Releases: Rathio12/LuwanTerm
Release list
LuwanTerm v2.1.0
Fourteen plugins ship with the app. 2.0 gave you a panel you could describe
in a JSON file, and then left the folder empty - a feature nobody finds. Settings
now has a button that copies a ready-made set into your plugins folder:
| Disk use | df -h, real filesystems only |
| Containers | docker ps as a table |
| Failed units / Running services | what systemd gave up on, and what it has up |
| Who is on / Recent logins | who and last -n 20 |
| Listening ports / Open connections | ss -tulpn and established TCP |
| Memory hogs / CPU hogs | the fifteen heaviest processes, either way round |
| Recent errors | the last 25 errors in the journal |
| Where the disk went | the largest folders under /var |
| Pending updates | packages with a newer version waiting |
| Scheduled jobs | crontab -l |
They arrive switched off. Nothing runs until you tick it, and the command is
printed beside each one before you do - which is the bargain the whole feature
makes. Deleting one is deleting a file.
Two of them are worked examples in the guide, because the
obvious command is not always the right one. docker ps pads its columns with
spaces and prints its own header, so it needs "split": "columns" and
"skipLines": 1. And ps aux prints eleven columns with the command last, so
five declared columns would fold seven fields into the last one - asking ps
for the five fields you want lines up exactly.
Windows, and what it is actually doing
The guides were pointing at the wrong purchase. They said an EV certificate
buys SmartScreen reputation immediately. Microsoft retired that behaviour and
now says in as many words that paying the premium for that reason alone is not
justified. That was a few hundred pounds of advice in the wrong direction.
Corrected, along with the part that was missing: blue, red and blocked are
three different states. Blue is no verdict at all - SmartScreen has never seen
the file. Red is Defender saying the file is bad, which is a false positive to
report rather than a reputation to build. And Smart App Control, on by default
on clean Windows 11 installs, blocks unsigned binaries outright with no way past
in the dialog, however many people have downloaded them.
The Store is the only route that removes the prompt rather than softening it,
and developer accounts are free now - but a Win32 installer still has to be
signed by a trusted authority before it is accepted, so it stacks on a
certificate rather than replacing one.
The website said these builds are signed with a self-signed certificate.
They are not signed at all. It says so now, and tells people the two clicks that
get them past the dialog - next to the download button, rather than only in a
guide they reach afterwards.
Also in this release
A test that failed roughly one CI run in a hundred and fifty. ssh2 writes an
Ed25519 public key as a big integer, so a key whose public half begins with a
zero byte loses it and comes back 31 bytes - a file ssh2 itself then refuses to
read. Measured here at 4 keys in 3000.
The app already survived it: key generation inspects what it made and throws it
away if it will not parse, up to eight times. The test fixtures did not, so four
checks failed at random. They retry now, and the retry in the app - which had
only a statistical test behind it - has four deterministic ones, including a
generator that only ever returns rubbish and has to be given up on.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.1.0-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.1.0-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
ab8bad22fae27a46ed7ca077336f6e17c5e413b33706a77a6fe176b8c1ab6bf8 LuwanTerm-2.1.0-portable.exe
dbd7d2aa025b37ca86d1883c26e992b50b4fcfac078234854b2791b3ca042eb5 LuwanTerm-2.1.0-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.1.0-setup.exe -Algorithm SHA256
Full changelog: v2.0.0...v2.1.0
LuwanTerm v2.1.0-beta.93
No changelog entry for 2.1.0-beta.93.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.1.0-beta.93-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.1.0-beta.93-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
3babac89b59dda99e9d52cf664774de8510357c00814329e4073dd830bdbd6a6 LuwanTerm-2.1.0-beta.93-portable.exe
f6140bd4d6625ee6e4130962317d2ec4d5ec0d555116e18e34b6c2759e9e58d7 LuwanTerm-2.1.0-beta.93-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.1.0-beta.93-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v2.0.0-beta.92
No changelog entry for 2.0.0-beta.92.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.0.0-beta.92-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.0.0-beta.92-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
7587ca6cc78cb2f8e658ea8a9fa1712345c4df77d287cdac236f43c27447fafa LuwanTerm-2.0.0-beta.92-portable.exe
fbe035a8814ff0c3265fc9518dc76bd116085f7954da5470a5373a4f65c6ba81 LuwanTerm-2.0.0-beta.92-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.0.0-beta.92-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v2.0.0-beta.91
No changelog entry for 2.0.0-beta.91.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.0.0-beta.91-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.0.0-beta.91-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
044b88e0677714690b58dcdab0eded971fa6300fcf6acf6ce36fa19546033807 LuwanTerm-2.0.0-beta.91-portable.exe
31327bb1632cea019329ef8e4f80c3c38e850e0c3c5f17abed70c0fdfa4fdf95 LuwanTerm-2.0.0-beta.91-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.0.0-beta.91-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v2.0.0-beta.90
No changelog entry for 2.0.0-beta.90.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.0.0-beta.90-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.0.0-beta.90-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
abea61afd88cc1b6c564a289d191b6410ab0acf30360a65cad9255e280984691 LuwanTerm-2.0.0-beta.90-portable.exe
7019b3678478b40f2dd6a4444d82cb6688827c09bfe57db2074a37a7a12ea517 LuwanTerm-2.0.0-beta.90-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.0.0-beta.90-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v2.0.0
Plugins. A panel you describe in a small JSON file - a name, a command, and
the shape of its output. LuwanTerm runs the command on the server you are
connected to, over the channel the Stats panel already uses, and draws the
answer as a table beside Files, Tunnels and Stats.
{
"name": "Recent logins",
"icon": "server",
"command": "last -n 20",
"columns": ["user", "from", "when"],
"every": 60
}A plugin is data, never code, and that is the whole design. This app holds
private keys, passphrases and live connections to production machines.
Third-party JavaScript inside that process would undo the policy files, the
audit log and every check in the attack suite in one step. A declarative plugin
can do nothing you could not do by typing the command yourself, which is what
makes the rest of it safe to offer.
So the command is shown in full in Settings before you switch a plugin on, and
printed under the table every time the panel is open. allowMonitoring in a
policy file turns the whole class of thing off for a
fleet, refused in the main process rather than hidden in the interface. Runs
reach the audit log as plugin.run, with the command and the interval - once
per plugin per session rather than once per refresh, so a panel reloading every
two seconds does not become the only thing in the log.
Three ways to cut output up, because server output comes in three shapes:
whitespace for plain fields, columns for output aligned in columns where a
field can hold a single space, and lines for output that is not a table at
all. The last declared column keeps whatever is left of the line, so the date at
the end of last -n 20 survives, and short lines are padded rather than left
ragged. skipLines drops a header the command printed itself.
Everything the server sends is treated as hostile. Escape sequences and
control characters are stripped before anything is drawn, so a server cannot
repaint the panel, forge a row with a carriage return or smuggle a colour code
into a cell. One run reads at most 256 KB, draws at most 500 rows, allows 300
characters to a cell and gives up after twenty seconds. A panel only runs while
you are looking at it.
Manifests are files somebody else may have written, so the loader is a parser: a
broken one is listed in Settings with the reason in plain English rather than
being ignored, and one broken file never stops the others loading or the app
starting. The guide has the format, four worked examples
you can install as they are, and the limits in a table.
Also in this release
A session that ended left its monitor behind. The hook that tells the rest
of the app a session is gone was assigned and never called, so a watched session
kept its stats channel after it closed. It is called now, and both the stats
watcher and the plugin log-keeper listen on it.
A stray closing brace at the end of the stylesheet, harmless where it sat,
but every rule added after it would have fallen outside the sheet.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.0.0-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.0.0-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
2251dd81899733259142a4118d26a6b23d38eb73a711c10ffdd1b76388042fb3 LuwanTerm-2.0.0-portable.exe
4ef1ac2a299558fbf6eb0142efffcf98df050632dd0d42c9f705c0a0d46f0f87 LuwanTerm-2.0.0-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.0.0-setup.exe -Algorithm SHA256
Full changelog: v1.9.7...v2.0.0
LuwanTerm v2.0.0-beta.88
No changelog entry for 2.0.0-beta.88.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-2.0.0-beta.88-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-2.0.0-beta.88-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
f062b3793b928e72fec6a5625129d4b4d43704e246f15b61a2e9e87f213dc0e0 LuwanTerm-2.0.0-beta.88-portable.exe
c95504691161e6d2fc832df77602a329ab5e258bc301fc5df4782520d4fea006 LuwanTerm-2.0.0-beta.88-setup.exe
On Windows: Get-FileHash .\LuwanTerm-2.0.0-beta.88-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v1.9.7
A malformed policy file stopped the app starting. A policy.json
containing __proto__ reached a lookup that resolved to Object.prototype -
truthy, and not iterable - and the destructuring beneath it threw. Policy is
read during boot, so that was not a bad setting being ignored; it was the
application refusing to open. A corrupted file or a fat-fingered fleet
deployment was enough.
Both stores now accept only keys they declare, checked as own properties
rather than with in, which every object answers yes to for __proto__ and
constructor.
An attack suite, run by npm test like everything else. Thirty-two checks
that push hostile input where hostile input can actually arrive - a server the
user connected to, a file somebody else wrote, a value arriving over IPC - and
assert the app refuses or sanitises rather than crashes or complies.
It covers download paths trying to escape the folder, policy and settings
carrying prototype keys, junk types, truncated JSON and two hundred levels of
nesting, a server sending a two-hundred-thousand-character line or naming five
thousand interfaces, an audit value with a newline in it trying to forge a
second log entry, and the check that keeps javascript: and file: away from
the shell. It was verified the only way worth doing: by putting the bug back
and watching the suite fail.
Smaller things it turned up. A server naming thousands of network
interfaces had them all sent to the interface and joined into a line of text;
that is capped at thirty-two now. And a server reporting no uptime was credited
with an uptime of zero, because Number('') is 0.
Also in this release
Turning beta builds off left you on a beta. Version comparison split on dots
alone, so 1.9.0-beta.51 read as newer than 1.9.0 - the opposite of what
semver says. A release now outranks its own prereleases.
Ticking "Include beta builds" asks first, which is the moment the decision is
actually made. Warning somebody once a beta has installed itself arrives too late
to act on.
The background image applies the moment you choose it, with opacity and blur
previewing live and Cancel putting back what was stored - the way the accent
colour always worked.
The away screen wakes on input rather than mouse movement, so a nudged desk
no longer counts as somebody working, and its clock lands on the minute instead
of drifting up to ten seconds behind.
README, SECURITY, CODE_OF_CONDUCT, CONTRIBUTING and SUPPORT rewritten at
roughly twice the length, with badges. SECURITY says what is defended and, at
equal length, what is not. CONTRIBUTING states the rule this project runs on - a
test that cannot fail is not a test. A roadmap says what
2.0 is for.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-1.9.7-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-1.9.7-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
61b36d3616dea476e9198f5617002afb2664dccb072bfc2ca2f408c06768a3c3 LuwanTerm-1.9.7-portable.exe
624d39bf962caf447978203312832b919a21d8a54fe2be744d7f2872ccb66545 LuwanTerm-1.9.7-setup.exe
On Windows: Get-FileHash .\LuwanTerm-1.9.7-setup.exe -Algorithm SHA256
Full changelog: v1.9.6...v1.9.7
LuwanTerm v1.9.7-beta.87
No changelog entry for 1.9.7-beta.87.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-1.9.7-beta.87-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-1.9.7-beta.87-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
8eb582fa246f44aa41c0272bac599f48fc2c5b3a45b6184f412f425e00d28612 LuwanTerm-1.9.7-beta.87-portable.exe
19c15444631919e7688cca4d092d7efac4d38db39b94c440ae96432463894874 LuwanTerm-1.9.7-beta.87-setup.exe
On Windows: Get-FileHash .\LuwanTerm-1.9.7-beta.87-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.
LuwanTerm v1.9.7-beta.86
No changelog entry for 1.9.7-beta.86.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-1.9.7-beta.86-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-1.9.7-beta.86-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
3638fe3c1b803cb2b42d4dcd6c379fa69dc045ed99d0db27b4a0f7a0e84c9c9b LuwanTerm-1.9.7-beta.86-portable.exe
6594102376c5d7e846223fc936c70dddef7834601712f2124cc55f2a57e019e4 LuwanTerm-1.9.7-beta.86-setup.exe
On Windows: Get-FileHash .\LuwanTerm-1.9.7-beta.86-setup.exe -Algorithm SHA256
This is a beta. Built from the beta branch, with the same tests a release
gets, but it is the version things break in. You only receive it if you ticked
Include beta builds in Settings. Going back means installing a stable build
by hand.