• **Replace PuTTY with xterm.js + WebView2 SSH terminal** — eliminates external process embedding
  and window chrome artifacts, provides native terminal rendering with full UTF-8/256-color support
• **Add embedded SFTP file browser** with automatic split view (terminal left, SFTP browser right)
  for SSH connections
• **SFTP browser features**: file/folder navigation with icons and color coding, upload/download
  with progress bar, delete/rename/create operations, double-click text file editing, drag-and-drop
  upload, context menu, hidden files toggle, connection status indicator
• **Fix Notifications panel** — enable Info/Warning messages by default, fix first-connection
  message drop, add timestamps to messages
• **Update SSH protocol implementations** — switch SSH1 and SSH2 from PuTTY-based to xterm.js-based
  terminal
• **Integrate SFTP browser** — auto-enable for SSH connections, add toggle to collapse/expand SFTP
  panel
• **Update PuTTY embedding** — fix window parent handle to work correctly with split view layout
• **Version bump** to 1.78.2.3468

New embedded SFTP browser panel with file operations

• New 953-line embedded SFTP file browser control with full file operations (upload, download,
 delete, rename, create)
• Features include navigation history (back/forward), path bar, file type color coding,
 drag-and-drop upload, and double-click text file editing
• Implements connection retry logic with status indicator (gray/orange/green/red dots) and progress
 bar for transfers
• Supports hidden file toggle, context menu, and automatic file re-upload when edited in external
 editor

mRemoteNG/UI/Controls/SftpBrowserPanel.cs

New standalone dockable SFTP browser window

• New 785-line standalone SFTP browser window (dockable panel) with auto-connect to active SSH tabs
• Implements toolbar with home, refresh, upload, download, new folder, delete, and disconnect
 buttons
• Auto-connects when SSH tab becomes active; tracks connection state and updates UI accordingly
• Includes file list with details view, drag-and-drop upload, and context menu operations

mRemoteNG/UI/Window/SFTPBrowserWindow.cs

New xterm.js-based SSH terminal using WebView2

• New 477-line SSH terminal implementation using WebView2 and xterm.js instead of PuTTY
• Handles SSH connection via SSH.NET SshClient and ShellStream with proper terminal resize
 handling
• Manages WebView2 initialization, resource extraction, and bidirectional message passing for
 terminal I/O
• Implements shell stream reading loop and UTF-8 binary data encoding/decoding via Base64

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs

Description

SSHTerminalBase unconditionally trusts the server host key by setting e.CanTrust=true, enabling
silent man-in-the-middle interception of SSH sessions. This impacts every SSH connection created by
the new terminal.

Code

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[R166-167]

+                // Auto-accept host keys (TODO: host key verification dialog)
+                _sshClient.HostKeyReceived += (s, e) => e.CanTrust = true;

Evidence

The new SSH terminal explicitly disables host-key verification by trusting every presented host key.

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[160-169]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
SSHTerminalBase currently accepts any SSH host key (`e.CanTrust = true`), which removes host identity verification and enables MITM attacks.
## Issue Context
mRemoteNG previously relied on PuTTY’s known-host behavior; the new SSH.NET-based client must implement an equivalent trust decision.
## Fix Focus Areas
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[160-169]
## What to change
- Replace unconditional trust with a real decision:
- Compute and display fingerprint.
- Compare against a persisted known-hosts store (per host:port + key type).
- If unknown/changed, prompt the user to accept/reject and persist acceptance.
- If running headless/no prompt is possible, fail closed (do not connect) unless a matching known-host entry exists.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

SSHTerminalBase.Connect() calls base.Connect() (which immediately fires ConnectedEvent) before any
SSH connection is established, and then ConnectSshAsync fires Event_Connected again after
connecting. This can mark the tab/session as connected prematurely and/or trigger downstream
“connected” handlers twice.

Code

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[R117-134]

+        public override bool Connect()
+        {
+            try
+            {
+                if (_initTask != null && !_initTask.IsCompleted)
+                {
+                    // SSH connection will be triggered when xterm.js sends "ready" message
+                    _initTask.ContinueWith(t =>
+                    {
+                        if (t.IsFaulted)
+                        {
+                            Runtime.MessageCollector.AddExceptionStackTrace("SSHTerminal: Init task failed", t.Exception);
+                        }
+                    }, TaskScheduler.Default);
+                }
+
+                base.Connect();
+                return true;

Evidence

ProtocolBase.Connect() directly invokes ConnectedEvent, and SSHTerminalBase invokes that path
immediately in Connect(). Later, once SSH is actually connected, SSHTerminalBase again calls
Event_Connected(), which also invokes ConnectedEvent.

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[117-135]
mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[187-193]
mRemoteNG/Connection/Protocol/ProtocolBase.cs[131-137]
mRemoteNG/Connection/Protocol/ProtocolBase.cs[323-326]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
SSHTerminalBase currently fires the protocol Connected event twice and fires it before the SSH connection exists. This can cause incorrect UI state and double-execution of connected handlers.
## Issue Context
- `ProtocolBase.Connect()` invokes `ConnectedEvent(this)` immediately.
- SSHTerminalBase calls `base.Connect()` inside `Connect()`.
- SSHTerminalBase also calls `Event_Connected(this)` after SSH connects.
## Fix Focus Areas
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[117-135]
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[187-193]
## What to change
- Do not call `base.Connect()` in `SSHTerminalBase.Connect()`.
- Instead, call `Event_Connecting(this)` (or another appropriate “connecting” signal) when initiating.
- Call **exactly one** connected signal after SSH is established:
- Either call `base.Connect()` once after SSH connection success, OR keep `Event_Connected(this)` and ensure `base.Connect()` is never called.
- Ensure failure paths do not emit Connected.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

xterm HTML/JS/CSS are extracted to a predictable %TEMP% folder and skipped if files already exist,
allowing pre-existing/tampered files in that directory to be loaded by WebView2. This enables local
content injection into the embedded terminal UI.

Code

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[R53-57]

+                // Extract xterm.js resources to a temp folder for virtual host mapping
+                _resourceFolder = Path.Combine(
+                    Path.GetTempPath(),
+                    "mRemoteNG_XtermResources");
+                ExtractResources();

Evidence

The resource directory is a fixed path under %TEMP% ("mRemoteNG_XtermResources"), and
ExtractResources does not overwrite existing files. WebView2 maps and navigates to those files via a
virtual host, so any modified content in that folder is executed/rendered.

mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[47-58]
mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[422-456]
mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[83-98]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
WebView2 loads xterm assets from a predictable temp folder and the extraction code skips overwriting existing files. This allows pre-population/tampering of JS/CSS/HTML that WebView2 will execute.
## Issue Context
- `_resourceFolder` is `%TEMP%\\mRemoteNG_XtermResources`.
- `ExtractResources()` does `if (File.Exists(targetPath)) continue;`.
- WebView2 maps that folder and navigates to `https://xterm.local/xterm-terminal.html`.
## Fix Focus Areas
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[47-58]
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[422-456]
- mRemoteNG/Connection/Protocol/SSH/SSHTerminalBase.cs[83-98]
## What to change
- Prefer one of:
1) Avoid temp files entirely: load HTML via `NavigateToString` and serve JS/CSS via `WebResourceRequested` from embedded resources.
2) If files must exist on disk: extract into a **unique per-session** directory (GUID), and delete it on close.
- Always overwrite/atomically write the expected embedded content (write to temp name then replace) rather than skipping when files exist.
- Consider using a more restrictive resource access kind than `Allow` if possible.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

SftpBrowserPanel’s edit feature writes to a deterministic temp filename using the host and remote
filename, which can contain invalid Windows filename characters and collide across sessions. If
Process.Start returns null (or an editor has no process handle), the FileSystemWatcher is never
disposed and remains active indefinitely, leaking resources and retaining the panel instance via
event handlers.

Code

mRemoteNG/UI/Controls/SftpBrowserPanel.cs[R634-723]

+                // Download to temp file
+                var tempDir = Path.Combine(Path.GetTempPath(), "mRemoteNG_SFTP");
+                Directory.CreateDirectory(tempDir);
+                var tempFile = Path.Combine(tempDir, $"{_host}_{Path.GetFileName(item.Name)}");
+
+                _lblStatus.Text = $"Downloading {item.Name} for editing...";
+                await _service.DownloadFileAsync(item.FullPath, tempFile);
+
+                // Track modification time
+                var lastWrite = File.GetLastWriteTimeUtc(tempFile);
+
+                // Open in default editor
+                var proc = Process.Start(new ProcessStartInfo(tempFile) { UseShellExecute = true });
+
+                _lblStatus.Text = $"Editing {item.Name} — save in editor to upload";
+
+                // Watch for file changes using FileSystemWatcher
+                var remotePath = item.FullPath;
+                var watcher = new FileSystemWatcher(tempDir, Path.GetFileName(tempFile))
+                {
+                    NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.Size,
+                    EnableRaisingEvents = true
+                };
+
+                // Debounce: editors may fire multiple write events
+                DateTime lastUpload = DateTime.MinValue;
+                watcher.Changed += async (ws, we) =>
+                {
+                    // Debounce — skip if we just uploaded within 2 seconds
+                    if ((DateTime.Now - lastUpload).TotalSeconds < 2) return;
+                    lastUpload = DateTime.Now;
+
+                    // Small delay to let the editor finish writing
+                    await System.Threading.Tasks.Task.Delay(500);
+
+                    try
+                    {
+                        BeginInvoke(async () =>
+                        {
+                            try
+                            {
+                                _lblStatus.Text = $"Uploading {item.Name}...";
+                                await _service.UploadFileAsync(tempFile, remotePath);
+                                _lblStatus.Text = $"Saved {item.Name}";
+                                Runtime.MessageCollector.AddMessage(MessageClass.InformationMsg,
+                                    $"SFTP Edit: {item.Name} saved to {_host}:{remotePath}", true);
+                                _suppressHistory = true;
+                                await NavigateTo(_service.CurrentPath);
+                            }
+                            catch (Exception ex)
+                            {
+                                _lblStatus.Text = $"Upload failed: {ex.Message}";
+                            }
+                        });
+                    }
+                    catch { }
+                };
+
+                // If we got a process handle, clean up when editor closes
+                if (proc != null)
+                {
+                    _ = System.Threading.Tasks.Task.Run(async () =>
+                    {
+                        await proc.WaitForExitAsync();
+                        watcher.EnableRaisingEvents = false;
+                        watcher.Dispose();
+                        // Final check for changes
+                        if (File.Exists(tempFile) && File.GetLastWriteTimeUtc(tempFile) > lastWrite)
+                        {
+                            BeginInvoke(async () =>
+                            {
+                                try
+                                {
+                                    _lblStatus.Text = $"Uploading {item.Name}...";
+                                    await _service.UploadFileAsync(tempFile, remotePath);
+                                    _lblStatus.Text = $"Saved {item.Name}";
+                                    _suppressHistory = true;
+                                    await NavigateTo(_service.CurrentPath);
+                                }
+                                catch { }
+                            });
+                        }
+                        await System.Threading.Tasks.Task.Delay(1000);
+                        try { if (File.Exists(tempFile)) File.Delete(tempFile); } catch { }
+                    });
+                }
+                // If no process handle (editor already running), watcher stays active
+                // It will auto-upload on each save. Temp file persists until app close.
+            }
+            catch (Exception ex)

Evidence

The temp file path is built from _host and item.Name without sanitizing invalid filename
characters. The watcher is disposed only inside the if (proc != null) branch, and the code
explicitly states the watcher stays active otherwise.

mRemoteNG/UI/Controls/SftpBrowserPanel.cs[634-723]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The SFTP edit flow creates a temp filename from host+remote filename (can be invalid on Windows and collide) and may leak FileSystemWatcher when no process handle is available.
## Issue Context
- Temp file: `Path.Combine(tempDir, $"{_host}_{Path.GetFileName(item.Name)}")`.
- Watcher is only disposed when `proc != null`; otherwise it remains active indefinitely.
## Fix Focus Areas
- mRemoteNG/UI/Controls/SftpBrowserPanel.cs[634-723]
## What to change
- Generate a safe unique temp filename (e.g., GUID) and keep a mapping to the remote path.
- Sanitize any user/remote-derived components using `Path.GetInvalidFileNameChars()` replacement if you still want readable names.
- Ensure `FileSystemWatcher` is always disposed:
- Track watchers in a field collection and dispose them in `Dispose(bool disposing)`.
- Add a timeout/cleanup mechanism when `proc == null`.
- Unsubscribe event handlers before disposing to avoid retaining the panel instance.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools