Changelog

• NewClipboard history: everything you copy inside NetStacks is recorded with where it came from — session, device and CLI flavour. Ctrl+Shift+H searches it, Enter pastes into the active terminal, and pinned clips survive the retention window.
• SecurityPasswords, secrets, keys and SNMP communities are scrubbed from stored clipboard history. The OS clipboard is never touched.
• NewPaste review: pasting two or more lines opens a dialog showing your clipboard beside the exact bytes the device will receive, after the CLI-flavour preset has normalised line endings and stripped comments. Edit before sending; Ctrl+Shift+V still pastes raw.
• NewPer-flavour paste presets for IOS, NX-OS, XR, EOS, Junos and Linux, with retention and a master switch under Settings → Clipboard.
• ImprovedTabs track unsaved work, so closing one with pending changes prompts instead of discarding them.

• ImprovedQuit behaviour in the application menu now shuts the agent down cleanly.

• NewOut-of-band console access. Session Settings gains a Console tab — terminal server host and port, SSH or Telnet, credential profile — and right-click → Open Console opens the console in its own tab. Works with any console server that exposes serial lines over SSH or Telnet: Opengear, Cisco async, Avocent, Lantronix.
• NewNetBox import fills in console access: cable each device's console port to its console server and set the device_console custom field, and re-running an import refreshes console paths on sessions you already have.
• NewConsole fields are carried through session export/import and the CSV importer, with new console_host, console_port, console_protocol, console_profile and console_legacy_ssh columns.
• NewAI console tools open_console and run_console_command, off by default. They only work through a console tab you can see, require approval in Ask mode, refuse login prompts, ROMMON and config mode, and never enter credentials.

• FixedSFTP editor tabs save reliably, including via Cmd+S.

• FixedBase URL and Verify TLS are now stored per AI provider instead of being shared.
• FixedVertex chat streams even when the selected model pins a non-streaming action.

• NewTab-to-autocomplete across free-text fields throughout the app, filled from real workspace context rather than a generic completion.
• FixedInline AI suggestions render at the cursor position on WebGL terminals.
• FixedOpenRouter honours a custom base URL and the Verify TLS toggle, and trims stray whitespace from the URL.

• NewLive workspace context: the assistant sees your terminal scrollback, the file open in the editor and whether it has unsaved changes. Scrollback depth and whether the editor is included are configurable.
• NewPre-flight guard that catches config-mode and interactive-prompt collisions before a suggested command is sent.
• FixedThe syntax highlighter no longer corrupts terminal escape sequences.

Packaging release. No user-facing changes.

• FixedBuild fix for a nullable AI provider and the Windows/Linux menu bar.

• NewGlobal search from the command palette, aggregating sessions, devices, documents and settings, and opening whatever you pick.
• NewVault recovery: a forgot-password reset on the vault gate for when the master password is lost.
• NewA proper menu bar on Windows and Linux, driven by the same menu model as the native macOS menu.

• NewCommand Center top bar with per-OS window decorations and custom window controls on Windows and Linux.
• NewLive AI model picker: NetStacks fetches the model list from your provider, with a refresh button and manual entry as a fallback.
• NewHostname display-strip — a pattern that shortens long hostnames across sessions, topology and file titles for display only. Exports, documents and anything the AI acts on keep the full name.
• ImprovedAI settings report actionable errors rather than generic failures, and required fields are enforced before a provider can be saved or made default.
• FixedForm dialogs ignore backdrop clicks, so a stray click no longer discards unsaved work.
• FixedStreaming no longer hangs when an OpenAI-compatible provider omits the terminating [DONE].

• NewTopology multi-select: Ctrl/Cmd to toggle, marquee selection in both 2D and 3D, group drag that undoes as one action, and delete-selected with confirmation.
• NewAuto-layout for the map — grid, circular, hierarchical and force-directed — with bulk undo and redo.
• NewExtensible device detail: identity, connectivity, live SNMP, enrichment and traceroute sections composed into the device card and tab.
• NewSecret mapped keys, stored encrypted in the vault with an explicit reveal, for chords that send a password or enable secret.
• NewDiscovery and status visibility filters in the Layers dropdown; SVG export honours whatever you have filtered out.

• NewFirst-run setup wizard, re-runnable at any time from Settings → General → Onboarding.
• NewThe assistant understands NetStacks itself: product documentation is bundled into the agent, and a contextual Ask-AI pop-over explains whatever part of the UI you are looking at.
• NewGeneric API tools let the assistant list and call your saved API Resources, propose a pre-filled resource for a new API (you enter the secret), and onboard devices from any API that can list them.
• NewTopology and Documents awareness for the assistant, including right-click Ask AI on the map, on a device and on a link.
• NewSettings → Documents sets where each kind of generated document is saved — snapshots, terminal captures, MOP exports, scratchpad, script output and enrichment digests.
• NewPurge All on the trusted SSH host keys page.
• NewAgent mode names are customisable.
• FixedOne provider governs all AI features instead of per-toolset overrides, and genuine configuration errors are surfaced rather than swallowed.

• NewProfile-based authentication for enterprise sessions and SFTP, replacing per-session credentials, with an Enterprise Profiles tab for managing users and secrets.
• SecurityEvery hardcoded TLS bypass removed. Certificate verification is now a per-integration Verify SSL setting that defaults to on.
• SecuritySSRF validation on outbound integration requests, tightened CORS, and HTML escaping on a path that previously used innerHTML.
• ChangedSource made available under the Elastic License 2.0, replacing all-rights-reserved.

• NewFactory reset, a database location picker, and support for a custom database path.

• NewConfiguration backup and restore of the whole database, with export/import planned before it is applied, merge or wipe modes, per-category selection, and a Backup & Seed UI in the Integrations tab.
• ImprovedWipe-mode imports take a timestamped backup first, so a bad import is recoverable.
• FixedNetBox import reports the real problem when no API token is stored, rather than telling you to unlock the vault.

Release-pipeline work only. No user-facing changes.

• NewServer-side knowledge tools through the Controller, so the assistant can search team knowledge rather than only what is on your machine.
• FixedIntegration calls authenticate correctly, and saved credentials are reloaded when a source is retested.
• ChangedSigned installers are published to netstacks.net/download directly from the build, rather than through GitHub Releases.

• Newnetcli syntax highlighting for network device configuration in the editor.
• ImprovedBackup history tracks a clean baseline, so it can tell your edits apart from the device's own config.

• NewTwo light themes — Anchored Deep and Slate Mist — alongside the default dark, switchable in Settings.
• ImprovedLanguage server support routes through the Controller in enterprise mode.

Build and packaging release. No user-facing changes.

• NewSub-agent interface for delegating work to a focused assistant.
• ImprovedClearer AI prompts and operational guidance from the agent.

Maintenance release. No user-facing changes.

• ImprovedTLS moved onto the ring crypto backend, simplifying builds across macOS, Windows and Linux.

• ChangedThe Local Agent is downloaded and cached on first run instead of being bundled into the installer, which makes the download substantially smaller.