Merge remote-tracking branch 'origin/next' into 8826-investigate-postgresql-restart

2026-03-10 21:46:03 +01:00 · 2026-03-10 21:46:03 +01:00 · 0a1782175a
commit 0a1782175a
parent e41dbde46b a3e59e5c96
18 changed files with 732 additions and 200 deletions
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@ -177,9 +177,10 @@ private function cleanupApplicationImages(Server $server, $applications = null):
                ->filter(fn ($image) => ! empty($image['tag']));

            // Separate images into categories
-            // PR images (pr-*) and build images (*-build) are excluded from retention
-            // Build images will be cleaned up by docker image prune -af
+            // PR images (pr-*) are always deleted
+            // Build images (*-build) are cleaned up to match retained regular images
            $prImages = $images->filter(fn ($image) => str_starts_with($image['tag'], 'pr-'));
+            $buildImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && str_ends_with($image['tag'], '-build'));
            $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));

            // Always delete all PR images
@ -209,6 +210,26 @@ private function cleanupApplicationImages(Server $server, $applications = null):
                    'output' => $deleteOutput ?? 'Image removed or was in use',
                ];
            }
+
+            // Clean up build images (-build suffix) that don't correspond to retained regular images
+            // Build images are intermediate artifacts (e.g. Nixpacks) not used by running containers.
+            // If a build is in progress, docker rmi will fail silently since the image is in use.
+            $keptTags = $sortedRegularImages->take($imagesToKeep)->pluck('tag');
+            if (! empty($currentTag)) {
+                $keptTags = $keptTags->push($currentTag);
+            }
+
+            foreach ($buildImages as $image) {
+                $baseTag = preg_replace('/-build$/', '', $image['tag']);
+                if (! $keptTags->contains($baseTag)) {
+                    $deleteCommand = "docker rmi {$image['image_ref']} 2>/dev/null || true";
+                    $deleteOutput = instant_remote_process([$deleteCommand], $server, false);
+                    $cleanupLog[] = [
+                        'command' => $deleteCommand,
+                        'output' => $deleteOutput ?? 'Build image removed or was in use',
+                    ];
+                }
+            }
        }

        return $cleanupLog;
--- a/config/constants.php
+++ b/config/constants.php
@ -2,9 +2,9 @@

 return [
    'coolify' => [
-        'version' => '4.0.0-beta.464',
+        'version' => '4.0.0-beta.465',
        'helper_version' => '1.0.12',
-        'realtime_version' => '1.0.10',
+        'realtime_version' => '1.0.11',
        'self_hosted' => env('SELF_HOSTED', true),
        'autoupdate' => env('AUTOUPDATE'),
        'base_config_path' => env('BASE_CONFIG_PATH', '/data/coolify'),
--- a/docker-compose-maxio.dev.yml
+++ b/docker-compose-maxio.dev.yml
@ -73,6 +73,7 @@ services:
    volumes:
      - ./storage:/var/www/html/storage
      - ./docker/coolify-realtime/terminal-server.js:/terminal/terminal-server.js
+      - ./docker/coolify-realtime/terminal-utils.js:/terminal/terminal-utils.js
    environment:
      SOKETI_DEBUG: "false"
      SOKETI_DEFAULT_APP_ID: "${PUSHER_APP_ID:-coolify}"
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@ -73,6 +73,7 @@ services:
    volumes:
      - ./storage:/var/www/html/storage
      - ./docker/coolify-realtime/terminal-server.js:/terminal/terminal-server.js
+      - ./docker/coolify-realtime/terminal-utils.js:/terminal/terminal-utils.js
    environment:
      SOKETI_DEBUG: "false"
      SOKETI_DEFAULT_APP_ID: "${PUSHER_APP_ID:-coolify}"
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@ -60,7 +60,7 @@ services:
      retries: 10
      timeout: 2s
  soketi:
-    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.10'
+    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.11'
    ports:
      - "${SOKETI_PORT:-6001}:6001"
      - "6002:6002"
--- a/docker/coolify-realtime/Dockerfile
+++ b/docker/coolify-realtime/Dockerfile
@ -16,6 +16,7 @@ RUN npm i
 RUN npm rebuild node-pty --update-binary
 COPY docker/coolify-realtime/soketi-entrypoint.sh /soketi-entrypoint.sh
 COPY docker/coolify-realtime/terminal-server.js /terminal/terminal-server.js
+COPY docker/coolify-realtime/terminal-utils.js /terminal/terminal-utils.js

 # Install Cloudflared based on architecture
 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \
--- a/docker/coolify-realtime/package-lock.json
+++ b/docker/coolify-realtime/package-lock.json
@ -5,29 +5,29 @@
    "packages": {
        "": {
            "dependencies": {
-                "@xterm/addon-fit": "0.10.0",
-                "@xterm/xterm": "5.5.0",
-                "axios": "1.12.0",
-                "cookie": "1.0.2",
-                "dotenv": "16.5.0",
-                "node-pty": "1.0.0",
-                "ws": "8.18.1"
+                "@xterm/addon-fit": "0.11.0",
+                "@xterm/xterm": "6.0.0",
+                "axios": "1.13.6",
+                "cookie": "1.1.1",
+                "dotenv": "17.3.1",
+                "node-pty": "1.1.0",
+                "ws": "8.19.0"
            }
        },
        "node_modules/@xterm/addon-fit": {
-            "version": "0.10.0",
-            "resolved": "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.10.0.tgz",
-            "integrity": "sha512-UFYkDm4HUahf2lnEyHvio51TNGiLK66mqP2JoATy7hRZeXaGMRDr00JiSF7m63vR5WKATF605yEggJKsw0JpMQ==",
-            "license": "MIT",
-            "peerDependencies": {
-                "@xterm/xterm": "^5.0.0"
-            }
+            "version": "0.11.0",
+            "resolved": "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.11.0.tgz",
+            "integrity": "sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g==",
+            "license": "MIT"
        },
        "node_modules/@xterm/xterm": {
-            "version": "5.5.0",
-            "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
-            "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-            "license": "MIT"
+            "version": "6.0.0",
+            "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz",
+            "integrity": "sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==",
+            "license": "MIT",
+            "workspaces": [
+                "addons/*"
+            ]
        },
        "node_modules/asynckit": {
            "version": "0.4.0",
@ -36,13 +36,13 @@
            "license": "MIT"
        },
        "node_modules/axios": {
-            "version": "1.12.0",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.0.tgz",
-            "integrity": "sha512-oXTDccv8PcfjZmPGlWsPSwtOJCZ/b6W5jAMCNcfwJbCzDckwG0jrYJFaWH1yvivfCXjVzV/SPDEhMB3Q+DSurg==",
+            "version": "1.13.6",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz",
+            "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==",
            "license": "MIT",
            "dependencies": {
-                "follow-redirects": "^1.15.6",
-                "form-data": "^4.0.4",
+                "follow-redirects": "^1.15.11",
+                "form-data": "^4.0.5",
                "proxy-from-env": "^1.1.0"
            }
        },
@ -72,12 +72,16 @@
            }
        },
        "node_modules/cookie": {
-            "version": "1.0.2",
-            "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.0.2.tgz",
-            "integrity": "sha512-9Kr/j4O16ISv8zBBhJoi4bXOYNTkFLOqSL3UDB0njXxCXNezjeyVrJyGOWtgfs/q2km1gwBcfH8q1yEGoMYunA==",
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+            "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
            "license": "MIT",
            "engines": {
                "node": ">=18"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
            }
        },
        "node_modules/delayed-stream": {
@ -90,9 +94,9 @@
            }
        },
        "node_modules/dotenv": {
-            "version": "16.5.0",
-            "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.5.0.tgz",
-            "integrity": "sha512-m/C+AwOAr9/W1UOIZUo232ejMNnJAJtYQjUbHoNTBNTJSvqzzDh7vnrei3o3r3m9blf6ZoDkvcw0VmozNRFJxg==",
+            "version": "17.3.1",
+            "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.3.1.tgz",
+            "integrity": "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==",
            "license": "BSD-2-Clause",
            "engines": {
                "node": ">=12"
@ -161,9 +165,9 @@
            }
        },
        "node_modules/follow-redirects": {
-            "version": "1.15.9",
-            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
-            "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==",
+            "version": "1.15.11",
+            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
+            "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
            "funding": [
                {
                    "type": "individual",
@ -181,9 +185,9 @@
            }
        },
        "node_modules/form-data": {
-            "version": "4.0.4",
-            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-            "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+            "version": "4.0.5",
+            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+            "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
            "license": "MIT",
            "dependencies": {
                "asynckit": "^0.4.0",
@ -323,20 +327,20 @@
                "node": ">= 0.6"
            }
        },
-        "node_modules/nan": {
-            "version": "2.23.0",
-            "resolved": "https://registry.npmjs.org/nan/-/nan-2.23.0.tgz",
-            "integrity": "sha512-1UxuyYGdoQHcGg87Lkqm3FzefucTa0NAiOcuRsDmysep3c1LVCRK2krrUDafMWtjSG04htvAmvg96+SDknOmgQ==",
+        "node_modules/node-addon-api": {
+            "version": "7.1.1",
+            "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+            "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
            "license": "MIT"
        },
        "node_modules/node-pty": {
-            "version": "1.0.0",
-            "resolved": "https://registry.npmjs.org/node-pty/-/node-pty-1.0.0.tgz",
-            "integrity": "sha512-wtBMWWS7dFZm/VgqElrTvtfMq4GzJ6+edFI0Y0zyzygUSZMgZdraDUMUhCIvkjhJjme15qWmbyJbtAx4ot4uZA==",
+            "version": "1.1.0",
+            "resolved": "https://registry.npmjs.org/node-pty/-/node-pty-1.1.0.tgz",
+            "integrity": "sha512-20JqtutY6JPXTUnL0ij1uad7Qe1baT46lyolh2sSENDd4sTzKZ4nmAFkeAARDKwmlLjPx6XKRlwRUxwjOy+lUg==",
            "hasInstallScript": true,
            "license": "MIT",
            "dependencies": {
-                "nan": "^2.17.0"
+                "node-addon-api": "^7.1.0"
            }
        },
        "node_modules/proxy-from-env": {
@ -346,9 +350,9 @@
            "license": "MIT"
        },
        "node_modules/ws": {
-            "version": "8.18.1",
-            "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.1.tgz",
-            "integrity": "sha512-RKW2aJZMXeMxVpnZ6bck+RswznaxmzdULiBr6KY7XkTnW8uvt0iT9H5DkHUChXrc+uurzwa0rVI16n/Xzjdz1w==",
+            "version": "8.19.0",
+            "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
+            "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
            "license": "MIT",
            "engines": {
                "node": ">=10.0.0"
--- a/docker/coolify-realtime/package.json
+++ b/docker/coolify-realtime/package.json
@ -2,12 +2,12 @@
    "private": true,
    "type": "module",
    "dependencies": {
-        "@xterm/addon-fit": "0.10.0",
-        "@xterm/xterm": "5.5.0",
-        "cookie": "1.0.2",
-        "axios": "1.12.0",
-        "dotenv": "16.5.0",
-        "node-pty": "1.0.0",
-        "ws": "8.18.1"
+        "@xterm/addon-fit": "0.11.0",
+        "@xterm/xterm": "6.0.0",
+        "cookie": "1.1.1",
+        "axios": "1.13.6",
+        "dotenv": "17.3.1",
+        "node-pty": "1.1.0",
+        "ws": "8.19.0"
    }
 }
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@ -4,8 +4,33 @@ import pty from 'node-pty';
 import axios from 'axios';
 import cookie from 'cookie';
 import 'dotenv/config';
+import {
+    extractHereDocContent,
+    extractSshArgs,
+    extractTargetHost,
+    extractTimeout,
+    isAuthorizedTargetHost,
+} from './terminal-utils.js';

 const userSessions = new Map();
+const terminalDebugEnabled = ['local', 'development'].includes(
+    String(process.env.APP_ENV || process.env.NODE_ENV || '').toLowerCase()
+);
+
+function logTerminal(level, message, context = {}) {
+    if (!terminalDebugEnabled) {
+        return;
+    }
+
+    const formattedMessage = `[TerminalServer] ${message}`;
+
+    if (Object.keys(context).length > 0) {
+        console[level](formattedMessage, context);
+        return;
+    }
+
+    console[level](formattedMessage);
+}

 const server = http.createServer((req, res) => {
    if (req.url === '/ready') {
@ -31,9 +56,19 @@ const getSessionCookie = (req) => {

 const verifyClient = async (info, callback) => {
    const { xsrfToken, laravelSession, sessionCookieName } = getSessionCookie(info.req);
+    const requestContext = {
+        remoteAddress: info.req.socket?.remoteAddress,
+        origin: info.origin,
+        sessionCookieName,
+        hasXsrfToken: Boolean(xsrfToken),
+        hasLaravelSession: Boolean(laravelSession),
+    };
+
+    logTerminal('log', 'Verifying websocket client.', requestContext);

    // Verify presence of required tokens
    if (!laravelSession || !xsrfToken) {
+        logTerminal('warn', 'Rejecting websocket client because required auth tokens are missing.', requestContext);
        return callback(false, 401, 'Unauthorized: Missing required tokens');
    }

@ -47,13 +82,22 @@ const verifyClient = async (info, callback) => {
        });

        if (response.status === 200) {
-            // Authentication successful
+            logTerminal('log', 'Websocket client authentication succeeded.', requestContext);
            callback(true);
        } else {
+            logTerminal('warn', 'Websocket client authentication returned a non-success status.', {
+                ...requestContext,
+                status: response.status,
+            });
            callback(false, 401, 'Unauthorized: Invalid credentials');
        }
    } catch (error) {
-        console.error('Authentication error:', error.message);
+        logTerminal('error', 'Websocket client authentication failed.', {
+            ...requestContext,
+            error: error.message,
+            responseStatus: error.response?.status,
+            responseData: error.response?.data,
+        });
        callback(false, 500, 'Internal Server Error');
    }
 };
@ -65,28 +109,62 @@ wss.on('connection', async (ws, req) => {
    const userId = generateUserId();
    const userSession = { ws, userId, ptyProcess: null, isActive: false, authorizedIPs: [] };
    const { xsrfToken, laravelSession, sessionCookieName } = getSessionCookie(req);
+    const connectionContext = {
+        userId,
+        remoteAddress: req.socket?.remoteAddress,
+        sessionCookieName,
+        hasXsrfToken: Boolean(xsrfToken),
+        hasLaravelSession: Boolean(laravelSession),
+    };

    // Verify presence of required tokens
    if (!laravelSession || !xsrfToken) {
+        logTerminal('warn', 'Closing websocket connection because required auth tokens are missing.', connectionContext);
        ws.close(401, 'Unauthorized: Missing required tokens');
        return;
    }
-    const response = await axios.post(`http://coolify:8080/terminal/auth/ips`, null, {
-        headers: {
-            'Cookie': `${sessionCookieName}=${laravelSession}`,
-            'X-XSRF-TOKEN': xsrfToken
-        },
-    });
-    userSession.authorizedIPs = response.data.ipAddresses || [];
+
+    try {
+        const response = await axios.post(`http://coolify:8080/terminal/auth/ips`, null, {
+            headers: {
+                'Cookie': `${sessionCookieName}=${laravelSession}`,
+                'X-XSRF-TOKEN': xsrfToken
+            },
+        });
+        userSession.authorizedIPs = response.data.ipAddresses || [];
+        logTerminal('log', 'Fetched authorized terminal hosts for websocket session.', {
+            ...connectionContext,
+            authorizedIPs: userSession.authorizedIPs,
+        });
+    } catch (error) {
+        logTerminal('error', 'Failed to fetch authorized terminal hosts.', {
+            ...connectionContext,
+            error: error.message,
+            responseStatus: error.response?.status,
+            responseData: error.response?.data,
+        });
+        ws.close(1011, 'Failed to fetch terminal authorization data');
+        return;
+    }
+
    userSessions.set(userId, userSession);
+    logTerminal('log', 'Terminal websocket connection established.', {
+        ...connectionContext,
+        authorizedHostCount: userSession.authorizedIPs.length,
+    });

    ws.on('message', (message) => {
        handleMessage(userSession, message);
-
    });
    ws.on('error', (err) => handleError(err, userId));
-    ws.on('close', () => handleClose(userId));
-
+    ws.on('close', (code, reason) => {
+        logTerminal('log', 'Terminal websocket connection closed.', {
+            userId,
+            code,
+            reason: reason?.toString(),
+        });
+        handleClose(userId);
+    });
 });

 const messageHandlers = {
@ -98,6 +176,7 @@ const messageHandlers = {
    },
    pause: (session) => session.ptyProcess.pause(),
    resume: (session) => session.ptyProcess.resume(),
+    ping: (session) => session.ws.send('pong'),
    checkActive: (session, data) => {
        if (data === 'force' && session.isActive) {
            killPtyProcess(session.userId);
@ -110,12 +189,34 @@ const messageHandlers = {

 function handleMessage(userSession, message) {
    const parsed = parseMessage(message);
-    if (!parsed) return;
+    if (!parsed) {
+        logTerminal('warn', 'Ignoring websocket message because JSON parsing failed.', {
+            userId: userSession.userId,
+            rawMessage: String(message).slice(0, 500),
+        });
+        return;
+    }
+
+    logTerminal('log', 'Received websocket message.', {
+        userId: userSession.userId,
+        keys: Object.keys(parsed),
+        isActive: userSession.isActive,
+    });

    Object.entries(parsed).forEach(([key, value]) => {
        const handler = messageHandlers[key];
-        if (handler && (userSession.isActive || key === 'checkActive' || key === 'command')) {
+        if (handler && (userSession.isActive || key === 'checkActive' || key === 'command' || key === 'ping')) {
            handler(userSession, value);
+        } else if (!handler) {
+            logTerminal('warn', 'Ignoring websocket message with unknown handler key.', {
+                userId: userSession.userId,
+                key,
+            });
+        } else {
+            logTerminal('warn', 'Ignoring websocket message because no PTY session is active yet.', {
+                userId: userSession.userId,
+                key,
+            });
        }
    });
 }
@ -124,7 +225,9 @@ function parseMessage(message) {
    try {
        return JSON.parse(message);
    } catch (e) {
-        console.error('Failed to parse message:', e);
+        logTerminal('error', 'Failed to parse websocket message.', {
+            error: e?.message ?? e,
+        });
        return null;
    }
 }
@ -134,6 +237,9 @@ async function handleCommand(ws, command, userId) {
    if (userSession && userSession.isActive) {
        const result = await killPtyProcess(userId);
        if (!result) {
+            logTerminal('warn', 'Rejecting new terminal command because the previous PTY could not be terminated.', {
+                userId,
+            });
            // if terminal is still active, even after we tried to kill it, dont continue and show error
            ws.send('unprocessable');
            return;
@ -147,13 +253,30 @@ async function handleCommand(ws, command, userId) {

    // Extract target host from SSH command
    const targetHost = extractTargetHost(sshArgs);
+    logTerminal('log', 'Parsed terminal command metadata.', {
+        userId,
+        targetHost,
+        timeout,
+        sshArgs,
+        authorizedIPs: userSession?.authorizedIPs ?? [],
+    });
+
    if (!targetHost) {
+        logTerminal('warn', 'Rejecting terminal command because no target host could be extracted.', {
+            userId,
+            sshArgs,
+        });
        ws.send('Invalid SSH command: No target host found');
        return;
    }

    // Validate target host against authorized IPs
-    if (!userSession.authorizedIPs.includes(targetHost)) {
+    if (!isAuthorizedTargetHost(targetHost, userSession.authorizedIPs)) {
+        logTerminal('warn', 'Rejecting terminal command because target host is not authorized.', {
+            userId,
+            targetHost,
+            authorizedIPs: userSession.authorizedIPs,
+        });
        ws.send(`Unauthorized: Target host ${targetHost} not in authorized list`);
        return;
    }
@ -169,6 +292,11 @@ async function handleCommand(ws, command, userId) {
    // NOTE: - Initiates a process within the Terminal container
    //         Establishes an SSH connection to root@coolify with RequestTTY enabled
    //         Executes the 'docker exec' command to connect to a specific container
+    logTerminal('log', 'Spawning PTY process for terminal session.', {
+        userId,
+        targetHost,
+        timeout,
+    });
    const ptyProcess = pty.spawn('ssh', sshArgs.concat([hereDocContent]), options);

    userSession.ptyProcess = ptyProcess;
@ -182,7 +310,11 @@ async function handleCommand(ws, command, userId) {

    // when parent closes
    ptyProcess.onExit(({ exitCode, signal }) => {
-        console.error(`Process exited with code ${exitCode} and signal ${signal}`);
+        logTerminal(exitCode === 0 ? 'log' : 'error', 'PTY process exited.', {
+            userId,
+            exitCode,
+            signal,
+        });
        ws.send('pty-exited');
        userSession.isActive = false;
    });
@ -194,28 +326,18 @@ async function handleCommand(ws, command, userId) {
    }
 }

-function extractTargetHost(sshArgs) {
-    // Find the argument that matches the pattern user@host
-    const userAtHost = sshArgs.find(arg => {
-        // Skip paths that contain 'storage/app/ssh/keys/'
-        if (arg.includes('storage/app/ssh/keys/')) {
-            return false;
-        }
-        return /^[^@]+@[^@]+$/.test(arg);
-    });
-    if (!userAtHost) return null;
-
-    // Extract host from user@host
-    const host = userAtHost.split('@')[1];
-    return host;
-}
-
 async function handleError(err, userId) {
-    console.error('WebSocket error:', err);
+    logTerminal('error', 'WebSocket error.', {
+        userId,
+        error: err?.message ?? err,
+    });
    await killPtyProcess(userId);
 }

 async function handleClose(userId) {
+    logTerminal('log', 'Cleaning up terminal websocket session.', {
+        userId,
+    });
    await killPtyProcess(userId);
    userSessions.delete(userId);
 }
@ -231,6 +353,11 @@ async function killPtyProcess(userId) {

        const attemptKill = () => {
            killAttempts++;
+            logTerminal('log', 'Attempting to terminate PTY process.', {
+                userId,
+                killAttempts,
+                maxAttempts,
+            });

            // session.ptyProcess.kill() wont work here because of https://github.com/moby/moby/issues/9098
            // patch with https://github.com/moby/moby/issues/9098#issuecomment-189743947
@ -238,6 +365,10 @@ async function killPtyProcess(userId) {

            setTimeout(() => {
                if (!session.isActive || !session.ptyProcess) {
+                    logTerminal('log', 'PTY process terminated successfully.', {
+                        userId,
+                        killAttempts,
+                    });
                    resolve(true);
                    return;
                }
@ -245,6 +376,10 @@ async function killPtyProcess(userId) {
                if (killAttempts < maxAttempts) {
                    attemptKill();
                } else {
+                    logTerminal('warn', 'PTY process still active after maximum termination attempts.', {
+                        userId,
+                        killAttempts,
+                    });
                    resolve(false);
                }
            }, 500);
@ -258,76 +393,8 @@ function generateUserId() {
    return Math.random().toString(36).substring(2, 11);
 }

-function extractTimeout(commandString) {
-    const timeoutMatch = commandString.match(/timeout (\d+)/);
-    return timeoutMatch ? parseInt(timeoutMatch[1], 10) : null;
-}
-
-function extractSshArgs(commandString) {
-    const sshCommandMatch = commandString.match(/ssh (.+?) 'bash -se'/);
-    if (!sshCommandMatch) return [];
-
-    const argsString = sshCommandMatch[1];
-    let sshArgs = [];
-
-    // Parse shell arguments respecting quotes
-    let current = '';
-    let inQuotes = false;
-    let quoteChar = '';
-    let i = 0;
-
-    while (i < argsString.length) {
-        const char = argsString[i];
-        const nextChar = argsString[i + 1];
-
-        if (!inQuotes && (char === '"' || char === "'")) {
-            // Starting a quoted section
-            inQuotes = true;
-            quoteChar = char;
-            current += char;
-        } else if (inQuotes && char === quoteChar) {
-            // Ending a quoted section
-            inQuotes = false;
-            current += char;
-            quoteChar = '';
-        } else if (!inQuotes && char === ' ') {
-            // Space outside quotes - end of argument
-            if (current.trim()) {
-                sshArgs.push(current.trim());
-                current = '';
-            }
-        } else {
-            // Regular character
-            current += char;
-        }
-        i++;
-    }
-
-    // Add final argument if exists
-    if (current.trim()) {
-        sshArgs.push(current.trim());
-    }
-
-    // Replace RequestTTY=no with RequestTTY=yes
-    sshArgs = sshArgs.map(arg => arg === 'RequestTTY=no' ? 'RequestTTY=yes' : arg);
-
-    // Add RequestTTY=yes if not present
-    if (!sshArgs.includes('RequestTTY=yes') && !sshArgs.some(arg => arg.includes('RequestTTY='))) {
-        sshArgs.push('-o', 'RequestTTY=yes');
-    }
-
-    return sshArgs;
-}
-
-function extractHereDocContent(commandString) {
-    const delimiterMatch = commandString.match(/<< (\S+)/);
-    const delimiter = delimiterMatch ? delimiterMatch[1] : null;
-    const escapedDelimiter = delimiter.slice(1).trim().replace(/[/\-\\^$*+?.()|[\]{}]/g, '\\$&');
-    const hereDocRegex = new RegExp(`<< \\\\${escapedDelimiter}([\\s\\S\\.]*?)${escapedDelimiter}`);
-    const hereDocMatch = commandString.match(hereDocRegex);
-    return hereDocMatch ? hereDocMatch[1] : '';
-}
-
 server.listen(6002, () => {
-    console.log('Coolify realtime terminal server listening on port 6002. Let the hacking begin!');
+    logTerminal('log', 'Terminal debug logging is enabled.', {
+        terminalDebugEnabled,
+    });
 });
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@ -0,0 +1,127 @@
+export function extractTimeout(commandString) {
+    const timeoutMatch = commandString.match(/timeout (\d+)/);
+    return timeoutMatch ? parseInt(timeoutMatch[1], 10) : null;
+}
+
+function normalizeShellArgument(argument) {
+    if (!argument) {
+        return argument;
+    }
+
+    return argument
+        .replace(/'([^']*)'/g, '$1')
+        .replace(/"([^"]*)"/g, '$1');
+}
+
+export function extractSshArgs(commandString) {
+    const sshCommandMatch = commandString.match(/ssh (.+?) 'bash -se'/);
+    if (!sshCommandMatch) return [];
+
+    const argsString = sshCommandMatch[1];
+    let sshArgs = [];
+
+    let current = '';
+    let inQuotes = false;
+    let quoteChar = '';
+    let i = 0;
+
+    while (i < argsString.length) {
+        const char = argsString[i];
+
+        if (!inQuotes && (char === '"' || char === "'")) {
+            inQuotes = true;
+            quoteChar = char;
+            current += char;
+        } else if (inQuotes && char === quoteChar) {
+            inQuotes = false;
+            current += char;
+            quoteChar = '';
+        } else if (!inQuotes && char === ' ') {
+            if (current.trim()) {
+                sshArgs.push(current.trim());
+                current = '';
+            }
+        } else {
+            current += char;
+        }
+        i++;
+    }
+
+    if (current.trim()) {
+        sshArgs.push(current.trim());
+    }
+
+    sshArgs = sshArgs.map((arg) => normalizeShellArgument(arg));
+    sshArgs = sshArgs.map(arg => arg === 'RequestTTY=no' ? 'RequestTTY=yes' : arg);
+
+    if (!sshArgs.includes('RequestTTY=yes') && !sshArgs.some(arg => arg.includes('RequestTTY='))) {
+        sshArgs.push('-o', 'RequestTTY=yes');
+    }
+
+    return sshArgs;
+}
+
+export function extractHereDocContent(commandString) {
+    const delimiterMatch = commandString.match(/<< (\S+)/);
+    const delimiter = delimiterMatch ? delimiterMatch[1] : null;
+    const escapedDelimiter = delimiter?.slice(1).trim().replace(/[/\-\\^$*+?.()|[\]{}]/g, '\\$&');
+
+    if (!escapedDelimiter) {
+        return '';
+    }
+
+    const hereDocRegex = new RegExp(`<< \\\\${escapedDelimiter}([\\s\\S\\.]*?)${escapedDelimiter}`);
+    const hereDocMatch = commandString.match(hereDocRegex);
+    return hereDocMatch ? hereDocMatch[1] : '';
+}
+
+export function normalizeHostForAuthorization(host) {
+    if (!host) {
+        return null;
+    }
+
+    let normalizedHost = host.trim();
+
+    while (
+        normalizedHost.length >= 2 &&
+        ((normalizedHost.startsWith("'") && normalizedHost.endsWith("'")) ||
+            (normalizedHost.startsWith('"') && normalizedHost.endsWith('"')))
+    ) {
+        normalizedHost = normalizedHost.slice(1, -1).trim();
+    }
+
+    if (normalizedHost.startsWith('[') && normalizedHost.endsWith(']')) {
+        normalizedHost = normalizedHost.slice(1, -1);
+    }
+
+    return normalizedHost.toLowerCase();
+}
+
+export function extractTargetHost(sshArgs) {
+    const userAtHost = sshArgs.find(arg => {
+        if (arg.includes('storage/app/ssh/keys/')) {
+            return false;
+        }
+
+        return /^[^@]+@[^@]+$/.test(arg);
+    });
+
+    if (!userAtHost) {
+        return null;
+    }
+
+    const atIndex = userAtHost.indexOf('@');
+    return normalizeHostForAuthorization(userAtHost.slice(atIndex + 1));
+}
+
+export function isAuthorizedTargetHost(targetHost, authorizedHosts = []) {
+    const normalizedTargetHost = normalizeHostForAuthorization(targetHost);
+
+    if (!normalizedTargetHost) {
+        return false;
+    }
+
+    return authorizedHosts
+        .map(host => normalizeHostForAuthorization(host))
+        .includes(normalizedTargetHost);
+}
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    extractSshArgs,
+    extractTargetHost,
+    isAuthorizedTargetHost,
+    normalizeHostForAuthorization,
+} from './terminal-utils.js';
+
+test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ServerAliveInterval=20 -o ConnectTimeout=10 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"
+    );
+
+    assert.equal(extractTargetHost(sshArgs), '10.0.0.5');
+});
+
+test('extractSshArgs strips shell quotes from port and user host arguments before spawning ssh', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -p '22' -o StrictHostKeyChecking=no 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"
+    );
+
+    assert.deepEqual(sshArgs.slice(0, 5), ['-p', '22', '-o', 'StrictHostKeyChecking=no', 'root@10.0.0.5']);
+});
+
+test('extractSshArgs preserves proxy command as a single normalized ssh option value', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o ProxyCommand='cloudflared access ssh --hostname %h' -o StrictHostKeyChecking=no 'root'@'example.com' 'bash -se' << \\\\$abc\necho hi\nabc"
+    );
+
+    assert.equal(sshArgs[1], 'ProxyCommand=cloudflared access ssh --hostname %h');
+    assert.equal(sshArgs[4], 'root@example.com');
+});
+
+test('isAuthorizedTargetHost matches normalized hosts against plain allowlist values', () => {
+    assert.equal(isAuthorizedTargetHost("'10.0.0.5'", ['10.0.0.5']), true);
+    assert.equal(isAuthorizedTargetHost('"host.docker.internal"', ['host.docker.internal']), true);
+});
+
+test('normalizeHostForAuthorization unwraps bracketed IPv6 hosts', () => {
+    assert.equal(normalizeHostForAuthorization("'[2001:db8::10]'"), '2001:db8::10');
+    assert.equal(isAuthorizedTargetHost("'[2001:db8::10]'", ['2001:db8::10']), true);
+});
+
+test('isAuthorizedTargetHost rejects hosts that are not in the allowlist', () => {
+    assert.equal(isAuthorizedTargetHost("'10.0.0.9'", ['10.0.0.5']), false);
+});
--- a/resources/js/terminal.js
+++ b/resources/js/terminal.js
@ -2,6 +2,16 @@ import { Terminal } from '@xterm/xterm';
 import '@xterm/xterm/css/xterm.css';
 import { FitAddon } from '@xterm/addon-fit';

+const terminalDebugEnabled = import.meta.env.DEV;
+
+function logTerminal(level, message, ...context) {
+    if (!terminalDebugEnabled) {
+        return;
+    }
+
+    console[level](message, ...context);
+}
+
 export function initializeTerminalComponent() {
    function terminalData() {
        return {
@ -30,6 +40,8 @@ export function initializeTerminalComponent() {
            pingTimeoutId: null,
            heartbeatMissed: 0,
            maxHeartbeatMisses: 3,
+            // Command buffering for race condition prevention
+            pendingCommand: null,
            // Resize handling
            resizeObserver: null,
            resizeTimeout: null,
@ -120,6 +132,7 @@ export function initializeTerminalComponent() {
                this.checkIfProcessIsRunningAndKillIt();
                this.clearAllTimers();
                this.connectionState = 'disconnected';
+                this.pendingCommand = null;
                if (this.socket) {
                    this.socket.close(1000, 'Client cleanup');
                }
@ -154,6 +167,7 @@ export function initializeTerminalComponent() {
                    this.pendingWrites = 0;
                    this.paused = false;
                    this.commandBuffer = '';
+                    this.pendingCommand = null;

                    // Notify parent component that terminal disconnected
                    this.$wire.dispatch('terminalDisconnected');
@ -188,7 +202,7 @@ export function initializeTerminalComponent() {

            initializeWebSocket() {
                if (this.socket && this.socket.readyState !== WebSocket.CLOSED) {
-                    console.log('[Terminal] WebSocket already connecting/connected, skipping');
+                    logTerminal('log', '[Terminal] WebSocket already connecting/connected, skipping');
                    return; // Already connecting or connected
                }

@ -197,7 +211,7 @@ export function initializeTerminalComponent() {

                // Ensure terminal config is available
                if (!window.terminalConfig) {
-                    console.warn('[Terminal] Terminal config not available, using defaults');
+                    logTerminal('warn', '[Terminal] Terminal config not available, using defaults');
                    window.terminalConfig = {};
                }

@ -223,7 +237,7 @@ export function initializeTerminalComponent() {
                }

                const url = `${connectionString.protocol}://${connectionString.host}${connectionString.port}${connectionString.path}`
-                console.log(`[Terminal] Attempting connection to: ${url}`);
+                logTerminal('log', `[Terminal] Attempting connection to: ${url}`);

                try {
                    this.socket = new WebSocket(url);
@ -232,7 +246,7 @@ export function initializeTerminalComponent() {
                    const timeoutMs = this.reconnectAttempts === 0 ? 15000 : this.connectionTimeout;
                    this.connectionTimeoutId = setTimeout(() => {
                        if (this.connectionState === 'connecting') {
-                            console.error(`[Terminal] Connection timeout after ${timeoutMs}ms`);
+                            logTerminal('error', `[Terminal] Connection timeout after ${timeoutMs}ms`);
                            this.socket.close();
                            this.handleConnectionError('Connection timeout');
                        }
@ -244,13 +258,13 @@ export function initializeTerminalComponent() {
                    this.socket.onclose = this.handleSocketClose.bind(this);

                } catch (error) {
-                    console.error('[Terminal] Failed to create WebSocket:', error);
+                    logTerminal('error', '[Terminal] Failed to create WebSocket:', error);
                    this.handleConnectionError(`Failed to create WebSocket connection: ${error.message}`);
                }
            },

            handleSocketOpen() {
-                console.log('[Terminal] WebSocket connection established. Cool cool cool cool cool cool.');
+                logTerminal('log', '[Terminal] WebSocket connection established.');
                this.connectionState = 'connected';
                this.reconnectAttempts = 0;
                this.heartbeatMissed = 0;
@ -262,6 +276,12 @@ export function initializeTerminalComponent() {
                    this.connectionTimeoutId = null;
                }

+                // Flush any buffered command from before WebSocket was ready
+                if (this.pendingCommand) {
+                    this.sendMessage(this.pendingCommand);
+                    this.pendingCommand = null;
+                }
+
                // Start ping timeout monitoring
                this.resetPingTimeout();

@ -270,16 +290,16 @@ export function initializeTerminalComponent() {
            },

            handleSocketError(error) {
-                console.error('[Terminal] WebSocket error:', error);
-                console.error('[Terminal] WebSocket state:', this.socket ? this.socket.readyState : 'No socket');
-                console.error('[Terminal] Connection attempt:', this.reconnectAttempts + 1);
+                logTerminal('error', '[Terminal] WebSocket error:', error);
+                logTerminal('error', '[Terminal] WebSocket state:', this.socket ? this.socket.readyState : 'No socket');
+                logTerminal('error', '[Terminal] Connection attempt:', this.reconnectAttempts + 1);
                this.handleConnectionError('WebSocket error occurred');
            },

            handleSocketClose(event) {
-                console.warn(`[Terminal] WebSocket connection closed. Code: ${event.code}, Reason: ${event.reason || 'No reason provided'}`);
-                console.log('[Terminal] Was clean close:', event.code === 1000);
-                console.log('[Terminal] Connection attempt:', this.reconnectAttempts + 1);
+                logTerminal('warn', `[Terminal] WebSocket connection closed. Code: ${event.code}, Reason: ${event.reason || 'No reason provided'}`);
+                logTerminal('log', '[Terminal] Was clean close:', event.code === 1000);
+                logTerminal('log', '[Terminal] Connection attempt:', this.reconnectAttempts + 1);

                this.connectionState = 'disconnected';
                this.clearAllTimers();
@ -297,7 +317,7 @@ export function initializeTerminalComponent() {
            },

            handleConnectionError(reason) {
-                console.error(`[Terminal] Connection error: ${reason} (attempt ${this.reconnectAttempts + 1})`);
+                logTerminal('error', `[Terminal] Connection error: ${reason} (attempt ${this.reconnectAttempts + 1})`);
                this.connectionState = 'disconnected';

                // Only dispatch error to UI after a few failed attempts to avoid immediate error on page load
@ -310,7 +330,7 @@ export function initializeTerminalComponent() {

            scheduleReconnect() {
                if (this.reconnectAttempts >= this.maxReconnectAttempts) {
-                    console.error('[Terminal] Max reconnection attempts reached');
+                    logTerminal('error', '[Terminal] Max reconnection attempts reached');
                    this.message = '(connection failed - max retries exceeded)';
                    return;
                }
@ -323,7 +343,7 @@ export function initializeTerminalComponent() {
                    this.maxReconnectDelay
                );

-                console.warn(`[Terminal] Scheduling reconnect attempt ${this.reconnectAttempts + 1} in ${delay}ms`);
+                logTerminal('warn', `[Terminal] Scheduling reconnect attempt ${this.reconnectAttempts + 1} in ${delay}ms`);

                this.reconnectInterval = setTimeout(() => {
                    this.reconnectAttempts++;
@ -335,17 +355,21 @@ export function initializeTerminalComponent() {
                if (this.socket && this.socket.readyState === WebSocket.OPEN) {
                    this.socket.send(JSON.stringify(message));
                } else {
-                    console.warn('[Terminal] WebSocket not ready, message not sent:', message);
+                    logTerminal('warn', '[Terminal] WebSocket not ready, message not sent:', message);
                }
            },

            sendCommandWhenReady(message) {
                if (this.isWebSocketReady()) {
                    this.sendMessage(message);
+                } else {
+                    this.pendingCommand = message;
                }
            },

            handleSocketMessage(event) {
+                logTerminal('log', '[Terminal] Received WebSocket message:', event.data);
+
                // Handle pong responses
                if (event.data === 'pong') {
                    this.heartbeatMissed = 0;
@ -354,6 +378,10 @@ export function initializeTerminalComponent() {
                    return;
                }

+                if (!this.term?._initialized && event.data !== 'pty-ready') {
+                    logTerminal('warn', '[Terminal] Received message before PTY initialization:', event.data);
+                }
+
                if (event.data === 'pty-ready') {
                    if (!this.term._initialized) {
                        this.term.open(document.getElementById('terminal'));
@ -398,17 +426,24 @@ export function initializeTerminalComponent() {

                    // Notify parent component that terminal disconnected
                    this.$wire.dispatch('terminalDisconnected');
+                } else if (
+                    typeof event.data === 'string' &&
+                    (event.data.startsWith('Unauthorized:') || event.data.startsWith('Invalid SSH command:'))
+                ) {
+                    logTerminal('error', '[Terminal] Backend rejected terminal startup:', event.data);
+                    this.$wire.dispatch('error', event.data);
+                    this.terminalActive = false;
                } else {
                    try {
                        this.pendingWrites++;
                        this.term.write(event.data, (err) => {
                            if (err) {
-                                console.error('[Terminal] Write error:', err);
+                                logTerminal('error', '[Terminal] Write error:', err);
                            }
                            this.flowControlCallback();
                        });
                    } catch (error) {
-                        console.error('[Terminal] Write operation failed:', error);
+                        logTerminal('error', '[Terminal] Write operation failed:', error);
                        this.pendingWrites = Math.max(0, this.pendingWrites - 1);
                    }
                }
@ -483,10 +518,10 @@ export function initializeTerminalComponent() {
                        clearTimeout(this.pingTimeoutId);
                        this.pingTimeoutId = null;
                    }
-                    console.log('[Terminal] Tab hidden, pausing heartbeat monitoring');
+                    logTerminal('log', '[Terminal] Tab hidden, pausing heartbeat monitoring');
                } else if (wasVisible === false) {
                    // Tab is now visible again
-                    console.log('[Terminal] Tab visible, resuming connection management');
+                    logTerminal('log', '[Terminal] Tab visible, resuming connection management');

                    if (this.wasConnectedBeforeHidden && this.socket && this.socket.readyState === WebSocket.OPEN) {
                        // Send immediate ping to verify connection is still alive
@ -508,10 +543,10 @@ export function initializeTerminalComponent() {

                this.pingTimeoutId = setTimeout(() => {
                    this.heartbeatMissed++;
-                    console.warn(`[Terminal] Ping timeout - missed ${this.heartbeatMissed}/${this.maxHeartbeatMisses}`);
+                    logTerminal('warn', `[Terminal] Ping timeout - missed ${this.heartbeatMissed}/${this.maxHeartbeatMisses}`);

                    if (this.heartbeatMissed >= this.maxHeartbeatMisses) {
-                        console.error('[Terminal] Too many missed heartbeats, closing connection');
+                        logTerminal('error', '[Terminal] Too many missed heartbeats, closing connection');
                        this.socket.close(1001, 'Heartbeat timeout');
                    }
                }, this.pingTimeout);
@ -553,7 +588,7 @@ export function initializeTerminalComponent() {

                    // Check if dimensions are valid
                    if (height <= 0 || width <= 0) {
-                        console.warn('[Terminal] Invalid wrapper dimensions, retrying...', { height, width });
+                        logTerminal('warn', '[Terminal] Invalid wrapper dimensions, retrying...', { height, width });
                        setTimeout(() => this.resizeTerminal(), 100);
                        return;
                    }
@ -562,7 +597,7 @@ export function initializeTerminalComponent() {

                    if (!charSize.height || !charSize.width) {
                        // Fallback values if char size not available yet
-                        console.warn('[Terminal] Character size not available, retrying...');
+                        logTerminal('warn', '[Terminal] Character size not available, retrying...');
                        setTimeout(() => this.resizeTerminal(), 100);
                        return;
                    }
@ -583,10 +618,10 @@ export function initializeTerminalComponent() {
                            });
                        }
                    } else {
-                        console.warn('[Terminal] Invalid calculated dimensions:', { rows, cols, height, width, charSize });
+                        logTerminal('warn', '[Terminal] Invalid calculated dimensions:', { rows, cols, height, width, charSize });
                    }
                } catch (error) {
-                    console.error('[Terminal] Resize error:', error);
+                    logTerminal('error', '[Terminal] Resize error:', error);
                }
            },

--- a/resources/views/livewire/project/shared/execute-container-command.blade.php
+++ b/resources/views/livewire/project/shared/execute-container-command.blade.php
@ -21,7 +21,8 @@
            <div>No containers are running or terminal access is disabled on this server.</div>
        @else
            <form class="w-96 min-w-fit flex gap-2 items-end" wire:submit="$dispatchSelf('connectToContainer')"
-                x-data="{ autoConnected: false }" x-init="if ({{ count($containers) }} === 1 && !autoConnected) {
+                x-data="{ autoConnected: false }"
+                x-on:terminal-websocket-ready.window="if ({{ count($containers) }} === 1 && !autoConnected) {
                    autoConnected = true;
                    $nextTick(() => $wire.dispatchSelf('connectToContainer'));
                }">
--- a/routes/web.php
+++ b/routes/web.php
@ -168,9 +168,23 @@
    Route::post('/terminal/auth/ips', function () {
        if (auth()->check()) {
            $team = auth()->user()->currentTeam();
-            $ipAddresses = $team->servers->where('settings.is_terminal_enabled', true)->pluck('ip')->toArray();
+            $ipAddresses = $team->servers
+                ->where('settings.is_terminal_enabled', true)
+                ->pluck('ip')
+                ->filter()
+                ->values();

-            return response()->json(['ipAddresses' => $ipAddresses], 200);
+            if (isDev()) {
+                $ipAddresses = $ipAddresses->merge([
+                    'coolify-testing-host',
+                    'host.docker.internal',
+                    'localhost',
+                    '127.0.0.1',
+                    base_ip(),
+                ])->filter()->unique()->values();
+            }
+
+            return response()->json(['ipAddresses' => $ipAddresses->all()], 200);
        }

        return response()->json(['ipAddresses' => []], 401);
--- a/tests/Feature/RealtimeTerminalPackagingTest.php
+++ b/tests/Feature/RealtimeTerminalPackagingTest.php
@ -0,0 +1,34 @@
+<?php
+
+it('copies the realtime terminal utilities into the container image', function () {
+    $dockerfile = file_get_contents(base_path('docker/coolify-realtime/Dockerfile'));
+
+    expect($dockerfile)->toContain('COPY docker/coolify-realtime/terminal-utils.js /terminal/terminal-utils.js');
+});
+
+it('mounts the realtime terminal utilities in local development compose files', function (string $composeFile) {
+    $composeContents = file_get_contents(base_path($composeFile));
+
+    expect($composeContents)->toContain('./docker/coolify-realtime/terminal-utils.js:/terminal/terminal-utils.js');
+})->with([
+    'default dev compose' => 'docker-compose.dev.yml',
+    'maxio dev compose' => 'docker-compose-maxio.dev.yml',
+]);
+
+it('keeps terminal browser logging restricted to Vite development mode', function () {
+    $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+    expect($terminalClient)
+        ->toContain('const terminalDebugEnabled = import.meta.env.DEV;')
+        ->toContain("logTerminal('log', '[Terminal] WebSocket connection established.');")
+        ->not->toContain("console.log('[Terminal] WebSocket connection established. Cool cool cool cool cool cool.');");
+});
+
+it('keeps realtime terminal server logging restricted to development environments', function () {
+    $terminalServer = file_get_contents(base_path('docker/coolify-realtime/terminal-server.js'));
+
+    expect($terminalServer)
+        ->toContain("const terminalDebugEnabled = ['local', 'development'].includes(")
+        ->toContain('if (!terminalDebugEnabled) {')
+        ->not->toContain("console.log('Coolify realtime terminal server listening on port 6002. Let the hacking begin!');");
+});
--- a/tests/Feature/TerminalAuthIpsRouteTest.php
+++ b/tests/Feature/TerminalAuthIpsRouteTest.php
@ -0,0 +1,51 @@
+<?php
+
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.env', 'local');
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->privateKey = PrivateKey::create([
+        'name' => 'Test Key',
+        'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+        'team_id' => $this->team->id,
+    ]);
+});
+
+it('includes development terminal host aliases for authenticated users', function () {
+    Server::factory()->create([
+        'name' => 'Localhost',
+        'ip' => 'coolify-testing-host',
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+
+    $response = $this->postJson('/terminal/auth/ips');
+
+    $response->assertSuccessful();
+    $response->assertJsonPath('ipAddresses.0', 'coolify-testing-host');
+
+    expect($response->json('ipAddresses'))
+        ->toContain('coolify-testing-host')
+        ->toContain('localhost')
+        ->toContain('127.0.0.1')
+        ->toContain('host.docker.internal');
+});
--- a/tests/Unit/Actions/Server/CleanupDockerTest.php
+++ b/tests/Unit/Actions/Server/CleanupDockerTest.php
@ -8,9 +8,7 @@
    Mockery::close();
 });

-it('categorizes images correctly into PR and regular images', function () {
-    // Test the image categorization logic
-    // Build images (*-build) are excluded from retention and handled by docker image prune
+it('categorizes images correctly into PR, build, and regular images', function () {
    $images = collect([
        ['repository' => 'app-uuid', 'tag' => 'abc123', 'created_at' => '2024-01-01', 'image_ref' => 'app-uuid:abc123'],
        ['repository' => 'app-uuid', 'tag' => 'def456', 'created_at' => '2024-01-02', 'image_ref' => 'app-uuid:def456'],
@ -25,6 +23,11 @@
    expect($prImages)->toHaveCount(2);
    expect($prImages->pluck('tag')->toArray())->toContain('pr-123', 'pr-456');

+    // Build images (tags ending with '-build', excluding PR builds)
+    $buildImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && str_ends_with($image['tag'], '-build'));
+    expect($buildImages)->toHaveCount(2);
+    expect($buildImages->pluck('tag')->toArray())->toContain('abc123-build', 'def456-build');
+
    // Regular images (neither PR nor build) - these are subject to retention policy
    $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));
    expect($regularImages)->toHaveCount(2);
@ -340,3 +343,128 @@
    // Other images should not be protected
    expect(preg_match($pattern, 'nginx:alpine'))->toBe(0);
 });
+
+it('deletes build images not matching retained regular images', function () {
+    // Simulates the Nixpacks scenario from issue #8765:
+    // Many -build images accumulate because they were excluded from both cleanup paths
+    $images = collect([
+        ['repository' => 'app-uuid', 'tag' => 'commit1', 'created_at' => '2024-01-01 10:00:00', 'image_ref' => 'app-uuid:commit1'],
+        ['repository' => 'app-uuid', 'tag' => 'commit2', 'created_at' => '2024-01-02 10:00:00', 'image_ref' => 'app-uuid:commit2'],
+        ['repository' => 'app-uuid', 'tag' => 'commit3', 'created_at' => '2024-01-03 10:00:00', 'image_ref' => 'app-uuid:commit3'],
+        ['repository' => 'app-uuid', 'tag' => 'commit4', 'created_at' => '2024-01-04 10:00:00', 'image_ref' => 'app-uuid:commit4'],
+        ['repository' => 'app-uuid', 'tag' => 'commit5', 'created_at' => '2024-01-05 10:00:00', 'image_ref' => 'app-uuid:commit5'],
+        ['repository' => 'app-uuid', 'tag' => 'commit1-build', 'created_at' => '2024-01-01 09:00:00', 'image_ref' => 'app-uuid:commit1-build'],
+        ['repository' => 'app-uuid', 'tag' => 'commit2-build', 'created_at' => '2024-01-02 09:00:00', 'image_ref' => 'app-uuid:commit2-build'],
+        ['repository' => 'app-uuid', 'tag' => 'commit3-build', 'created_at' => '2024-01-03 09:00:00', 'image_ref' => 'app-uuid:commit3-build'],
+        ['repository' => 'app-uuid', 'tag' => 'commit4-build', 'created_at' => '2024-01-04 09:00:00', 'image_ref' => 'app-uuid:commit4-build'],
+        ['repository' => 'app-uuid', 'tag' => 'commit5-build', 'created_at' => '2024-01-05 09:00:00', 'image_ref' => 'app-uuid:commit5-build'],
+    ]);
+
+    $currentTag = 'commit5';
+    $imagesToKeep = 2;
+
+    $buildImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && str_ends_with($image['tag'], '-build'));
+    $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));
+
+    $sortedRegularImages = $regularImages
+        ->filter(fn ($image) => $image['tag'] !== $currentTag)
+        ->sortByDesc('created_at')
+        ->values();
+
+    // Determine kept tags: current + N newest rollback
+    $keptTags = $sortedRegularImages->take($imagesToKeep)->pluck('tag');
+    if (! empty($currentTag)) {
+        $keptTags = $keptTags->push($currentTag);
+    }
+
+    // Kept tags should be: commit5 (running), commit4, commit3 (2 newest rollback)
+    expect($keptTags->toArray())->toContain('commit5', 'commit4', 'commit3');
+
+    // Build images to delete: those whose base tag is NOT in keptTags
+    $buildImagesToDelete = $buildImages->filter(function ($image) use ($keptTags) {
+        $baseTag = preg_replace('/-build$/', '', $image['tag']);
+
+        return ! $keptTags->contains($baseTag);
+    });
+
+    // Should delete commit1-build and commit2-build (their base tags are not kept)
+    expect($buildImagesToDelete)->toHaveCount(2);
+    expect($buildImagesToDelete->pluck('tag')->toArray())->toContain('commit1-build', 'commit2-build');
+
+    // Should keep commit3-build, commit4-build, commit5-build (matching retained images)
+    $buildImagesToKeep = $buildImages->filter(function ($image) use ($keptTags) {
+        $baseTag = preg_replace('/-build$/', '', $image['tag']);
+
+        return $keptTags->contains($baseTag);
+    });
+    expect($buildImagesToKeep)->toHaveCount(3);
+    expect($buildImagesToKeep->pluck('tag')->toArray())->toContain('commit5-build', 'commit4-build', 'commit3-build');
+});
+
+it('deletes all build images when retention is disabled', function () {
+    $images = collect([
+        ['repository' => 'app-uuid', 'tag' => 'commit1', 'created_at' => '2024-01-01 10:00:00', 'image_ref' => 'app-uuid:commit1'],
+        ['repository' => 'app-uuid', 'tag' => 'commit2', 'created_at' => '2024-01-02 10:00:00', 'image_ref' => 'app-uuid:commit2'],
+        ['repository' => 'app-uuid', 'tag' => 'commit1-build', 'created_at' => '2024-01-01 09:00:00', 'image_ref' => 'app-uuid:commit1-build'],
+        ['repository' => 'app-uuid', 'tag' => 'commit2-build', 'created_at' => '2024-01-02 09:00:00', 'image_ref' => 'app-uuid:commit2-build'],
+    ]);
+
+    $currentTag = 'commit2';
+    $imagesToKeep = 0; // Retention disabled
+
+    $buildImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && str_ends_with($image['tag'], '-build'));
+    $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));
+
+    $sortedRegularImages = $regularImages
+        ->filter(fn ($image) => $image['tag'] !== $currentTag)
+        ->sortByDesc('created_at')
+        ->values();
+
+    // With imagesToKeep=0, only current tag is kept
+    $keptTags = $sortedRegularImages->take($imagesToKeep)->pluck('tag');
+    if (! empty($currentTag)) {
+        $keptTags = $keptTags->push($currentTag);
+    }
+
+    $buildImagesToDelete = $buildImages->filter(function ($image) use ($keptTags) {
+        $baseTag = preg_replace('/-build$/', '', $image['tag']);
+
+        return ! $keptTags->contains($baseTag);
+    });
+
+    // commit1-build should be deleted (not retained), commit2-build kept (matches running)
+    expect($buildImagesToDelete)->toHaveCount(1);
+    expect($buildImagesToDelete->pluck('tag')->toArray())->toContain('commit1-build');
+});
+
+it('preserves build image for currently running tag', function () {
+    $images = collect([
+        ['repository' => 'app-uuid', 'tag' => 'commit1', 'created_at' => '2024-01-01 10:00:00', 'image_ref' => 'app-uuid:commit1'],
+        ['repository' => 'app-uuid', 'tag' => 'commit1-build', 'created_at' => '2024-01-01 09:00:00', 'image_ref' => 'app-uuid:commit1-build'],
+    ]);
+
+    $currentTag = 'commit1';
+    $imagesToKeep = 2;
+
+    $buildImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && str_ends_with($image['tag'], '-build'));
+    $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));
+
+    $sortedRegularImages = $regularImages
+        ->filter(fn ($image) => $image['tag'] !== $currentTag)
+        ->sortByDesc('created_at')
+        ->values();
+
+    $keptTags = $sortedRegularImages->take($imagesToKeep)->pluck('tag');
+    if (! empty($currentTag)) {
+        $keptTags = $keptTags->push($currentTag);
+    }
+
+    $buildImagesToDelete = $buildImages->filter(function ($image) use ($keptTags) {
+        $baseTag = preg_replace('/-build$/', '', $image['tag']);
+
+        return ! $keptTags->contains($baseTag);
+    });
+
+    // Build image for running tag should NOT be deleted
+    expect($buildImagesToDelete)->toHaveCount(0);
+});
--- a/versions.json
+++ b/versions.json
@ -1,19 +1,19 @@
 {
    "coolify": {
        "v4": {
-            "version": "4.0.0-beta.464"
+            "version": "4.0.0-beta.465"
        },
        "nightly": {
-            "version": "4.0.0-beta.465"
+            "version": "4.0.0-beta.466"
        },
        "helper": {
            "version": "1.0.12"
        },
        "realtime": {
-            "version": "1.0.10"
+            "version": "1.0.11"
        },
        "sentinel": {
-            "version": "0.0.18"
+            "version": "0.0.19"
        }
    },
    "traefik": {
@ -26,4 +26,4 @@
        "v3.0": "3.0.4",
        "v2.11": "2.11.32"
    }
-}
+}