hqterm desktop: tabs, split panes, layout restore, images + HD emoji (0.2.0)

[ralyodio]

Adds hqterm desktop: our own terminal window so HD OpenEmoji/OpenIcon images show everywhere (Konsole cannot show them).

• desktop/: Electron + xterm.js (WebGL renderer, image addon with iTerm2 inline images + sixel, unicode11 emoji widths, web links, fit) on node-pty. OpenEmoji colour font bundled at build time.
• Tabs + split panes: Ctrl+Shift+T/W tabs, Ctrl+Tab switch, Ctrl+Shift+D/E split right/down, Ctrl+Shift+Arrows or one click to focus, Ctrl+Shift+X close pane, draggable dividers, Ctrl+Shift+C/V, Ctrl+=/-/0 zoom, OSC 2 titles.
• + menu: new shell, the hqterm session manager, or any host from ~/.ssh/config + hosts.json (hqsh <host> --session main), using the TUI's own host parser (bundled for Node).
• Layout restore: tabs/splits with each remote pane's host+session saved to ~/.config/hqterm/desktop-layout.json; next launch reattaches each remote pane to its hqsh session, local panes reopen as fresh shells.
• Panes run with TERM=xterm-256color COLORTERM=truecolor TERM_PROGRAM=hqterm HQTUI_IMAGES=iterm QC_HD=iterm.
• CLI: hqterm desktop [--host H] [--session S] finds the app ($HQTERM_DESKTOP, ~/.local/opt/hqterm-desktop/, /Applications/hqterm.app) or prints the install line; a second launch opens a tab in the running window.
• install.sh: --desktop / --no-desktop; plain install adds the AppImage + KDE/GNOME launcher entry on Linux when a display is present; --appimage-extract-and-run when FUSE is missing.
• Release: builds hqterm-desktop-linux-{x86_64,aarch64}.AppImage (smoke-tested under Xvfb), adds them and hqterm-desktop.png to SHA256SUMS. Version 0.2.0.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	electron-builder@​26.15.3
	@​xterm/​addon-fit@​0.11.0
	@​xterm/​addon-web-links@​0.12.0
	@​xterm/​addon-unicode11@​0.9.0
	@​xterm/​addon-webgl@​0.19.0
	@​xterm/​xterm@​6.0.0
	node-pty@​1.1.0
	@​xterm/​addon-image@​0.9.0
	electron@​44.5.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Deprecated by its maintainer: npm boolean Reason: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. From: desktop/package-lock.json → npm/electron-builder@26.15.3 → npm/boolean@3.2.0 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/boolean@3.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm glob Reason: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me From: desktop/package-lock.json → npm/electron-builder@26.15.3 → npm/glob@7.2.3 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@7.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm inflight Reason: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. From: desktop/package-lock.json → npm/electron-builder@26.15.3 → npm/inflight@1.0.6 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/inflight@1.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm rimraf Reason: Rimraf versions prior to v4 are no longer supported From: desktop/package-lock.json → npm/electron-builder@26.15.3 → npm/rimraf@2.6.3 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@2.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report