(var r=0;r<o.length;r++){var i=o[r];if(i.data.dedent&&!1!==i.data.dedentIfLineStart){var l=i.regex.exec(t);if(l&&l[0]){a--,(i.next||i.push)&&(o=c[i.next||i.push]),t=t.slice(l[0].length);continue e}}}break}return a<0?0:e.indent[a]})};if(p=o)for(var f in o)o.hasOwnProperty(f)&&(u[f]=o[f]);return u}});;
+!function(t){"object"==typeof exports&&"object"==typeof module?t(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],t):t(CodeMirror)}(function(y){"use strict";var C={autoSelfClosers:{area:!0,base:!0,br:!0,col:!0,command:!0,embed:!0,frame:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0,menuitem:!0},implicitlyClosed:{dd:!0,li:!0,optgroup:!0,option:!0,p:!0,rp:!0,rt:!0,tbody:!0,td:!0,tfoot:!0,th:!0,tr:!0},contextGrabbers:{dd:{dd:!0,dt:!0},dt:{dd:!0,dt:!0},li:{li:!0},option:{option:!0,optgroup:!0},optgroup:{optgroup:!0},p:{address:!0,article:!0,aside:!0,blockquote:!0,dir:!0,div:!0,dl:!0,fieldset:!0,footer:!0,form:!0,h1:!0,h2:!0,h3:!0,h4:!0,h5:!0,h6:!0,header:!0,hgroup:!0,hr:!0,menu:!0,nav:!0,ol:!0,p:!0,pre:!0,section:!0,table:!0,ul:!0},rp:{rp:!0,rt:!0},rt:{rp:!0,rt:!0},tbody:{tbody:!0,tfoot:!0},td:{td:!0,th:!0},tfoot:{tbody:!0},th:{td:!0,th:!0},thead:{tbody:!0,tfoot:!0},tr:{tr:!0}},doNotIndent:{pre:!0},allowUnquoted:!0,allowMissing:!0,caseFold:!0},z={autoSelfClosers:{},implicitlyClosed:{},contextGrabbers:{},doNotIndent:{},allowUnquoted:!1,allowMissing:!1,allowMissingTagName:!1,caseFold:!1};y.defineMode("xml",function(t,e){var n,i,a,l=t.indentUnit,u={},r=e.htmlMode?C:z;for(n in r)u[n]=r[n];for(n in e)u[n]=e[n];function c(e,n){function t(t){return(n.tokenize=t)(e,n)}var r=e.next();return"<"==r?e.eat("!")?e.eat("[")?e.match("CDATA[")?t(o("atom","]]>")):null:e.match("--")?t(o("comment","--\x3e")):e.match("DOCTYPE",!0,!0)?(e.eatWhile(/[\w\._\-]/),t(function r(o){return function(t,e){for(var n;null!=(n=t.next());){if("<"==n)return e.tokenize=r(o+1),e.tokenize(t,e);if(">"==n){if(1!=o)return e.tokenize=r(o-1),e.tokenize(t,e);e.tokenize=c;break}}return"meta"}}(1))):null:e.eat("?")?(e.eatWhile(/[\w\._\-]/),n.tokenize=o("meta","?>"),"meta"):(i=e.eat("/")?"closeTag":"openTag",n.tokenize=d,"tag bracket"):"&"==r?(e.eat("#")?e.eat("x")?e.eatWhile(/[a-fA-F\d]/)&&e.eat(";"):e.eatWhile(/[\d]/)&&e.eat(";"):e.eatWhile(/[\w\.\-:]/)&&e.eat(";"))?"atom":"error":(e.eatWhile(/[^&<]/),null)}function d(t,e){var n,r,o=t.next();return">"==o||"/"==o&&t.eat(">")?(e.tokenize=c,i=">"==o?"endTag":"selfcloseTag","tag bracket"):"="==o?(i="equals",null):"<"==o?(e.tokenize=c,e.state=p,e.tagName=e.tagStart=null,(n=e.tokenize(t,e))?n+" tag error":"tag error"):/[\'\"]/.test(o)?(e.tokenize=(r=o,a.isInAttribute=!0,a),e.stringStartCol=t.column(),e.tokenize(t,e)):(t.match(/^[^\s\u00a0=<>\"\']*[^\s\u00a0=<>\"\'\/]/),"word");function a(t,e){for(;!t.eol();)if(t.next()==r){e.tokenize=d;break}return"string"}}function o(n,r){return function(t,e){for(;!t.eol();){if(t.match(r)){e.tokenize=c;break}t.next()}return n}}function s(t){return t&&t.toLowerCase()}function f(t,e,n){this.prev=t.context,this.tagName=e||"",this.indent=t.indented,this.startOfLine=n,(u.doNotIndent.hasOwnProperty(e)||t.context&&t.context.noIndent)&&(this.noIndent=!0)}function m(t){t.context&&(t.context=t.context.prev)}function g(t,e){for(var n;;){if(!t.context)return;if(n=t.context.tagName,!u.contextGrabbers.hasOwnProperty(s(n))||!u.contextGrabbers[s(n)].hasOwnProperty(s(e)))return;m(t)}}function p(t,e,n){return"openTag"==t?(n.tagStart=e.column(),h):"closeTag"==t?x:p}function h(t,e,n){return"word"==t?(n.tagName=e.current(),a="tag",w):u.allowMissingTagName&&"endTag"==t?(a="tag bracket",w(t,0,n)):(a="error",h)}function x(t,e,n){var r;return"word"==t?(r=e.current(),n.context&&n.context.tagName!=r&&u.implicitlyClosed.hasOwnProperty(s(n.context.tagName))&&m(n),n.context&&n.context.tagName==r||!1===u.matchClosing?(a="tag",b):(a="tag error",k)):u.allowMissingTagName&&"endTag"==t?(a="tag bracket",b(t,0,n)):(a="error",k)}function b(t,e,n){return"endTag"!=t?(a="error",b):(m(n),p)}function k(t,e,n){return a="error",b(t,0,n)}function w(t,e,n){return"word"==t?(a="attribute",T):"endTag"==t||"selfcloseTag"==t?(r=n.tagName,o=n.tagStart,n.tagName=n.tagStart=null,"selfcloseTag"==t||u.autoSelfClosers.hasOwnProperty(s(r))?g(n,r):(g(n,r),n.context=new f(n,r,o==n.indented)),p):(a="error",w);var r,o}function T(t,e,n){return"equals"==t?v:(u.allowMissing||(a="error"),w(t,0,n))}function v(t,e,n){return"string"==t?N:"word"==t&&u.allowUnquoted?(a="string",w):(a="error",w(t,0,n))}function N(t,e,n){return"string"==t?N:w(t,0,n)}return c.isInText=!0,{startState:function(t){var e={tokenize:c,state:p,indented:t||0,tagName:null,tagStart:null,context:null};return null!=t&&(e.baseIndent=t),e},token:function(t,e){if(!e.tagName&&t.sol()&&(e.indented=t.indentation()),t.eatSpace())return null;i=null;var n=e.tokenize(t,e);return(n||i)&&"comment"!=n&&(a=null,e.state=e.state(i||n,t,e),a&&(n="error"==a?n+" error":a)),n},indent:function(t,e,n){var r=t.context;if(t.tokenize.isInAttribute)return t.tagStart==t.indented?t.stringStartCol+1:t.indented+l;if(r&&r.noIndent)return y.Pass;if(t.tokenize!=d&&t.tokenize!=c)return n?n.match(/^(\s*)/)[0].length:0;if(t.tagName)return!1!==u.multilineTagIndentPastTag?t.tagStart+t.tagName.length+2:t.tagStart+l*(u.multilinLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(rt){"use strict";rt.defineMode("javascript",function(e,l){var t,r,O,P,f=e.indentUnit,N=l.statementIndent,U=l.jsonld,o=l.json||U,W=!1!==l.trackScope,u=l.typescript,B=l.wordCharacters||/[\w$\xa1-\uffff]/,F=(e=n("keyword a"),t=n("keyword b"),r=n("keyword c"),O=n("keyword d"),P=n("operator"),{if:n("if"),while:e,with:e,else:t,do:t,try:t,finally:t,return:O,break:O,continue:O,new:n("new"),delete:r,void:r,throw:r,debugger:n("debugger"),var:n("var"),const:n("var"),let:n("var"),function:n("function"),catch:n("catch"),for:n("for"),switch:n("switch"),case:n("case"),default:n("default"),in:P,typeof:P,instanceof:P,true:e={type:"atom",style:"atom"},false:e,null:e,undefined:e,NaN:e,Infinity:e,this:n("this"),class:n("class"),super:n("atom"),yield:r,export:n("export"),import:n("import"),extends:r,await:r});function n(e){return{type:e,style:"keyword"}}var H,D,G=/[+\-*&%=<>!?|~^@]/,J=/^@(context|id|value|language|type|container|list|set|reverse|index|base|vocab|graph)"/;function i(e,t,r){return H=e,D=r,t}function d(e,t){var a,r=e.next();if('"'==r||"'"==r)return t.tokenize=(a=r,function(e,t){var r,n=!1;if(U&&"@"==e.peek()&&e.match(J))return t.tokenize=d,i("jsonld-keyword","meta");for(;null!=(r=e.next())&&(r!=a||n);)n=!n&&"\\"==r;return n||(t.tokenize=d),i("string","string")}),t.tokenize(e,t);if("."==r&&e.match(/^\d[\d_]*(?:[eE][+\-]?[\d_]+)?/))return i("number","number");if("."==r&&e.match(".."))return i("spread","meta");if(/[\[\]{}\(\),;\:\.]/.test(r))return i(r);if("="==r&&e.eat(">"))return i("=>","operator");if("0"==r&&e.match(/^(?:x[\dA-Fa-f_]+|o[0-7_]+|b[01_]+)n?/))return i("number","number");if(/\d/.test(r))return e.match(/^[\d_]*(?:n|(?:\.[\d_]*)?(?:[eE][+\-]?[\d_]+)?)?/),i("number","number");if("/"==r)return e.eat("*")?(t.tokenize=K)(e,t):e.eat("/")?(e.skipToEnd(),i("comment","comment")):tt(e,t,1)?(function(e){for(var t,r=!1,n=!1;null!=(t=e.next());){if(!r){if("/"==t&&!n)return;"["==t?n=!0:n&&"]"==t&&(n=!1)}r=!r&&"\\"==t}}(e),e.match(/^\b(([gimyus])(?![gimyus]*\2))+\b/),i("regexp","string-2")):(e.eat("="),i("operator","operator",e.current()));if("`"==r)return(t.tokenize=L)(e,t);if("#"==r&&"!"==e.peek())return e.skipToEnd(),i("meta","meta");if("#"==r&&e.eatWhile(B))return i("variable","property");if("<"==r&&e.match("!--")||"-"==r&&e.match("->")&&!/\S/.test(e.string.slice(0,e.start)))return e.skipToEnd(),i("comment","comment");if(G.test(r))return">"==r&&t.lexical&&">"==t.lexical.type||(e.eat("=")?"!"!=r&&"="!=r||e.eat("="):/[<>*+\-|&?]/.test(r)&&(e.eat(r),">"==r&&e.eat(r))),"?"==r&&e.eat(".")?i("."):i("operator","operator",e.current());if(B.test(r)){e.eatWhile(B);r=e.current();if("."!=t.lastType){if(F.propertyIsEnumerable(r))return i((t=F[r]).type,t.style,r);if("async"==r&&e.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/,!1))return i("async","keyword",r)}return i("variable","variable",r)}}function K(e,t){for(var r,n=!1;r=e.next();){if("/"==r&&n){t.tokenize=d;break}n="*"==r}return i("comment","comment")}function L(e,t){for(var r,n=!1;null!=(r=e.next());){if(!n&&("`"==r||"$"==r&&e.eat("{"))){t.tokenize=d;break}n=!n&&"\\"==r}return i("quasi","string-2",e.current())}function Q(e,t){t.fatArrowAt&&(t.fatArrowAt=null);var r=e.string.indexOf("=>",e.start);if(!(r<0)){!u||(n=/:\s*(?:\w+(?:<[^>]*>|\[\])?|\{[^}]*\})\s*$/.exec(e.string.slice(e.start,r)))&&(r=n.index);for(var n,a=0,i=!1,o=r-1;0<=o;--o){var c=e.string.charAt(o),s="([{}])".indexOf(c);if(0<=s&&s<3){if(!a){++o;break}if(0==--a){"("==c&&(i=!0);break}}else if(3<=s&&s<6)++a;else if(B.test(c))i=!0;else if(/["'\/`]/.test(c))for(;;--o){if(0==o)return;if(e.string.charAt(o-1)==c&&"\\"!=e.string.charAt(o-2)){o--;break}}else if(i&&!a){++o;break}}i&&!a&&(t.fatArrowAt=o)}}var R={atom:!0,number:!0,variable:!0,string:!0,regexp:!0,this:!0,import:!0,"jsonld-keyword":!0};function X(e,t,r,n,a,i){this.indented=e,this.column=t,this.type=r,this.prev=a,this.info=i,null!=n&&(this.align=n)}function Y(e,t,r,n,a){var i=e.cc;for(c.state=e,c.stream=a,c.marked=null,c.cc=i,c.style=t,e.lexical.hasOwnProperty("align")||(e.lexical.align=!0);;)if((i.length?i.pop():o?x:b)(r,n)){for(;i.length&&i[i.length-1].lex;)i.pop()();return c.marked?c.marked:"variable"==r&&function(e,t){if(W){for(var r=e.localVars;r;r=r.next)if(r.name==t)return 1;for(var n=e.context;n;n=n.prev)for(r=n.vars;r;r=r.next)if(r.name==t)return 1}}(e,n)?"variable-2":t}}var c={state:null,column:null,marked:null,cc:null};function s(){for(var e=arguments.length-1;0<=e;e--)c.cc.push(arguments[e])}function p(){return s.apply(null,arguments),!0}function Z(e,t){for(var r=t;r;r=r.next)if(r.name==e)return 1}function a(e){var t=c.state;if(c.marked="def",W){if(t.context)if("var"==t.lexical.info&&t.context&&t.context.block){var r=function e(t,r){{var n;return r?r.block?(n=e(t,r.prev))?n==r.prev?r:new te(n,r.vars,!0):null:Z(t,r.vars)?r:new te(r.prev,new re(t,r.varLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(T){"use strict";function e(e){for(var t={},r=0;r<e.length;++r)t[e[r].toLowerCase()]=!0;return t}T.defineMode("css",function(e,t){var a,i,r=t.inline,n=(t.propertyKeywords||(t=T.resolveMode("text/css")),e.indentUnit),l=t.tokenHooks,o=t.documentTypes||{},s=t.mediaTypes||{},c=t.mediaFeatures||{},d=t.mediaValueKeywords||{},p=t.propertyKeywords||{},u=t.nonStandardPropertyKeywords||{},m=t.fontProperties||{},g=t.counterDescriptors||{},b=t.colorKeywords||{},h=t.valueKeywords||{},f=t.allowNested,k=t.lineComment,y=!0===t.supportsAtComponent,w=!1!==e.highlightNonStandardPropertyKeywords;function v(e,t){return a=t,e}function x(i){return function(e,t){for(var r,o=!1;null!=(r=e.next());){if(r==i&&!o){")"==i&&e.backUp(1);break}o=!o&&"\\"==r}return r!=i&&(o||")"==i)||(t.tokenize=null),a="string"}}function z(e,t){return e.next(),e.match(/^\s*[\"\')]/,!1)?t.tokenize=null:t.tokenize=x(")"),a="(",null}function j(e,t,r){this.type=e,this.indent=t,this.prev=r}function P(e,t,r,o){return e.context=new j(r,t.indentation()+(!1===o?0:n),e.context),r}function K(e){return e.context.prev&&(e.context=e.context.prev),e.context.type}function q(e,t,r){return _[r.context.type](e,t,r)}function C(e,t,r,o){for(var i=o||1;0<i;i--)r.context=r.context.prev;return q(e,t,r)}function B(e){e=e.current().toLowerCase();i=h.hasOwnProperty(e)?"atom":b.hasOwnProperty(e)?"keyword":"variable"}var _={top:function(e,t,r){if("{"==e)return P(r,t,"block");if("}"==e&&r.context.prev)return K(r);if(y&&/@component/i.test(e))return P(r,t,"atComponentBlock");if(/^@(-moz-)?document$/i.test(e))return P(r,t,"documentTypes");if(/^@(media|supports|(-moz-)?document|import)$/i.test(e))return P(r,t,"atBlock");if(/^@(font-face|counter-style)/i.test(e))return r.stateArg=e,"restricted_atBlock_before";if(/^@(-(moz|ms|o|webkit)-)?keyframes$/i.test(e))return"keyframes";if(e&&"@"==e.charAt(0))return P(r,t,"at");if("hash"==e)i="builtin";else if("word"==e)i="tag";else{if("variable-definition"==e)return"maybeprop";if("interpolation"==e)return P(r,t,"interpolation");if(":"==e)return"pseudo";if(f&&"("==e)return P(r,t,"parens")}return r.context.type},block:function(e,t,r){var o;return"word"==e?(o=t.current().toLowerCase(),p.hasOwnProperty(o)?(i="property","maybeprop"):u.hasOwnProperty(o)?(i=w?"string-2":"property","maybeprop"):f?(i=t.match(/^\s*:(?:\s|$)/,!1)?"property":"tag","block"):(i+=" error","maybeprop")):"meta"==e?"block":f||"hash"!=e&&"qualifier"!=e?_.top(e,t,r):(i="error","block")},maybeprop:function(e,t,r){return":"==e?P(r,t,"prop"):q(e,t,r)},prop:function(e,t,r){if(";"==e)return K(r);if("{"==e&&f)return P(r,t,"propBlock");if("}"==e||"{"==e)return C(e,t,r);if("("==e)return P(r,t,"parens");if("hash"!=e||/^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/.test(t.current())){if("word"==e)B(t);else if("interpolation"==e)return P(r,t,"interpolation")}else i+=" error";return"prop"},propBlock:function(e,t,r){return"}"==e?K(r):"word"==e?(i="property","maybeprop"):r.context.type},parens:function(e,t,r){return"{"==e||"}"==e?C(e,t,r):")"==e?K(r):"("==e?P(r,t,"parens"):"interpolation"==e?P(r,t,"interpolation"):("word"==e&&B(t),"parens")},pseudo:function(e,t,r){return"meta"==e?"pseudo":"word"==e?(i="variable-3",r.context.type):q(e,t,r)},documentTypes:function(e,t,r){return"word"==e&&o.hasOwnProperty(t.current())?(i="tag",r.context.type):_.atBlock(e,t,r)},atBlock:function(e,t,r){return"("==e?P(r,t,"atBlock_parens"):"}"==e||";"==e?C(e,t,r):"{"==e?K(r)&&P(r,t,f?"block":"top"):"interpolation"==e?P(r,t,"interpolation"):("word"==e&&(e=t.current().toLowerCase(),i="only"==e||"not"==e||"and"==e||"or"==e?"keyword":s.hasOwnProperty(e)?"attribute":c.hasOwnProperty(e)?"property":d.hasOwnProperty(e)?"keyword":p.hasOwnProperty(e)?"property":u.hasOwnProperty(e)?w?"string-2":"property":h.hasOwnProperty(e)?"atom":b.hasOwnProperty(e)?"keyword":"error"),r.context.type)},atComponentBlock:function(e,t,r){return"}"==e?C(e,t,r):"{"==e?K(r)&&P(r,t,f?"block":"top",!1):("word"==e&&(i="error"),r.context.type)},atBlock_parens:function(e,t,r){return")"==e?K(r):"{"==e||"}"==e?C(e,t,r,2):_.atBlock(e,t,r)},restricted_atBlock_before:function(e,t,r){return"{"==e?P(r,t,"restricted_atBlock"):"word"==e&&"@counter-style"==r.stateArg?(i="variable","restricted_atBlock_before"):q(e,t,r)},restricted_atBlock:function(e,t,r){return"}"==e?(r.stateArg=null,K(r)):"word"==e?(i="@font-face"==r.stateArg&&!m.hasOwnProperty(t.current().toLowerCase())||"@counter-style"==r.stateArg&&!g.hasOwnProperty(t.current().toLowerCase())?"error":"property","maybeprop"):"restricted_atBlock"},keyframes:function(e,t,r){return"word"==e?(i="variable","keyframes"):"{"==e?P(r,t,"top"):q(e,t,r)},at:function(e,t,r){return";"==e?K(r):"{"==e||"}"==e?C(e,t,r):("word"==e?i="tag":"hash"==e&&(i="builtin"),"at")},interpolation:function(e,t,r){return"}"==e?K(r):"{"==e||";"==e?C(e,tLine truncated
+!function(t){"object"==typeof exports&&"object"==typeof module?t(require("../../lib/codemirror"),require("../xml/xml"),require("../javascript/javascript"),require("../css/css")):"function"==typeof define&&define.amd?define(["../../lib/codemirror","../xml/xml","../javascript/javascript","../css/css"],t):t(CodeMirror)}(function(m){"use strict";var l={script:[["lang",/(javascript|babel)/i,"javascript"],["type",/^(?:text|application)\/(?:x-)?(?:java|ecma)script$|^module$|^$/i,"javascript"],["type",/./,"text/plain"],[null,null,"javascript"]],style:[["lang",/^css$/i,"css"],["type",/^(text\/)?(x-)?(stylesheet|css)$/i,"css"],["type",/./,"text/plain"],[null,null,"css"]]};var a={};function d(t,e){e=t.match(a[t=e]||(a[t]=new RegExp("\\s+"+t+"\\s*=\\s*('|\")?([^'\"]+)('|\")?\\s*")));return e?/^\s*(.*?)\s*$/.exec(e[2])[1]:""}function g(t,e){return new RegExp((e?"^":"")+"</\\s*"+t+"\\s*>","i")}function o(t,e){for(var a in t)for(var n=e[a]||(e[a]=[]),l=t[a],o=l.length-1;0<=o;o--)n.unshift(l[o])}m.defineMode("htmlmixed",function(i,t){var c=m.getMode(i,{name:"xml",htmlMode:!0,multilineTagIndentFactor:t.multilineTagIndentFactor,multilineTagIndentPastTag:t.multilineTagIndentPastTag,allowMissingTagName:t.allowMissingTagName}),s={},e=t&&t.tags,a=t&&t.scriptTypes;if(o(l,s),e&&o(e,s),a)for(var n=a.length-1;0<=n;n--)s.script.unshift(["type",a[n].matches,a[n].mode]);function u(t,e){var a,o,r,n=c.token(t,e.htmlState),l=/\btag\b/.test(n);return l&&!/[<>\s\/]/.test(t.current())&&(a=e.htmlState.tagName&&e.htmlState.tagName.toLowerCase())&&s.hasOwnProperty(a)?e.inTag=a+" ":e.inTag&&l&&/>$/.test(t.current())?(a=/^([\S]+) (.*)/.exec(e.inTag),e.inTag=null,l=">"==t.current()&&function(t,e){for(var a=0;a<t.length;a++){var n=t[a];if(!n[0]||n[1].test(d(e,n[0])))return n[2]}}(s[a[1]],a[2]),l=m.getMode(i,l),o=g(a[1],!0),r=g(a[1],!1),e.token=function(t,e){return t.match(o,!1)?(e.token=u,e.localState=e.localMode=null):(a=t,n=r,t=e.localMode.token(t,e.localState),e=a.current(),-1<(l=e.search(n))?a.backUp(e.length-l):e.match(/<\/?$/)&&(a.backUp(e.length),a.match(n,!1)||a.match(e)),t);var a,n,l},e.localMode=l,e.localState=m.startState(l,c.indent(e.htmlState,"",""))):e.inTag&&(e.inTag+=t.current(),t.eol()&&(e.inTag+=" ")),n}return{startState:function(){return{token:u,inTag:null,localMode:null,localState:null,htmlState:m.startState(c)}},copyState:function(t){var e;return t.localState&&(e=m.copyState(t.localMode,t.localState)),{token:t.token,inTag:t.inTag,localMode:t.localMode,localState:e,htmlState:m.copyState(c,t.htmlState)}},token:function(t,e){return e.token(t,e)},indent:function(t,e,a){return!t.localMode||/^\s*<\//.test(e)?c.indent(t.htmlState,e,a):t.localMode.indent?t.localMode.indent(t.localState,e,a):m.Pass},innerMode:function(t){return{state:t.localState||t.htmlState,mode:t.localMode||c}}}},"xml","javascript","css"),m.defineMIME("text/html","htmlmixed")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(M){"use strict";function L(e,t,n,r,o,a){this.indented=e,this.column=t,this.type=n,this.info=r,this.align=o,this.prev=a}function D(e,t,n,r){var o=e.indented;e.context&&"statement"==e.context.type&&"statement"!=n&&(o=e.context.indented),e.context=new L(o,t,n,r,null,e.context)}function P(e){var t=e.context.type;return")"!=t&&"]"!=t&&"}"!=t||(e.indented=e.context.indented),e.context=e.context.prev}function E(e,t,n){return"variable"==t.prevToken||"type"==t.prevToken||(!!/\S(?:[^- ]>|[*\]])\s*$|\*$/.test(e.string.slice(0,n))||(!(!t.typeAtEndOfLine||e.column()!=e.indentation())||void 0))}function z(e){for(;;){if(!e||"top"==e.type)return 1;if("}"==e.type&&"namespace"!=e.prev.info)return;e=e.prev}}function e(e){for(var t={},n=e.split(" "),r=0;r<n.length;++r)t[n[r]]=!0;return t}function F(e,t){return"function"==typeof e?e(t):e.propertyIsEnumerable(t)}M.defineMode("clike",function(e,a){var i,l,s=e.indentUnit,c=a.statementIndentUnit||s,u=a.dontAlignCalls,o=a.keywords||{},d=a.types||{},f=a.builtin||{},p=a.blockKeywords||{},m=a.defKeywords||{},h=a.atoms||{},y=a.hooks||{},g=a.multiLineStrings,k=!1!==a.indentStatements,e=!1!==a.indentSwitch,x=a.namespaceSeparator,b=a.isPunctuationChar||/[\[\]{}\(\),;\:\.]/,v=a.numberStart||/[\d\.]/,w=a.number||/^(?:0x[a-f\d]+|0b[01]+|(?:\d+\.?\d*|\.\d+)(?:e[-+]?\d+)?)(u|ll?|l|f)?/i,_=a.isOperatorChar||/[+\-*&%=<>!?|\/]/,S=a.isIdentifierChar||/[\w\$_\xa1-\uffff]/,T=a.isReservedIdentifier||!1;function C(e,t){var a,n=e.next();if(y[n]){var r=y[n](e,t);if(!1!==r)return r}if('"'==n||"'"==n)return t.tokenize=(a=n,function(e,t){for(var n,r=!1,o=!1;null!=(n=e.next());){if(n==a&&!r){o=!0;break}r=!r&&"\\"==n}return!o&&(r||g)||(t.tokenize=null),"string"}),t.tokenize(e,t);if(v.test(n)){if(e.backUp(1),e.match(w))return"number";e.next()}if(b.test(n))return i=n,null;if("/"==n){if(e.eat("*"))return(t.tokenize=I)(e,t);if(e.eat("/"))return e.skipToEnd(),"comment"}if(_.test(n)){for(;!e.match(/^\/[\/*]/,!1)&&e.eat(_););return"operator"}if(e.eatWhile(S),x)for(;e.match(x);)e.eatWhile(S);r=e.current();return F(o,r)?(F(p,r)&&(i="newstatement"),F(m,r)&&(l=!0),"keyword"):F(d,r)?"type":F(f,r)||T&&T(r)?(F(p,r)&&(i="newstatement"),"builtin"):F(h,r)?"atom":"variable"}function I(e,t){for(var n,r=!1;n=e.next();){if("/"==n&&r){t.tokenize=null;break}r="*"==n}return"comment"}function N(e,t){a.typeFirstDefinitions&&e.eol()&&z(t.context)&&(t.typeAtEndOfLine=E(e,t,e.pos))}return{startState:function(e){return{tokenize:null,context:new L((e||0)-s,0,"top",null,!1),indented:0,startOfLine:!0,prevToken:null}},token:function(e,t){var n=t.context;if(e.sol()&&(null==n.align&&(n.align=!1),t.indented=e.indentation(),t.startOfLine=!0),e.eatSpace())return N(e,t),null;i=l=null;var r,o=(t.tokenize||C)(e,t);if("comment"==o||"meta"==o)return o;if(null==n.align&&(n.align=!0),";"==i||":"==i||","==i&&e.match(/^\s*(?:\/\/.*)?$/,!1))for(;"statement"==t.context.type;)P(t);else if("{"==i)D(t,e.column(),"}");else if("["==i)D(t,e.column(),"]");else if("("==i)D(t,e.column(),")");else if("}"==i){for(;"statement"==n.type;)n=P(t);for("}"==n.type&&(n=P(t));"statement"==n.type;)n=P(t)}else i==n.type?P(t):k&&(("}"==n.type||"top"==n.type)&&";"!=i||"statement"==n.type&&"newstatement"==i)&&D(t,e.column(),"statement",e.current());return"variable"==o&&("def"==t.prevToken||a.typeFirstDefinitions&&E(e,t,e.start)&&z(t.context)&&e.match(/^\s*\(/,!1))&&(o="def"),"def"==(o=y.token&&void 0!==(r=y.token(e,t,o))?r:o)&&!1===a.styleDefs&&(o="variable"),t.startOfLine=!1,t.prevToken=l?"def":o||i,N(e,t),o},indent:function(e,t){if(e.tokenize!=C&&null!=e.tokenize||e.typeAtEndOfLine&&z(e.context))return M.Pass;var n=e.context,r=t&&t.charAt(0),o=r==n.type;if("statement"==n.type&&"}"==r&&(n=n.prev),a.dontIndentStatements)for(;"statement"==n.type&&a.dontIndentStatements.test(n.info);)n=n.prev;if(y.indent){e=y.indent(e,n,t,s);if("number"==typeof e)return e}e=n.prev&&"switch"==n.prev.info;if(a.allmanIndentation&&/[{(]/.test(r)){for(;"top"!=n.type&&"}"!=n.type;)n=n.prev;return n.indented}return"statement"==n.type?n.indented+("{"==r?0:c):!n.align||u&&")"==n.type?")"!=n.type||o?n.indented+(o?0:s)+(o||!e||/^(?:case|default)\b/.test(t)?0:s):n.indented+c:n.column+(o?0:1)},electricInput:e?/^\s*(?:case .*?:|default:|\{\}?|\})$/:/^\s*[{}]$/,blockCommentStart:"/*",blockCommentEnd:"*/",blockCommentContinue:" * ",lineComment:"//",fold:"brace"}});var t="auto if break case register continue return default do sizeof static else struct switch extern typedef union for goto while enum const volatile inline restrict asm fortran",n="alignas alignof and and_eq audit axiom bitand bitor catch class compl concept constexpr const_cast decltype delete dynamic_cast explicit export final friend import module mutable namespace new noexcept not not_eq operator or or_eq override private protected public reinterpret_cast requLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror"),require("../htmlmixed/htmlmixed"),require("../clike/clike")):"function"==typeof define&&define.amd?define(["../../lib/codemirror","../htmlmixed/htmlmixed","../clike/clike"],e):e(CodeMirror)}(function(a){"use strict";function e(e){for(var t={},_=e.split(" "),r=0;r<_.length;++r)t[_[r]]=!0;return t}function o(s,i,l){return 0==s.length?n(i):function(e,t){for(var _=s[0],r=0;r<_.length;r++)if(e.match(_[r][0]))return t.tokenize=o(s.slice(1),i),_[r][1];return t.tokenize=n(i,l),"string"}}function n(n,a){return function(e,t){var _=e,r=t,s=n,i=a;if(!1!==i&&_.match("${",!1)||_.match("{$",!1))return r.tokenize=null,"string";if(!1!==i&&_.match(/^\$[a-zA-Z_][a-zA-Z0-9_]*/))return _.match("[",!1)&&(r.tokenize=o([[["[",null]],[[/\d[\w\.]*/,"number"],[/\$[a-zA-Z_][a-zA-Z0-9_]*/,"variable-2"],[/[\w\$]+/,"variable"]],[["]",null]]],s,i)),_.match(/^->\w/,!1)&&(r.tokenize=o([[["->",null]],[[/[\w]+/,"variable"]]],s,i)),"variable-2";for(var l=!1;!_.eol()&&(l||!1===i||!_.match("{$",!1)&&!_.match(/^(\$[a-zA-Z_][a-zA-Z0-9_]*|\$\{)/,!1));){if(!l&&_.match(s)){r.tokenize=null,r.tokStack.pop(),r.tokStack.pop();break}l="\\"==_.next()&&!l}return"string"}}var t="abstract and array as break case catch class clone const continue declare default do else elseif enddeclare endfor endforeach endif endswitch endwhile enum extends final for foreach function global goto if implements interface instanceof namespace new or private protected public static switch throw trait try use var while xor die echo empty exit eval include include_once isset list require require_once return print unset __halt_compiler self static parent yield insteadof finally readonly match",_="true false null TRUE FALSE NULL __CLASS__ __DIR__ __FILE__ __LINE__ __METHOD__ __FUNCTION__ __NAMESPACE__ __TRAIT__",r="func_num_args func_get_arg func_get_args strlen strcmp strncmp strcasecmp strncasecmp each error_reporting define defined trigger_error user_error set_error_handler restore_error_handler get_declared_classes get_loaded_extensions extension_loaded get_extension_funcs debug_backtrace constant bin2hex hex2bin sleep usleep time mktime gmmktime strftime gmstrftime strtotime date gmdate getdate localtime checkdate flush wordwrap htmlspecialchars htmlentities html_entity_decode md5 md5_file crc32 getimagesize image_type_to_mime_type phpinfo phpversion phpcredits strnatcmp strnatcasecmp substr_count strspn strcspn strtok strtoupper strtolower strpos strrpos strrev hebrev hebrevc nl2br basename dirname pathinfo stripslashes stripcslashes strstr stristr strrchr str_shuffle str_word_count strcoll substr substr_replace quotemeta ucfirst ucwords strtr addslashes addcslashes rtrim str_replace str_repeat count_chars chunk_split trim ltrim strip_tags similar_text explode implode setlocale localeconv parse_str str_pad chop strchr sprintf printf vprintf vsprintf sscanf fscanf parse_url urlencode urldecode rawurlencode rawurldecode readlink linkinfo link unlink exec system escapeshellcmd escapeshellarg passthru shell_exec proc_open proc_close rand srand getrandmax mt_rand mt_srand mt_getrandmax base64_decode base64_encode abs ceil floor round is_finite is_nan is_infinite bindec hexdec octdec decbin decoct dechex base_convert number_format fmod ip2long long2ip getenv putenv getopt microtime gettimeofday getrusage uniqid quoted_printable_decode set_time_limit get_cfg_var magic_quotes_runtime set_magic_quotes_runtime get_magic_quotes_gpc get_magic_quotes_runtime import_request_variables error_log serialize unserialize memory_get_usage memory_get_peak_usage var_dump var_export debug_zval_dump print_r highlight_file show_source highlight_string ini_get ini_get_all ini_set ini_alter ini_restore get_include_path set_include_path restore_include_path setcookie header headers_sent connection_aborted connection_status ignore_user_abort parse_ini_file is_uploaded_file move_uploaded_file intval floatval doubleval strval gettype settype is_null is_resource is_bool is_long is_float is_int is_integer is_double is_real is_numeric is_string is_array is_object is_scalar ereg ereg_replace eregi eregi_replace split spliti join sql_regcase dl pclose popen readfile rewind rmdir umask fclose feof fgetc fgets fgetss fread fopen fpassthru ftruncate fstat fseek ftell fflush fwrite fputs mkdir rename copy tempnam tmpfile file file_get_contents file_put_contents stream_select stream_context_create stream_context_set_params stream_context_set_option stream_context_get_options stream_filter_prepend stream_filter_append fgetcsv flock get_meta_tags stream_set_write_buffer set_file_buffer set_socket_blocking stream_set_blocking socket_set_blocking stream_get_meta_data stream_register_wrapper stream_wrapper_register stream_set_timeout socket_set_timeout socket_get_status realpath fnmatch fsockopen pfsockopen pack unpack get_browser crypt opendir closedir chdir getcwd rewinddir readdir dir glob fileatime filectime filegroup fileiLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(x){"use strict";function k(e){return new RegExp("^(("+e.join(")|(")+"))\\b")}var _=k(["and","or","not","is"]),v=["as","assert","break","class","continue","def","del","elif","else","except","finally","for","from","global","if","import","lambda","pass","raise","return","try","while","with","yield","in","False","True"],z=["abs","all","any","bin","bool","bytearray","callable","chr","classmethod","compile","complex","delattr","dict","dir","divmod","enumerate","eval","filter","float","format","frozenset","getattr","globals","hasattr","hash","help","hex","id","input","int","isinstance","issubclass","iter","len","list","locals","map","max","memoryview","min","next","object","oct","open","ord","pow","property","range","repr","reversed","round","set","setattr","slice","sorted","staticmethod","str","sum","super","tuple","type","vars","zip","__import__","NotImplemented","Ellipsis","__debug__"];function w(e){return e.scopes[e.scopes.length-1]}x.registerHelper("hintWords","python",v.concat(z).concat(["exec","print"])),x.defineMode("python",function(t,l){for(var s="error",o=l.delimiters||l.singleDelimiters||/^[\(\)\[\]\{\}@,:`=;\.\\]/,a=[l.singleOperators,l.doubleOperators,l.doubleDelimiters,l.tripleDelimiters,l.operators||/^([-+*/%\/&|^]=?|[<>=]+|\/\/=?|\*\*=?|!=|[~!@]|\.\.\.)/],e=0;e<a.length;e++)a[e]||a.splice(e--,1);var c,u,f=l.hangingIndent||t.indentUnit,n=v,r=z,p=(null!=l.extra_keywords&&(n=n.concat(l.extra_keywords)),null!=l.extra_builtins&&(r=r.concat(l.extra_builtins)),!(l.version&&Number(l.version)<3)),d=(u=p?(c=l.identifiers||/^[_A-Za-z\u00A1-\uFFFF][_A-Za-z0-9\u00A1-\uFFFF]*/,n=n.concat(["nonlocal","None","aiter","anext","async","await","breakpoint","match","case"]),r=r.concat(["ascii","bytes","exec","print"]),new RegExp("^(([rbuf]|(br)|(rb)|(fr)|(rf))?('{3}|\"{3}|['\"]))","i")):(c=l.identifiers||/^[_A-Za-z][_A-Za-z0-9]*/,n=n.concat(["exec","print"]),r=r.concat(["apply","basestring","buffer","cmp","coerce","execfile","file","intern","long","raw_input","reduce","reload","unichr","unicode","xrange","None"]),new RegExp("^(([rubf]|(ur)|(br))?('{3}|\"{3}|['\"]))","i")),k(n)),m=k(r);function i(e,t){var n,r=e.sol()&&"\\"!=t.lastToken;return r&&(t.indent=e.indentation()),r&&"py"==w(t).type?(r=w(t).offset,e.eatSpace()?(r<(n=e.indentation())?b(t):n<r&&y(e,t)&&"#"!=e.peek()&&(t.errorToken=!0),null):(n=h(e,t),0<r&&y(e,t)&&(n+=" "+s),n)):h(e,t)}function h(e,t,n){if(e.eatSpace())return null;if(!n&&e.match(/^#.*/))return"comment";if(e.match(/^[0-9\.]/,!1)){var r=!1;if(e.match(/^[\d_]*\.\d+(e[\+\-]?\d+)?/i)&&(r=!0),e.match(/^[\d_]+\.\d*/)&&(r=!0),r=e.match(/^\.\d+/)?!0:r)return e.eat(/J/i),"number";r=!1;if(e.match(/^0x[0-9a-f_]+/i)&&(r=!0),e.match(/^0b[01_]+/i)&&(r=!0),e.match(/^0o[0-7_]+/i)&&(r=!0),e.match(/^[1-9][\d_]*(e[\+\-]?[\d_]+)?/)&&(e.eat(/J/i),r=!0),r=e.match(/^0(?![\dx])/i)?!0:r)return e.eat(/L/i),"number"}if(e.match(u))return r=-1!==e.current().toLowerCase().indexOf("f"),t.tokenize=(r?function(n,r){for(;0<="rubf".indexOf(n.charAt(0).toLowerCase());)n=n.substr(1);var i=1==n.length,o="string";function a(e,t){for(;!e.eol();)if(e.eatWhile(/[^'"\{\}\\]/),e.eat("\\")){if(e.next(),i&&e.eol())return o}else{if(e.match(n))return t.tokenize=r,o;if(e.match("{{"))return o;if(e.match("{",!1))return t.tokenize=function r(i){return function(e,t){var n=h(e,t,!0);return"punctuation"==n&&("{"==e.current()?t.tokenize=r(i+1):"}"==e.current()&&(t.tokenize=1<i?r(i-1):a)),n}}(0),e.current()?o:t.tokenize(e,t);if(e.match("}}"))return o;if(e.match("}"))return s;e.eat(/['"]/)}if(i){if(l.singleLineStringErrors)return s;t.tokenize=r}return o}return a.isString=!0,a}:function(n,r){for(;0<="rubf".indexOf(n.charAt(0).toLowerCase());)n=n.substr(1);var i=1==n.length,o="string";function e(e,t){for(;!e.eol();)if(e.eatWhile(/[^'"\\]/),e.eat("\\")){if(e.next(),i&&e.eol())return o}else{if(e.match(n))return t.tokenize=r,o;e.eat(/['"]/)}if(i){if(l.singleLineStringErrors)return s;t.tokenize=r}return o}return e.isString=!0,e})(e.current(),t.tokenize),t.tokenize(e,t);for(var i=0;i<a.length;i++)if(e.match(a[i]))return"operator";return e.match(o)?"punctuation":"."==t.lastToken&&e.match(c)?"property":e.match(d)||e.match(_)?"keyword":e.match(m)?"builtin":e.match(/^(self|cls)\b/)?"variable-2":e.match(c)?"def"==t.lastToken||"class"==t.lastToken?"def":"variable":(e.next(),n?null:s)}function b(e){for(;"py"!=w(e).type;)e.scopes.pop();e.scopes.push({offset:w(e).offset+t.indentUnit,type:"py",align:null})}function y(e,t){for(var n=e.indentation();1<t.scopes.length&&w(t).offset>n;){if("py"!=w(t).type)return 1;t.scopes.pop()}return w(t).offset!=n}function g(e,t){e.sol()&&(t.beginningOfLine=!0,t.dedent=!1);var n,r,i,o=t.tokenize(e,t),a=e.current();if(t.beginningOfLine&&"@"==a)return e.match(c,!1)?"meta":p?"operator":s;if(/\S/.test(a)&&(t.beginningOfLine=!1),"variable"!=o&&"builtin"Line truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(p){"use strict";p.defineMode("go",function(e){var i,o=e.indentUnit,r={break:!0,case:!0,chan:!0,const:!0,continue:!0,default:!0,defer:!0,else:!0,fallthrough:!0,for:!0,func:!0,go:!0,goto:!0,if:!0,import:!0,interface:!0,map:!0,package:!0,range:!0,return:!0,select:!0,struct:!0,switch:!0,type:!0,var:!0,bool:!0,byte:!0,complex64:!0,complex128:!0,float32:!0,float64:!0,int8:!0,int16:!0,int32:!0,int64:!0,string:!0,uint8:!0,uint16:!0,uint32:!0,uint64:!0,int:!0,uint:!0,uintptr:!0,error:!0,rune:!0,any:!0,comparable:!0},a={true:!0,false:!0,iota:!0,nil:!0,append:!0,cap:!0,close:!0,complex:!0,copy:!0,delete:!0,imag:!0,len:!0,make:!0,new:!0,panic:!0,print:!0,println:!0,real:!0,recover:!0},c=/[+\-*&^%:=<>!|\/]/;function u(e,t){var o,n=e.next();if('"'==n||"'"==n||"`"==n)return t.tokenize=(o=n,function(e,t){for(var n,r=!1,i=!1;null!=(n=e.next());){if(n==o&&!r){i=!0;break}r=!r&&"`"!=o&&"\\"==n}return(i||!r&&"`"!=o)&&(t.tokenize=u),"string"}),t.tokenize(e,t);if(/[\d\.]/.test(n))return"."==n?e.match(/^[0-9_]+([eE][\-+]?[0-9_]+)?/):"0"==n?e.match(/^[xX][0-9a-fA-F_]+/)||e.match(/^[0-7_]+/):e.match(/^[0-9_]*\.?[0-9_]*([eE][\-+]?[0-9_]+)?/),"number";if(/[\[\]{}\(\),;\:\.]/.test(n))return i=n,null;if("/"==n){if(e.eat("*"))return(t.tokenize=l)(e,t);if(e.eat("/"))return e.skipToEnd(),"comment"}if(c.test(n))return e.eatWhile(c),"operator";e.eatWhile(/[\w\$_\xa1-\uffff]/);t=e.current();return r.propertyIsEnumerable(t)?("case"!=t&&"default"!=t||(i="case"),"keyword"):a.propertyIsEnumerable(t)?"atom":"variable"}function l(e,t){for(var n,r=!1;n=e.next();){if("/"==n&&r){t.tokenize=u;break}r="*"==n}return"comment"}function f(e,t,n,r,i){this.indented=e,this.column=t,this.type=n,this.align=r,this.prev=i}function s(e,t,n){e.context=new f(e.indented,t,n,null,e.context)}function d(e){var t;e.context.prev&&(")"!=(t=e.context.type)&&"]"!=t&&"}"!=t||(e.indented=e.context.indented),e.context=e.context.prev)}return{startState:function(e){return{tokenize:null,context:new f((e||0)-o,0,"top",!1),indented:0,startOfLine:!0}},token:function(e,t){var n=t.context;if(e.sol()&&(null==n.align&&(n.align=!1),t.indented=e.indentation(),t.startOfLine=!0,"case"==n.type&&(n.type="}")),e.eatSpace())return null;i=null;var r=(t.tokenize||u)(e,t);return"comment"==r||(null==n.align&&(n.align=!0),"{"==i?s(t,e.column(),"}"):"["==i?s(t,e.column(),"]"):"("==i?s(t,e.column(),")"):"case"==i?n.type="case":("}"==i&&"}"==n.type||i==n.type)&&d(t),t.startOfLine=!1),r},indent:function(e,t){if(e.tokenize!=u&&null!=e.tokenize)return p.Pass;var n=e.context,r=t&&t.charAt(0);if("case"==n.type&&/^(?:case|default)\b/.test(t))return e.context.type="}",n.indented;t=r==n.type;return n.align?n.column+(t?0:1):n.indented+(t?0:o)},electricChars:"{}):",closeBrackets:"()[]{}''\"\"``",fold:"brace",blockCommentStart:"/*",blockCommentEnd:"*/",lineComment:"//"}}),p.defineMIME("text/x-go","go")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("yaml",function(){var n=new RegExp("\\b(("+["true","false","on","off","yes","no"].join(")|(")+"))$","i");return{token:function(e,i){var t=e.peek(),r=i.escaped;if(i.escaped=!1,"#"==t&&(0==e.pos||/\s/.test(e.string.charAt(e.pos-1))))return e.skipToEnd(),"comment";if(e.match(/^('([^']|\\.)*'?|"([^"]|\\.)*"?)/))return"string";if(i.literal&&e.indentation()>i.keyCol)return e.skipToEnd(),"string";if(i.literal&&(i.literal=!1),e.sol()){if(i.keyCol=0,i.pair=!1,i.pairStart=!1,e.match("---"))return"def";if(e.match("..."))return"def";if(e.match(/\s*-\s+/))return"meta"}if(e.match(/^(\{|\}|\[|\])/))return"{"==t?i.inlinePairs++:"}"==t?i.inlinePairs--:"["==t?i.inlineList++:i.inlineList--,"meta";if(0<i.inlineList&&!r&&","==t)return e.next(),"meta";if(0<i.inlinePairs&&!r&&","==t)return i.keyCol=0,i.pair=!1,i.pairStart=!1,e.next(),"meta";if(i.pairStart){if(e.match(/^\s*(\||\>)\s*/))return i.literal=!0,"meta";if(e.match(/^\s*(\&|\*)[a-z0-9\._-]+\b/i))return"variable-2";if(0==i.inlinePairs&&e.match(/^\s*-?[0-9\.\,]+\s?$/))return"number";if(0<i.inlinePairs&&e.match(/^\s*-?[0-9\.\,]+\s?(?=(,|}))/))return"number";if(e.match(n))return"keyword"}return!i.pair&&e.match(/^\s*(?:[,\[\]{}&*!|>'"%@`][^\s'":]|[^\s,\[\]{}#&*!|>'"%@`])[^#:]*(?=:($|\s))/)?(i.pair=!0,i.keyCol=e.indentation(),"atom"):i.pair&&e.match(/^:\s*/)?(i.pairStart=!0,"meta"):(i.pairStart=!1,i.escaped="\\"==t,e.next(),null)},startState:function(){return{pair:!1,pairStart:!1,keyCol:0,inlinePairs:0,inlineList:0,literal:!1,escaped:!1}},lineComment:"#",fold:"indent"}}),e.defineMIME("text/x-yaml","yaml"),e.defineMIME("text/yaml","yaml")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(s){"use strict";s.defineMode("shell",function(){var o={};function e(e,t){for(var n=0;n<t.length;n++)o[t[n]]=e}var t=["true","false"],n=["if","then","do","else","elif","while","until","for","in","esac","fi","fin","fil","done","exit","set","unset","export","function"],r=["ab","awk","bash","beep","cat","cc","cd","chown","chmod","chroot","clear","cp","curl","cut","diff","echo","find","gawk","gcc","get","git","grep","hg","kill","killall","ln","ls","make","mkdir","openssl","mv","nc","nl","node","npm","ping","ps","restart","rm","rmdir","sed","service","sh","shopt","shred","source","sort","sleep","ssh","start","stop","su","sudo","svn","tee","telnet","top","touch","vi","vim","wall","wc","wget","who","write","yes","zsh"];function i(e,t){if(e.eatSpace())return null;var n,r=e.sol(),i=e.next();if("\\"===i)return e.next(),null;if("'"===i||'"'===i||"`"===i)return t.tokens.unshift(f(i,"`"===i?"quote":"string")),l(e,t);if("#"===i)return r&&e.eat("!")?(e.skipToEnd(),"meta"):(e.skipToEnd(),"comment");if("$"===i)return t.tokens.unshift(u),l(e,t);if("+"===i||"="===i)return"operator";if("-"===i)return e.eat("-"),e.eatWhile(/\w/),"attribute";if("<"==i){if(e.match("<<"))return"operator";r=e.match(/^<-?\s*['"]?([^'"]*)['"]?/);if(r)return t.tokens.unshift((n=r[1],function(e,t){return e.sol()&&e.string==n&&t.tokens.shift(),e.skipToEnd(),"string-2"})),"string-2"}if(/\d/.test(i)&&(e.eatWhile(/\d/),e.eol()||!/\w/.test(e.peek())))return"number";e.eatWhile(/[\w-]/);t=e.current();return"="===e.peek()&&/\w+/.test(t)?"def":o.hasOwnProperty(t)?o[t]:null}function f(i,o){var s="("==i?")":"{"==i?"}":i;return function(e,t){for(var n,r=!1;null!=(n=e.next());){if(n===s&&!r){t.tokens.shift();break}if("$"===n&&!r&&"'"!==i&&e.peek()!=s){r=!0,e.backUp(1),t.tokens.unshift(u);break}if(!r&&i!==s&&n===i)return t.tokens.unshift(f(i,o)),l(e,t);if(!r&&/['"]/.test(n)&&!/['"]/.test(i)){t.tokens.unshift(function(n,r){return function(e,t){return t.tokens[0]=f(n,r),e.next(),l(e,t)}}(n,"string")),e.backUp(1);break}r=!r&&"\\"===n}return o}}s.registerHelper("hintWords","shell",t.concat(n,r)),e("atom",t),e("keyword",n),e("builtin",r);var u=function(e,t){1<t.tokens.length&&e.eat("$");var n=e.next();return/['"({]/.test(n)?(t.tokens[0]=f(n,"("==n?"quote":"{"==n?"def":"string"),l(e,t)):(/\d/.test(n)||e.eatWhile(/\w/),t.tokens.shift(),"def")};function l(e,t){return(t.tokens[0]||i)(e,t)}return{startState:function(){return{tokens:[]}},token:l,closeBrackets:"()[]{}''\"\"``",lineComment:"#",fold:"brace"}}),s.defineMIME("text/x-sh","shell"),s.defineMIME("application/x-sh","shell")});;
+!function(t){"object"==typeof exports&&"object"==typeof module?t(require("../../lib/codemirror"),require("../xml/xml"),require("../meta")):"function"==typeof define&&define.amd?define(["../../lib/codemirror","../xml/xml","../meta"],t):t(CodeMirror)}(function(w){"use strict";w.defineMode("markdown",function(m,d){var g=w.getMode(m,"text/html"),u="null"==g.name;void 0===d.highlightFormatting&&(d.highlightFormatting=!1),void 0===d.maxBlockquoteDepth&&(d.maxBlockquoteDepth=0),void 0===d.taskLists&&(d.taskLists=!1),void 0===d.strikethrough&&(d.strikethrough=!1),void 0===d.emoji&&(d.emoji=!1),void 0===d.fencedCodeBlockHighlighting&&(d.fencedCodeBlockHighlighting=!0),void 0===d.fencedCodeBlockDefaultMode&&(d.fencedCodeBlockDefaultMode="text/plain"),void 0===d.xml&&(d.xml=!0),void 0===d.tokenTypeOverrides&&(d.tokenTypeOverrides={});var t,c={header:"header",code:"comment",quote:"quote",list1:"variable-2",list2:"variable-3",list3:"keyword",hr:"hr",image:"image",imageAltText:"image-alt-text",imageMarker:"image-marker",formatting:"formatting",linkInline:"link",linkEmail:"link",linkText:"link",linkHref:"string",em:"em",strong:"strong",strikethrough:"strikethrough",emoji:"builtin"};for(t in c)c.hasOwnProperty(t)&&d.tokenTypeOverrides[t]&&(c[t]=d.tokenTypeOverrides[t]);var f=/^([*\-_])(?:\s*\1){2,}\s*$/,k=/^(?:[*\-+]|^[0-9]+([.)]))\s+/,F=/^\[(x| )\](?=\s)/i,D=d.allowAtxHeaderWithoutSpace?/^(#+)/:/^(#+)(?: |$)/,p=/^ {0,3}(?:\={1,}|-{2,})\s*$/,i=/^[^#!\[\]*_\\<>` "'(~:]+/,E=/^(~~~+|```+)[ \t]*([\w\/+#-]*)[^\n`]*$/,x=/^\s*\[[^\]]+?\]:.*$/,A=/[!"#$%&'()*+,\-.\/:;<=>?@\[\\\]^_`{|}~\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060D\u061B\u061E\u061F\u066A-\u066D\u06D4\u0700-\u070D\u07F7-\u07F9\u0830-\u083E\u085E\u0964\u0965\u0970\u0AF0\u0DF4\u0E4F\u0E5A\u0E5B\u0F04-\u0F12\u0F14\u0F3A-\u0F3D\u0F85\u0FD0-\u0FD4\u0FD9\u0FDA\u104A-\u104F\u10FB\u1360-\u1368\u1400\u166D\u166E\u169B\u169C\u16EB-\u16ED\u1735\u1736\u17D4-\u17D6\u17D8-\u17DA\u1800-\u180A\u1944\u1945\u1A1E\u1A1F\u1AA0-\u1AA6\u1AA8-\u1AAD\u1B5A-\u1B60\u1BFC-\u1BFF\u1C3B-\u1C3F\u1C7E\u1C7F\u1CC0-\u1CC7\u1CD3\u2010-\u2027\u2030-\u2043\u2045-\u2051\u2053-\u205E\u207D\u207E\u208D\u208E\u2308-\u230B\u2329\u232A\u2768-\u2775\u27C5\u27C6\u27E6-\u27EF\u2983-\u2998\u29D8-\u29DB\u29FC\u29FD\u2CF9-\u2CFC\u2CFE\u2CFF\u2D70\u2E00-\u2E2E\u2E30-\u2E42\u3001-\u3003\u3008-\u3011\u3014-\u301F\u3030\u303D\u30A0\u30FB\uA4FE\uA4FF\uA60D-\uA60F\uA673\uA67E\uA6F2-\uA6F7\uA874-\uA877\uA8CE\uA8CF\uA8F8-\uA8FA\uA8FC\uA92E\uA92F\uA95F\uA9C1-\uA9CD\uA9DE\uA9DF\uAA5C-\uAA5F\uAADE\uAADF\uAAF0\uAAF1\uABEB\uFD3E\uFD3F\uFE10-\uFE19\uFE30-\uFE52\uFE54-\uFE61\uFE63\uFE68\uFE6A\uFE6B\uFF01-\uFF03\uFF05-\uFF0A\uFF0C-\uFF0F\uFF1A\uFF1B\uFF1F\uFF20\uFF3B-\uFF3D\uFF3F\uFF5B\uFF5D\uFF5F-\uFF65]|\uD800[\uDD00-\uDD02\uDF9F\uDFD0]|\uD801\uDD6F|\uD802[\uDC57\uDD1F\uDD3F\uDE50-\uDE58\uDE7F\uDEF0-\uDEF6\uDF39-\uDF3F\uDF99-\uDF9C]|\uD804[\uDC47-\uDC4D\uDCBB\uDCBC\uDCBE-\uDCC1\uDD40-\uDD43\uDD74\uDD75\uDDC5-\uDDC9\uDDCD\uDDDB\uDDDD-\uDDDF\uDE38-\uDE3D\uDEA9]|\uD805[\uDCC6\uDDC1-\uDDD7\uDE41-\uDE43\uDF3C-\uDF3E]|\uD809[\uDC70-\uDC74]|\uD81A[\uDE6E\uDE6F\uDEF5\uDF37-\uDF3B\uDF44]|\uD82F\uDC9F|\uD836[\uDE87-\uDE8B]/;function C(t,e,i){return(e.f=e.inline=i)(t,e)}function S(t,e,i){return(e.f=e.block=i)(t,e)}function n(t){var e;return t.linkTitle=!1,t.linkHref=!1,t.linkText=!1,t.em=!1,t.strong=!1,t.strikethrough=!1,t.quote=0,t.indentedCode=!1,t.f==v&&(u?u:"xml"==(e=w.innerMode(g,t.htmlState)).mode.name&&null===e.state.tagStart&&!e.state.context&&e.state.tokenize.isInText)&&(t.f=T,t.block=a,t.htmlState=null),t.trailingSpace=0,t.trailingSpaceNewLine=!1,t.prevLine=t.thisLine,t.thisLine={stream:null},null}function a(t,e){var i=t.column()===e.indentation,n=!(n=e.prevLine.stream)||!/\S/.test(n.string),u=e.indentedCode,a=e.prevLine.hr,r=!1!==e.list,o=(e.listStack[e.listStack.length-1]||0)+3,l=(e.indentedCode=!1,e.indentation);if(null===e.indentationDiff&&(e.indentationDiff=e.indentation,r)){for(e.list=null;l<e.listStack[e.listStack.length-1];)e.listStack.pop(),e.listStack.length?e.indentation=e.listStack[e.listStack.length-1]:e.list=!1;!1!==e.list&&(e.indentationDiff=l-e.listStack[e.listStack.length-1])}var h,s=!(n||a||e.prevLine.header||r&&u||e.prevLine.fencedCodeEnd),a=(!1===e.list||a||n)&&e.indentation<=o&&t.match(f),g=null;return 4<=e.indentationDiff&&(u||e.prevLine.fencedCodeEnd||e.prevLine.header||n)?(t.skipToEnd(),e.indentedCode=!0,c.code):t.eatSpace()?null:i&&e.indentation<=o&&(g=t.match(D))&&g[1].length<=6?(e.quote=0,e.header=g[1].length,e.thisLine.header=!0,d.highlightFormatting&&(e.formatting="header"),e.f=e.inline,L(e)):e.indentation<=o&&t.eat(">")?(e.quote=i?1:e.quote+1,d.highlightFormatting&&(e.formatting="quote"),t.eatSpace(),L(e)):!a&&!e.setext&&i&&e.indentation<=o&&(g=t.match(k))?(u=g[1]?"ol":"ul",e.indentation=l+t.current().length,e.list=!0,e.quote=0,e.listStack.push(e.indentation),e.em=!1,e.strong=!1,e.code=!1,e.strikethrough=!1,d.taskLists&Line truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(a){"use strict";function e(e){for(var t;null!=(t=e.next());)if("`"==t&&!e.eat("`"))return"variable-2";return e.backUp(e.current().length-1),e.eatWhile(/\w/)?"variable-2":null}function t(e){return e.eat("@")&&(e.match("session."),e.match("local."),e.match("global.")),e.eat("'")?(e.match(/^.*'/),"variable-2"):e.eat('"')?(e.match(/^.*"/),"variable-2"):e.eat("`")?(e.match(/^.*`/),"variable-2"):e.match(/^[0-9a-zA-Z$\.\_]+/)?"variable-2":null}function r(e){return e.eat("N")?"atom":e.match(/^[a-zA-Z.#!?]/)?"variable-2":null}a.defineMode("sql",function(r,e){var i=e.client||{},n=e.atoms||{false:!0,true:!0,null:!0},s=e.builtin||y(v),o=e.keywords||y(f),l=e.operatorChars||/^[*+\-%<>!=&|~^\/]/,c=e.support||{},m=e.hooks||{},d=e.dateSQL||{date:!0,time:!0,timestamp:!0},u=!1!==e.backslashStringEscapes,p=e.brackets||/^[\{}\(\)\[\]]/,_=e.punctuation||/^[;.,:]/;function g(e,t){var r=e.next();if(m[r]){var a=m[r](e,t);if(!1!==a)return a}return c.hexNumber&&("0"==r&&e.match(/^[xX][0-9a-fA-F]+/)||("x"==r||"X"==r)&&e.match(/^'[0-9a-fA-F]*'/))||c.binaryNumber&&(("b"==r||"B"==r)&&e.match(/^'[01]*'/)||"0"==r&&e.match(/^b[01]+/))?"number":47<r.charCodeAt(0)&&r.charCodeAt(0)<58?(e.match(/^[0-9]*(\.[0-9]+)?([eE][-+]?[0-9]+)?/),c.decimallessFloat&&e.match(/^\.(?!\.)/),"number"):"?"==r&&(e.eatSpace()||e.eol()||e.eat(";"))?"variable-3":"'"==r||'"'==r&&c.doubleQuote?(t.tokenize=h(r),t.tokenize(e,t)):!(c.nCharCast&&("n"==r||"N"==r)||c.charsetCast&&"_"==r&&e.match(/[a-z][a-z0-9]*/i))||"'"!=e.peek()&&'"'!=e.peek()?c.escapeConstant&&("e"==r||"E"==r)&&("'"==e.peek()||'"'==e.peek()&&c.doubleQuote)?(t.tokenize=function(e,t){return(t.tokenize=h(e.next(),!0))(e,t)},"keyword"):c.commentSlashSlash&&"/"==r&&e.eat("/")||c.commentHash&&"#"==r||"-"==r&&e.eat("-")&&(!c.commentSpaceRequired||e.eat(" "))?(e.skipToEnd(),"comment"):"/"==r&&e.eat("*")?(t.tokenize=function a(i){return function(e,t){var r=e.match(/^.*?(\/\*|\*\/)/);return r?"/*"==r[1]?t.tokenize=a(i+1):t.tokenize=1<i?a(i-1):g:e.skipToEnd(),"comment"}}(1),t.tokenize(e,t)):"."==r?c.zerolessFloat&&e.match(/^(?:\d+(?:e[+-]?\d+)?)/i)?"number":e.match(/^\.+/)?null:e.match(/^[\w\d_$#]+/)?"variable-2":void 0:l.test(r)?(e.eatWhile(l),"operator"):p.test(r)?"bracket":_.test(r)?(e.eatWhile(_),"punctuation"):"{"==r&&(e.match(/^( )*(d|D|t|T|ts|TS)( )*'[^']*'( )*}/)||e.match(/^( )*(d|D|t|T|ts|TS)( )*"[^"]*"( )*}/))?"number":(e.eatWhile(/^[_\w\d]/),a=e.current().toLowerCase(),d.hasOwnProperty(a)&&(e.match(/^( )+'[^']*'/)||e.match(/^( )+"[^"]*"/))?"number":n.hasOwnProperty(a)?"atom":s.hasOwnProperty(a)?"type":o.hasOwnProperty(a)?"keyword":i.hasOwnProperty(a)?"builtin":null):"keyword"}function h(i,n){return function(e,t){for(var r,a=!1;null!=(r=e.next());){if(r==i&&!a){t.tokenize=g;break}a=(u||n)&&!a&&"\\"==r}return"string"}}function b(e,t,r){t.context={prev:t.context,indent:e.indentation(),col:e.column(),type:r}}return{startState:function(){return{tokenize:g,context:null}},token:function(e,t){if(e.sol()&&t.context&&null==t.context.align&&(t.context.align=!1),t.tokenize==g&&e.eatSpace())return null;var r=t.tokenize(e,t);if("comment"==r)return r;t.context&&null==t.context.align&&(t.context.align=!0);var a=e.current();return"("==a?b(e,t,")"):"["==a?b(e,t,"]"):t.context&&t.context.type==a&&((e=t).indent=e.context.indent,e.context=e.context.prev),r},indent:function(e,t){e=e.context;if(!e)return a.Pass;t=t.charAt(0)==e.type;return e.align?e.col+(t?0:1):e.indent+(t?0:r.indentUnit)},blockCommentStart:"/*",blockCommentEnd:"*/",lineComment:c.commentSlashSlash?"//":c.commentHash?"#":"--",closeBrackets:"()[]{}''\"\"``",config:e}});var f="alter and as asc between by count create delete desc distinct drop from group having in insert into is join like not on or order select set table union update values where limit ";function y(e){for(var t={},r=e.split(" "),a=0;a<r.length;++a)t[r[a]]=!0;return t}var v="bool boolean bit blob enum long longblob longtext medium mediumblob mediumint mediumtext time timestamp tinyblob tinyint tinytext text bigint int int1 int2 int3 int4 int8 integer float float4 float8 double char varbinary varchar varcharacter precision real date datetime year unsigned signed decimal numeric";a.defineMIME("text/x-sql",{name:"sql",keywords:y(f+"begin"),builtin:y(v),atoms:y("false true null unknown"),dateSQL:y("date time timestamp"),support:y("doubleQuote binaryNumber hexNumber")}),a.defineMIME("text/x-mssql",{name:"sql",client:y("$partition binary_checksum checksum connectionproperty context_info current_request_id error_line error_message error_number error_procedure error_severity error_state formatmessage get_filestream_transaction_context getansinull host_id host_name isnull isnumeric min_active_rowversion newid newsequentialid rowcount_big xact_state object_id"),keywords:y(f+"begin trigger proc view index for add constLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("properties",function(){return{token:function(e,i){var t=e.sol()||i.afterSection,n=e.eol();if(i.afterSection=!1,t&&(i.nextMultiline?(i.inMultiline=!0,i.nextMultiline=!1):i.position="def"),n&&!i.nextMultiline&&(i.inMultiline=!1,i.position="def"),t)for(;e.eatSpace(););n=e.next();return!t||"#"!==n&&"!"!==n&&";"!==n?t&&"["===n?(i.afterSection=!0,e.skipTo("]"),e.eat("]"),"header"):"="===n||":"===n?(i.position="quote",null):("\\"===n&&"quote"===i.position&&e.eol()&&(i.nextMultiline=!0),i.position):(i.position="comment",e.skipToEnd(),"comment")},startState:function(){return{position:"def",nextMultiline:!1,inMultiline:!1,afterSection:!1}}}}),e.defineMIME("text/x-properties","properties"),e.defineMIME("text/x-ini","properties")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("toml",function(){return{startState:function(){return{inString:!1,stringType:"",lhs:!0,inArray:0}},token:function(e,t){if(t.inString||'"'!=e.peek()&&"'"!=e.peek()||(t.stringType=e.peek(),e.next(),t.inString=!0),e.sol()&&0===t.inArray&&(t.lhs=!0),t.inString){for(;t.inString&&!e.eol();)e.peek()===t.stringType?(e.next(),t.inString=!1):"\\"===e.peek()?(e.next(),e.next()):e.match(/^.[^\\\"\']*/);return t.lhs?"property string":"string"}return t.inArray&&"]"===e.peek()?(e.next(),t.inArray--,"bracket"):t.lhs&&"["===e.peek()&&e.skipTo("]")?(e.next(),"]"===e.peek()&&e.next(),"atom"):"#"===e.peek()?(e.skipToEnd(),"comment"):e.eatSpace()?null:t.lhs&&e.eatWhile(function(e){return"="!=e&&" "!=e})?"property":t.lhs&&"="===e.peek()?(e.next(),t.lhs=!1,null):(t.lhs||!e.match(/^\d\d\d\d[\d\-\:\.T]*Z/))&&(t.lhs||!e.match("true")&&!e.match("false"))?t.lhs||"["!==e.peek()?!t.lhs&&e.match(/^\-?\d+(?:\.\d+)?/)?"number":(e.eatSpace()||e.next(),null):(t.inArray++,e.next(),"bracket"):"atom"}}}),e.defineMIME("text/x-toml","toml")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("nginx",function(e){function _(e){for(var _={},t=e.split(" "),i=0;i<t.length;++i)_[t[i]]=!0;return _}var s,i=_("break return rewrite set accept_mutex accept_mutex_delay access_log add_after_body add_before_body add_header addition_types aio alias allow ancient_browser ancient_browser_value auth_basic auth_basic_user_file auth_http auth_http_header auth_http_timeout autoindex autoindex_exact_size autoindex_localtime charset charset_types client_body_buffer_size client_body_in_file_only client_body_in_single_buffer client_body_temp_path client_body_timeout client_header_buffer_size client_header_timeout client_max_body_size connection_pool_size create_full_put_path daemon dav_access dav_methods debug_connection debug_points default_type degradation degrade deny devpoll_changes devpoll_events directio directio_alignment empty_gif env epoll_events error_log eventport_events expires fastcgi_bind fastcgi_buffer_size fastcgi_buffers fastcgi_busy_buffers_size fastcgi_cache fastcgi_cache_key fastcgi_cache_methods fastcgi_cache_min_uses fastcgi_cache_path fastcgi_cache_use_stale fastcgi_cache_valid fastcgi_catch_stderr fastcgi_connect_timeout fastcgi_hide_header fastcgi_ignore_client_abort fastcgi_ignore_headers fastcgi_index fastcgi_intercept_errors fastcgi_max_temp_file_size fastcgi_next_upstream fastcgi_param fastcgi_pass_header fastcgi_pass_request_body fastcgi_pass_request_headers fastcgi_read_timeout fastcgi_send_lowat fastcgi_send_timeout fastcgi_split_path_info fastcgi_store fastcgi_store_access fastcgi_temp_file_write_size fastcgi_temp_path fastcgi_upstream_fail_timeout fastcgi_upstream_max_fails flv geoip_city geoip_country google_perftools_profiles gzip gzip_buffers gzip_comp_level gzip_disable gzip_hash gzip_http_version gzip_min_length gzip_no_buffer gzip_proxied gzip_static gzip_types gzip_vary gzip_window if_modified_since ignore_invalid_headers image_filter image_filter_buffer image_filter_jpeg_quality image_filter_transparency imap_auth imap_capabilities imap_client_buffer index ip_hash keepalive_requests keepalive_timeout kqueue_changes kqueue_events large_client_header_buffers limit_conn limit_conn_log_level limit_rate limit_rate_after limit_req limit_req_log_level limit_req_zone limit_zone lingering_time lingering_timeout lock_file log_format log_not_found log_subrequest map_hash_bucket_size map_hash_max_size master_process memcached_bind memcached_buffer_size memcached_connect_timeout memcached_next_upstream memcached_read_timeout memcached_send_timeout memcached_upstream_fail_timeout memcached_upstream_max_fails merge_slashes min_delete_depth modern_browser modern_browser_value msie_padding msie_refresh multi_accept open_file_cache open_file_cache_errors open_file_cache_events open_file_cache_min_uses open_file_cache_valid open_log_file_cache output_buffers override_charset perl perl_modules perl_require perl_set pid pop3_auth pop3_capabilities port_in_redirect postpone_gzipping postpone_output protocol proxy proxy_bind proxy_buffer proxy_buffer_size proxy_buffering proxy_buffers proxy_busy_buffers_size proxy_cache proxy_cache_key proxy_cache_methods proxy_cache_min_uses proxy_cache_path proxy_cache_use_stale proxy_cache_valid proxy_connect_timeout proxy_headers_hash_bucket_size proxy_headers_hash_max_size proxy_hide_header proxy_ignore_client_abort proxy_ignore_headers proxy_intercept_errors proxy_max_temp_file_size proxy_method proxy_next_upstream proxy_pass_error_message proxy_pass_header proxy_pass_request_body proxy_pass_request_headers proxy_read_timeout proxy_redirect proxy_send_lowat proxy_send_timeout proxy_set_body proxy_set_header proxy_ssl_session_reuse proxy_store proxy_store_access proxy_temp_file_write_size proxy_temp_path proxy_timeout proxy_upstream_fail_timeout proxy_upstream_max_fails random_index read_ahead real_ip_header recursive_error_pages request_pool_size reset_timedout_connection resolver resolver_timeout rewrite_log rtsig_overflow_events rtsig_overflow_test rtsig_overflow_threshold rtsig_signo satisfy secure_link_secret send_lowat send_timeout sendfile sendfile_max_chunk server_name_in_redirect server_names_hash_bucket_size server_names_hash_max_size server_tokens set_real_ip_from smtp_auth smtp_capabilities smtp_client_buffer smtp_greeting_delay so_keepalive source_charset ssi ssi_ignore_recycled_buffers ssi_min_file_chunk ssi_silent_errors ssi_types ssi_value_length ssl ssl_certificate ssl_certificate_key ssl_ciphers ssl_client_certificate ssl_crl ssl_dhparam ssl_engine ssl_prefer_server_ciphers ssl_protocols ssl_session_cache ssl_session_timeout ssl_verify_client ssl_verify_depth starttls stub_status sub_filter sub_filter_once sub_filter_types tcp_nodelay tcp_nopush thread_stack_size timeout timer_resolution types_hash_bucket_size types_hash_maLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror"),require("../../addon/mode/simple")):"function"==typeof define&&define.amd?define(["../../lib/codemirror","../../addon/mode/simple"],e):e(CodeMirror)}(function(e){"use strict";var n="from",t=new RegExp("^(\\s*)\\b(from)\\b","i"),r=["run","cmd","entrypoint","shell"],o=new RegExp("^(\\s*)("+r.join("|")+")(\\s+\\[)","i"),l="expose",s=new RegExp("^(\\s*)("+l+")(\\s+)","i"),n="("+[n,l].concat(r).concat(["arg","from","maintainer","label","env","add","copy","volume","user","workdir","onbuild","stopsignal","healthcheck","shell"]).join("|")+")",l=new RegExp("^(\\s*)"+n+"(\\s*)(#.*)?$","i"),r=new RegExp("^(\\s*)"+n+"(\\s+)","i");e.defineSimpleMode("dockerfile",{start:[{regex:/^\s*#.*$/,sol:!0,token:"comment"},{regex:t,token:[null,"keyword"],sol:!0,next:"from"},{regex:l,token:[null,"keyword",null,"error"],sol:!0},{regex:o,token:[null,"keyword",null],sol:!0,next:"array"},{regex:s,token:[null,"keyword",null],sol:!0,next:"expose"},{regex:r,token:[null,"keyword",null],sol:!0,next:"arguments"},{regex:/./,token:null}],from:[{regex:/\s*$/,token:null,next:"start"},{regex:/(\s*)(#.*)$/,token:[null,"error"],next:"start"},{regex:/(\s*\S+\s+)(as)/i,token:[null,"keyword"],next:"start"},{token:null,next:"start"}],single:[{regex:/(?:[^\\']|\\.)/,token:"string"},{regex:/'/,token:"string",pop:!0}],double:[{regex:/(?:[^\\"]|\\.)/,token:"string"},{regex:/"/,token:"string",pop:!0}],array:[{regex:/\]/,token:null,next:"start"},{regex:/"(?:[^\\"]|\\.)*"?/,token:"string"}],expose:[{regex:/\d+$/,token:"number",next:"start"},{regex:/[^\d]+$/,token:null,next:"start"},{regex:/\d+/,token:"number"},{regex:/[^\d]+/,token:null},{token:null,next:"start"}],arguments:[{regex:/^\s*#.*$/,sol:!0,token:"comment"},{regex:/"(?:[^\\"]|\\.)*"?$/,token:"string",next:"start"},{regex:/"/,token:"string",push:"double"},{regex:/'(?:[^\\']|\\.)*'?$/,token:"string",next:"start"},{regex:/'/,token:"string",push:"single"},{regex:/[^#"']+[\\`]$/,token:null},{regex:/[^#"']+$/,token:null,next:"start"},{regex:/[^#"']+/,token:null},{token:null,next:"start"}],meta:{lineComment:"#"}}),e.defineMIME("text/x-dockerfile","dockerfile")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("lua",function(e,t){var n=e.indentUnit;function a(e){return new RegExp("^(?:"+e.join("|")+")$","i")}var r=a(t.specials||[]),o=a(["_G","_VERSION","assert","collectgarbage","dofile","error","getfenv","getmetatable","ipairs","load","loadfile","loadstring","module","next","pairs","pcall","print","rawequal","rawget","rawset","require","select","setfenv","setmetatable","tonumber","tostring","type","unpack","xpcall","coroutine.create","coroutine.resume","coroutine.running","coroutine.status","coroutine.wrap","coroutine.yield","debug.debug","debug.getfenv","debug.gethook","debug.getinfo","debug.getlocal","debug.getmetatable","debug.getregistry","debug.getupvalue","debug.setfenv","debug.sethook","debug.setlocal","debug.setmetatable","debug.setupvalue","debug.traceback","close","flush","lines","read","seek","setvbuf","write","io.close","io.flush","io.input","io.lines","io.open","io.output","io.popen","io.read","io.stderr","io.stdin","io.stdout","io.tmpfile","io.type","io.write","math.abs","math.acos","math.asin","math.atan","math.atan2","math.ceil","math.cos","math.cosh","math.deg","math.exp","math.floor","math.fmod","math.frexp","math.huge","math.ldexp","math.log","math.log10","math.max","math.min","math.modf","math.pi","math.pow","math.rad","math.random","math.randomseed","math.sin","math.sinh","math.sqrt","math.tan","math.tanh","os.clock","os.date","os.difftime","os.execute","os.exit","os.getenv","os.remove","os.rename","os.setlocale","os.time","os.tmpname","package.cpath","package.loaded","package.loaders","package.loadlib","package.path","package.preload","package.seeall","string.byte","string.char","string.dump","string.find","string.format","string.gmatch","string.gsub","string.len","string.lower","string.match","string.rep","string.reverse","string.sub","string.upper","table.concat","table.insert","table.maxn","table.remove","table.sort"]),i=a(["and","break","elseif","false","nil","not","or","return","true","function","end","if","then","else","do","while","repeat","until","for","in","local"]),l=a(["function","if","repeat","do","\\(","{"]),s=a(["end","until","\\)","}"]),u=new RegExp("^(?:"+["end","until","\\)","}","else","elseif"].join("|")+")","i");function c(e){for(var t=0;e.eat("=");)++t;return e.eat("["),t}function m(e,t){var r,n=e.next();return"-"==n&&e.eat("-")?e.eat("[")&&e.eat("[")?(t.cur=d(c(e),"comment"))(e,t):(e.skipToEnd(),"comment"):'"'==n||"'"==n?(t.cur=(r=n,function(e,t){for(var n,a=!1;null!=(n=e.next())&&(n!=r||a);)a=!a&&"\\"==n;return a||(t.cur=m),"string"}))(e,t):"["==n&&/[\[=]/.test(e.peek())?(t.cur=d(c(e),"string"))(e,t):/\d/.test(n)?(e.eatWhile(/[\w.%]/),"number"):/[\w_]/.test(n)?(e.eatWhile(/[\w\\\-_.]/),"variable"):null}function d(r,o){return function(e,t){for(var n,a=null;null!=(n=e.next());)if(null==a)"]"==n&&(a=0);else if("="==n)++a;else{if("]"==n&&a==r){t.cur=m;break}a=null}return o}}return{startState:function(e){return{basecol:e||0,indentDepth:0,cur:m}},token:function(e,t){if(e.eatSpace())return null;var n=t.cur(e,t),e=e.current();return"variable"==n&&(i.test(e)?n="keyword":o.test(e)?n="builtin":r.test(e)&&(n="variable-2")),"comment"!=n&&"string"!=n&&(l.test(e)?++t.indentDepth:s.test(e)&&--t.indentDepth),n},indent:function(e,t){t=u.test(t);return e.basecol+n*(e.indentDepth-(t?1:0))},electricInput:/^\s*(?:end|until|else|\)|\})$/,lineComment:"--",blockCommentStart:"--[[",blockCommentEnd:"]]"}}),e.defineMIME("text/x-lua","lua")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror"),require("../../addon/mode/simple")):"function"==typeof define&&define.amd?define(["../../lib/codemirror","../../addon/mode/simple"],e):e(CodeMirror)}(function(e){"use strict";e.defineSimpleMode("rust",{start:[{regex:/b?"/,token:"string",next:"string"},{regex:/b?r"/,token:"string",next:"string_raw"},{regex:/b?r#+"/,token:"string",next:"string_raw_hash"},{regex:/'(?:[^'\\]|\\(?:[nrt0'"]|x[\da-fA-F]{2}|u\{[\da-fA-F]{6}\}))'/,token:"string-2"},{regex:/b'(?:[^']|\\(?:['\\nrt0]|x[\da-fA-F]{2}))'/,token:"string-2"},{regex:/(?:(?:[0-9][0-9_]*)(?:(?:[Ee][+-]?[0-9_]+)|\.[0-9_]+(?:[Ee][+-]?[0-9_]+)?)(?:f32|f64)?)|(?:0(?:b[01_]+|(?:o[0-7_]+)|(?:x[0-9a-fA-F_]+))|(?:[0-9][0-9_]*))(?:u8|u16|u32|u64|i8|i16|i32|i64|isize|usize)?/,token:"number"},{regex:/(let(?:\s+mut)?|fn|enum|mod|struct|type|union)(\s+)([a-zA-Z_][a-zA-Z0-9_]*)/,token:["keyword",null,"def"]},{regex:/(?:abstract|alignof|as|async|await|box|break|continue|const|crate|do|dyn|else|enum|extern|fn|for|final|if|impl|in|loop|macro|match|mod|move|offsetof|override|priv|proc|pub|pure|ref|return|self|sizeof|static|struct|super|trait|type|typeof|union|unsafe|unsized|use|virtual|where|while|yield)\b/,token:"keyword"},{regex:/\b(?:Self|isize|usize|char|bool|u8|u16|u32|u64|f16|f32|f64|i8|i16|i32|i64|str|Option)\b/,token:"atom"},{regex:/\b(?:true|false|Some|None|Ok|Err)\b/,token:"builtin"},{regex:/\b(fn)(\s+)([a-zA-Z_][a-zA-Z0-9_]*)/,token:["keyword",null,"def"]},{regex:/#!?\[.*\]/,token:"meta"},{regex:/\/\/.*/,token:"comment"},{regex:/\/\*/,token:"comment",next:"comment"},{regex:/[-+\/*=<>!]+/,token:"operator"},{regex:/[a-zA-Z_]\w*!/,token:"variable-3"},{regex:/[a-zA-Z_]\w*/,token:"variable"},{regex:/[\{\[\(]/,indent:!0},{regex:/[\}\]\)]/,dedent:!0}],string:[{regex:/"/,token:"string",next:"start"},{regex:/(?:[^\\"]|\\(?:.|$))*/,token:"string"}],string_raw:[{regex:/"/,token:"string",next:"start"},{regex:/[^"]*/,token:"string"}],string_raw_hash:[{regex:/"#+/,token:"string",next:"start"},{regex:/(?:[^"]|"(?!#))*/,token:"string"}],comment:[{regex:/.*?\*\//,token:"comment",next:"start"},{regex:/.*/,token:"comment"}],meta:{dontIndentStates:["comment"],electricInput:/^\s*\}$/,blockCommentStart:"/*",blockCommentEnd:"*/",lineComment:"//",fold:"brace"}}),e.defineMIME("text/x-rustsrc","rust"),e.defineMIME("text/rust","rust")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("diff",function(){var o={"+":"positive","-":"negative","@":"meta"};return{token:function(e){var r=e.string.search(/[\t ]+?$/);if(!e.sol()||0===r)return e.skipToEnd(),("error "+(o[e.string.charAt(0)]||"")).replace(/ $/,"");var i=o[e.peek()]||e.skipToEnd();return-1===r?e.skipToEnd():e.pos=r,i}}}),e.defineMIME("text/x-diff","diff")});;
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(o){"use strict";function e(e){for(var t={},n=0,r=e.length;n<r;++n)t[e[n]]=!0;return t}var t=["alias","and","BEGIN","begin","break","case","class","def","defined?","do","else","elsif","END","end","ensure","false","for","if","in","module","next","not","or","redo","rescue","retry","return","self","super","then","true","undef","unless","until","when","while","yield","nil","raise","throw","catch","fail","loop","callcc","caller","lambda","proc","public","protected","private","require","load","require_relative","extend","autoload","__END__","__FILE__","__LINE__","__dir__"],a=e(t),u=e(["def","class","case","for","while","until","module","catch","loop","proc","begin"]),p=e(["end","until"]),k={"[":"]","{":"}","(":")"},m={"]":"[","}":"{",")":"("};o.defineMode("ruby",function(i){var l;function f(e,t,n){return n.tokenize.push(e),e(t,n)}function d(e,t){if(e.sol()&&e.match("=begin")&&e.eol())return t.tokenize.push(c),"comment";if(e.eatSpace())return null;var n,r,i,o,a,u=e.next();if("`"==u||"'"==u||'"'==u)return f(s(u,"string",'"'==u||"`"==u),e,t);if("/"==u)return function(e){var t,n=e.pos,r=0,i=!1,o=!1;for(;null!=(t=e.next());)if(o)o=!1;else{if(-1<"[{(".indexOf(t))r++;else if(-1<"]})".indexOf(t)){if(--r<0)break}else if("/"==t&&0==r){i=!0;break}o="\\"==t}return e.backUp(e.pos-n),i}(e)?f(s(u,"string-2",!0),e,t):"operator";if("%"==u)return i="string",n=!0,e.eat("s")?i="atom":e.eat(/[WQ]/)?i="string":e.eat(/[r]/)?i="string-2":e.eat(/[wxq]/)&&(n=!(i="string")),(r=e.eat(/[^\w\s=]/))?f(s(r=k.propertyIsEnumerable(r)?k[r]:r,i,n,!0),e,t):"operator";if("#"==u)return e.skipToEnd(),"comment";if("<"==u&&(r=e.match(/^<([-~])[\`\"\']?([a-zA-Z_?]\w*)[\`\"\']?(?:;|$)/)))return f((o=r[2],a=r[1],function(e,t){return a&&e.eatSpace(),e.match(o)?t.tokenize.pop():e.skipToEnd(),"string"}),e,t);if("0"==u)return e.eat("x")?e.eatWhile(/[\da-fA-F]/):e.eat("b")?e.eatWhile(/[01]/):e.eatWhile(/[0-7]/),"number";if(/\d/.test(u))return e.match(/^[\d_]*(?:\.[\d_]+)?(?:[eE][+\-]?[\d_]+)?/),"number";if("?"!=u)return":"==u?e.eat("'")?f(s("'","atom",!1),e,t):e.eat('"')?f(s('"',"atom",!0),e,t):e.eat(/[\<\>]/)?(e.eat(/[\<\>]/),"atom"):e.eat(/[\+\-\*\/\&\|\:\!]/)?"atom":e.eat(/[a-zA-Z$@_\xa1-\uffff]/)?(e.eatWhile(/[\w$\xa1-\uffff]/),e.eat(/[\?\!\=]/),"atom"):"operator":"@"==u&&e.match(/^@?[a-zA-Z_\xa1-\uffff]/)?(e.eat("@"),e.eatWhile(/[\w\xa1-\uffff]/),"variable-2"):"$"==u?(e.eat(/[a-zA-Z_]/)?e.eatWhile(/[\w]/):e.eat(/\d/)?e.eat(/\d/):e.next(),"variable-3"):/[a-zA-Z_\xa1-\uffff]/.test(u)?(e.eatWhile(/[\w\xa1-\uffff]/),e.eat(/[\?\!]/),e.eat(":")?"atom":"ident"):"|"!=u||!t.varList&&"{"!=t.lastTok&&"do"!=t.lastTok?/[\(\)\[\]{}\\;]/.test(u)?(l=u,null):"-"==u&&e.eat(">")?"arrow":/[=+\-\/*:\.^%<>~|]/.test(u)?(i=e.eatWhile(/[=+\-\/*:\.^%<>~|]/),"."!=u||i||(l="."),"operator"):null:(l="|",null);for(;e.match(/^\\[CM]-/););return e.eat("\\")?e.eatWhile(/\w/):e.next(),"string"}function s(i,o,a,u){return function(e,t){var n,r=!1;for("read-quoted-paused"===t.context.type&&(t.context=t.context.prev,e.eat("}"));null!=(n=e.next());){if(n==i&&(u||!r)){t.tokenize.pop();break}if(a&&"#"==n&&!r){if(e.eat("{")){"}"==i&&(t.context={prev:t.context,type:"read-quoted-paused"}),t.tokenize.push(function n(r){return r=r||1,function(e,t){if("}"==e.peek()){if(1==r)return t.tokenize.pop(),t.tokenize[t.tokenize.length-1](e,t);t.tokenize[t.tokenize.length-1]=n(r-1)}else"{"==e.peek()&&(t.tokenize[t.tokenize.length-1]=n(r+1));return d(e,t)}}());break}if(/[@\$]/.test(e.peek())){t.tokenize.push(function(){var n=!1;return function(e,t){return n?(t.tokenize.pop(),t.tokenize[t.tokenize.length-1](e,t)):(n=!0,d(e,t))}}());break}}r=!r&&"\\"==n}return o}}function c(e,t){return e.sol()&&e.match("=end")&&e.eol()&&t.tokenize.pop(),e.skipToEnd(),"comment"}return{startState:function(){return{tokenize:[d],indented:0,context:{type:"top",indented:-i.indentUnit},continuedLine:!1,lastTok:null,varList:!1}},token:function(e,t){l=null,e.sol()&&(t.indented=e.indentation());var n,r,i=t.tokenize[t.tokenize.length-1](e,t),o=l;return"ident"==i&&(r=e.current(),"keyword"==(i="."==t.lastTok?"property":a.propertyIsEnumerable(e.current())?"keyword":/^[A-Z]/.test(r)?"tag":"def"==t.lastTok||"class"==t.lastTok||t.varList?"def":"variable")&&(u.propertyIsEnumerable(o=r)?n="indent":p.propertyIsEnumerable(r)?n="dedent":(("if"==r||"unless"==r)&&e.column()==e.indentation()||"do"==r&&t.context.indented<t.indented)&&(n="indent"))),(l||i&&"comment"!=i)&&(t.lastTok=o),"|"==l&&(t.varList=!t.varList),"indent"==n||/[\(\[\{]/.test(l)?t.context={prev:t.context,type:l||i,indented:t.indented}:("dedent"==n||/[\)\]\}]/.test(l))&&t.context.prev&&(t.context=t.context.prev),e.eol()&&(t.continuedLine="\\"==l||"operator"==i),i},indent:function(e,t){if(e.tokenize[e.tokenize.length-1]!=d)return o.Pass;var n=t&&t.charAt(0),r=e.context,n=r.type==m[n]||"keyword"==r.type&Line truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";function R(e,t){return e.string.charAt(e.pos+(t||0))}function c(e,t){var r;return t?(r=e.pos-t,e.string.substr(0<=r?r:0,t)):e.string.substr(0,e.pos-1)}function p(e,t){var r=e.string.length,n=r-e.pos+1;return e.string.substr(e.pos,t&&t<r?t:n)}function _(e,t){var r,t=e.pos+t;t<=0?e.pos=0:t>=(r=e.string.length-1)?e.pos=r:e.pos=t}e.defineMode("perl",function(){var a={"->":4,"++":4,"--":4,"**":4,"=~":4,"!~":4,"*":4,"/":4,"%":4,x:4,"+":4,"-":4,".":4,"<<":4,">>":4,"<":4,">":4,"<=":4,">=":4,lt:4,gt:4,le:4,ge:4,"==":4,"!=":4,"<=>":4,eq:4,ne:4,cmp:4,"~~":4,"&":4,"|":4,"^":4,"&&":4,"||":4,"//":4,"..":4,"...":4,"?":4,":":4,"=":4,"+=":4,"-=":4,"*=":4,",":4,"=>":4,"::":4,not:4,and:4,or:4,xor:4,BEGIN:[5,1],END:[5,1],PRINT:[5,1],PRINTF:[5,1],GETC:[5,1],READ:[5,1],READLINE:[5,1],DESTROY:[5,1],TIE:[5,1],TIEHANDLE:[5,1],UNTIE:[5,1],STDIN:5,STDIN_TOP:5,STDOUT:5,STDOUT_TOP:5,STDERR:5,STDERR_TOP:5,$ARG:5,$_:5,"@ARG":5,"@_":5,$LIST_SEPARATOR:5,'$"':5,$PROCESS_ID:5,$PID:5,$$:5,$REAL_GROUP_ID:5,$GID:5,"$(":5,$EFFECTIVE_GROUP_ID:5,$EGID:5,"$)":5,$PROGRAM_NAME:5,$0:5,$SUBSCRIPT_SEPARATOR:5,$SUBSEP:5,"$;":5,$REAL_USER_ID:5,$UID:5,"$<":5,$EFFECTIVE_USER_ID:5,$EUID:5,"$>":5,$a:5,$b:5,$COMPILING:5,"$^C":5,$DEBUGGING:5,"$^D":5,"${^ENCODING}":5,$ENV:5,"%ENV":5,$SYSTEM_FD_MAX:5,"$^F":5,"@F":5,"${^GLOBAL_PHASE}":5,"$^H":5,"%^H":5,"@INC":5,"%INC":5,$INPLACE_EDIT:5,"$^I":5,"$^M":5,$OSNAME:5,"$^O":5,"${^OPEN}":5,$PERLDB:5,"$^P":5,$SIG:5,"%SIG":5,$BASETIME:5,"$^T":5,"${^TAINT}":5,"${^UNICODE}":5,"${^UTF8CACHE}":5,"${^UTF8LOCALE}":5,$PERL_VERSION:5,"$^V":5,"${^WIN32_SLOPPY_STAT}":5,$EXECUTABLE_NAME:5,"$^X":5,$1:5,$MATCH:5,"$&":5,"${^MATCH}":5,$PREMATCH:5,"$`":5,"${^PREMATCH}":5,$POSTMATCH:5,"$'":5,"${^POSTMATCH}":5,$LAST_PAREN_MATCH:5,"$+":5,$LAST_SUBMATCH_RESULT:5,"$^N":5,"@LAST_MATCH_END":5,"@+":5,"%LAST_PAREN_MATCH":5,"%+":5,"@LAST_MATCH_START":5,"@-":5,"%LAST_MATCH_START":5,"%-":5,$LAST_REGEXP_CODE_RESULT:5,"$^R":5,"${^RE_DEBUG_FLAGS}":5,"${^RE_TRIE_MAXBUF}":5,$ARGV:5,"@ARGV":5,ARGV:5,ARGVOUT:5,$OUTPUT_FIELD_SEPARATOR:5,$OFS:5,"$,":5,$INPUT_LINE_NUMBER:5,$NR:5,"$.":5,$INPUT_RECORD_SEPARATOR:5,$RS:5,"$/":5,$OUTPUT_RECORD_SEPARATOR:5,$ORS:5,"$\\":5,$OUTPUT_AUTOFLUSH:5,"$|":5,$ACCUMULATOR:5,"$^A":5,$FORMAT_FORMFEED:5,"$^L":5,$FORMAT_PAGE_NUMBER:5,"$%":5,$FORMAT_LINES_LEFT:5,"$-":5,$FORMAT_LINE_BREAK_CHARACTERS:5,"$:":5,$FORMAT_LINES_PER_PAGE:5,"$=":5,$FORMAT_TOP_NAME:5,"$^":5,$FORMAT_NAME:5,"$~":5,"${^CHILD_ERROR_NATIVE}":5,$EXTENDED_OS_ERROR:5,"$^E":5,$EXCEPTIONS_BEING_CAUGHT:5,"$^S":5,$WARNING:5,"$^W":5,"${^WARNING_BITS}":5,$OS_ERROR:5,$ERRNO:5,"$!":5,"%OS_ERROR":5,"%ERRNO":5,"%!":5,$CHILD_ERROR:5,"$?":5,$EVAL_ERROR:5,"$@":5,$OFMT:5,"$#":5,"$*":5,$ARRAY_BASE:5,"$[":5,$OLD_PERL_VERSION:5,"$]":5,if:[1,1],elsif:[1,1],else:[1,1],while:[1,1],unless:[1,1],for:[1,1],foreach:[1,1],abs:1,accept:1,alarm:1,atan2:1,bind:1,binmode:1,bless:1,bootstrap:1,break:1,caller:1,chdir:1,chmod:1,chomp:1,chop:1,chown:1,chr:1,chroot:1,close:1,closedir:1,connect:1,continue:[1,1],cos:1,crypt:1,dbmclose:1,dbmopen:1,default:1,defined:1,delete:1,die:1,do:1,dump:1,each:1,endgrent:1,endhostent:1,endnetent:1,endprotoent:1,endpwent:1,endservent:1,eof:1,eval:1,exec:1,exists:1,exit:1,exp:1,fcntl:1,fileno:1,flock:1,fork:1,format:1,formline:1,getc:1,getgrent:1,getgrgid:1,getgrnam:1,gethostbyaddr:1,gethostbyname:1,gethostent:1,getlogin:1,getnetbyaddr:1,getnetbyname:1,getnetent:1,getpeername:1,getpgrp:1,getppid:1,getpriority:1,getprotobyname:1,getprotobynumber:1,getprotoent:1,getpwent:1,getpwnam:1,getpwuid:1,getservbyname:1,getservbyport:1,getservent:1,getsockname:1,getsockopt:1,given:1,glob:1,gmtime:1,goto:1,grep:1,hex:1,import:1,index:1,int:1,ioctl:1,join:1,keys:1,kill:1,last:1,lc:1,lcfirst:1,length:1,link:1,listen:1,local:2,localtime:1,lock:1,log:1,lstat:1,m:null,map:1,mkdir:1,msgctl:1,msgget:1,msgrcv:1,msgsnd:1,my:2,new:1,next:1,no:1,oct:1,open:1,opendir:1,ord:1,our:2,pack:1,package:1,pipe:1,pop:1,pos:1,print:1,printf:1,prototype:1,push:1,q:null,qq:null,qr:null,quotemeta:null,qw:null,qx:null,rand:1,read:1,readdir:1,readline:1,readlink:1,readpipe:1,recv:1,redo:1,ref:1,rename:1,require:1,reset:1,return:1,reverse:1,rewinddir:1,rindex:1,rmdir:1,s:null,say:1,scalar:1,seek:1,seekdir:1,select:1,semctl:1,semget:1,semop:1,send:1,setgrent:1,sethostent:1,setnetent:1,setpgrp:1,setpriority:1,setprotoent:1,setpwent:1,setservent:1,setsockopt:1,shift:1,shmctl:1,shmget:1,shmread:1,shmwrite:1,shutdown:1,sin:1,sleep:1,socket:1,socketpair:1,sort:1,splice:1,split:1,sprintf:1,sqrt:1,srand:1,stat:1,state:1,study:1,sub:1,substr:1,symlink:1,syscall:1,sysopen:1,sysread:1,sysseek:1,system:1,syswrite:1,tell:1,telldir:1,tie:1,tied:1,time:1,times:1,tr:null,truncate:1,uc:1,ucfirst:1,umask:1,undef:1,unlink:1,unpack:1,unshift:1,untie:1,use:1,utime:1,values:1,vec:1,wait:1,waitpid:1,wantarray:1,warn:1,whenLine truncated
+!function(e){"object"==typeof exports&&"object"==typeof module?e(require("../../lib/codemirror")):"function"==typeof define&&define.amd?define(["../../lib/codemirror"],e):e(CodeMirror)}(function(e){"use strict";e.defineMode("cmake",function(){var i=/({)?[a-zA-Z0-9_]+(})?/;function r(e,n){for(var t,i,r=!1;!e.eol()&&(t=e.next())!=n.pending;){if("$"===t&&"\\"!=i&&'"'==n.pending){r=!0;break}i=t}return r&&e.backUp(1),t==n.pending?n.continueString=!1:n.continueString=!0,"string"}return{startState:function(){var e={inDefinition:!1,inInclude:!1,continueString:!1,pending:!1};return e},token:function(e,n){return e.eatSpace()?null:(n=n,"$"===(t=(e=e).next())?e.match(i)?"variable-2":"variable":n.continueString?(e.backUp(1),r(e,n)):e.match(/(\s+)?\w+\(/)||e.match(/(\s+)?\w+\ \(/)?(e.backUp(1),"def"):"#"==t?(e.skipToEnd(),"comment"):"'"==t||'"'==t?(n.pending=t,r(e,n)):"("==t||")"==t?"bracket":t.match(/[0-9]/)?"number":(e.eatWhile(/[\w-]/),null));var t}}}),e.defineMIME("text/x-cmake","cmake")});;

internal/server/web/static/docview.js

@@ -0,0 +1,528 @@
+// Light previews of office files for the file manager, with no libraries:
+// docx, xlsx and ods are zip archives of XML, opened with the browser's own
+// DecompressionStream; csv and tsv are parsed here; an old binary .doc only
+// gives up its text. Each turns into plain HTML the page styles itself.
+(function () {
+  'use strict';
+
+  const esc = s => String(s).replace(/[&<>"]/g, c => ({'&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;'}[c]));
+
+  // ---------- zip ----------
+  // Reads the central directory; a file is inflated only when asked for.
+  function openZip(buf) {
+    const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    let eocd = -1;
+    for (let i = b.length - 22; i >= Math.max(0, b.length - 65557); i--) {
+      if (dv.getUint32(i, true) === 0x06054b50) { eocd = i; break; }
+    }
+    if (eocd < 0) throw new Error('не zip-архив');
+    const count = dv.getUint16(eocd + 10, true);
+    let p = dv.getUint32(eocd + 16, true);
+    const files = new Map();
+    const dec = new TextDecoder();
+    for (let n = 0; n < count && dv.getUint32(p, true) === 0x02014b50; n++) {
+      const method = dv.getUint16(p + 10, true), size = dv.getUint32(p + 20, true);
+      const nameLen = dv.getUint16(p + 28, true), extra = dv.getUint16(p + 30, true), comment = dv.getUint16(p + 32, true);
+      const local = dv.getUint32(p + 42, true);
+      files.set(dec.decode(b.subarray(p + 46, p + 46 + nameLen)), {method, size, local});
+      p += 46 + nameLen + extra + comment;
+    }
+    async function bytes(name) {
+      const f = files.get(name);
+      if (!f) return null;
+      const start = f.local + 30 + dv.getUint16(f.local + 26, true) + dv.getUint16(f.local + 28, true);
+      const raw = b.subarray(start, start + f.size);
+      if (f.method === 0) return raw;
+      if (f.method !== 8) throw new Error('сжатие zip, которое браузер не знает');
+      const out = new Blob([raw]).stream().pipeThrough(new DecompressionStream('deflate-raw'));
+      return new Uint8Array(await new Response(out).arrayBuffer());
+    }
+    async function xml(name) {
+      const raw = await bytes(name);
+      return raw ? new DOMParser().parseFromString(new TextDecoder().decode(raw), 'application/xml') : null;
+    }
+    return {files, bytes, xml};
+  }
+
+  // Children of an element by local name, whatever the namespace prefix.
+  const kids = (el, name) => el ? Array.from(el.children).filter(c => c.localName === name) : [];
+  const kid = (el, name) => kids(el, name)[0] || null;
+  const attr = (el, name) => {
+    if (!el) return null;
+    for (const a of el.attributes) if (a.localName === name) return a.value;
+    return null;
+  };
+
+  // ---------- docx ----------
+  async function docx(buf) {
+    const z = openZip(buf);
+    const doc = await z.xml('word/document.xml');
+    if (!doc) throw new Error('в архиве нет word/document.xml');
+    // Style ids to names, to know headings whatever the language of Word.
+    const styles = {};
+    const st = await z.xml('word/styles.xml');
+    if (st) for (const s of st.getElementsByTagNameNS('*', 'style')) {
+      styles[attr(s, 'styleId')] = (attr(kid(s, 'name'), 'val') || '').toLowerCase();
+    }
+    const body = doc.getElementsByTagNameNS('*', 'body')[0];
+    return '<div class="dv-doc">' + blocks(body, styles) + '</div>';
+  }
+  function blocks(el, styles) {
+    let html = '', list = false;
+    for (const c of el ? el.children : []) {
+      if (c.localName === 'p') {
+        const pPr = kid(c, 'pPr');
+        const isList = !!kid(pPr, 'numPr');
+        if (isList && !list) { html += '<ul>'; list = true; }
+        if (!isList && list) { html += '</ul>'; list = false; }
+        html += para(c, pPr, styles, isList);
+      } else {
+        if (list) { html += '</ul>'; list = false; }
+        if (c.localName === 'tbl') html += table(c, styles);
+        else if (c.localName === 'sdt') html += blocks(kid(c, 'sdtContent'), styles);
+      }
+    }
+    return html + (list ? '</ul>' : '');
+  }
+  function para(p, pPr, styles, isList) {
+    const name = styles[attr(kid(pPr, 'pStyle'), 'val')] || '';
+    const h = /^heading (\d)/.exec(name);
+    const tag = isList ? 'li' : name === 'title' ? 'h1' : h ? 'h' + Math.min(6, +h[1] + 1) : 'p';
+    const jc = attr(kid(pPr, 'jc'), 'val');
+    const align = jc === 'center' ? 'center' : (jc === 'right' || jc === 'end') ? 'right' : (jc === 'both' ? 'justify' : '');
+    const inner = runs(p);
+    return '<' + tag + (align ? ' style="text-align:' + align + '"' : '') + '>' + (inner || '&nbsp;') + '</' + tag + '>';
+  }
+  function runs(el) {
+    let html = '';
+    for (const c of el.children) {
+      if (c.localName === 'r') html += run(c);
+      else if (c.localName === 'hyperlink' || c.localName === 'smartTag' || c.localName === 'ins' || c.localName === 'sdt' || c.localName === 'sdtContent' || c.localName === 'fldSimple') {
+        const inner = runs(c);
+        html += c.localName === 'hyperlink' ? '<u class="dv-link">' + inner + '</u>' : inner;
+      }
+    }
+    return html;
+  }
+  function run(r) {
+    const pr = kid(r, 'rPr');
+    const on = n => { const e = kid(pr, n); return !!e && attr(e, 'val') !== '0' && attr(e, 'val') !== 'false'; };
+    let t = '';
+    for (const c of r.children) {
+      if (c.localName === 't') t += esc(c.textContent);
+      else if (c.localName === 'tab') t += '&emsp;';
+      else if (c.localName === 'br' || c.localName === 'cr') t += '<br>';
+    }
+    if (!t) return '';
+    if (on('b')) t = '<b>' + t + '</b>';
+    if (on('i')) t = '<i>' + t + '</i>';
+    if (kid(pr, 'u') && attr(kid(pr, 'u'), 'val') !== 'none') t = '<u>' + t + '</u>';
+    if (on('strike')) t = '<s>' + t + '</s>';
+    // A size set on the run itself, as many documents do instead of styles.
+    const sz = +attr(kid(pr, 'sz'), 'val');
+    if (sz && sz !== 24) t = '<span style="font-size:' + Math.max(9, Math.min(36, sz / 2)) + 'pt">' + t + '</span>';
+    const va = attr(kid(pr, 'vertAlign'), 'val');
+    if (va === 'superscript') t = '<sup>' + t + '</sup>';
+    else if (va === 'subscript') t = '<sub>' + t + '</sub>';
+    return t;
+  }
+  function table(tbl, styles) {
+    let html = '<div class="dv-scroll"><table class="dv-table">';
+    for (const tr of kids(tbl, 'tr')) {
+      html += '<tr>';
+      for (const tc of kids(tr, 'tc')) {
+        const span = attr(kid(kid(tc, 'tcPr'), 'gridSpan'), 'val');
+        html += '<td' + (span > 1 ? ' colspan="' + span + '"' : '') + '>' + blocks(tc, styles) + '</td>';
+      }
+      html += '</tr>';
+    }
+    return html + '</table></div>';
+  }
+
+  // ---------- tables: one grid per sheet ----------
+  const MAX_ROWS = 2000, MAX_COLS = 60;
+  function colName(i) { let s = ''; for (i++; i > 0; i = Math.floor((i - 1) / 26)) s = String.fromCharCode(65 + (i - 1) % 26) + s; return s; }
+  function grid(rows, names) {
+    let cols = names ? names.length : 0;
+    for (const r of rows) cols = Math.max(cols, r.length);
+    cols = Math.min(cols, MAX_COLS);
+    const cut = rows.length > MAX_ROWS || rows.some(r => r.length > MAX_COLS);
+    let html = '<div class="dv-scroll dv-grid"><table class="dv-sheet"><thead><tr><th></th>';
+    for (let c = 0; c < cols; c++) html += '<th>' + esc(names && names[c] != null ? names[c] : colName(c)) + '</th>';
+    html += '</tr></thead><tbody>';
+    rows.slice(0, MAX_ROWS).forEach((r, i) => {
+      html += '<tr><th>' + (i + 1) + '</th>';
+      for (let c = 0; c < cols; c++) {
+        const v = r[c] == null ? '' : r[c];
+        html += '<td' + (typeof v === 'number' ? ' class="n"' : '') + '>' + esc(v) + '</td>';
+      }
+      html += '</tr>';
+    });
+    html += '</tbody></table></div>';
+    return {html, cut};
+  }
+  // Several sheets: tabs over the grid.
+  function sheets(list) {
+    if (!list.length) return '<p class="dv-note">в книге нет листов</p>';
+    let html = '';
+    if (list.length > 1) {
+      html += '<div class="dv-tabs">' + list.map((s, i) => '<button type="button" data-sheet="' + i + '"' + (i ? '' : ' class="on"') + '>' + esc(s.name) + '</button>').join('') + '</div>';
+    }
+    list.forEach((s, i) => {
+      const g = grid(s.rows, s.cols);
+      html += '<div class="dv-pane" data-pane="' + i + '"' + (i ? ' hidden' : '') + '>' + (s.note ? '<p class="dv-note">' + esc(s.note) + '</p>' : '') + g.html +
+        (g.cut ? '<p class="dv-note">показаны первые ' + MAX_ROWS + ' строк и ' + MAX_COLS + ' столбцов</p>' : '') + '</div>';
+    });
+    return html;
+  }
+  function bindTabs(root) {
+    root.querySelectorAll('[data-sheet]').forEach(b => b.onclick = () => {
+      root.querySelectorAll('[data-sheet]').forEach(x => x.classList.toggle('on', x === b));
+      root.querySelectorAll('[data-pane]').forEach(p => p.hidden = p.dataset.pane !== b.dataset.sheet);
+    });
+  }
+
+  // ---------- xlsx ----------
+  async function xlsx(buf) {
+    const z = openZip(buf);
+    const wb = await z.xml('xl/workbook.xml');
+    if (!wb) throw new Error('в архиве нет xl/workbook.xml');
+    const rels = {};
+    const rx = await z.xml('xl/_rels/workbook.xml.rels');
+    if (rx) for (const r of rx.getElementsByTagNameNS('*', 'Relationship')) rels[r.getAttribute('Id')] = r.getAttribute('Target');
+    const shared = [];
+    const ss = await z.xml('xl/sharedStrings.xml');
+    if (ss) for (const si of ss.getElementsByTagNameNS('*', 'si')) {
+      shared.push(Array.from(si.getElementsByTagNameNS('*', 't')).filter(t => t.parentElement.localName !== 'rPh').map(t => t.textContent).join(''));
+    }
+    const list = [];
+    for (const s of wb.getElementsByTagNameNS('*', 'sheet')) {
+      let target = rels[attr(s, 'id')] || '';
+      target = target.startsWith('/') ? target.slice(1) : 'xl/' + target.replace(/^\.\//, '');
+      const doc = await z.xml(target);
+      list.push({name: s.getAttribute('name') || '?', rows: doc ? xlsxRows(doc, shared) : []});
+    }
+    return sheets(list);
+  }
+  function xlsxRows(doc, shared) {
+    const rows = [];
+    for (const row of doc.getElementsByTagNameNS('*', 'row')) {
+      const ri = (+row.getAttribute('r') || rows.length + 1) - 1;
+      if (ri >= MAX_ROWS) break;
+      const out = rows[ri] = rows[ri] || [];
+      let next = 0;
+      for (const c of kids(row, 'c')) {
+        const ref = /^([A-Z]+)/.exec(c.getAttribute('r') || '');
+        let ci = next;
+        if (ref) { ci = 0; for (const ch of ref[1]) ci = ci * 26 + ch.charCodeAt(0) - 64; ci--; }
+        next = ci + 1;
+        if (ci >= MAX_COLS + 1) continue;
+        const t = c.getAttribute('t'), v = kid(c, 'v');
+        let val = v ? v.textContent : '';
+        if (t === 's') val = shared[+val] || '';
+        else if (t === 'inlineStr') val = Array.from(c.getElementsByTagNameNS('*', 't')).map(x => x.textContent).join('');
+        else if (t === 'b') val = val === '1' ? 'TRUE' : 'FALSE';
+        else if (t !== 'str' && t !== 'e' && val !== '' && !isNaN(val)) val = +val;
+        out[ci] = val;
+      }
+    }
+    for (let i = 0; i < rows.length; i++) rows[i] = rows[i] || [];
+    return rows;
+  }
+
+  // ---------- ods / odt ----------
+  async function ods(buf) {
+    const z = openZip(buf);
+    const doc = await z.xml('content.xml');
+    if (!doc) throw new Error('в архиве нет content.xml');
+    const list = [];
+    for (const t of doc.getElementsByTagNameNS('*', 'table')) {
+      if (t.parentElement && t.parentElement.localName === 'table-cell') continue;
+      const rows = [];
+      for (const r of t.getElementsByTagNameNS('*', 'table-row')) {
+        const cells = [];
+        for (const c of r.children) {
+          if (c.localName !== 'table-cell' && c.localName !== 'covered-table-cell') continue;
+          const rep = Math.min(+attr(c, 'number-columns-repeated') || 1, MAX_COLS + 1 - cells.length);
+          const num = attr(c, 'value');
+          const text = Array.from(c.getElementsByTagNameNS('*', 'p')).map(p => p.textContent).join('\n');
+          const val = attr(c, 'value-type') === 'float' && num != null ? +num : text;
+          for (let i = 0; i < rep; i++) cells.push(val);
+          if (cells.length > MAX_COLS) break;
+        }
+        while (cells.length && cells[cells.length - 1] === '') cells.pop();
+        const rep = Math.min(+attr(r, 'number-rows-repeated') || 1, MAX_ROWS + 1 - rows.length);
+        for (let i = 0; i < rep; i++) rows.push(cells);
+        if (rows.length > MAX_ROWS) break;
+      }
+      while (rows.length && !rows[rows.length - 1].length) rows.pop();
+      list.push({name: attr(t, 'name') || '?', rows});
+    }
+    return sheets(list);
+  }
+  async function odt(buf) {
+    const z = openZip(buf);
+    const doc = await z.xml('content.xml');
+    const body = doc && doc.getElementsByTagNameNS('*', 'text')[0];
+    if (!body) throw new Error('в архиве нет текста');
+    // Runs of spaces, tabs and breaks are elements of their own in ODF.
+    const inline = el => {
+      let html = '';
+      for (const n of el.childNodes) {
+        if (n.nodeType === 3) html += esc(n.nodeValue);
+        else if (n.localName === 's') html += ' '.repeat(+attr(n, 'c') || 1);
+        else if (n.localName === 'tab') html += '&emsp;';
+        else if (n.localName === 'line-break') html += '<br>';
+        else if (n.nodeType === 1) html += inline(n);
+      }
+      return html;
+    };
+    const walk = el => {
+      let html = '';
+      for (const c of el.children) {
+        if (c.localName === 'h') { const l = Math.min(6, (+attr(c, 'outline-level') || 1) + 1); html += '<h' + l + '>' + inline(c) + '</h' + l + '>'; }
+        else if (c.localName === 'p') html += '<p>' + (inline(c) || '&nbsp;') + '</p>';
+        else if (c.localName === 'list') html += '<ul>' + kids(c, 'list-item').map(li => '<li>' + walk(li) + '</li>').join('') + '</ul>';
+        else if (c.localName === 'table') html += '<div class="dv-scroll"><table class="dv-table">' + Array.from(c.getElementsByTagNameNS('*', 'table-row')).map(r =>
+          '<tr>' + kids(r, 'table-cell').map(td => '<td>' + walk(td) + '</td>').join('') + '</tr>').join('') + '</table></div>';
+        else if (c.localName === 'section') html += walk(c);
+      }
+      return html;
+    };
+    return '<div class="dv-doc">' + walk(body) + '</div>';
+  }
+
+  // ---------- csv / tsv ----------
+  function csv(text, tab) {
+    const first = text.slice(0, text.indexOf('\n') >>> 0 || text.length);
+    const sep = tab ? '\t' : (first.split(';').length > first.split(',').length ? ';' : ',');
+    const rows = [];
+    let row = [], f = '', q = false;
+    for (let i = 0; i < text.length; i++) {
+      const c = text[i];
+      if (q) {
+        if (c === '"') { if (text[i + 1] === '"') { f += '"'; i++; } else q = false; }
+        else f += c;
+      } else if (c === '"' && f === '') q = true;
+      else if (c === sep) { row.push(f); f = ''; }
+      else if (c === '\n' || c === '\r') {
+        if (c === '\r' && text[i + 1] === '\n') i++;
+        row.push(f); f = ''; rows.push(row); row = [];
+        if (rows.length > MAX_ROWS) break;
+      } else f += c;
+    }
+    if (f !== '' || row.length) { row.push(f); rows.push(row); }
+    return sheets([{name: '', rows: rows.map(r => r.map(v => v !== '' && !isNaN(v) && /^-?[\d.]+$/.test(v.trim()) ? +v : v))}]);
+  }
+
+  // ---------- old .doc ----------
+  // Word 97-2003 is a binary format; without a full parser all that can be
+  // shown is the text, picked out of the document's WordDocument stream as
+  // the runs that read as words.
+  function cfbStream(b, want) {
+    const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    if (dv.getUint32(0, true) !== 0xE011CFD0) return null;
+    const ss = 1 << dv.getUint16(0x1E, true);
+    const sector = n => 512 + n * ss;
+    const fat = [];
+    const addFat = n => { const o = sector(n); for (let i = 0; i < ss / 4; i++) fat.push(dv.getUint32(o + i * 4, true)); };
+    for (let i = 0; i < 109; i++) { const n = dv.getUint32(0x4C + i * 4, true); if (n < 0xFFFFFFFA) addFat(n); }
+    for (let n = dv.getUint32(0x44, true), k = 0; n < 0xFFFFFFFA && k < 1000; k++) {
+      const o = sector(n);
+      for (let i = 0; i < ss / 4 - 1; i++) { const m = dv.getUint32(o + i * 4, true); if (m < 0xFFFFFFFA) addFat(m); }
+      n = dv.getUint32(o + ss - 4, true);
+    }
+    const chain = (start, size) => {
+      const out = new Uint8Array(size);
+      let n = start, at = 0;
+      for (let guard = 0; n < 0xFFFFFFFA && at < size && guard < 1e6; guard++) {
+        const o = sector(n), len = Math.min(ss, size - at);
+        if (o + len > b.length) break;
+        out.set(b.subarray(o, o + len), at);
+        at += len;
+        n = fat[n];
+      }
+      return out.subarray(0, at);
+    };
+    const dirStart = dv.getUint32(0x30, true);
+    const dir = chain(dirStart, ss * 64);
+    const dd = new DataView(dir.buffer, dir.byteOffset, dir.byteLength);
+    for (let o = 0; o + 128 <= dir.length; o += 128) {
+      const nameLen = dd.getUint16(o + 0x40, true);
+      let name = '';
+      for (let i = 0; i + 2 < nameLen; i += 2) name += String.fromCharCode(dd.getUint16(o + i, true));
+      if (name === want && dd.getUint8(o + 0x42) === 2) return chain(dd.getUint32(o + 0x74, true), dd.getUint32(o + 0x78, true));
+    }
+    return null;
+  }
+  function doc(buf) {
+    const all = new Uint8Array(buf);
+    const b = cfbStream(all, 'WordDocument') || all;
+    const ok = c => c === 9 || c === 10 || c === 13 || (c >= 32 && c < 127) || (c >= 0xA0 && c <= 0x24F) || (c >= 0x400 && c <= 0x4FF) || (c >= 0x2010 && c <= 0x2026) || c === 0x2116;
+    const pieces = [];
+    let cur = '';
+    const flush = min => {
+      const letters = (cur.match(/[A-Za-zА-Яа-яЁё0-9]/g) || []).length;
+      if (cur.trim().length >= min && letters >= cur.trim().length * 0.5) pieces.push(cur);
+      cur = '';
+    };
+    for (let i = 0; i + 1 < b.length; i += 2) {
+      const c = b[i] | (b[i + 1] << 8);
+      if (ok(c)) cur += String.fromCharCode(c); else flush(3);
+    }
+    flush(4);
+    let text = pieces.join('\n');
+    if (text.length < 40) { // a document that keeps its text 8-bit
+      const p8 = [];
+      for (let i = 0; i < b.length; i++) {
+        const c = b[i];
+        if (c === 9 || c === 10 || c === 13 || (c >= 32 && c < 127)) cur += String.fromCharCode(c);
+        else { if (cur.trim().length >= 8 && (cur.match(/[A-Za-z]/g) || []).length >= cur.length * 0.5) p8.push(cur); cur = ''; }
+      }
+      text = p8.join('\n');
+    }
+    if (!text.trim()) throw new Error('текст не нашёлся');
+    return '<p class="dv-note">старый формат .doc: показан только текст, без оформления</p><div class="dv-doc">' +
+      text.split(/\r\n|\r|\n|\x07/).filter(l => l.trim()).map(l => '<p>' + esc(l) + '</p>').join('') + '</div>';
+  }
+
+  // ---------- sqlite ----------
+  // Reads the database file itself: the b-tree of sqlite_master for the
+  // tables, then each table's b-tree for its first rows. No SQL engine.
+  function sqlite(buf) {
+    const b = new Uint8Array(buf);
+    if (new TextDecoder().decode(b.subarray(0, 15)) !== 'SQLite format 3') throw new Error('не база SQLite');
+    const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    let ps = dv.getUint16(16);
+    if (ps === 1) ps = 65536;
+    const usable = ps - b[20];
+    const enc = dv.getUint32(56);
+    const dec = new TextDecoder(enc === 2 ? 'utf-16le' : enc === 3 ? 'utf-16be' : 'utf-8');
+    const page = n => (n - 1) * ps;
+
+    function varint(o) {
+      let v = 0;
+      for (let i = 0; i < 9; i++) {
+        const c = b[o + i];
+        if (i === 8) return [v * 256 + c, o + 9];
+        v = v * 128 + (c & 0x7f);
+        if (!(c & 0x80)) return [v, o + i + 1];
+      }
+    }
+    // A cell's payload, gathered from its overflow pages when it spills.
+    function payload(o, size) {
+      const max = usable - 35;
+      if (size <= max) return b.subarray(o, o + size);
+      const min = Math.floor((usable - 12) * 32 / 255) - 23;
+      let local = min + (size - min) % (usable - 4);
+      if (local > max) local = min;
+      const out = new Uint8Array(size);
+      out.set(b.subarray(o, o + local));
+      let at = local, next = dv.getUint32(o + local);
+      for (let guard = 0; next && at < size && guard < 1e6; guard++) {
+        const po = page(next), len = Math.min(usable - 4, size - at);
+        out.set(b.subarray(po + 4, po + 4 + len), at);
+        at += len;
+        next = dv.getUint32(po);
+      }
+      return out;
+    }
+    function record(p) {
+      const pv = new DataView(p.buffer, p.byteOffset, p.byteLength);
+      let [hlen, o] = vi(p, 0);
+      const types = [];
+      while (o < hlen) { const r = vi(p, o); types.push(r[0]); o = r[1]; }
+      let d = hlen;
+      return types.map(t => {
+        let v = null;
+        if (t >= 1 && t <= 6) {
+          const n = [0, 1, 2, 3, 4, 6, 8][t];
+          let x = 0;
+          for (let i = 0; i < n; i++) x = x * 256 + p[d + i];
+          if (p[d] & 0x80) x -= Math.pow(2, 8 * n);
+          v = n === 8 && Math.abs(x) > Number.MAX_SAFE_INTEGER ? pv.getBigInt64(d).toString() : x;
+          d += n;
+        } else if (t === 7) { v = pv.getFloat64(d); d += 8; }
+        else if (t === 8) v = 0;
+        else if (t === 9) v = 1;
+        else if (t >= 12 && t % 2 === 0) { const n = (t - 12) / 2; v = '[blob ' + n + ' B]'; d += n; }
+        else if (t >= 13) { const n = (t - 13) / 2; v = dec.decode(p.subarray(d, d + n)); d += n; }
+        return v;
+      });
+    }
+    // varint over a payload buffer rather than the file
+    function vi(p, o) {
+      let v = 0;
+      for (let i = 0; i < 9; i++) {
+        const c = p[o + i];
+        if (i === 8) return [v * 256 + c, o + 9];
+        v = v * 128 + (c & 0x7f);
+        if (!(c & 0x80)) return [v, o + i + 1];
+      }
+    }
+    // Walks a table b-tree in rowid order, up to limit rows; also counts all.
+    function table(root, limit) {
+      const rows = [];
+      let count = 0;
+      const walk = (n, depth) => {
+        if (depth > 40) return;
+        const h = page(n) + (n === 1 ? 100 : 0);
+        const type = b[h], cells = dv.getUint16(h + 3);
+        const ptrs = h + (type === 0x05 ? 12 : 8);
+        if (type === 0x0d) {
+          count += cells;
+          for (let i = 0; i < cells && rows.length < limit; i++) {
+            let o = page(n) + dv.getUint16(ptrs + i * 2), size, rowid;
+            [size, o] = varint(o);
+            [rowid, o] = varint(o);
+            rows.push({rowid, values: record(payload(o, size))});
+          }
+        } else if (type === 0x05) {
+          for (let i = 0; i < cells; i++) walk(dv.getUint32(page(n) + dv.getUint16(ptrs + i * 2)), depth + 1);
+          walk(dv.getUint32(h + 8), depth + 1);
+        }
+      };
+      walk(root, 0);
+      return {rows, count};
+    }
+    // Column names out of CREATE TABLE; an INTEGER PRIMARY KEY is the rowid.
+    function columns(sql) {
+      const m = /\(([\s\S]*)\)/.exec(sql || '');
+      if (!m) return {names: [], rowidCol: -1};
+      const parts = [];
+      let depth = 0, cur = '';
+      for (const c of m[1]) {
+        if (c === '(') depth++;
+        if (c === ')') depth--;
+        if (c === ',' && !depth) { parts.push(cur); cur = ''; } else cur += c;
+      }
+      parts.push(cur);
+      const names = [];
+      let rowidCol = -1;
+      for (const p of parts) {
+        const t = p.trim();
+        if (!t || /^(constraint|primary\s+key|unique|check|foreign\s+key)\b/i.test(t)) continue;
+        const nm = /^("(?:[^"]|"")+"|`[^`]+`|\[[^\]]+\]|\S+)/.exec(t)[1].replace(/^["`\[]|["`\]]$/g, '');
+        if (/^\S+\s+integer\s+primary\s+key\b/i.test(t.replace(/^("(?:[^"]|"")+"|`[^`]+`|\[[^\]]+\])/, 'x'))) rowidCol = names.length;
+        names.push(nm);
+      }
+      return {names, rowidCol};
+    }
+
+    const master = table(1, 100000).rows.map(r => ({type: r.values[0], name: r.values[1], root: r.values[3], sql: r.values[4] || ''}));
+    const list = [];
+    for (const t of master.filter(x => x.type === 'table' && x.root).sort((a, c) => String(a.name).localeCompare(String(c.name)))) {
+      if (/without\s+rowid/i.test(t.sql)) { list.push({name: t.name, rows: [], note: 'таблица WITHOUT ROWID - её строки здесь не показываются'}); continue; }
+      const {names, rowidCol} = columns(t.sql);
+      let data;
+      try { data = table(t.root, MAX_ROWS); } catch (e) { list.push({name: t.name, rows: [], note: 'не удалось прочитать: ' + e.message}); continue; }
+      const rows = data.rows.map(r => { const v = r.values.slice(); if (rowidCol >= 0 && v[rowidCol] == null) v[rowidCol] = r.rowid; return v; });
+      list.push({name: t.name, cols: names, rows, note: data.count + ' ' + (data.count % 10 === 1 && data.count % 100 !== 11 ? 'строка' : data.count % 10 >= 2 && data.count % 10 <= 4 && (data.count % 100 < 12 || data.count % 100 > 14) ? 'строки' : 'строк') + (data.count > rows.length ? ', показаны первые ' + rows.length : '')});
+    }
+    if (!list.length) return '<p class="dv-note">в базе нет таблиц</p>';
+    return sheets(list);
+  }
+
+  window.DocView = {docx, xlsx, ods, odt, csv, doc, sqlite, bindTabs};
+})();

internal/server/web/templates/dashboard.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Машины — LPRA</title>
+<title>Машины - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 </head>
 <body>
@@ -21,28 +21,37 @@
   <h1>Машины-клиенты</h1>
   <div class="card">
     {{if .Agents}}
-    <table>
-      <thead><tr><th>Статус</th><th>Имя</th><th>Hostname</th><th>ОС / Арх</th><th>Активность</th><th></th></tr></thead>
+    <table class="stack">
+      <thead><tr><th>Статус</th><th>Имя</th><th>Hostname</th><th>ОС / Арх</th><th>Активность</th><th>Действия</th></tr></thead>
       <tbody>
       {{range .Agents}}
-        <tr>
-          <td><span class="dot {{if .Online}}on{{else}}off{{end}}"></span>{{if .Online}}online{{else}}offline{{end}}</td>
-          <td>{{.Name}}</td>
-          <td class="muted">{{.Hostname}}</td>
-          <td class="muted">{{.OS}}/{{.Arch}}</td>
-          <td class="muted">{{.Seen}}</td>
-          <td>
+        <tr data-agent="{{.ID}}">
+          <td class="nowrap" data-l="Статус"><span class="dot {{if .Online}}on{{else}}off{{end}}"></span><span class="state">{{if .Online}}online{{else}}offline{{end}}</span></td>
+          <td class="lead">{{.Name}}</td>
+          <td class="muted" data-l="Hostname">{{.Hostname}}</td>
+          <td class="muted nowrap" data-l="ОС / Арх">{{.OS}}/{{.Arch}}</td>
+          <td class="muted nowrap seen" data-l="Активность">{{.Seen}}</td>
+          <td class="actions">
             <div class="row" style="gap:6px">
-              <a class="btn small" href="/agents/{{.ID}}/terminal">Терминал</a>
-              <a class="btn ghost small" href="/agents/{{.ID}}/files">Файлы</a>
-              <a class="btn ghost small" href="/agents/{{.ID}}/forwards">Порты</a>
-              <a class="btn ghost small icon" href="/agents/{{.ID}}/edit" title="Изменить">
+              <a class="btn small icon" href="/agents/{{.ID}}/terminal" data-tip="Терминал" aria-label="Терминал">
+                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+              </a>
+              <a class="btn ghost small icon" href="/agents/{{.ID}}/files" data-tip="Файлы" aria-label="Файлы">
+                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg>
+              </a>
+              <a class="btn ghost small icon" href="/agents/{{.ID}}/forwards" data-tip="Порты" aria-label="Порты">
+                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="17 1 21 5 17 9"/><path d="M3 11V9a4 4 0 0 1 4-4h14"/><polyline points="7 23 3 19 7 15"/><path d="M21 13v2a4 4 0 0 1-4 4H3"/></svg>
+              </a>
+              <a class="btn ghost small icon" href="/agents/{{.ID}}/status" data-tip="Статус" aria-label="Статус">
+                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>
+              </a>
+              <a class="btn ghost small icon" href="/agents/{{.ID}}/edit" data-tip="Изменить" aria-label="Изменить">
                 <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20h9"/><path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4 12.5-12.5z"/></svg>
               </a>
               <form method="post" action="/agents/{{.ID}}/delete" style="display:inline"
-                    onsubmit="return confirm('Удалить машину {{.Name}}? Сервис на ней продолжит работать, но перестанет быть виден. Чтобы снова подключиться — переустановите агента.')">
+                    onsubmit="return confirm('Удалить машину {{.Name}}? Сервис на ней продолжит работать, но перестанет быть виден. Чтобы снова подключиться - переустановите агента.')">
                 <input type="hidden" name="csrf" value="{{$.CSRF}}">
-                <button class="btn danger small icon" type="submit" title="Удалить">
+                <button class="btn danger small icon" type="submit" data-tip="Удалить" aria-label="Удалить">
                   <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 6h18"/><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><line x1="10" y1="11" x2="10" y2="17"/><line x1="14" y1="11" x2="14" y2="17"/></svg>
                 </button>
               </form>
@@ -54,9 +63,42 @@
     </table>
     {{else}}
       <p class="muted">Пока нет подключённых машин. Добавьте первую в разделе
-        <a href="/settings">Настройки</a> — там одна команда для установки.</p>
+        <a href="/settings">Настройки</a> - там одна команда для установки.</p>
     {{end}}
   </div>
 </div>
+<script>
+// Keep the status column live; nothing is asked while the tab is hidden.
+(function () {
+  var rows = {};
+  document.querySelectorAll('tr[data-agent]').forEach(function (tr) { rows[tr.dataset.agent] = tr; });
+  var timer = null, busy = false;
+  function schedule() {
+    clearTimeout(timer);
+    if (!document.hidden) timer = setTimeout(load, 5000);
+  }
+  function load() {
+    if (busy || document.hidden) return;
+    busy = true;
+    fetch('/api/panel/agents/presence', {credentials: 'same-origin'})
+      .then(function (r) { return r.ok ? r.json() : []; })
+      .then(function (list) {
+        list.forEach(function (a) {
+          var tr = rows[a.id];
+          if (!tr) return;
+          tr.querySelector('.dot').className = 'dot ' + (a.online ? 'on' : 'off');
+          tr.querySelector('.state').textContent = a.online ? 'online' : 'offline';
+          tr.querySelector('.seen').textContent = a.seen;
+        });
+      })
+      .catch(function () {})
+      .then(function () { busy = false; schedule(); });
+  }
+  document.addEventListener('visibilitychange', function () {
+    if (document.hidden) clearTimeout(timer); else load();
+  });
+  if (Object.keys(rows).length) schedule();
+})();
+</script>
 </body>
 </html>

internal/server/web/templates/edit.html

@@ -3,14 +3,18 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Изменить машину — LPRA</title>
-<link rel="stylesheet" href="/static/app.css">
+<title>Изменить машину - LPRA</title>
+<link rel="stylesheet" href="/static/app.css?v={{.ServerVersion}}-2">
 </head>
 <body>
 <header class="topbar">
   <div class="brand">LPRA · Изменить машину</div>
   <nav>
     <a href="/">← Машины</a>
+    <a href="/agents/{{.Agent.ID}}/terminal">Терминал</a>
+    <a href="/agents/{{.Agent.ID}}/files">Файлы</a>
+    <a href="/agents/{{.Agent.ID}}/forwards">Порты</a>
+    <a href="/agents/{{.Agent.ID}}/status">Статус</a>
   </nav>
 </header>
 <div class="wrap">
@@ -28,6 +32,46 @@
     </p>
   </div>
 
+  <div class="card">
+    <h2>Пользователь</h2>
+    {{if .UserOK}}<div class="err" style="background:#1d3a24;border-color:#2b6b3a;color:#b3ffcb">{{.UserOK}}</div>{{end}}
+    {{if .UserErr}}<div class="err">{{.UserErr}}</div>{{end}}
+    <p class="muted">
+      Клиент запущен от: <code>{{if .Users}}{{.Users.Current}}{{else if .Agent.RunUser}}{{.Agent.RunUser}}{{else}}неизвестно{{end}}</code>
+      · Терминал открывается от: <code>{{.Agent.TerminalUser}}</code>
+    </p>
+    {{if .Users}}
+    <form method="post" action="/agents/{{.Agent.ID}}/user" class="row">
+      <input type="hidden" name="csrf" value="{{.CSRF}}">
+      <select name="user" {{if not .Users.CanSwitch}}disabled{{end}}>
+        {{range .Users.Users}}<option value="{{.}}" {{if eq . $.Agent.TerminalUser}}selected{{end}}>{{.}}</option>{{end}}
+      </select>
+      <button type="submit" {{if not .Users.CanSwitch}}disabled{{end}}>Сохранить</button>
+      {{if .Users.CanSwitch}}<button type="button" class="btn ghost" onclick="document.getElementById('newuser').hidden = !document.getElementById('newuser').hidden">Создать нового</button>{{end}}
+    </form>
+    {{if .Users.CanSwitch}}
+    <form id="newuser" method="post" action="/agents/{{.Agent.ID}}/users/add" style="max-width:360px; margin-top:16px" hidden>
+      <input type="hidden" name="csrf" value="{{.CSRF}}">
+      <label for="nu-name">Имя нового пользователя</label>
+      <input type="text" id="nu-name" name="name" pattern="[a-z_][a-z0-9_\-]{0,31}" autocomplete="off" required>
+      <label for="nu-pass">Пароль</label>
+      <input type="password" id="nu-pass" name="password" autocomplete="new-password">
+      <label style="color:var(--text); font-size:14px">
+        <input type="checkbox" name="sudo" value="1"> Добавить в sudo
+      </label>
+      <p class="muted" style="font-size:13px">Без пароля вход по паролю (и sudo) для него работать не будет - только терминал из панели.</p>
+      <button type="submit">Создать пользователя</button>
+    </form>
+    {{else}}
+    <p class="muted" style="font-size:13px; margin-top:12px">Клиент запущен не от root, поэтому сменить или создать пользователя нельзя.</p>
+    {{end}}
+    {{else if .UsersErr}}
+    <p class="muted" style="font-size:13px">Список пользователей недоступен: {{.UsersErr}}.</p>
+    {{else}}
+    <p class="muted" style="font-size:13px">Машина офлайн - сменить пользователя можно, когда она на связи.</p>
+    {{end}}
+  </div>
+
   <div class="card">
     <h2>Версия клиента</h2>
     {{if .Updated}}<div class="err" style="background:#1d3a24;border-color:#2b6b3a;color:#b3ffcb">Команда обновления отправлена. Клиент скачает свежий бинарник и перезапустится.</div>{{end}}
@@ -50,7 +94,7 @@
   <div class="card">
     <h2>Удаление</h2>
     <p class="muted">Удаляет машину из панели. Сервис на самой машине продолжит работать,
-      но перестанет быть виден; чтобы подключиться снова — переустановите агента.</p>
+      но перестанет быть виден; чтобы подключиться снова - переустановите агента.</p>
     <form method="post" action="/agents/{{.Agent.ID}}/delete"
           onsubmit="return confirm('Удалить машину {{.Agent.Name}}?')">
       <input type="hidden" name="csrf" value="{{.CSRF}}">

internal/server/web/templates/forwards.html

@@ -3,49 +3,69 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Порты · {{.Agent.Name}} — LPRA</title>
+<title>Порты · {{.Agent.Name}} - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 <style>
-  .frow { display:flex; align-items:flex-end; gap:14px; flex-wrap:wrap; }
-  .frow label { margin:0 0 6px; }
-  .frow .fld { display:flex; flex-direction:column; }
-  .frow select, .frow input, .frow button {
+  /* One line: fixed narrow fields, the label takes what is left. */
+  .frow { display:flex; align-items:flex-end; gap:12px; flex-wrap:wrap; }
+  .frow label { margin:0 0 6px; white-space:nowrap; }
+  .frow .fld { display:flex; flex-direction:column; flex:none; width:108px; }
+  .frow .fld.addr { width:128px; }
+  .frow .fld.grow { flex:1; width:auto; min-width:150px; }
+  .frow select, .frow input[type=text], .frow button {
     height:40px; box-sizing:border-box; font-size:14px; line-height:1; margin:0;
   }
-  .frow select {
-    padding:0 32px 0 12px; border-radius:8px; border:1px solid var(--border);
-    background:#0c0f13; color:var(--text);
+  .frow select { min-width:0; width:100%; padding:0 30px 0 12px; background-position:right 10px center; }
+  /* The ufw switch hangs under the button, centred on it, level with the note. */
+  .frow .act { position:relative; }
+  .frow .act label.check {
+    position:absolute; top:100%; left:50%; transform:translateX(-50%);
+    display:inline-flex; align-items:center; gap:8px; height:20px; margin:12px 0 0;
+    color:var(--text); font-size:14px; cursor:pointer;
+  }
+  .under { min-height:20px; margin:12px 110px 0 0; font-size:13px; line-height:20px; }
+  /* Phones: two fields a line, the label and the button each a line of their own. */
+  @media (max-width: 640px) {
+    .frow .fld, .frow .fld.addr { width:calc(50% - 6px); }
+    .frow .fld.grow { flex:1 1 100%; }
+    .frow .act { display:flex; align-items:center; gap:16px; width:100%; }
+    .frow .act button { flex:1; }
+    .frow .act label.check { position:static; transform:none; margin:0; }
+    .under { margin-right:0; }
   }
 </style>
 </head>
 <body>
 <header class="topbar">
-  <div class="brand">LPRA · Порты — {{.Agent.Name}} <span class="muted">({{.Agent.Hostname}})</span></div>
+  <div class="brand">LPRA · Порты - {{.Agent.Name}} <span class="muted">({{.Agent.Hostname}})</span></div>
   <nav>
     <a href="/">← Машины</a>
     <a href="/agents/{{.Agent.ID}}/terminal">Терминал</a>
     <a href="/agents/{{.Agent.ID}}/files">Файлы</a>
+    <a href="/agents/{{.Agent.ID}}/status">Статус</a>
+    <a href="/agents/{{.Agent.ID}}/edit">Изменить</a>
   </nav>
 </header>
 <div class="wrap">
   <h1>Проброс портов</h1>
   <p class="muted">Порт сервиса на машине-клиенте становится доступен на порту хоста.
-    Клиент за NAT — трафик идёт исходящим подключением агента.</p>
+    Клиент за NAT - трафик идёт исходящим подключением агента.</p>
   {{if .Error}}<div class="err">{{.Error}}</div>{{end}}
 
   <div class="card">
     <h2>Правила</h2>
     {{if .Rules}}
-    <table>
-      <thead><tr><th>Тип</th><th>Хост (порт)</th><th>→ Клиент (порт)</th><th>Слушать на</th><th></th></tr></thead>
+    <table class="stack">
+      <thead><tr><th>Тип</th><th>Хост (порт)</th><th>→ Клиент (порт)</th><th>Слушать на</th><th>Метка</th><th></th></tr></thead>
       <tbody>
       {{range .Rules}}
         <tr>
-          <td><code>{{.Proto}}</code></td>
-          <td class="muted">:{{.HostPort}}</td>
-          <td class="muted">127.0.0.1:{{.ClientPort}}</td>
-          <td class="muted">{{.ListenAddr}}</td>
-          <td style="text-align:right">
+          <td data-l="Тип"><code>{{.Proto}}</code></td>
+          <td class="muted" data-l="Хост">:{{.HostPort}}</td>
+          <td class="muted" data-l="→ Клиент">127.0.0.1:{{.ClientPort}}</td>
+          <td class="muted" data-l="Слушать на">{{.ListenAddr}}{{if and .NoUfw $.UfwEnabled}} · без ufw{{end}}</td>
+          <td class="lead">{{.Label}}</td>
+          <td class="actions" style="text-align:right">
             <form method="post" action="/forwards/{{.ID}}/delete" style="display:inline"
                   onsubmit="return confirm('Удалить правило?')">
               <input type="hidden" name="csrf" value="{{$.CSRF}}">
@@ -69,44 +89,55 @@
         <div class="fld">
           <label>Тип</label>
           <select name="proto" id="proto">
-            <option value="http">http (long-poll, работает везде)</option>
-            <option value="tcp">tcp (прямой, низкая задержка, порт 8446)</option>
-            <option value="udp">udp (прямой, порт 8446)</option>
+            <option value="http">http-lp</option>
+            <option value="tcp">tcp</option>
+            <option value="udp">udp</option>
           </select>
         </div>
         <div class="fld">
-          <label>Порт на клиенте</label>
-          <input type="text" name="client_port" placeholder="напр. 22" style="max-width:140px" required>
+          <label>Порт клиента</label>
+          <input type="text" name="client_port" placeholder="22" required>
         </div>
         <div class="fld">
-          <label>Порт на хосте</label>
-          <input type="text" name="host_port" placeholder="напр. 2222" style="max-width:140px" required>
+          <label>Порт хоста</label>
+          <input type="text" name="host_port" placeholder="2222" required>
         </div>
-        <div class="fld">
-          <label>Слушать на хосте</label>
-          <input type="text" name="listen_addr" value="0.0.0.0" style="max-width:160px">
+        <div class="fld addr">
+          <label>Слушать на</label>
+          <input type="text" name="listen_addr" value="0.0.0.0">
+        </div>
+        <div class="fld grow">
+          <label>Метка</label>
+          <input type="text" name="label" maxlength="80" placeholder="необязательно">
+        </div>
+        <div class="act">
+          <button type="submit">Создать</button>
+          {{if .UfwEnabled}}
+          <label class="check" title="Порт не будет открыт в ufw, и при удалении правила в ufw ничего не изменится">
+            <input type="checkbox" name="no_ufw" value="1"> Без ufw
+          </label>
+          {{end}}
         </div>
-        <button type="submit">Создать</button>
       </div>
+      <div class="under"><span class="muted" id="note"></span></div>
     </form>
-    <p class="muted" id="note" style="font-size:13px; margin-top:12px"></p>
   </div>
 
   <div class="card">
     <h2>Режимы</h2>
     <ul class="muted" style="font-size:14px; line-height:1.7">
-      <li><b>http</b> — туннель поверх HTTP long-poll (через nginx :8445). Работает везде, где доступна панель, но задержка выше.</li>
-      <li><b>tcp</b> — прямой TCP-мультиплексор через порт <b>8446</b> хоста. Минимальная задержка, keep-alive, TCP_NODELAY. Нужно открыть 8446/tcp на хосте.</li>
-      <li><b>udp</b> — прямой UDP через порт <b>8446</b> хоста. Нужно открыть 8446/udp.</li>
+      <li><b>http-lp</b> - туннель поверх HTTP long-poll (через адрес панели, порт {{.PanelPort}}). Работает везде, где доступна панель, но задержка выше.</li>
+      <li><b>tcp</b> - прямой TCP-мультиплексор через порт <b>{{.TunnelPort}}</b> хоста. Минимальная задержка, keep-alive, TCP_NODELAY. Нужно открыть {{.TunnelPort}}/tcp на хосте.</li>
+      <li><b>udp</b> - прямой UDP через порт <b>{{.TunnelPort}}</b> хоста. Нужно открыть {{.TunnelPort}}/udp.</li>
     </ul>
-    <p class="muted" style="font-size:13px">Для tcp/udp агент держит исходящее соединение к <code>host:8446</code>; несколько клиентов и портов мультиплексируются на нём.</p>
+    <p class="muted" style="font-size:13px">Для tcp/udp агент держит исходящее соединение к <code>host:{{.TunnelPort}}</code>; несколько клиентов и портов мультиплексируются на нём.</p>
   </div>
 </div>
 <script>
   var notes = {
-    http: 'Трафик идёт через :8445 (long-poll). Порт 8446 не требуется.',
-    tcp:  'Требуется открытый порт 8446/tcp на хосте. Самая низкая задержка.',
-    udp:  'Требуется открытый порт 8446/udp на хосте.'
+    http: 'Трафик идёт через порт панели {{.PanelPort}} (long-poll). Порт {{.TunnelPort}} не требуется.',
+    tcp:  'Требуется открытый порт {{.TunnelPort}}/tcp на хосте. Самая низкая задержка.',
+    udp:  'Требуется открытый порт {{.TunnelPort}}/udp на хосте.'
   };
   var sel = document.getElementById('proto'), note = document.getElementById('note');
   function upd(){ note.textContent = notes[sel.value] || ''; }

internal/server/web/templates/login.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Вход — LPRA</title>
+<title>Вход - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 </head>
 <body>

internal/server/web/templates/settings.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Настройки — LPRA</title>
+<title>Настройки - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 </head>
 <body>
@@ -19,6 +19,7 @@
 </header>
 <div class="wrap">
   <h1>Настройки</h1>
+  {{if .Error}}<div class="err">{{.Error}}</div>{{end}}
 
   <div class="card">
     <h2>Установка на новую машину</h2>
@@ -49,6 +50,26 @@
     </form>
   </div>
 
+  <div class="card">
+    <h2>Прямой туннель (tcp/udp проброс)</h2>
+    {{if not .TunnelDefault}}
+      <p class="muted">Прямой туннель отключён при запуске сервера (пустой <code>-tunnel</code> / <code>LPRA_TUNNEL_ADDR</code>).</p>
+    {{else}}
+      <p class="muted">Адрес, к которому агенты подключаются для проброса в режимах tcp/udp. Агенты забирают его
+        с панели сами - при подключении и при каждом опросе, так что смена применяется без переустановки.
+        Хост можно оставить пустым (тогда берётся хост из адреса панели) или указать IP/другое имя.</p>
+      <form method="post" action="/settings/tunnel" class="row">
+        <input type="hidden" name="csrf" value="{{.CSRF}}">
+        <input type="text" name="tunnel_host" value="{{.TunnelHost}}" placeholder="хост (как у панели)" style="max-width:260px">
+        <input type="number" name="tunnel_port" min="1" max="65535" value="{{if .TunnelCustom}}{{.TunnelPort}}{{end}}" placeholder="{{.TunnelDefault}}" style="max-width:120px">
+        <button type="submit">Сохранить</button>
+      </form>
+      <p class="muted" style="font-size:13px">Сейчас сервер слушает порт <b>{{.TunnelPort}}</b> (tcp и udp). При смене порта сервер
+        сразу начинает слушать новый, агенты переподключаются в течение ~30 секунд, правило ufw переносится.
+        Агенты старше 0.0.3 и агенты с заданными <code>TUNNEL_ADDR</code>/<code>TUNNEL_PORT</code> адрес с панели не берут.</p>
+    {{end}}
+  </div>
+
   <div class="card">
     <h2>Enroll-секрет</h2>
     <p class="muted">Общий секрет для регистрации новых агентов.</p>
@@ -94,7 +115,7 @@
   <div class="card">
     <h2>Firewall (ufw)</h2>
     {{if not .UfwInstalled}}
-      <p class="muted">ufw не установлен на хосте — интеграция недоступна.</p>
+      <p class="muted">ufw не установлен на хосте - интеграция недоступна.</p>
     {{else if not .UfwRunnable}}
       <p class="muted">ufw установлен, но сервер не может им управлять (нужны права root).
         Запустите сервер под root или настройте sudo для ufw.</p>
@@ -103,7 +124,8 @@
         Статус ufw: {{if .UfwActive}}<span style="color:var(--ok)">активен</span>{{else}}<span style="color:var(--danger)">выключен</span>{{end}}
         · Интеграция: {{if .UfwEnabled}}<span style="color:var(--ok)">включена</span>{{else}}<span class="muted">выключена</span>{{end}}
       </p>
-      <p class="muted" style="font-size:13px">При создании правила проброса порт открывается в ufw автоматически (для tcp/udp — также порт 8446).</p>
+      <p class="muted" style="font-size:13px">При создании правила проброса порт открывается в ufw автоматически (для tcp/udp - также порт туннеля{{if .TunnelPort}} {{.TunnelPort}}{{end}}); для http-проброса открывается tcp-порт хоста. Порты правил, слушающих только 127.0.0.1, не открываются.</p>
+      {{if .UfwError}}<div class="err">Последняя команда ufw завершилась ошибкой: <code>{{.UfwError}}</code></div>{{end}}
       <form method="post" action="/settings/ufw/toggle" style="display:inline">
         <input type="hidden" name="csrf" value="{{.CSRF}}">
         <input type="hidden" name="enabled" value="{{if .UfwEnabled}}0{{else}}1{{end}}">
@@ -119,6 +141,7 @@
         {{range .UfwRules}}
           <tr>
             <td><code>{{.Port}}/{{.Proto}}</code></td>
+            <td class="muted">{{if .Manual}}вручную{{else if .RuleID}}проброс{{else}}туннель{{end}}</td>
             <td style="text-align:right">
               <form method="post" action="/settings/ufw/revoke" style="display:inline"
                     onsubmit="return confirm('Отменить правило ufw {{.Port}}/{{.Proto}}?')">
@@ -134,6 +157,20 @@
       {{else}}
       <p class="muted" style="font-size:13px; margin-top:10px">Панель пока не открывала портов в ufw.</p>
       {{end}}
+
+      {{if and .UfwActive .UfwEnabled}}
+      <h2 style="margin-top:18px; font-size:15px">Открыть порт вручную</h2>
+      <form method="post" action="/settings/ufw/add" class="row">
+        <input type="hidden" name="csrf" value="{{.CSRF}}">
+        <input type="number" name="port" min="1" max="65535" placeholder="порт" style="max-width:120px" required>
+        <select name="proto" style="max-width:100px">
+          <option value="tcp">tcp</option>
+          <option value="udp">udp</option>
+        </select>
+        <button type="submit">Открыть</button>
+      </form>
+      <p class="muted" style="font-size:13px">Такое правило не привязано к пробросу и остаётся, пока его не отменить здесь.</p>
+      {{end}}
     {{end}}
   </div>
 

internal/server/web/templates/setup.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Настройка — LPRA</title>
+<title>Настройка - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 </head>
 <body>

internal/server/web/templates/status.html

@@ -0,0 +1,346 @@
+<!doctype html>
+<html lang="ru">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Статус · {{.Agent.Name}} - LPRA</title>
+<link rel="stylesheet" href="/static/app.css">
+<style>
+  .meters { display:grid; grid-template-columns:repeat(auto-fit, minmax(240px, 1fr)); gap:20px; margin-bottom:20px; }
+  .meters .card { margin:0; }
+  .meter .head { display:flex; align-items:baseline; justify-content:space-between; }
+  .meter .name { color:var(--muted); font-size:13px; }
+  .meter .val { font-size:26px; font-weight:600; font-variant-numeric:tabular-nums; }
+  .meter .sub { color:var(--muted); font-size:13px; margin-top:8px; min-height:20px; font-variant-numeric:tabular-nums; }
+  .bar { height:8px; border-radius:4px; background:#0c0f13; border:1px solid var(--border); overflow:hidden; margin-top:10px; }
+  .bar i { display:block; height:100%; width:100%; background:var(--accent); transform-origin:left; transform:scaleX(0); transition:transform .4s; }
+  .bar i.warn { background:#e6a23c; }
+  .bar i.crit { background:var(--danger); }
+  .speed { display:flex; gap:28px; flex-wrap:wrap; margin-top:16px; }
+  .speed b { display:block; font-size:20px; font-variant-numeric:tabular-nums; }
+  .speed span { color:var(--muted); font-size:13px; }
+  .live { display:flex; align-items:center; gap:28px; flex-wrap:wrap; margin-top:20px; }
+  .gauge { position:relative; width:240px; flex:none; }
+  .gauge svg { display:block; width:100%; }
+  .gauge path { fill:none; stroke-width:14; stroke-linecap:round; }
+  .gauge .track { stroke:#0c0f13; }
+  .gauge .fill { stroke:var(--accent); stroke-dasharray:251.4; stroke-dashoffset:251.4; transition:stroke-dashoffset .25s linear, stroke .3s; }
+  .gauge .num { position:absolute; left:0; right:0; bottom:26px; text-align:center; font-size:38px; font-weight:600; line-height:1; font-variant-numeric:tabular-nums; }
+  .gauge .unit { position:absolute; left:0; right:0; bottom:4px; text-align:center; color:var(--muted); font-size:13px; }
+  .live .side { flex:1; min-width:220px; }
+  .live .phase { font-size:15px; margin-bottom:8px; }
+  .live .phase i { font-style:normal; color:var(--accent); margin-right:6px; }
+  .live.up .phase i { color:var(--ok); }
+  .live.up .gauge .fill { stroke:var(--ok); }
+  .spark { display:block; width:100%; height:64px; }
+  .spark polyline { fill:none; stroke:var(--accent); stroke-width:2; vector-effect:non-scaling-stroke; stroke-linejoin:round; }
+  .spark polygon { fill:var(--accent); opacity:.15; }
+  .live.up .spark polyline { stroke:var(--ok); }
+  .live.up .spark polygon { fill:var(--ok); }
+  label.check { display:inline-flex; align-items:center; gap:8px; margin:0; color:var(--text); font-size:14px; cursor:pointer; }
+</style>
+</head>
+<body>
+<header class="topbar">
+  <div class="brand">LPRA · Статус - {{.Agent.Name}} <span class="muted">({{.Agent.Hostname}})</span></div>
+  <nav>
+    <a href="/">← Машины</a>
+    <a href="/agents/{{.Agent.ID}}/terminal">Терминал</a>
+    <a href="/agents/{{.Agent.ID}}/files">Файлы</a>
+    <a href="/agents/{{.Agent.ID}}/forwards">Порты</a>
+    <a href="/agents/{{.Agent.ID}}/edit">Изменить</a>
+  </nav>
+</header>
+<div class="wrap">
+  <h1>Статус</h1>
+  <div class="err" id="err" hidden></div>
+
+  <div class="meters">
+    <div class="card meter">
+      <div class="head"><span class="name">Процессор</span><span class="val" id="cpu-val">-</span></div>
+      <div class="bar"><i id="cpu-bar"></i></div>
+      <div class="sub" id="cpu-sub"></div>
+    </div>
+    <div class="card meter">
+      <div class="head"><span class="name">Оперативная память</span><span class="val" id="mem-val">-</span></div>
+      <div class="bar"><i id="mem-bar"></i></div>
+      <div class="sub" id="mem-sub"></div>
+    </div>
+    <div class="card meter">
+      <div class="head"><span class="name">Диск (/)</span><span class="val" id="disk-val">-</span></div>
+      <div class="bar"><i id="disk-bar"></i></div>
+      <div class="sub" id="disk-sub"></div>
+    </div>
+  </div>
+
+  <div class="card">
+    <h2>Скорость соединения</h2>
+    <p class="muted">Клиент замеряет свой канал до хоста панели - тот же, по которому идут терминал, файлы и http-проброс.
+      С галочкой «До браузера» данные идут дальше, через панель до этого браузера и обратно: так виден весь путь клиент - панель - браузер.
+      Замер занимает около 15 секунд, не дольше 40, и на это время нагружает канал.</p>
+    <div class="row">
+      <button id="speed-btn" type="button">Замерить скорость</button>
+      <label class="check" title="Данные пойдут не только между клиентом и хостом панели, а через панель до этого браузера и обратно">
+        <input type="checkbox" id="speed-relay"> До браузера
+      </label>
+      <span class="muted" id="speed-note"></span>
+    </div>
+    <div class="live" id="live" hidden>
+      <div class="gauge">
+        <svg viewBox="0 0 200 110">
+          <path class="track" d="M20 100 A80 80 0 0 1 180 100"/>
+          <path class="fill" id="lv-arc" d="M20 100 A80 80 0 0 1 180 100"/>
+        </svg>
+        <div class="num" id="lv-num">-</div>
+        <div class="unit" id="lv-unit"></div>
+      </div>
+      <div class="side">
+        <div class="phase"><i id="lv-ico"></i><span id="lv-phase"></span></div>
+        <svg class="spark" viewBox="0 0 100 100" preserveAspectRatio="none">
+          <polygon id="lv-area" points=""/>
+          <polyline id="lv-line" points=""/>
+        </svg>
+      </div>
+    </div>
+    <div class="speed" id="speed" hidden>
+      <div><b id="sp-ping"></b><span>задержка</span></div>
+      <div><b id="sp-down"></b><span id="sp-down-lbl"></span></div>
+      <div><b id="sp-up"></b><span id="sp-up-lbl"></span></div>
+    </div>
+  </div>
+</div>
+<script>
+(function () {
+  var base = '/api/panel/agents/' + encodeURIComponent({{.Agent.ID}});
+  var $ = function (id) { return document.getElementById(id); };
+  var errBox = $('err');
+
+  function size(n) {
+    var u = ['Б', 'КБ', 'МБ', 'ГБ', 'ТБ'], i = 0;
+    while (n >= 1024 && i < u.length - 1) { n /= 1024; i++; }
+    return n.toFixed(n < 10 && i > 0 ? 1 : 0) + ' ' + u[i];
+  }
+  function rateParts(bps) {
+    var u = ['бит/с', 'Кбит/с', 'Мбит/с', 'Гбит/с'], i = 0;
+    while (bps >= 1000 && i < u.length - 1) { bps /= 1000; i++; }
+    return [bps.toFixed(bps < 100 && i > 0 ? 1 : 0), u[i]];
+  }
+  function rate(bps) { return rateParts(bps).join(' '); }
+  function meter(name, pct, sub) {
+    pct = Math.max(0, Math.min(100, pct));
+    $(name + '-val').textContent = Math.round(pct) + '%';
+    var bar = $(name + '-bar');
+    bar.style.transform = 'scaleX(' + pct / 100 + ')';
+    bar.className = pct >= 90 ? 'crit' : pct >= 75 ? 'warn' : '';
+    $(name + '-sub').textContent = sub;
+  }
+  function showErr(msg) {
+    errBox.textContent = msg || '';
+    errBox.hidden = !msg;
+  }
+  function cores(n) {
+    var d = n % 10, h = n % 100;
+    return n + (d === 1 && h !== 11 ? ' ядро' : d >= 2 && d <= 4 && (h < 12 || h > 14) ? ' ядра' : ' ядер');
+  }
+
+  // One request at a time, and none while the tab is hidden: the client is
+  // sampled only for a page somebody is looking at.
+  var timer = null, busy = false;
+  function schedule(ms) {
+    clearTimeout(timer);
+    if (!document.hidden) timer = setTimeout(load, ms);
+  }
+  function load() {
+    if (busy || document.hidden) return;
+    busy = true;
+    var next = 3000;
+    fetch(base + '/stat', {credentials: 'same-origin'})
+      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })
+      .then(function (res) {
+        if (!res.ok) { showErr(res.error || 'ошибка'); next = 10000; return; }
+        showErr('');
+        var d = res.data;
+        meter('cpu', d.cpu, cores(d.ncpu));
+        meter('mem', d.mem_total ? 100 * d.mem_used / d.mem_total : 0,
+          'занято ' + size(d.mem_used) + ' из ' + size(d.mem_total) + ' · свободно ' + size(d.mem_total - d.mem_used));
+        meter('disk', d.disk_total ? 100 * (d.disk_total - d.disk_free) / d.disk_total : 0,
+          'свободно ' + size(d.disk_free) + ' из ' + size(d.disk_total));
+      })
+      .catch(function (e) { showErr('Нет связи с панелью: ' + e.message); next = 10000; })
+      .then(function () { busy = false; schedule(next); });
+  }
+  document.addEventListener('visibilitychange', function () {
+    if (document.hidden) clearTimeout(timer); else load();
+  });
+  load();
+
+  var btn = $('speed-btn'), note = $('speed-note');
+  function json(r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); }
+  function post(path) { return fetch(base + path, {method: 'POST', credentials: 'same-origin'}).then(json); }
+
+  // The browser's round trip to the panel: the first request may pay for a
+  // new connection, so keep the best.
+  function panelPing() {
+    var best = Infinity, left = 4;
+    function one() {
+      var t = performance.now();
+      return fetch('/api/panel/ping', {credentials: 'same-origin', cache: 'no-store'})
+        .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); })
+        .then(function () {
+          best = Math.min(best, performance.now() - t);
+          return --left > 0 ? one() : best;
+        });
+    }
+    return one();
+  }
+  // Keeps the client's download fed until stopped or the panel says the
+  // client has read enough; the pieces grow while they go through quickly.
+  function feed(stop) {
+    var block = new Uint8Array(65536), n = 4;
+    crypto.getRandomValues(block);
+    function one() {
+      var parts = [], t = performance.now();
+      for (var i = 0; i < n; i++) parts.push(block);
+      return fetch(base + '/speed/down', {method: 'POST', body: new Blob(parts), credentials: 'same-origin', signal: stop.signal})
+        .then(function (r) {
+          if (r.status !== 204) return;
+          if (performance.now() - t < 500 && n < 256) n *= 2;
+          return one();
+        });
+    }
+    one().catch(function () {});
+  }
+  // Reads what the client sends and times it from the first byte. It stops by
+  // itself a little after the client's window, so bytes still queued on a slow
+  // link don't hold the result back. st.n is the count so far, for the live
+  // reading.
+  function drain(st, onFirst) {
+    var ac = new AbortController(), last = 0;
+    st.stop = function () { ac.abort(); };
+    function done() { return st.start && last > st.start ? st.n * 8000 / (last - st.start) : 0; }
+    return fetch(base + '/speed/up', {credentials: 'same-origin', cache: 'no-store', signal: ac.signal}).then(function (r) {
+      if (!r.ok) throw new Error('HTTP ' + r.status);
+      var rd = r.body.getReader();
+      function pump() {
+        return rd.read().then(function (c) {
+          if (c.done) return done();
+          last = performance.now();
+          if (!st.start) { st.start = last; setTimeout(st.stop, {{.RelayUpMs}}); onFirst(); }
+          else st.n += c.value.length;
+          return pump();
+        });
+      }
+      return pump();
+    }).catch(function (e) { if (st.start) return done(); throw e; });
+  }
+  // The test through the browser: the client's download is what this page
+  // uploads, and its upload is timed here, where it arrives.
+  function relayTest(st) {
+    return panelPing().then(function (ping) {
+      return post('/speed/relay').then(function (res) {
+        if (!res.ok) return res;
+        var stop = new AbortController();
+        var up = drain(st, function () { stop.abort(); });
+        up.catch(function () {});
+        feed(stop);
+        return post('/speed?relay=1').then(function (res) {
+          stop.abort();
+          // No upload under way by now: none is coming.
+          if (!res.ok || !st.start) { st.stop(); }
+          if (!res.ok) return res;
+          return up.catch(function () { return 0; }).then(function (bps) {
+            res.data.ping_ms += ping;
+            if (bps) res.data.up_bps = bps;
+            return res;
+          });
+        }, function (e) { stop.abort(); st.stop(); throw e; });
+      });
+    });
+  }
+
+  // The live reading: the rate over the last second, from the byte counts the
+  // panel keeps for the running test - or, for the client's upload in a test
+  // through the browser, from what has arrived here.
+  var ARC = 251.4, lv = null;
+  function liveStart(relay, st) {
+    lv = {relay: relay, st: st, phase: '', pts: [], hist: [], busy: false};
+    $('live').hidden = false;
+    liveShow('ping', 0);
+    lv.timer = setInterval(liveTick, 200);
+  }
+  function liveStop() {
+    if (!lv) return;
+    clearInterval(lv.timer);
+    lv = null;
+    $('live').hidden = true;
+  }
+  function liveTick() {
+    var cur = lv;
+    if (cur.relay && cur.st.start) { livePoint(cur, 'up', cur.st.n, performance.now()); return; }
+    if (cur.busy) return;
+    cur.busy = true;
+    fetch(base + '/speed/progress', {credentials: 'same-origin', cache: 'no-store'})
+      .then(json)
+      .then(function (d) {
+        if (cur !== lv || !d.phase || (cur.relay && cur.st.start)) return;
+        livePoint(cur, d.phase, d.phase === 'up' ? d.up : d.down, d.ms);
+      })
+      .catch(function () {})
+      .then(function () { cur.busy = false; });
+  }
+  function livePoint(cur, phase, bytes, ms) {
+    if (phase !== cur.phase) { cur.phase = phase; cur.pts = []; cur.hist = []; }
+    if (phase === 'ping') { liveShow(phase, 0); return; }
+    var pts = cur.pts;
+    pts.push([ms, bytes]);
+    while (pts.length > 2 && ms - pts[0][0] > 1000) pts.shift();
+    if (pts.length < 2 || ms <= pts[0][0]) return;
+    var bps = (bytes - pts[0][1]) * 8000 / (ms - pts[0][0]);
+    cur.hist.push(bps);
+    liveShow(phase, bps, cur);
+  }
+  function liveShow(phase, bps, cur) {
+    var relay = lv && lv.relay, p = rateParts(bps);
+    $('live').className = 'live' + (phase === 'up' ? ' up' : '');
+    $('lv-ico').textContent = phase === 'up' ? '↑' : phase === 'down' ? '↓' : '';
+    $('lv-phase').textContent = phase === 'ping' ? 'Задержка…'
+      : phase === 'up' ? (relay ? 'клиент → браузер' : 'клиент → хост')
+      : (relay ? 'браузер → клиент' : 'хост → клиент');
+    $('lv-num').textContent = phase === 'ping' ? '…' : p[0];
+    $('lv-unit').textContent = phase === 'ping' ? '' : p[1];
+    // A log scale up to 1 Гбит/с, so a slow link moves the needle too.
+    var f = Math.min(1, Math.log(1 + bps / 1e6) / Math.log(1001));
+    $('lv-arc').style.strokeDashoffset = ARC * (1 - f);
+    var h = cur ? cur.hist : [], max = 1.25 * Math.max.apply(null, h.concat(1)), line = '';
+    for (var i = 0; i < h.length; i++) {
+      line += (h.length > 1 ? 100 * i / (h.length - 1) : 0).toFixed(1) + ',' + (98 - 94 * h[i] / max).toFixed(1) + ' ';
+    }
+    $('lv-line').setAttribute('points', line);
+    $('lv-area').setAttribute('points', h.length > 1 ? '0,100 ' + line + '100,100' : '');
+  }
+
+  btn.onclick = function () {
+    var relay = $('speed-relay').checked, st = {n: 0, start: 0, stop: function () {}};
+    btn.disabled = true;
+    note.textContent = 'Идёт замер…';
+    $('speed').hidden = true;
+    liveStart(relay, st);
+    (relay ? relayTest(st) : post('/speed'))
+      .then(function (res) {
+        if (!res.ok) { note.textContent = res.error || 'ошибка'; return; }
+        var d = res.data;
+        $('sp-ping').textContent = d.ping_ms ? d.ping_ms.toFixed(d.ping_ms < 10 ? 1 : 0) + ' мс' : '-';
+        $('sp-down').textContent = rate(d.down_bps);
+        $('sp-up').textContent = d.up_bps ? rate(d.up_bps) : '-';
+        $('sp-down-lbl').textContent = relay ? 'браузер → клиент' : 'хост → клиент';
+        $('sp-up-lbl').textContent = relay ? 'клиент → браузер' : 'клиент → хост';
+        $('speed').hidden = false;
+        note.textContent = d.partial ? 'Замер остановлен по времени - показано то, что успело набраться' : '';
+      })
+      .catch(function (e) { note.textContent = 'Не удалось: ' + e.message; })
+      .then(function () { liveStop(); btn.disabled = false; });
+  };
+})();
+</script>
+</body>
+</html>

internal/server/web/templates/terminal.html

@@ -3,27 +3,84 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Терминал · {{.Agent.Name}} — LPRA</title>
+<title>Терминал · {{.Agent.Name}} - LPRA</title>
 <link rel="stylesheet" href="/static/app.css">
 <link rel="stylesheet" href="/static/xterm.css">
 <style>
   #status.st-ok  { color:#37c871; }
   #status.st-err { color:#ff5c5c; }
+  /* Touch screens: the page is as tall as what the on-screen keyboard leaves,
+     with a row of extra keys at the bottom, the way Termux does it. */
+  .keys { display:none; }
+  body.touch { position:fixed; left:0; right:0; top:0; height:100%; display:flex; flex-direction:column; overflow:hidden; }
+  body.touch .wrap { flex:1; min-height:0; display:flex; width:100%; margin:0; padding:6px; }
+  body.touch #terminal { flex:1; min-width:0; height:auto; }
+  body.touch .keys {
+    display:grid; grid-template-columns:repeat(7, 1fr); gap:4px; flex:none;
+    padding:4px 4px calc(4px + env(safe-area-inset-bottom)); background:var(--panel); border-top:1px solid var(--border);
+  }
+  .keys button {
+    height:38px; padding:0; border:1px solid var(--border); border-radius:6px;
+    background:#0c0f13; color:var(--text); font:500 13px ui-monospace, SFMono-Regular, Menlo, monospace;
+    touch-action:manipulation; user-select:none; -webkit-user-select:none; -webkit-tap-highlight-color:transparent;
+  }
+  .keys button:active { background:var(--border); }
+  .keys button.on { background:var(--accent); border-color:var(--accent); color:#fff; }
+  .keys button.lock { background:var(--accent); border-color:#fff; color:#fff; }
+  /* Copy and paste on touch screens: a long press selects, this menu acts. */
+  .selmenu { position:fixed; left:50%; transform:translateX(-50%); z-index:20; display:flex; gap:7px; padding:5px;
+             background:var(--panel); border:1px solid var(--border); border-radius:8px; box-shadow:0 6px 24px rgba(0,0,0,.5); }
+  .selmenu[hidden] { display:none; }
+  .selmenu button { width:42px; height:42px; padding:0; display:inline-flex; align-items:center; justify-content:center;
+                    touch-action:manipulation; -webkit-tap-highlight-color:transparent; }
+  body.touch #terminal { -webkit-user-select:none; user-select:none; -webkit-touch-callout:none; }
 </style>
 </head>
 <body>
 <header class="topbar">
-  <div class="brand">LPRA · Терминал — {{.Agent.Name}} <span class="muted">({{.Agent.Hostname}})</span></div>
+  <div class="brand">LPRA · Терминал - {{.Agent.Name}} <span class="muted">({{.Agent.TerminalUser}}@{{.Agent.Hostname}})</span></div>
   <nav>
     <a href="/">← Машины</a>
     <a href="/agents/{{.Agent.ID}}/files">Файлы</a>
     <a href="/agents/{{.Agent.ID}}/forwards">Порты</a>
+    <a href="/agents/{{.Agent.ID}}/status">Статус</a>
+    <a href="/agents/{{.Agent.ID}}/edit">Изменить</a>
     <span id="status" class="muted" style="margin-left:28px">подключение…</span>
   </nav>
 </header>
 <div class="wrap" style="max-width:none">
   <div id="terminal"></div>
 </div>
+<div class="selmenu" id="selmenu" hidden>
+  <button type="button" data-a="copy" title="Копировать" aria-label="Копировать">
+    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15H4a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v1"/></svg>
+  </button>
+  <button type="button" class="btn ghost" data-a="paste" title="Вставить" aria-label="Вставить">
+    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/></svg>
+  </button>
+  <button type="button" class="btn ghost" data-a="all" title="Выделить всё" aria-label="Выделить всё">
+    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 3a2 2 0 0 0-2 2M19 3a2 2 0 0 1 2 2M21 19a2 2 0 0 1-2 2M5 21a2 2 0 0 1-2-2M9 3h1M9 21h1M14 3h1M14 21h1M3 9v1M21 9v1M3 14v1M21 14v1"/><rect x="7" y="7" width="10" height="10" rx="1"/></svg>
+  </button>
+  <button type="button" class="btn ghost close" data-a="close" title="Закрыть" aria-label="Закрыть">
+    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round"><path d="M18 6 6 18M6 6l12 12"/></svg>
+  </button>
+</div>
+<div class="keys" id="keys">
+  <button type="button" data-k="esc">ESC</button>
+  <button type="button" data-k="/">/</button>
+  <button type="button" data-k="-">-</button>
+  <button type="button" data-k="home">HOME</button>
+  <button type="button" data-k="up">↑</button>
+  <button type="button" data-k="end">END</button>
+  <button type="button" data-k="pgup">PGUP</button>
+  <button type="button" data-k="tab">TAB</button>
+  <button type="button" data-k="ctrl" data-mod="ctrl">CTRL</button>
+  <button type="button" data-k="alt" data-mod="alt">ALT</button>
+  <button type="button" data-k="left">←</button>
+  <button type="button" data-k="down">↓</button>
+  <button type="button" data-k="right">→</button>
+  <button type="button" data-k="pgdn">PGDN</button>
+</div>
 
 <script src="/static/xterm.js"></script>
 <script src="/static/addon-fit.js"></script>
@@ -31,11 +88,13 @@
 (function () {
   const agentID = {{.Agent.ID}};
   const statusEl = document.getElementById('status');
+  const touch = window.matchMedia('(pointer: coarse)').matches;
+  if (touch) document.body.classList.add('touch');
   function setStatus(t, cls) { statusEl.textContent = t; statusEl.className = cls || ''; }
 
   const term = new Terminal({
     cursorBlink: true,
-    fontSize: 14,
+    fontSize: touch ? 13 : 14,
     fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace',
     theme: { background: '#0c0f13' }
   });
@@ -78,7 +137,7 @@
         setStatus('ошибка открытия (' + r.status + ')', 'st-err');
         term.write('\r\n\x1b[31m[не удалось открыть сессию: HTTP ' + r.status + ']\x1b[0m\r\n');
         if (body) term.write(body.slice(0, 300).replace(/\n/g, '\r\n') + '\r\n');
-        if (r.status === 404) term.write('\x1b[33mМашина не найдена на сервере — возможно, устаревший бинарник сервера без маршрута /open.\x1b[0m\r\n');
+        if (r.status === 404) term.write('\x1b[33mМашина не найдена на сервере - возможно, устаревший бинарник сервера без маршрута /open.\x1b[0m\r\n');
         return;
       }
       const j = await r.json();
@@ -124,17 +183,237 @@
     term.write('\r\n\x1b[33m' + msg + '\x1b[0m\r\n');
   }
 
-  term.onData(function (data) {
+  // Input goes out one request at a time, so on a slow link a keystroke can
+  // never overtake the one before it; what is typed meanwhile is sent together
+  // next. A request that fails goes again under the same number, and the
+  // server drops one it already has.
+  let inSeq = 0, inBusy = false;
+  const inQueue = [];
+  function queueIn(m) {
     if (closed || !sid) return;
-    const bytes = new TextEncoder().encode(data);
-    post(base + sid + '/in', { t: 'i', d: bytesToB64(bytes) });
+    const last = inQueue[inQueue.length - 1];
+    if (last && last.t === 'i' && m.t === 'i') last.text += m.text;
+    else if (last && last.t === 'r' && m.t === 'r') inQueue[inQueue.length - 1] = m;
+    else inQueue.push(m);
+    pumpIn();
+  }
+  async function pumpIn() {
+    if (inBusy || !inQueue.length) return;
+    inBusy = true;
+    while (inQueue.length && !closed) {
+      const m = inQueue.shift();
+      const body = m.t === 'i'
+        ? { t: 'i', d: bytesToB64(new TextEncoder().encode(m.text)), seq: ++inSeq }
+        : { t: 'r', cols: m.cols, rows: m.rows, seq: ++inSeq };
+      for (let wait = 300; !closed; wait = Math.min(wait * 2, 5000)) {
+        let r = null;
+        try {
+          r = await fetch(base + sid + '/in', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body)
+          });
+        } catch (e) { /* no answer: send it again */ }
+        if (r && r.status < 500) break; // taken, or refused for good
+        await new Promise(res => setTimeout(res, wait));
+      }
+    }
+    inBusy = false;
+  }
+  function send(data) { queueIn({ t: 'i', text: data }); }
+  // What the keyboard types gets the CTRL / ALT of the extra keys, if armed.
+  term.onData(function (data) { send(withMods(data)); });
+
+  // --- Extra keys (touch screens) ---
+  // CTRL and ALT: a tap arms the key for the next key press, a long press
+  // keeps it on until tapped again.
+  const mods = { ctrl: 0, alt: 0 }; // 0 off, 1 next key, 2 locked
+  const modBtn = {};
+  document.querySelectorAll('#keys [data-mod]').forEach(function (b) { modBtn[b.dataset.mod] = b; });
+  function showMods() {
+    for (const m in mods) {
+      modBtn[m].classList.toggle('on', mods[m] === 1);
+      modBtn[m].classList.toggle('lock', mods[m] === 2);
+    }
+  }
+  function useMods() {
+    const used = { ctrl: !!mods.ctrl, alt: !!mods.alt };
+    for (const m in mods) if (mods[m] === 1) mods[m] = 0;
+    showMods();
+    return used;
+  }
+  function ctrlChar(c) {
+    if (c === ' ' || c === '@') return '\x00';
+    if (c === '?') return '\x7f';
+    const code = c.toUpperCase().charCodeAt(0);
+    return code >= 64 && code <= 95 ? String.fromCharCode(code & 31) : c;
+  }
+  function withMods(data) {
+    if (!mods.ctrl && !mods.alt) return data;
+    const m = useMods();
+    if (m.ctrl && data.length === 1) data = ctrlChar(data);
+    return m.alt ? '\x1b' + data : data;
+  }
+  // xterm's modifier parameter: 1 + shift(1) + alt(2) + ctrl(4).
+  const CSI = { up: 'A', down: 'B', right: 'C', left: 'D', home: 'H', end: 'F' };
+  const TILDE = { pgup: 5, pgdn: 6 };
+  function keySeq(k) {
+    const m = useMods(), p = 1 + (m.alt ? 2 : 0) + (m.ctrl ? 4 : 0);
+    if (CSI[k]) {
+      if (p > 1) return '\x1b[1;' + p + CSI[k];
+      return (term.modes.applicationCursorKeysMode ? '\x1bO' : '\x1b[') + CSI[k];
+    }
+    if (TILDE[k]) return '\x1b[' + TILDE[k] + (p > 1 ? ';' + p : '') + '~';
+    let s = k === 'esc' ? '\x1b' : k === 'tab' ? '\t' : k;
+    if (m.ctrl && s.length === 1) s = ctrlChar(s);
+    return m.alt ? '\x1b' + s : s;
+  }
+  let press = null;
+  document.querySelectorAll('#keys button').forEach(function (b) {
+    // Keep the focus (and the on-screen keyboard) on the terminal.
+    b.addEventListener('pointerdown', function (e) {
+      e.preventDefault();
+      const mod = b.dataset.mod;
+      if (mod) press = { mod: mod, timer: setTimeout(function () { mods[mod] = 2; press = null; showMods(); }, 450) };
+    });
+    b.addEventListener('pointerup', function (e) {
+      e.preventDefault();
+      const mod = b.dataset.mod;
+      if (mod) {
+        if (press && press.mod === mod) {
+          clearTimeout(press.timer);
+          press = null;
+          mods[mod] = mods[mod] ? 0 : 1;
+          showMods();
+        }
+        return;
+      }
+      send(keySeq(b.dataset.k));
+    });
+    b.addEventListener('pointercancel', function () { if (press) { clearTimeout(press.timer); press = null; } });
+    b.addEventListener('contextmenu', function (e) { e.preventDefault(); });
   });
 
-  function sendResize() {
-    if (closed || !sid) return;
-    post(base + sid + '/in', { t: 'r', cols: term.cols, rows: term.rows });
+  function sendResize() { queueIn({ t: 'r', cols: term.cols, rows: term.rows }); }
+  // --- Selecting and copying on touch screens ---
+  // xterm.js has no touch selection of its own. A long press selects the word
+  // under the finger and dragging on from there stretches the selection; a
+  // menu then copies it or pastes. A plain tap or swipe still types and scrolls.
+  if (touch) {
+    const box = document.getElementById('terminal'), menu = document.getElementById('selmenu');
+    let timer = null, start = null, anchor = null, selecting = false;
+    function cellAt(x, y) {
+      const r = box.querySelector('.xterm-screen').getBoundingClientRect();
+      const col = Math.max(0, Math.min(term.cols - 1, Math.floor((x - r.left) / (r.width / term.cols))));
+      const row = Math.max(0, Math.min(term.rows - 1, Math.floor((y - r.top) / (r.height / term.rows))));
+      return { col: col, row: row + term.buffer.active.viewportY };
+    }
+    function selectWord(c) {
+      const line = term.buffer.active.getLine(c.row);
+      const text = line ? line.translateToString(false) : '';
+      const word = ch => ch && !/\s/.test(ch);
+      let a = c.col, b = c.col;
+      if (word(text[c.col])) {
+        while (a > 0 && word(text[a - 1])) a--;
+        while (b < text.length - 1 && word(text[b + 1])) b++;
+      }
+      term.select(a, c.row, b - a + 1);
+      anchor = { from: c.row * term.cols + a, to: c.row * term.cols + b };
+    }
+    function stretch(c) {
+      const p = c.row * term.cols + c.col;
+      const from = Math.min(anchor.from, p), to = Math.max(anchor.to, p);
+      term.select(from % term.cols, Math.floor(from / term.cols), to - from + 1);
+    }
+    function showMenu() {
+      const keys = document.getElementById('keys').getBoundingClientRect();
+      menu.style.top = '';
+      menu.style.bottom = (window.innerHeight - keys.top + 8) + 'px';
+      menu.querySelector('[data-a="copy"]').disabled = !term.hasSelection();
+      menu.hidden = false;
+    }
+    function hideMenu() { menu.hidden = true; term.clearSelection(); anchor = null; }
+    box.addEventListener('touchstart', function (e) {
+      if (e.touches.length !== 1) { clearTimeout(timer); return; }
+      const t = e.touches[0];
+      start = { x: t.clientX, y: t.clientY };
+      if (!menu.hidden) hideMenu();
+      clearTimeout(timer);
+      timer = setTimeout(function () {
+        selecting = true;
+        selectWord(cellAt(start.x, start.y));
+        if (navigator.vibrate) navigator.vibrate(15);
+      }, 450);
+    }, { passive: true, capture: true });
+    box.addEventListener('touchmove', function (e) {
+      const t = e.touches[0];
+      if (selecting) {
+        e.preventDefault(); // no scrolling while the selection stretches
+        e.stopPropagation();
+        stretch(cellAt(t.clientX, t.clientY));
+      } else if (start && Math.hypot(t.clientX - start.x, t.clientY - start.y) > 8) {
+        clearTimeout(timer); // a swipe: let it scroll
+      }
+    }, { passive: false, capture: true });
+    box.addEventListener('touchend', function (e) {
+      clearTimeout(timer);
+      if (!selecting) return;
+      selecting = false;
+      e.preventDefault(); // no tap: the keyboard stays as it was
+      e.stopPropagation();
+      showMenu();
+    }, { passive: false, capture: true });
+    box.addEventListener('contextmenu', function (e) { e.preventDefault(); });
+
+    function copyText(text) {
+      if (navigator.clipboard && window.isSecureContext) return navigator.clipboard.writeText(text);
+      // Plain http: the old way, through a field that is there for a moment.
+      const ta = document.createElement('textarea');
+      ta.value = text;
+      ta.style.cssText = 'position:fixed;top:0;left:0;opacity:0';
+      document.body.appendChild(ta);
+      ta.select();
+      const ok = document.execCommand('copy');
+      ta.remove();
+      return ok ? Promise.resolve() : Promise.reject(new Error('нет доступа к буферу'));
+    }
+    menu.addEventListener('pointerdown', function (e) { e.preventDefault(); });
+    menu.addEventListener('click', function (e) {
+      const b = e.target.closest('button');
+      if (!b) return;
+      const a = b.dataset.a;
+      if (a === 'copy') {
+        const text = term.getSelection();
+        hideMenu();
+        copyText(text).then(function () { setStatus('скопировано', 'st-ok'); setTimeout(function () { setStatus(connected ? 'подключено' : '', connected ? 'st-ok' : ''); }, 1500); },
+          function (err) { setStatus('не скопировалось: ' + err.message, 'st-err'); });
+      } else if (a === 'paste') {
+        hideMenu();
+        if (!navigator.clipboard || !navigator.clipboard.readText) { setStatus('вставка: браузер не даёт буфер', 'st-err'); return; }
+        navigator.clipboard.readText().then(function (t) { if (t) term.paste(t); }, function () { setStatus('вставка: нет доступа к буферу', 'st-err'); });
+      } else if (a === 'all') {
+        term.selectAll();
+        showMenu();
+      } else {
+        hideMenu();
+      }
+    });
   }
-  window.addEventListener('resize', function () { fit.fit(); sendResize(); });
+
+  function refit() {
+    if (touch && window.visualViewport) {
+      // Follow the visible area, so the extra keys sit right above the
+      // on-screen keyboard.
+      const vv = window.visualViewport;
+      document.body.style.top = vv.offsetTop + 'px';
+      document.body.style.height = vv.height + 'px';
+    }
+    fit.fit();
+  }
+  window.addEventListener('resize', refit);
+  if (touch && window.visualViewport) {
+    window.visualViewport.addEventListener('resize', refit);
+    window.visualViewport.addEventListener('scroll', refit);
+  }
+  refit();
   term.onResize(sendResize);
 
   window.addEventListener('pagehide', function () {

internal/tunnel/frame.go

@@ -1,5 +1,5 @@
 // Package tunnel defines the framed multiplexing protocol used for DIRECT port
-// forwarding over the dedicated host port (default 8446). Unlike the HTTP
+// forwarding over the dedicated host port (DefaultPort). Unlike the HTTP
 // long-poll forward, this is a raw TCP stream the agent dials outbound; it
 // carries many concurrent forwarded connections (streams) for one agent and
 // has far lower latency than long-polling.

version.go

@@ -0,0 +1,14 @@
+// Package lpra holds what the server and the agent share at build time.
+package lpra
+
+import (
+	_ "embed"
+	"strings"
+)
+
+//go:embed VERSION.txt
+var versionFile string
+
+// Version is the release version of every binary in this module. VERSION.txt
+// is the only place it is defined.
+var Version = strings.TrimSpace(versionFile)