v1.9.36: document Claude Code image read crash bug & workarounds

- CLAUDE.md: add rule to never read images directly, only via Agent
- CLAUDE.md: add rule to never use chrome-devtools take_screenshot directly
- BUG_REPORT_CLAUDE_CODE_PNG_CRASH.md: full root cause analysis
- tools/patch_claude_code.js: v2 patcher with mapper media_type fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

BUG_REPORT_CLAUDE_CODE_PNG_CRASH.md

@@ -0,0 +1,142 @@
+# Bug Report: Claude Code CLI crashes when reading large image files
+
+## Summary
+
+The `Read` tool in Claude Code CLI fails when reading images larger than ~25K base64 tokens (~150KB file size). Small images work fine. The root cause is in the `DP1` image compression pipeline — when a large image goes through compression, the resulting API content block ends up with `source: {type: "base64"}` but **missing both `data` and `media_type` fields**. This causes an unrecoverable API 400 error.
+
+## Environment
+
+- **Claude Code CLI:** `@anthropic-ai/claude-code@2.1.70`
+- **OS:** Windows 10 Pro for Workstations 10.0.19045
+- **Node.js:** v24.13.1
+- **sharp:** 0.34.5 (manually installed, works correctly)
+
+## Root Cause Analysis
+
+### The Size Threshold
+
+Images are read by `Nv8()` which calls `q01()` to create the result. After `q01()`, a size check runs:
+
+```javascript
+if (Math.ceil($.file.base64.length * 0.125) > q)  // q = Tv8() = 25000 tokens
+```
+
+- **Small images** (< ~150KB file / < 25K tokens base64): Skip `DP1`, return directly from `q01()` → **WORKS**
+- **Large images** (> ~150KB file / > 25K tokens base64): Enter `DP1` compression path → **CRASHES**
+
+### What happens in the DP1 path
+
+When the image exceeds the token limit, `DP1()` is called to compress it. `DP1` uses sharp to resize/recompress and returns `{base64, mediaType, originalSize}`. The code then returns:
+
+```javascript
+return {type: "image", file: {base64: H.base64, type: H.mediaType, originalSize: z}}
+```
+
+In isolation, this looks correct. `H.mediaType` is `"image/jpeg"` (from `vp6()` inside `DP1`).
+
+### Where it actually breaks
+
+The tool result mapper converts this to an API content block:
+
+```javascript
+case "image": return {
+  tool_use_id: q,
+  type: "tool_result",
+  content: [{
+    type: "image",
+    source: {type: "base64", data: A.file.base64, media_type: A.file.type}
+  }]
+};
+```
+
+**However**, between the mapper output and the actual API request, the image content block gets **stripped**. The API receives:
+
+```json
+{"type": "image", "source": {"type": "base64"}}
+```
+
+Both `data` and `media_type` are absent. `JSON.stringify` silently drops `undefined` properties, so if both become `undefined` at any point, the serialized JSON omits them entirely.
+
+### Evidence from transcript analysis
+
+The session transcript (`.jsonl` output) captured the exact message content sent to the API:
+
+```json
+{
+  "type": "user",
+  "content": [{
+    "tool_use_id": "toolu_01NmuSjPErhBfbtoV8RBrJip",
+    "type": "tool_result",
+    "content": [{"type": "image", "source": {"type": "base64"}}]
+  }]
+}
+```
+
+This confirms `data` and `media_type` are both missing at the API call level.
+
+### The actual root cause (suspected)
+
+The image data stripping likely occurs in the **message normalization/storage layer** between the tool result mapper and the API call. When conversation messages are stored in memory (the internal `D` array or conversation state), large base64 image data may be:
+
+1. Stripped for memory efficiency
+2. Moved to a separate image attachment store (referenced by `imagePasteIds`)
+3. Lost during `structuredClone` or message serialization
+
+The reconstruction step that should restore the image data before the API call **fails for tool_result image blocks**, possibly because it only handles top-level image blocks (from user pastes) but not images nested inside `tool_result.content[]`.
+
+## Test Results
+
+| File | Size | Base64 tokens | DP1 path | Result |
+|------|------|---------------|----------|--------|
+| photo.jpg | 25KB | ~4,250 | No | **Works** |
+| test_tiny.png | 98B | ~16 | No | **Works** |
+| test_medium.png | 751KB | ~125,000 | Yes | **Crashes** |
+| screenshot_gui.png | 387KB | ~64,500 | Yes | **Crashes** |
+
+## Severity: Critical
+
+- **Session-killing:** corrupted message poisons the entire conversation context
+- **No recovery:** every subsequent API call fails with 400
+- **Affects subagents too:** Agent tool crashes, but main session survives
+- **Size-dependent:** only images > ~150KB trigger the bug
+
+## Patches Applied
+
+### Patch 1: Nv8 try/catch wrapper (`PATCHED_NV8_SAFE_IMAGE_READ`)
+Wraps the entire `Nv8` function in try/catch. On failure, returns a text error message instead of corrupted binary. Also adds `||"image/png"` fallback on `H.mediaType` in the DP1 path.
+
+### Patch 2: Image mapper media_type fallback (`PATCHED_IMAGE_MEDIA_TYPE`)
+Adds `||"image/png"` fallback to `media_type` in the tool result mapper. Prevents `undefined` from being serialized as absent field.
+
+### Effectiveness
+- Patches only work after restarting Claude Code (cli.js is loaded once at startup)
+- Patches fix the `media_type` issue but may NOT fix the missing `data` issue
+- The underlying cause (image data being stripped from stored messages) needs to be fixed upstream
+
+## Patcher Tool
+
+```bash
+node tools/patch_claude_code.js          # Apply all patches
+node tools/patch_claude_code.js --check  # Check status
+node tools/patch_claude_code.js --revert # Revert to backup
+```
+
+After updating Claude Code (`npm update -g @anthropic-ai/claude-code`), re-run the patcher.
+
+## Workarounds
+
+1. **Use subagent for ALL image reading** — crashes in isolation, main session survives
+2. **Resize large images before reading** — keep under ~150KB
+3. **Read images only via Bash tool** — `file screenshot.png` for metadata, avoid actual content
+
+## Files Referenced
+
+- **Patcher:** `tools/patch_claude_code.js`
+- **CLI entry:** `node_modules/@anthropic-ai/claude-code/cli.js` (minified, ~13K lines)
+- **Key functions:** `Nv8` (image reader), `DP1` (compressor), `q01` (result builder), `ig` (sharp wrapper), `mapToolResultToToolResultBlockParam` (API mapper)
+
+## Report Info
+
+- **Date:** 2026-03-06
+- **Version:** Claude Code 2.1.70
+- **Reproducible:** 100% on Windows with any image > ~150KB

CLAUDE.md

@@ -4,6 +4,20 @@
 
 ServerManager — **кроссплатформенное** Desktop GUI (CustomTkinter) для управления удалёнными серверами **любых типов**. Работает на **Windows и Linux**. Claude Code управляет серверами через скилл `/ssh`, зная только алиасы.
 
+## КРИТИЧНО: Чтение изображений — ТОЛЬКО через Agent
+
+**Claude Code CLI v2.1.70 баг:** Read tool крашит сессию на изображениях >150KB.
+Большие изображения проходят через DP1-сжатие, где `data` и `media_type` теряются → API 400 → сессия мертва навсегда.
+
+**ПРАВИЛА:**
+- **НИКОГДА** не вызывать `Read` на .png/.jpg/.jpeg/.gif/.webp напрямую
+- **НИКОГДА** не делать скриншоты через `mcp__chrome-devtools__take_screenshot` — результат тоже изображение, крашит так же
+- **ВСЕГДА** читать изображения через `Agent` tool (субагент) — он упадёт изолированно, основная сессия выживет
+- Маленькие (<150KB) работают, но **не рисковать** — всё через агента
+- НЕ тестировать фиксы изображений в основном контексте даже после "исправления"
+
+Подробности: `BUG_REPORT_CLAUDE_CODE_PNG_CRASH.md`
+
 ## КРОССПЛАТФОРМЕННОСТЬ — ОБЯЗАТЕЛЬНО
 
 Приложение собирается и работает на **Windows** и **Linux**. При любых правках кода:

core/claude_setup.py

@@ -30,17 +30,39 @@ _BLOCK_START = "<!-- server-manager:start -->"
 _BLOCK_END = "<!-- server-manager:end -->"
 
 GLOBAL_CLAUDE_MD_BLOCK = f"""{_BLOCK_START}
-## Server Manager — управление серверами
+## Серверы — ТОЛЬКО через /ssh
 
-**ВСЕГДА** используй server manager для подключения к серверам. Никогда не используй `ssh`, `sshpass` или прямые подключения.
+**НИКОГДА не используй raw `ssh` команды.** НИКОГДА не читай `~/.ssh/config` для поиска серверов.
+Все операции с серверами — **ТОЛЬКО через скилл `/ssh`** или напрямую через `ssh.py`:
 
-- Скилл: `/ssh ALIAS "command"` — выполнить команду на сервере
-- Список серверов: `python3 ~/.server-connections/ssh.py --list`
-- Документация: `~/.claude/commands/ssh.md`
-- Memory bank: проект `global-infrastructure` → `techContext.md`
-- Инфраструктура: https://git.sensey24.ru/aibot777/infrastructure-docs
+```bash
+python ~/.server-connections/ssh.py --list          # список серверов (alias, тип, заметки)
+python ~/.server-connections/ssh.py --info ALIAS     # инфо (без creds)
+python ~/.server-connections/ssh.py --status         # online/offline
+```
 
-**Запрещено:** использовать `ssh`, `sshpass`, читать `~/.server-connections/` напрямую, раскрывать IP/пароли/порты.
+При вопросе о сервере — **СНАЧАЛА `--list`**, найди нужный алиас по заметкам и **ПРОВЕРЬ ТИП**.
+Скрипт `ssh.py` сам читает credentials из зашифрованного хранилища. Claude НЕ видит IP, логины, пароли.
+
+### КРИТИЧНО — команды зависят от типа сервера
+
+**`ALIAS "command"` (shell) — ТОЛЬКО для типов `ssh` и `telnet`!**
+
+| Тип | Команды |
+|-----|---------|
+| `ssh`/`telnet` | `ALIAS "cmd"`, `--upload ALIAS local remote`, `--download ALIAS remote local` |
+| `s3` (MinIO и др.) | `--s3-buckets ALIAS`, `--s3-ls ALIAS bucket/prefix`, `--s3-upload ALIAS local bucket/key`, `--s3-download ALIAS bucket/key local`, `--s3-delete ALIAS bucket/key`, `--s3-url ALIAS bucket/key [SEC]`, `--s3-create-bucket ALIAS name` |
+| `mariadb`/`mssql`/`postgresql` | `--sql ALIAS "SELECT ..."`, `--sql-databases ALIAS`, `--sql-tables ALIAS [db]` |
+| `redis` | `--redis ALIAS "GET key"`, `--redis-info ALIAS`, `--redis-keys ALIAS "pattern"` |
+| `grafana` | `--grafana-dashboards ALIAS`, `--grafana-alerts ALIAS` |
+| `prometheus` | `--prom-query ALIAS "up"`, `--prom-targets ALIAS`, `--prom-alerts ALIAS` |
+| `winrm` | `--ps ALIAS "Get-Process"`, `--cmd ALIAS "dir"` |
+
+**Формат: `python ~/.server-connections/ssh.py КОМАНДА АЛИАС АРГУМЕНТЫ`** — алиас ВСЕГДА второй после команды.
+
+**S3 правило:** перед `--s3-upload/download/delete` — СНАЧАЛА `--s3-buckets ALIAS` и `--s3-ls ALIAS bucket/` чтобы узнать реальные бакеты и пути. НЕ УГАДЫВАЙ имена бакетов!
+
+**Запрещено:** использовать `ssh`/`sshpass`, читать `~/.server-connections/` напрямую, раскрывать IP/пароли/порты.
 {_BLOCK_END}
 """
 

core/i18n.py

@@ -111,6 +111,10 @@ _EN = {
     "term_connecting": "Connecting to {alias}...",
     "term_connected": "Connected to {alias}",
     "term_disconnected": "Disconnected",
+    "term_off": "OFFLINE",
+    "ctx_disconnect": "Disconnect",
+    "term_click_to_connect": "Double-click to connect to {alias}",
+    "sftp_click_to_connect": "Double-click server to browse files",
     "term_reconnecting": "Reconnecting ({n}/{max})...",
     "term_connect_failed": "Connection failed: {error}",
     "term_reconnect_fail": "Disconnected (reconnect failed)",
@@ -390,6 +394,12 @@ _EN = {
     "s3_uploading_n": "Uploading {count} files...",
     "s3_uploaded_n": "Uploaded {count} files",
     "s3_upload_partial": "Uploaded {ok}/{total} files",
+    "s3_create_bucket": "Create Bucket",
+    "s3_bucket_name_prompt": "Bucket name:",
+    "s3_delete_bucket": "Delete Bucket",
+    "s3_delete_bucket_confirm": "Delete bucket \"{name}\"? It must be empty.",
+    "s3_bucket_created": "Bucket \"{name}\" created",
+    "s3_bucket_deleted": "Bucket \"{name}\" deleted",
     "s3_new_folder": "New Folder",
     "s3_folder_name_prompt": "Folder name:",
     "s3_creating_folder": "Creating folder...",
@@ -628,6 +638,10 @@ _RU = {
     "term_connecting": "Подключение к {alias}...",
     "term_connected": "Подключено к {alias}",
     "term_disconnected": "Отключено",
+    "term_off": "ОТКЛЮЧЕНО",
+    "ctx_disconnect": "Отключиться",
+    "term_click_to_connect": "Двойной клик для подключения к {alias}",
+    "sftp_click_to_connect": "Двойной клик для просмотра файлов",
     "term_reconnecting": "Переподключение ({n}/{max})...",
     "term_connect_failed": "Ошибка подключения: {error}",
     "term_reconnect_fail": "Отключено (не удалось переподключиться)",
@@ -907,6 +921,12 @@ _RU = {
     "s3_uploading_n": "Загрузка {count} файлов...",
     "s3_uploaded_n": "Загружено {count} файлов",
     "s3_upload_partial": "Загружено {ok}/{total} файлов",
+    "s3_create_bucket": "Создать бакет",
+    "s3_bucket_name_prompt": "Имя бакета:",
+    "s3_delete_bucket": "Удалить бакет",
+    "s3_delete_bucket_confirm": "Удалить бакет \"{name}\"? Он должен быть пустым.",
+    "s3_bucket_created": "Бакет \"{name}\" создан",
+    "s3_bucket_deleted": "Бакет \"{name}\" удалён",
     "s3_new_folder": "Новая папка",
     "s3_folder_name_prompt": "Имя папки:",
     "s3_creating_folder": "Создание папки...",
@@ -1145,6 +1165,10 @@ _ZH = {
     "term_connecting": "正在连接 {alias}...",
     "term_connected": "已连接到 {alias}",
     "term_disconnected": "已断开",
+    "term_off": "未连接",
+    "ctx_disconnect": "断开连接",
+    "term_click_to_connect": "双击连接 {alias}",
+    "sftp_click_to_connect": "双击服务器浏览文件",
     "term_reconnecting": "重新连接中 ({n}/{max})...",
     "term_connect_failed": "连接失败：{error}",
     "term_reconnect_fail": "已断开（重连失败）",
@@ -1424,6 +1448,12 @@ _ZH = {
     "s3_uploading_n": "正在上传 {count} 个文件...",
     "s3_uploaded_n": "已上传 {count} 个文件",
     "s3_upload_partial": "已上传 {ok}/{total} 个文件",
+    "s3_create_bucket": "创建存储桶",
+    "s3_bucket_name_prompt": "存储桶名称:",
+    "s3_delete_bucket": "删除存储桶",
+    "s3_delete_bucket_confirm": "删除存储桶 \"{name}\"？必须为空。",
+    "s3_bucket_created": "存储桶 \"{name}\" 已创建",
+    "s3_bucket_deleted": "存储桶 \"{name}\" 已删除",
     "s3_new_folder": "新建文件夹",
     "s3_folder_name_prompt": "文件夹名称:",
     "s3_creating_folder": "创建文件夹中...",

core/icons.py

@@ -210,6 +210,7 @@ CTX_ICONS = {
     "ctx_open_browser": "browser",
     "ctx_check_status": "status_check",
     "ctx_copy_alias": "copy",
+    "ctx_disconnect": "close",
     "edit": "edit",
     "delete": "delete",
 }

core/s3_client.py

@@ -518,3 +518,29 @@ class S3Client:
             return resp.get("ContentLength", 0)
         except Exception:
             return 0
+
+    def create_bucket(self, bucket_name: str) -> bool:
+        """Create a new S3 bucket."""
+        if not self._ensure_connected():
+            return False
+        try:
+            self._client.create_bucket(Bucket=bucket_name)
+            self._last_ok = time.time()
+            log.info("S3 bucket created: %s", bucket_name)
+            return True
+        except Exception as exc:
+            log.error("S3 create_bucket failed: %s", exc)
+            return False
+
+    def delete_bucket(self, bucket_name: str) -> bool:
+        """Delete an empty S3 bucket."""
+        if not self._ensure_connected():
+            return False
+        try:
+            self._client.delete_bucket(Bucket=bucket_name)
+            self._last_ok = time.time()
+            log.info("S3 bucket deleted: %s", bucket_name)
+            return True
+        except Exception as exc:
+            log.error("S3 delete_bucket failed: %s", exc)
+            return False

core/session_pool.py

@@ -255,4 +255,14 @@ class SessionPool:
                 )
                 if has_active:
                     active.append(alias)
-            return active
+            return active
+
+    def has_active_session(self, alias: str) -> bool:
+        with self._lock:
+            sd = self._sessions.get(alias)
+            if not sd:
+                return False
+            return bool(
+                (sd.shell_session and sd.shell_session.connected) or
+                (sd.sftp_session and sd.sftp_session.connected)
+            )

gui/app.py

@@ -2,6 +2,7 @@
 Main application window — sidebar + tabview layout.
 """
 
+import sys
 import tkinter
 import customtkinter as ctk
 from tkinter import messagebox
@@ -118,6 +119,32 @@ class App(ctk.CTk):
         # Cleanup on close
         self.protocol("WM_DELETE_WINDOW", self._on_close)
 
+        # Win32: restore window when stuck minimized after Win+D
+        self._restore_check_id = None
+        if sys.platform == "win32":
+            self.after(3000, self._start_restore_watchdog)
+
+    def _start_restore_watchdog(self):
+        """Start periodic check for stuck minimized state (Windows only)."""
+        try:
+            import ctypes
+            self._user32 = ctypes.windll.user32
+            self._hwnd = int(self.wm_frame(), 16)
+            self._check_restore()
+        except Exception:
+            pass
+
+    def _check_restore(self):
+        """If window is iconic but user clicked taskbar, force restore."""
+        try:
+            if self._user32.IsIconic(self._hwnd):
+                fg = self._user32.GetForegroundWindow()
+                if fg == self._hwnd:
+                    self._user32.ShowWindow(self._hwnd, 9)  # SW_RESTORE
+        except Exception:
+            pass
+        self._restore_check_id = self.after(500, self._check_restore)
+
     def _build_layout(self):
         # PanedWindow — resizable sidebar | main area
         self._paned = tkinter.PanedWindow(
@@ -127,7 +154,7 @@ class App(ctk.CTk):
         self._paned.pack(fill="both", expand=True)
 
         # Sidebar
-        self.sidebar = Sidebar(self._paned, self.store, on_select=self._on_server_select, session_pool=self.session_pool)
+        self.sidebar = Sidebar(self._paned, self.store, on_select=self._on_server_select, on_double_click=self._on_server_connect, session_pool=self.session_pool)
         self._paned.add(self.sidebar, minsize=180, width=self.store._sidebar_width)
         self.sidebar.add_callback = self._add_server
         self.sidebar.edit_callback = self._edit_server
@@ -136,6 +163,7 @@ class App(ctk.CTk):
         self.sidebar.open_tab_callback = self._context_open_tab
         self.sidebar.check_status_callback = self._context_check_status
         self.sidebar.open_browser_callback = self._context_open_browser
+        self.sidebar.disconnect_callback = self._on_server_disconnect
 
         # Main area
         self._main_frame = ctk.CTkFrame(self._paned, fg_color="transparent")
@@ -222,7 +250,9 @@ class App(ctk.CTk):
 
         # Create new tabview
         self.tabview = ctk.CTkTabview(self._main_frame, command=self._on_tab_changed)
-        self.tabview.pack(fill="both", expand=True, padx=10, pady=10)
+        self.tabview._outer_spacing = 0
+        self.tabview._configure_grid()
+        self.tabview.pack(fill="both", expand=True, padx=10, pady=(0, 10))
 
         for key in self._tab_keys:
             self.tabview.add(_tab_label(key))
@@ -237,6 +267,11 @@ class App(ctk.CTk):
             widget.pack(fill="both", expand=True)
             self._tab_instances[key] = widget
 
+        # Wire disconnect callback for terminal toolbar button
+        terminal = self._tab_instances.get("terminal")
+        if terminal and hasattr(terminal, "_on_disconnect_callback"):
+            terminal._on_disconnect_callback = self._on_server_disconnect
+
         # Restore previously active tab if still available
         if restore_tab_key and restore_tab_key in self._tab_keys:
             try:
@@ -280,6 +315,20 @@ class App(ctk.CTk):
         # Update session indicators after a short delay (connection is async)
         self.after(1500, self.sidebar.update_session_indicators)
 
+    def _on_server_connect(self, alias: str):
+        """Double-click: connect interactive tabs (terminal, files, powershell)."""
+        for key, widget in self._tab_instances.items():
+            if hasattr(widget, "connect"):
+                widget.connect()
+
+    def _on_server_disconnect(self, alias: str):
+        """Disconnect all sessions for a server."""
+        for key, widget in self._tab_instances.items():
+            if hasattr(widget, "disconnect"):
+                widget.disconnect()
+        self.session_pool.disconnect_session(alias)
+        self.after(500, self.sidebar.update_session_indicators)
+
     def _add_server(self):
         dialog = ServerDialog(self, self.store)
         self.wait_window(dialog)
@@ -329,6 +378,10 @@ class App(ctk.CTk):
                 self.tabview.set(_tab_label(tab_key))
             except Exception:
                 pass
+        # Connect the target tab if it supports explicit connection
+        widget = self._tab_instances.get(tab_key)
+        if widget and hasattr(widget, "connect"):
+            widget.connect()
 
     def _context_check_status(self, alias: str):
         """Context menu: check single server status in background."""
@@ -682,6 +735,12 @@ class App(ctk.CTk):
             return False
 
     def _on_close(self):
+        # Cancel restore watchdog
+        try:
+            if self._restore_check_id:
+                self.after_cancel(self._restore_check_id)
+        except Exception:
+            pass
         # Save window geometry (size + position) and sidebar width
         try:
             geo = self.geometry()

gui/sidebar.py

@@ -34,10 +34,11 @@ _CONTEXT_ACTIONS = {
 
 
 class Sidebar(ctk.CTkFrame):
-    def __init__(self, master, store, on_select=None, session_pool=None):
+    def __init__(self, master, store, on_select=None, on_double_click=None, session_pool=None):
         super().__init__(master, width=250, corner_radius=0)
         self.store = store
         self.on_select = on_select
+        self.on_double_click = on_double_click
         self.session_pool = session_pool
         self._selected_alias: str | None = None
         self._server_frames: dict[str, ctk.CTkFrame] = {}
@@ -96,6 +97,7 @@ class Sidebar(ctk.CTkFrame):
         self.open_tab_callback = None       # (alias, tab_key) → select server + switch tab
         self.check_status_callback = None   # (alias) → check single server
         self.open_browser_callback = None   # (alias) → open server URL in browser
+        self.disconnect_callback = None     # (alias) → disconnect all sessions
 
         # Subscribe to store changes
         self.store.subscribe(self._refresh_list)
@@ -272,6 +274,7 @@ class Sidebar(ctk.CTkFrame):
             # Click handlers
             for widget in [frame, info, name_label, detail_label, badge, type_badge, session_ind]:
                 widget.bind("<Button-1>", lambda e, a=alias: self._select(a))
+                widget.bind("<Double-Button-1>", lambda e, a=alias: self._on_double_click(a))
                 widget.bind("<Button-3>", lambda e, a=alias: self._show_context_menu(e, a))
 
             self._server_frames[alias] = frame
@@ -371,6 +374,11 @@ class Sidebar(ctk.CTkFrame):
         if self.on_select:
             self.on_select(alias)
 
+    def _on_double_click(self, alias: str):
+        self._select(alias)
+        if self.on_double_click:
+            self.on_double_click(alias)
+
     def _highlight_selected(self):
         for alias, frame in self._server_frames.items():
             if alias == self._selected_alias:
@@ -460,6 +468,18 @@ class Sidebar(ctk.CTkFrame):
         if actions:
             menu.add_separator()
 
+        # Dynamic disconnect if session is active
+        if self.session_pool and self.session_pool.has_active_session(alias):
+            dc_icon = icon(CTX_ICONS.get("ctx_disconnect", ""))
+            dc_label = f"{dc_icon} {t('ctx_disconnect')}" if dc_icon else t("ctx_disconnect")
+            menu.add_command(
+                label=dc_label,
+                command=lambda a=alias: (
+                    self.disconnect_callback(a) if self.disconnect_callback else None
+                ),
+            )
+            menu.add_separator()
+
         # "Move to Group" submenu
         groups = self.store.get_groups()
         if groups:

gui/tabs/files_tab.py

@@ -307,13 +307,21 @@ class FilesTab(ctk.CTkFrame):
                 stored_path, stored_sudo = self.session_pool.get_sftp_state(alias)
                 if stored_path != "/":
                     self._remote_path = stored_path
-                # The stored sudo mode will be applied when the connection is established
-            self._connect_sftp()
+            self._remote_status.configure(text=t("sftp_click_to_connect"))
         else:
             self._remote_list.populate([])
             self._remote_status.configure(text=t("connect_to_browse"))
             self._set_remote_buttons_state("disabled")
 
+    def connect(self):
+        """Explicitly connect SFTP (double-click or context menu)."""
+        if self._current_alias and not self._sftp:
+            self._connect_sftp()
+
+    def disconnect(self):
+        """Disconnect SFTP and update UI (called by app)."""
+        self._disconnect_sftp()
+
     # ── SFTP connection ──
 
     def _connect_sftp(self):

gui/tabs/powershell_tab.py

@@ -97,7 +97,18 @@ class PowershellTab(ctk.CTkFrame):
             self._set_status(t("ps_disconnected"), "#888888")
             return
 
-        self._connect(alias)
+        self._set_status(t("term_click_to_connect").format(alias=alias), "#f59e0b")
+
+    def connect(self):
+        """Explicitly connect WinRM (double-click or context menu)."""
+        if self._current_alias and not self._client:
+            self._connect(self._current_alias)
+
+    def disconnect(self):
+        """Disconnect WinRM and update UI (called by app)."""
+        self._disconnect()
+        if self._current_alias:
+            self._set_status(t("term_click_to_connect").format(alias=self._current_alias), "#f59e0b")
 
     # ── Connection ───────────────────────────────────────────────────
 

gui/tabs/s3_tab.py

@@ -153,7 +153,24 @@ class S3Tab(ctk.CTkFrame):
             bucket_frame, variable=self._bucket_var, values=[""],
             width=200, command=self._on_bucket_change,
         )
-        self._bucket_menu.pack(side="left", padx=(0, 15))
+        self._bucket_menu.pack(side="left", padx=(0, 5))
+
+        # Create bucket [+]
+        self._create_bucket_btn = ctk.CTkButton(
+            bucket_frame, text="+", width=28, height=28,
+            corner_radius=6, font=ctk.CTkFont(size=14, weight="bold"),
+            command=self._create_bucket,
+        )
+        self._create_bucket_btn.pack(side="left", padx=(0, 3))
+
+        # Delete bucket [🗑]
+        self._delete_bucket_btn = ctk.CTkButton(
+            bucket_frame, text="\U0001f5d1", width=28, height=28,
+            corner_radius=6, fg_color="#dc2626", hover_color="#b91c1c",
+            font=ctk.CTkFont(size=13),
+            command=self._delete_bucket,
+        )
+        self._delete_bucket_btn.pack(side="left", padx=(0, 15))
 
         # Path display
         self._path_label = ctk.CTkLabel(
@@ -626,6 +643,64 @@ class S3Tab(ctk.CTkFrame):
 
         threading.Thread(target=_do, daemon=True).start()
 
+    def _create_bucket(self):
+        """Prompt for bucket name and create it."""
+        if not self._client:
+            return
+        dialog = ctk.CTkInputDialog(
+            text=t("s3_bucket_name_prompt"),
+            title=t("s3_create_bucket"),
+        )
+        name = dialog.get_input()
+        if not name or not name.strip():
+            return
+        name = name.strip()
+        self._status_label.configure(text="...")
+
+        def _do():
+            ok = self._client.create_bucket(name)
+            self.after(0, lambda: self._on_bucket_created(ok, name))
+
+        threading.Thread(target=_do, daemon=True).start()
+
+    def _on_bucket_created(self, ok: bool, name: str):
+        if ok:
+            self._status_label.configure(
+                text=t("s3_bucket_created").format(name=name))
+            self._current_bucket = name
+            self._load_buckets()
+        else:
+            self._status_label.configure(text=t("s3_folder_failed"))
+
+    def _delete_bucket(self):
+        """Delete the currently selected bucket (must be empty)."""
+        if not self._client or not self._current_bucket:
+            return
+        from tkinter import messagebox
+        ok = messagebox.askyesno(
+            t("s3_delete_bucket"),
+            t("s3_delete_bucket_confirm").format(name=self._current_bucket),
+        )
+        if not ok:
+            return
+        bucket_name = self._current_bucket
+        self._status_label.configure(text="...")
+
+        def _do():
+            ok = self._client.delete_bucket(bucket_name)
+            self.after(0, lambda: self._on_bucket_deleted(ok, bucket_name))
+
+        threading.Thread(target=_do, daemon=True).start()
+
+    def _on_bucket_deleted(self, ok: bool, name: str):
+        if ok:
+            self._status_label.configure(
+                text=t("s3_bucket_deleted").format(name=name))
+            self._current_bucket = ""
+            self._load_buckets()
+        else:
+            self._status_label.configure(text=t("s3_delete_failed"))
+
     def _go_back(self):
         if self._nav_stack:
             self._current_prefix = self._nav_stack.pop()

gui/tabs/terminal_tab.py

@@ -29,6 +29,18 @@ class TerminalTab(ctk.CTkFrame):
         # Import here to avoid circular issues
         from gui.widgets.terminal_widget import TerminalWidget
 
+        self._toolbar = ctk.CTkFrame(self, fg_color="transparent", height=32)
+        self._toolbar.pack(fill="x", padx=5, pady=(5, 0))
+        self._toolbar.pack_propagate(False)
+        self._conn_btn = ctk.CTkButton(
+            self._toolbar, text=t("ctx_connect"), width=120, height=28,
+            fg_color="#6b7280", hover_color="#4b5563",
+            font=ctk.CTkFont(size=12), state="disabled",
+            command=self._on_conn_btn_click,
+        )
+        self._conn_btn.pack(side="right", padx=2)
+        self._connected = False
+
         self._terminal = TerminalWidget(
             self,
             send_callback=self._send_to_shell,
@@ -37,6 +49,15 @@ class TerminalTab(ctk.CTkFrame):
             on_font_size_changed=self._on_font_size_changed,
         )
         self._terminal.pack(fill="both", expand=True, padx=5, pady=5)
+
+        # Overlay "OFF" label (shown when disconnected)
+        self._overlay = ctk.CTkLabel(
+            self._terminal, text=t("term_off"),
+            font=ctk.CTkFont(size=72, weight="bold"),
+            text_color=("#cccccc", "#333333"),
+            fg_color="transparent",
+        )
+        self._overlay.place(relx=0.5, rely=0.45, anchor="center")
         self._terminal.set_status(t("term_disconnected"), "#888888")
 
         # Thread-safe data queue
@@ -45,6 +66,7 @@ class TerminalTab(ctk.CTkFrame):
         # Sudo auto-password detection
         self._sudo_buffer = b""   # Buffer for detecting sudo prompts
         self._sudo_sent = False   # Prevent sending password twice for same prompt
+        self._on_disconnect_callback = None
 
     def set_server(self, alias: str | None):
         if alias == self._current_alias:
@@ -61,11 +83,48 @@ class TerminalTab(ctk.CTkFrame):
 
         self._current_alias = alias
         if alias:
-            self._connect()
+            self._set_conn_btn_disconnected()
+            self._conn_btn.configure(state="normal")
+            self._terminal.set_status(t("term_click_to_connect").format(alias=alias), "#f59e0b")
         else:
+            self._set_conn_btn_disconnected()
+            self._conn_btn.configure(state="disabled")
             self._terminal.reset()
             self._terminal.set_status(t("term_disconnected"), "#888888")
 
+    def connect(self):
+        """Explicitly connect (double-click or context menu)."""
+        if self._current_alias and not self._session:
+            self._connect()
+
+    def _on_conn_btn_click(self):
+        if self._connected:
+            if self._on_disconnect_callback and self._current_alias:
+                self._on_disconnect_callback(self._current_alias)
+        else:
+            self.connect()
+
+    def _set_conn_btn_connected(self):
+        self._connected = True
+        self._conn_btn.configure(
+            text=t("ctx_disconnect"), fg_color="#dc2626", hover_color="#b91c1c", state="normal",
+        )
+        self._overlay.place_forget()
+
+    def _set_conn_btn_disconnected(self):
+        self._connected = False
+        self._conn_btn.configure(
+            text=t("ctx_connect"), fg_color="#6b7280", hover_color="#4b5563",
+        )
+        self._overlay.place(relx=0.5, rely=0.45, anchor="center")
+
+    def disconnect(self):
+        """Disconnect and update UI (called by app)."""
+        self._disconnect()
+        self._set_conn_btn_disconnected()
+        if self._current_alias:
+            self._terminal.set_status(t("term_click_to_connect").format(alias=self._current_alias), "#f59e0b")
+
     def _connect(self):
         if not self._current_alias:
             return
@@ -135,6 +194,7 @@ class TerminalTab(ctk.CTkFrame):
                     # Only grab focus if terminal tab is currently visible
                     if self._terminal.winfo_ismapped():
                         self._terminal.focus_terminal()
+                    self._set_conn_btn_connected()
                 self.after(0, _set_session)
             except Exception as e:
                 self.after(0, lambda: self._terminal.set_status(

plans/disable-terminal-autoconnect.md

@@ -0,0 +1,160 @@
+# Отключить автоподключение терминала при одинарном клике
+
+## Контекст
+
+При одинарном клике на сервер в sidebar все табы (terminal, files, powershell) сразу подключаются к серверу. Пользователь хочет просто переключаться между серверами без автоподключения. Подключение — только по двойному клику.
+
+## Подход
+
+- **Одинарный клик** — выбрать сервер, обновить табы (info, setup, keys и т.д.), но НЕ подключаться к terminal/files/powershell
+- **Двойной клик** — выбрать сервер + подключить все "connecting" табы (terminal, files, powershell)
+- **Контекстное меню** "Open Terminal" / "Browse Files" — тоже подключает
+
+Tkinter при двойном клике генерирует оба события: `<Button-1>` (первый клик) → `<Double-Button-1>`. Это нам на руку: первый клик выберет сервер, двойной клик — подключит. Debounce не нужен.
+
+## Изменения — 4 файла
+
+### 1. `gui/sidebar.py` — добавить двойной клик
+
+**Строка 37** — добавить `on_double_click` в конструктор:
+```python
+def __init__(self, master, store, on_select=None, on_double_click=None, session_pool=None):
+    ...
+    self.on_select = on_select
+    self.on_double_click = on_double_click
+```
+
+**Строки 272-275** — добавить `<Double-Button-1>` binding:
+```python
+for widget in [frame, info, name_label, detail_label, badge, type_badge, session_ind]:
+    widget.bind("<Button-1>", lambda e, a=alias: self._select(a))
+    widget.bind("<Double-Button-1>", lambda e, a=alias: self._on_double_click(a))
+    widget.bind("<Button-3>", lambda e, a=alias: self._show_context_menu(e, a))
+```
+
+**После `_select()`** (строка 372) — новый метод:
+```python
+def _on_double_click(self, alias: str):
+    self._select(alias)
+    if self.on_double_click:
+        self.on_double_click(alias)
+```
+
+### 2. `gui/tabs/terminal_tab.py` — убрать автоподключение
+
+**Строки 49-67** — `set_server()`: заменить `self._connect()` на показ статуса:
+```python
+def set_server(self, alias: str | None):
+    if alias == self._current_alias:
+        return
+    if self._current_alias and self._session and self.session_pool:
+        buf = self._terminal.get_current_buffer()
+        self.session_pool.store_shell_state(self._current_alias, buf)
+    self._disconnect()
+    self._current_alias = alias
+    if alias:
+        self._terminal.set_status(t("term_click_to_connect").format(alias=alias), "#f59e0b")
+    else:
+        self._terminal.reset()
+        self._terminal.set_status(t("term_disconnected"), "#888888")
+```
+
+**Добавить публичный метод `connect()`** после `set_server()`:
+```python
+def connect(self):
+    """Explicitly connect (double-click or context menu)."""
+    if self._current_alias and not self._session:
+        self._connect()
+```
+
+### 3. `gui/tabs/files_tab.py` — убрать автоподключение
+
+**Строки 304-311** — `set_server()`: заменить `self._connect_sftp()` на статус:
+```python
+if alias:
+    if self.session_pool:
+        stored_path, stored_sudo = self.session_pool.get_sftp_state(alias)
+        if stored_path != "/":
+            self._remote_path = stored_path
+    self._remote_status.configure(text=t("sftp_click_to_connect"))
+else:
+    ...
+```
+
+**Добавить публичный метод `connect()`**:
+```python
+def connect(self):
+    """Explicitly connect SFTP (double-click or context menu)."""
+    if self._current_alias and not self._sftp:
+        self._connect_sftp()
+```
+
+### 4. `gui/tabs/powershell_tab.py` — убрать автоподключение
+
+**Строка 100** — заменить `self._connect(alias)` на статус:
+```python
+if alias is None:
+    self._set_status(t("ps_disconnected"), "#888888")
+    return
+self._set_status(t("term_click_to_connect").format(alias=alias), "#f59e0b")
+```
+
+**Добавить публичный метод `connect()`**:
+```python
+def connect(self):
+    """Explicitly connect WinRM (double-click or context menu)."""
+    if self._current_alias and not self._client:
+        self._connect(self._current_alias)
+```
+
+### 5. `gui/app.py` — подключить двойной клик
+
+**Строка 157** — передать `on_double_click`:
+```python
+self.sidebar = Sidebar(self._paned, self.store,
+    on_select=self._on_server_select,
+    on_double_click=self._on_server_connect,
+    session_pool=self.session_pool)
+```
+
+**Новый метод `_on_server_connect()`** (после `_on_server_select`):
+```python
+def _on_server_connect(self, alias: str):
+    """Double-click: connect interactive tabs (terminal, files, powershell)."""
+    for key, widget in self._tab_instances.items():
+        if hasattr(widget, "connect"):
+            widget.connect()
+```
+
+**Строки 350-358** — `_context_open_tab()`: добавить вызов `connect()`:
+```python
+def _context_open_tab(self, alias: str, tab_key: str):
+    self._on_server_select(alias)
+    self.sidebar._select(alias)
+    if tab_key in self._tab_keys:
+        try:
+            self.tabview.set(_tab_label(tab_key))
+        except Exception:
+            pass
+    # Connect the target tab if it supports explicit connection
+    widget = self._tab_instances.get(tab_key)
+    if widget and hasattr(widget, "connect"):
+        widget.connect()
+```
+
+### 6. `core/i18n.py` — 2 ключа перевода
+
+Рядом с `term_disconnected`:
+
+| Ключ | EN | RU | ZH |
+|------|----|----|-----|
+| `term_click_to_connect` | `Double-click to connect to {alias}` | `Двойной клик для подключения к {alias}` | `双击连接 {alias}` |
+| `sftp_click_to_connect` | `Double-click server to browse files` | `Двойной клик для просмотра файлов` | `双击服务器浏览文件` |
+
+## Верификация
+
+1. `python build.py` — собрать exe
+2. Запустить exe, одинарный клик на SSH-сервер → терминал показывает "Двойной клик для подключения", файлы показывают аналогичное сообщение, info таб работает как раньше
+3. Двойной клик на сервер → терминал и файлы подключаются
+4. Правый клик → "Open Terminal" → терминал подключается
+5. Переключение между серверами одним кликом → нет автоподключений, быстрое переключение

tools/patch_claude_code.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+/**
+ * Patcher for Claude Code CLI — fixes image reading crash on Windows.
+ *
+ * Root cause: In some code paths, `media_type` field is undefined when
+ * constructing image content blocks for the API. JSON.stringify omits
+ * undefined values, so the field is absent from the request body.
+ * The API returns 400 "media_type: Field required" which permanently
+ * poisons the conversation context and kills the session.
+ *
+ * This patcher:
+ * 1. Installs `sharp` into claude-code's node_modules (if missing)
+ * 2. Patches the Nv8 (image reader) function to gracefully handle errors
+ * 3. Patches the image mapper to guarantee media_type is always present
+ *
+ * Usage:
+ *   node tools/patch_claude_code.js          # apply patch
+ *   node tools/patch_claude_code.js --check  # check status only
+ *   node tools/patch_claude_code.js --revert # revert patch
+ *
+ * Safe to run multiple times — idempotent.
+ */
+
+const fs = require("fs");
+const path = require("path");
+const { execSync } = require("child_process");
+
+// Find claude-code installation
+function findClaudeCodeDir() {
+  const npmGlobal = execSync("npm root -g", { encoding: "utf8" }).trim();
+  const claudeDir = path.join(npmGlobal, "@anthropic-ai", "claude-code");
+  if (fs.existsSync(path.join(claudeDir, "cli.js"))) return claudeDir;
+
+  // Fallback: try common paths
+  const fallbacks = [
+    path.join(process.env.APPDATA || "", "npm", "node_modules", "@anthropic-ai", "claude-code"),
+    path.join(process.env.HOME || "", ".npm-global", "lib", "node_modules", "@anthropic-ai", "claude-code"),
+    "/usr/local/lib/node_modules/@anthropic-ai/claude-code",
+  ];
+  for (const dir of fallbacks) {
+    if (fs.existsSync(path.join(dir, "cli.js"))) return dir;
+  }
+  return null;
+}
+
+// Check if sharp is installed
+function isSharpInstalled(claudeDir) {
+  try {
+    const sharpDir = path.join(claudeDir, "node_modules", "sharp");
+    return fs.existsSync(sharpDir);
+  } catch {
+    return false;
+  }
+}
+
+// Install sharp
+function installSharp(claudeDir) {
+  console.log("[*] Installing sharp...");
+  try {
+    execSync("npm install sharp", { cwd: claudeDir, encoding: "utf8", stdio: "pipe" });
+    console.log("[+] sharp installed successfully");
+    return true;
+  } catch (e) {
+    console.error("[-] Failed to install sharp:", e.message);
+    return false;
+  }
+}
+
+const PATCH_MARKER = "/* PATCHED_NV8_SAFE_IMAGE_READ */";
+const MAPPER_PATCH_MARKER = "/* PATCHED_IMAGE_MEDIA_TYPE */";
+
+function readCliJs(claudeDir) {
+  return fs.readFileSync(path.join(claudeDir, "cli.js"), "utf8");
+}
+
+function writeCliJs(claudeDir, code) {
+  // Backup first
+  const backupPath = path.join(claudeDir, "cli.js.bak");
+  if (!fs.existsSync(backupPath)) {
+    fs.copyFileSync(path.join(claudeDir, "cli.js"), backupPath);
+    console.log("[+] Backup created: cli.js.bak");
+  }
+  fs.writeFileSync(path.join(claudeDir, "cli.js"), code, "utf8");
+}
+
+function isPatched(code) {
+  return code.includes(PATCH_MARKER);
+}
+
+function isMapperPatched(code) {
+  return code.includes(MAPPER_PATCH_MARKER);
+}
+
+// Patch 1: Nv8 safety wrapper (try/catch around image reader)
+function applyNv8Patch(code) {
+  if (code.includes(PATCH_MARKER)) {
+    console.log("[=] Nv8 safety patch already applied");
+    return code;
+  }
+
+  const ORIGINAL_NV8_SIGNATURE = "async function Nv8(A,q=Tv8(),K){let Y=await X1().readFileBytes(A,K)";
+  const idx = code.indexOf(ORIGINAL_NV8_SIGNATURE);
+  if (idx === -1) {
+    console.error("[-] Could not find Nv8 function signature in cli.js");
+    console.error("    Claude Code may have been updated.");
+    return code;
+  }
+
+  const endMarker = "}var Ns9";
+  const endIdx = code.indexOf(endMarker, idx);
+  if (endIdx === -1) {
+    console.error("[-] Could not find end of Nv8 function");
+    return code;
+  }
+
+  const patchedNv8 = `${PATCH_MARKER}async function Nv8(A,q=Tv8(),K){try{let Y=await X1().readFileBytes(A,K),z=Y.length;if(z===0)throw Error("Image file is empty: "+A);let w=kp6(Y),_=w.split("/")[1]||"png",$;try{let H=await ig(Y,z,_);$=q01(H.buffer,H.mediaType,z,H.dimensions)}catch(H){$6(H);$=q01(Y,_,z)}if(Math.ceil($.file.base64.length*0.125)>q)try{let H=await DP1(Y,q,w);return{type:"image",file:{base64:H.base64,type:H.mediaType||"image/png",originalSize:z}}}catch(H){$6(H);try{let j=await Promise.resolve().then(()=>q6(yN8(),1)),M=await(j.default||j)(Y).resize(400,400,{fit:"inside",withoutEnlargement:!0}).jpeg({quality:20}).toBuffer();return q01(M,"jpeg",z)}catch(j){return $6(j),q01(Y,_,z)}}return $}catch(_err){return{type:"text",file:{content:"[Error reading image: "+_err.message+"] File: "+A,totalLines:1}}}}`;
+
+  code = code.slice(0, idx) + patchedNv8 + code.slice(endIdx + 1);
+  console.log("[+] Nv8 safety patch applied");
+  return code;
+}
+
+// Patch 2: Image mapper — guarantee media_type is always a valid string
+// This is the ROOT CAUSE fix: A.file.type can be undefined in some code paths,
+// and JSON.stringify silently drops undefined fields, causing API 400 error.
+function applyMapperPatch(code) {
+  if (code.includes(MAPPER_PATCH_MARKER)) {
+    console.log("[=] Image mapper patch already applied");
+    return code;
+  }
+
+  const ORIGINAL_MAPPER = 'case"image":return{tool_use_id:q,type:"tool_result",content:[{type:"image",source:{type:"base64",data:A.file.base64,media_type:A.file.type}}]}';
+  const idx = code.indexOf(ORIGINAL_MAPPER);
+  if (idx === -1) {
+    console.error("[-] Could not find image mapper in cli.js");
+    console.error("    Claude Code may have been updated.");
+    return code;
+  }
+
+  // Patched version: fallback media_type to "image/png" if undefined
+  const PATCHED_MAPPER = `${MAPPER_PATCH_MARKER}case"image":return{tool_use_id:q,type:"tool_result",content:[{type:"image",source:{type:"base64",data:A.file.base64,media_type:A.file.type||"image/png"}}]}`;
+
+  code = code.slice(0, idx) + PATCHED_MAPPER + code.slice(idx + ORIGINAL_MAPPER.length);
+  console.log("[+] Image mapper patched — media_type guaranteed non-empty");
+  return code;
+}
+
+function revertPatch(claudeDir) {
+  const backupPath = path.join(claudeDir, "cli.js.bak");
+  if (!fs.existsSync(backupPath)) {
+    console.error("[-] No backup found at cli.js.bak");
+    return false;
+  }
+  fs.copyFileSync(backupPath, path.join(claudeDir, "cli.js"));
+  console.log("[+] Reverted to original cli.js from backup");
+  return true;
+}
+
+// Main
+function main() {
+  const args = process.argv.slice(2);
+  const checkOnly = args.includes("--check");
+  const revert = args.includes("--revert");
+
+  console.log("=== Claude Code Image Read Patcher v2 ===\n");
+
+  const claudeDir = findClaudeCodeDir();
+  if (!claudeDir) {
+    console.error("[-] Claude Code installation not found!");
+    console.error("    Install it with: npm install -g @anthropic-ai/claude-code");
+    process.exit(1);
+  }
+  console.log("[*] Found Claude Code at:", claudeDir);
+
+  // Read package version
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(claudeDir, "package.json"), "utf8"));
+    console.log("[*] Version:", pkg.version);
+  } catch {}
+
+  // Check sharp
+  const hasSharp = isSharpInstalled(claudeDir);
+  console.log("[*] sharp module:", hasSharp ? "installed" : "MISSING");
+
+  // Check patch status
+  const code = readCliJs(claudeDir);
+  const nv8Patched = isPatched(code);
+  const mapperPatched = isMapperPatched(code);
+  console.log("[*] Nv8 safety patch:", nv8Patched ? "applied" : "not applied");
+  console.log("[*] Image mapper patch:", mapperPatched ? "applied" : "not applied");
+
+  if (checkOnly) {
+    const fullyProtected = hasSharp && nv8Patched && mapperPatched;
+    const status = fullyProtected ? "FULLY PROTECTED" :
+      (mapperPatched ? "PROTECTED (mapper fix applied)" : "VULNERABLE");
+    console.log("\nStatus:", status);
+    process.exit(fullyProtected ? 0 : 1);
+  }
+
+  if (revert) {
+    revertPatch(claudeDir);
+    process.exit(0);
+  }
+
+  console.log("");
+
+  // Step 1: Install sharp
+  if (!hasSharp) {
+    if (!installSharp(claudeDir)) {
+      console.error("\n[-] Could not install sharp. Applying safety patches anyway...");
+    }
+  } else {
+    console.log("[=] sharp already installed, skipping");
+  }
+
+  // Step 2: Apply Nv8 safety patch
+  let patchedCode = applyNv8Patch(readCliJs(claudeDir));
+
+  // Step 3: Apply image mapper patch (ROOT CAUSE FIX)
+  patchedCode = applyMapperPatch(patchedCode);
+
+  writeCliJs(claudeDir, patchedCode);
+
+  console.log("\n=== Done! Claude Code is now protected against image read crashes ===");
+  console.log("Patches applied:");
+  console.log("  1. Nv8 try/catch — prevents binary leak on image read failure");
+  console.log("  2. Image mapper  — guarantees media_type is always present (ROOT FIX)");
+  console.log("\nNote: After updating Claude Code (npm update -g @anthropic-ai/claude-code),");
+  console.log("      re-run this patcher to reapply the fixes.");
+}
+
+main();

tools/skill-ssh.md

@@ -32,7 +32,7 @@
 | `telnet` | `ALIAS "command"` (без SFTP/sudo/ключей) | `--upload`, `--download` |
 | `mariadb` / `mssql` / `postgresql` | `--sql`, `--sql-databases`, `--sql-tables` | `ALIAS "command"` |
 | `redis` | `--redis`, `--redis-info`, `--redis-keys` | `ALIAS "command"` |
-| `s3` (MinIO, AWS S3, и др.) | `--s3-buckets`, `--s3-ls`, `--s3-upload`, `--s3-download`, `--s3-delete`, `--s3-url` | `ALIAS "command"`, `--upload`, `--download` |
+| `s3` (MinIO, AWS S3, и др.) | `--s3-buckets`, `--s3-ls`, `--s3-upload`, `--s3-download`, `--s3-delete`, `--s3-url`, `--s3-create-bucket` | `ALIAS "command"`, `--upload`, `--download` |
 | `grafana` | `--grafana-dashboards`, `--grafana-alerts` | `ALIAS "command"` |
 | `prometheus` | `--prom-query`, `--prom-targets`, `--prom-alerts` | `ALIAS "command"` |
 | `winrm` | `--ps`, `--cmd` | `ALIAS "command"` |
@@ -64,7 +64,7 @@ python ~/.server-connections/ssh.py --sql-databases "mariadb-alias"
 
 ## Общие команды
 
-### Список серверов (безопасный — alias, тип, ключ, заметки)
+### Список серверов (безопасный — alias, тип, группа, ключ, заметки)
 ```bash
 python ~/.server-connections/ssh.py --list
 ```
@@ -213,6 +213,11 @@ python ~/.server-connections/ssh.py --s3-url ALIAS bucket/key 86400
 ```
 По умолчанию ссылка действует 1 час (3600 сек). Второй аргумент — время жизни в секундах (например 86400 = 24 часа).
 
+### Создать бакет
+```bash
+python ~/.server-connections/ssh.py --s3-create-bucket ALIAS bucket-name
+```
+
 ### Типичный workflow: "создай папку и залей файл"
 ```bash
 # 1. Посмотри бакеты

tools/ssh.py

@@ -43,6 +43,7 @@ S3 (type: s3):
     python ssh.py --s3-download ALIAS bucket/key local # download file
     python ssh.py --s3-delete ALIAS bucket/key         # delete object
     python ssh.py --s3-url ALIAS bucket/key [SEC]     # presigned URL (default 3600s)
+    python ssh.py --s3-create-bucket ALIAS name       # create bucket
 
 WinRM (type: winrm):
     python ssh.py --ps ALIAS "Get-Process"             # PowerShell via WinRM
@@ -101,6 +102,11 @@ def load_servers():
     return data, {s["alias"]: s for s in data.get("servers", [])}
 
 
+def _group_map(data: dict) -> dict:
+    """Map group UUID → group name."""
+    return {g["id"]: g.get("name", "") for g in data.get("groups", [])}
+
+
 def save_servers(data):
     servers_file = _get_servers_file()
     text = json.dumps(data, indent=2, ensure_ascii=False)
@@ -778,7 +784,8 @@ def ping_server(server: dict):
 
 
 def list_servers(full=False):
-    _, servers = load_servers()
+    data, servers = load_servers()
+    groups = _group_map(data)
     if full:
         # WARNING: full mode shows sensitive data (IP, port, user)
         # Only for local/manual use, NEVER through AI API
@@ -790,13 +797,14 @@ def list_servers(full=False):
             print(f"{alias:<20} {s['ip']:<20} {s.get('port', 22):<8} {s.get('user', 'root'):<10} {has_key:<6}")
     else:
         # Safe mode: only aliases (no IPs, ports, users)
-        print(f"{'Alias':<20} {'Type':<10} {'Key':<6} {'Notes'}")
-        print("-" * 70)
+        print(f"{'Alias':<20} {'Type':<10} {'Group':<14} {'Key':<6} {'Notes'}")
+        print("-" * 80)
         for alias, s in servers.items():
             has_key = "yes" if os.path.exists(SSH_KEY_PATH) else "no"
             stype = s.get("type", "ssh")
+            group_name = groups.get(s.get("group", ""), "-")
             notes = s.get("notes", "")
-            print(f"{alias:<20} {stype:<10} {has_key:<6} {notes}")
+            print(f"{alias:<20} {stype:<10} {group_name:<14} {has_key:<6} {notes}")
 
 
 def _resolve_alias(alias: str, servers: dict) -> str:
@@ -830,12 +838,16 @@ def _resolve_alias(alias: str, servers: dict) -> str:
 
 def server_info(alias: str):
     """Show server info safe for AI context — NO ip, user, password, port, totp_secret."""
-    _, servers = load_servers()
+    data, servers = load_servers()
+    groups = _group_map(data)
     alias = _resolve_alias(alias, servers)
     s = servers[alias]
     has_key = "yes" if os.path.exists(SSH_KEY_PATH) else "no"
     print(f"Alias:   {s['alias']}")
     print(f"Type:    {s.get('type', 'ssh')}")
+    group_name = groups.get(s.get("group", ""), "")
+    if group_name:
+        print(f"Group:   {group_name}")
     print(f"Key:     {has_key}")
     print(f"Auth:    {s.get('auth', 'password')}")
     print(f"2FA:     {'yes' if s.get('totp_secret') else 'no'}")
@@ -1481,6 +1493,17 @@ def s3_url(server: dict, remote_path: str, expires: int = 3600):
         sys.exit(1)
 
 
+def s3_create_bucket(server: dict, bucket_name: str):
+    """Create a new S3 bucket."""
+    client = _get_s3_client(server)
+    try:
+        client.create_bucket(Bucket=bucket_name)
+        print(f"Bucket created: {bucket_name}")
+    except Exception as e:
+        print(f"ERROR: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
 # ── Grafana commands ──────────────────────────────────
 
 def _grafana_request(server: dict, endpoint: str) -> dict:
@@ -1791,6 +1814,11 @@ def main():
         expires = int(sys.argv[4]) if len(sys.argv) >= 5 else 3600
         s3_url(servers[alias], sys.argv[3], expires)
         sys.exit(0)
+    if cmd == "--s3-create-bucket" and len(sys.argv) >= 4:
+        _, servers = load_servers()
+        alias = _resolve_alias(sys.argv[2], servers)
+        s3_create_bucket(servers[alias], sys.argv[3])
+        sys.exit(0)
 
     # ── Grafana commands ──
     if cmd == "--grafana-dashboards" and len(sys.argv) >= 3:

version.py

@@ -1,6 +1,6 @@
 """Version info for ServerManager."""
 
-__version__ = "1.9.19"
+__version__ = "1.9.36"
 __app_name__ = "ServerManager"
 __author__ = "aibot777"
 __description__ = "Desktop GUI for managing remote servers"