4.0.0-beta.2 — V4 preview, with the 3.8.6 security fixes

A second V4 preview, on GitHub only. npm serves 3.8.6, released the same day with the same security fixes. Installed 4.0.0-beta.1 desktop builds update to this one by themselves.

Security — everything in 3.8.6

Six advisories fixed. The broadest: the default on-error hook pasted the connection error, whose text a server chooses, into a shell command, so a server you connected to could run a command on your machine. Hook values now reach commands only as shell variables, and the default hook logs without a shell. Also fixed: restricted mode checks every command on a line; ssh_db_query runs inside a read-only transaction and a MongoDB query must be a filter document; ssh_deploy and ssh_backup_schedule quote every value. Host key verification and the quoting of cwd were already in beta.1. See the CHANGELOG.

Found by using V4 every day

• A refused password no longer hides behind "Too many authentication failures" (#88): the error says what was refused.
• KEYPATH expands only a leading ~ (#89).
• A stale SSH_MANAGER_ENV no longer loads zero servers in silence (#90).
• Hook settings, aliases, the profile and the logs live in ~/.ssh-manager/ (#87), so an upgrade keeps them.

Downloads

Platform	File	Signature
macOS (Apple silicon / Intel)	SSH Manager-4.0.0-beta.2-arm64.dmg / -x64.dmg	Signed and notarized by Apple; the DMG itself is now signed too
Windows (x64 / arm64)	SSH Manager-4.0.0-beta.2-setup.exe	Not code-signed in this preview: More info → Run anyway
Linux	.deb, .AppImage	—

npm engine, side by side with your current install (nothing global changes):

npm install --prefix ~/ssh-manager-v4-preview https://github.com/bvisible/mcp-ssh-manager/releases/download/v4.0.0-beta.2/mcp-ssh-manager-4.0.0-beta.2.tgz

Migration guide — including the one behaviour change: a changed host key is refused.