webtun 1.4.6 → 1.5.0

package/README.md

@@ -32,6 +32,8 @@
 - **Multi-tab terminal** — drag tabs to reorder, side-by-side sessions like your desktop
 - **File explorer** — browse, upload, download, rename, delete, cut/copy/paste with conflict resolution (replace, merge, keep both, skip)
 - **WebSocket + xterm.js** — responsive, low-latency typing
+- **Bracketed paste** — Ctrl+V works correctly in TUI apps (vim, nano, htop, mc)
+- **Command history** — automatic capture with smart dedup, works with pasted commands
 
 ### Mobile-First UX
 - **Touch gestures** — swipe to close tabs, swipe from edge to open sidebar, pull-to-refresh file list
@@ -41,16 +43,28 @@
 - **Selection mode** — toggle between terminal interaction and text selection
 - **Responsive** — optimized for phones (480px), tablets (1024px), and landscape orientation
 
+### Settings
+- **Right-click menu toggle** — enable/disable custom terminal context menu (Settings > Terminal)
+- **Terminal scroll** — reliable mouse wheel scroll in all apps, including TUI apps with mouse tracking
+
 ### File Explorer
-- **Multi-select** — select all / deselect all, batch delete and download files
-- **Zip / Extract** — right-click any file or folder to zip; right-click `.zip` files to extract
+- **Multi-select** — select all / deselect all, batch delete, download, zip, cut, and copy files
+- **Context menu on selection** — right-click actions (zip, download, delete, cut, copy) operate on all selected files
+- **Zip / Extract** — right-click any file or folder to zip; right-click `.zip` files to extract (archiver v8)
+- **Folder download** — folders download as `.zip` archives automatically
 - **Image viewer** — click images (.png, .jpg, .gif, .svg, .webp, .bmp, .ico) to preview inline
-- **Cut, Copy, Paste** — with conflict resolution dialog (replace, merge folders, keep both, skip, cancel)
+- **Cut, Copy, Paste** — multi-file support with conflict resolution dialog (replace, merge folders, keep both, skip, cancel)
 - **Upload with progress** — per-file progress bar via XHR
 - **Breadcrumb navigation** — tappable directory segments for quick navigation
 - **Long-press context menu** — rename, delete, download, copy on touch devices
 - **Text selection** — long-press file names to select and copy text on touch devices
 
+### System Stats
+- **CPU, Memory, Disk, Uptime** — real-time usage with progress bars
+- **GPU detection** — cross-platform (Linux: nvidia-smi/lspci, macOS: system_profiler, Windows: WMI)
+- **Multi-GPU support** — detects and displays all GPUs with VRAM, utilization, and temperature
+- **Top processes** — sorted by CPU usage
+
 ### Desktop App (Electron)
 - Cross-platform app for Linux & Windows
 - Runs the server as a child process — no terminal needed
@@ -231,6 +245,17 @@ kill $(pgrep -f 'cloudflared tunnel')
 | Protocol | WebSocket (ws) |
 | Tunnel | Cloudflare Tunnel (cloudflared) |
 | Desktop | Electron + electron-builder |
+| Archives | archiver v8 + yauzl |
+
+---
+
+## Security
+
+- **npm audit clean** — 0 known vulnerabilities
+- **PIN authentication** — optional, protects all API endpoints
+- **CSP headers** — restricts script sources to CDN
+- **WebSocket origin check** — prevents cross-site WebSocket hijacking
+- **Rate limiting** — per-IP rate limits on auth and search endpoints
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webtun",
-  "version": "1.4.6",
+  "version": "1.5.0",
   "description": "Self-hosted web terminal with Cloudflare Tunnel, file explorer, and PWA support",
   "author": {
     "name": "Gaurang Patel",

package/public/index.html

@@ -1191,6 +1191,10 @@ svg { display: block; }
             <label>Bell Sound</label>
             <div class="toggle" id="s-bell" role="switch" tabindex="0" aria-checked="false" onclick="toggleSetting('bell')" onkeydown="if(event.key===' '||event.key==='Enter'){event.preventDefault();toggleSetting('bell')}"></div>
           </div>
+          <div class="setting-row">
+            <label>Right-Click Menu</label>
+            <div class="toggle on" id="s-termRightClick" role="switch" tabindex="0" aria-checked="true" onclick="toggleSetting('termRightClick')" onkeydown="if(event.key===' '||event.key==='Enter'){event.preventDefault();toggleSetting('termRightClick')}"></div>
+          </div>
         </div>
         <div class="settings-section">
           <h3>Interface</h3>
@@ -1343,6 +1347,7 @@ svg { display: block; }
           <div class="sys-val" id="sys-uptime-val">—</div>
           <div class="sys-sub" id="sys-uptime-sub"></div>
         </div>
+        <div id="sys-gpu-container"></div>
       </div>
       <div class="settings-section">
         <h3>Top Processes by CPU</h3>
@@ -1471,7 +1476,7 @@ let hasTmux = false;
 let settings = {
   theme: 'light', fontSize: 14, font: "'SF Mono', 'Fira Code', Consolas, monospace",
   cursor: 'block', blink: true, scrollback: 5000, bell: false,
-  mobilekeys: false, confirmclose: true, datasaver: false, autostart: false, keepAwake: false
+  mobilekeys: false, confirmclose: true, datasaver: false, autostart: false, keepAwake: false, termRightClick: true
 };
 let serverPlatform = '';
 
@@ -1902,22 +1907,44 @@ function connectWebSocket(tab, isReconnect = false) {
 
   const sendInput = data => {
     if (ws.readyState !== WebSocket.OPEN) return;
-    // On Enter, read command from terminal screen buffer (avoids echo-back pollution)
+    // On Enter, capture the command for history
     for (let i = 0; i < data.length; i++) {
       const ch = data.charCodeAt(i);
       if (ch === 13 || ch === 10) { // Enter
         try {
-          const buf = tab.term.buffer.active;
-          const line = buf.getLine(buf.baseY + buf.cursorY);
-          if (line) {
-            let text = line.translateToString(true).trim();
-            // Strip prompt prefix: find last $ # or % and take text after it
-            const promptEnd = Math.max(text.lastIndexOf('$'), text.lastIndexOf('#'), text.lastIndexOf('%'));
-            if (promptEnd >= 0 && promptEnd < text.length - 1) {
-              text = text.substring(promptEnd + 1).trim();
+          // Prefer stored paste text (avoids single-row truncation from getLine)
+          let text = tab._lastPasteText;
+          tab._lastPasteText = null;
+          if (text) {
+            // For multi-line pastes, take only the last line (the command)
+            const lines = text.split('\n');
+            text = lines[lines.length - 1] || lines[lines.length - 2] || text;
+            text = text.trim();
+          } else {
+            // Read from terminal buffer — collect all rows from prompt to cursor
+            const buf = tab.term.buffer.active;
+            const cursorRow = buf.baseY + buf.cursorY;
+            let collected = '';
+            // Scan upward to find the prompt line (contains $, #, or %)
+            for (let r = cursorRow; r >= Math.max(0, cursorRow - 20); r--) {
+              const row = buf.getLine(r);
+              if (!row) break;
+              const rowText = row.translateToString(false);
+              // Prompt detection: line ends with $, #, or % followed by space
+              if (/\s*[#$%]\s*$/.test(rowText)) {
+                const promptEnd = rowText.search(/[#$%]\s*$/);
+                if (promptEnd >= 0) {
+                  collected = rowText.substring(promptEnd + 1) + collected;
+                }
+                break;
+              }
+              collected = rowText + collected;
             }
-            if (text) addToCmdHist(text);
+            text = collected.trim();
+            // Strip any trailing prompt artifacts from multi-row
+            text = text.replace(/\s*[#$%]\s*$/, '').trim();
           }
+          if (text) addToCmdHist(text);
         } catch {}
       }
     }
@@ -2159,6 +2186,21 @@ function initTerminal(tab) {
   tab.closed = false;
   tab.textarea = term.textarea || term.element?.querySelector('.xterm-textarea, textarea');
 
+  // Intercept paste events to use bracketed paste mode (required for TUI apps like vim, nano, mc)
+  if (tab.textarea) {
+    tab.textarea.addEventListener('paste', e => {
+      e.preventDefault();
+      const text = (e.clipboardData || window.clipboardData)?.getData('text');
+      if (!text || !tab.ws || tab.ws.readyState !== WebSocket.OPEN) return;
+      tab._lastPasteText = text;
+      const bracketed = '\x1b[200~' + text + '\x1b[201~';
+      const enc = new TextEncoder().encode(bracketed);
+      const buf = new Uint8Array(1 + enc.length);
+      buf[0] = 0x00; buf.set(enc, 1);
+      tab.ws.send(buf.buffer);
+    }, true);
+  }
+
   // term.onFocus() was removed from xterm.js — use native DOM event instead
   term.element.addEventListener('focusin', () => {
     if (activeTabId !== tab.id) {
@@ -2210,6 +2252,7 @@ function initTerminal(tab) {
 
   // Terminal right-click context menu
   term.element.addEventListener('contextmenu', e => {
+    if (!settings.termRightClick) return;
     e.preventDefault();
     const menu = document.getElementById('term-ctx-menu');
     const sel = term.getSelection();
@@ -2277,18 +2320,22 @@ function initTerminal(tab) {
     if (!tab.closed) connectWebSocket(tab, false);
   });
 
-  // Scroll terminal on wheel; yield to TUI apps when mouse tracking is active
+  // Scroll terminal on wheel
   tab.wrapper.addEventListener('wheel', e => {
     if (e.ctrlKey || e.metaKey) return;
-    // When a TUI app (vim, htop, tmux…) has mouse tracking on, let the app handle scroll
+    e.preventDefault();
+    // TUI apps with mouse tracking handle scroll themselves — forward the event to xterm.js
     try {
       const core = term._core;
-      if (core && core.coreMouseService && core.coreMouseService.isMouseTrackingActive()) return;
+      if (core && core.coreMouseService && core.coreMouseService.isMouseTrackingActive()) {
+        const vp = tab.wrapper.querySelector('.xterm-viewport');
+        if (vp) vp.dispatchEvent(new WheelEvent('wheel', e));
+        return;
+      }
     } catch (_) {}
     const atTop = term.buffer.active.baseY === 0;
     const atBottom = term.buffer.active.baseY + term.rows >= term.buffer.active.length;
     if (tilesMode && ((e.deltaY < 0 && atTop) || (e.deltaY > 0 && atBottom))) return;
-    e.preventDefault();
     let delta = e.deltaY;
     if (e.deltaMode === 1) delta *= 16;
     else if (e.deltaMode === 2) delta *= 16 * term.rows;
@@ -2965,12 +3012,20 @@ document.addEventListener('click', () => {
 
 document.getElementById('ctx-open').onclick = () => { if (!ctxTarget) return; if (isImageFile(ctxTarget.path)) openImageViewer(ctxTarget.path); else loadFiles(ctxTarget.path); };
 document.getElementById('ctx-edit').onclick = () => ctxTarget && openFileEditor(ctxTarget.path);
-document.getElementById('ctx-download').onclick = () => ctxTarget && downloadFile(ctxTarget.path);
+document.getElementById('ctx-download').onclick = () => {
+  if (selectedFiles.length > 0) { downloadSelected(); return; }
+  if (ctxTarget) downloadFile(ctxTarget.path);
+};
 document.getElementById('ctx-zip').onclick = async () => {
-  if (!ctxTarget) return;
+  const files = selectedFiles.length > 0 ? selectedFiles : (ctxTarget ? [ctxTarget.path] : []);
+  if (!files.length) return;
   const t = toast('Zipping…', 'info');
-  await zipFile(ctxTarget.path, ctxTarget.name);
+  for (const p of files) {
+    const name = p.split(/[\\/]/).pop();
+    await zipFile(p, name);
+  }
   t.remove();
+  clearSelection();
 };
 document.getElementById('ctx-extract').onclick = async () => {
   if (!ctxTarget) return;
@@ -2995,10 +3050,29 @@ document.getElementById('ctx-folder-size').onclick = async () => {
 };
 document.getElementById('ctx-rename').onclick = () => ctxTarget && startRename(ctxTarget.path, ctxTarget.name);
 document.getElementById('ctx-copy-path').onclick = () => { if (!ctxTarget) return; navigator.clipboard.writeText(ctxTarget.path).then(() => toast('Path copied')).catch(() => toast('Copy failed', 'error')); };
-document.getElementById('ctx-delete').onclick = () => ctxTarget && deleteFile(ctxTarget);
+document.getElementById('ctx-delete').onclick = () => {
+  if (selectedFiles.length > 0) { deleteSelected(); return; }
+  if (ctxTarget) deleteFile(ctxTarget);
+};
 document.getElementById('ctx-open-term').onclick = () => { if (!ctxTarget) return; newTab(`Term @ ${ctxTarget.name}`, null, ctxTarget.path); };
-document.getElementById('ctx-copy').onclick = () => { if (!ctxTarget) return; fsClipboard = { action: 'copy', path: ctxTarget.path, name: ctxTarget.name }; updatePasteUI(); toast('Copied: ' + ctxTarget.name, 'success'); };
-document.getElementById('ctx-cut').onclick = () => { if (!ctxTarget) return; fsClipboard = { action: 'cut', path: ctxTarget.path, name: ctxTarget.name }; updatePasteUI(); toast('Cut: ' + ctxTarget.name, 'success'); };
+document.getElementById('ctx-copy').onclick = () => {
+  const files = selectedFiles.length > 0
+    ? selectedFiles.map(p => ({ path: p, name: p.split(/[\\/]/).pop() }))
+    : (ctxTarget ? [{ path: ctxTarget.path, name: ctxTarget.name }] : []);
+  if (!files.length) return;
+  fsClipboard = { action: 'copy', files };
+  updatePasteUI();
+  toast(`Copied ${files.length} item(s)`, 'success');
+};
+document.getElementById('ctx-cut').onclick = () => {
+  const files = selectedFiles.length > 0
+    ? selectedFiles.map(p => ({ path: p, name: p.split(/[\\/]/).pop() }))
+    : (ctxTarget ? [{ path: ctxTarget.path, name: ctxTarget.name }] : []);
+  if (!files.length) return;
+  fsClipboard = { action: 'cut', files };
+  updatePasteUI();
+  toast(`Cut ${files.length} item(s)`, 'success');
+};
 document.getElementById('ctx-paste').onclick = () => { if (fsClipboard) pasteFile(currentPath); };
 
 function updatePasteUI() {
@@ -3013,38 +3087,44 @@ let _pasteBusy = false;
 async function pasteFile(destDir, conflictMode) {
   if (!fsClipboard || _pasteBusy) return;
   _pasteBusy = true;
-  const label = fsClipboard.action === 'copy' ? 'Copying' : 'Moving';
-  const toastEl = toast(label + '…', 'info');
-  const dest = joinPath(destDir, fsClipboard.name);
-  const ep = fsClipboard.action === 'copy' ? '/api/files/copy' : '/api/files/move';
-  const body = { source: fsClipboard.path, destination: dest };
-  if (conflictMode) body.conflict = conflictMode;
-  const r = await api(ep, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body)
-  });
-  if (r.conflict) {
-    toastEl.remove();
-    _conflictResolve = { destDir, conflictMode: null };
-    document.getElementById('conflict-name').textContent = r.name;
-    document.getElementById('conflict-dir-hint').style.display = r.isDir ? '' : 'none';
-    document.getElementById('conflict-merge').style.display = r.isDir ? '' : 'none';
-    openOverlay('conflict-overlay');
-    return;
-  }
-  if (r.success) {
+  try {
+    // Support both old single-file and new multi-file format
+    const files = fsClipboard.files || [{ path: fsClipboard.path, name: fsClipboard.name }];
+    const label = fsClipboard.action === 'copy' ? 'Copying' : 'Moving';
+    const toastEl = toast(label + '…', 'info');
+    const ep = fsClipboard.action === 'copy' ? '/api/files/copy' : '/api/files/move';
+    let succeeded = 0, failed = 0;
+    for (const file of files) {
+      const dest = joinPath(destDir, file.name);
+      const body = { source: file.path, destination: dest };
+      if (conflictMode) body.conflict = conflictMode;
+      const r = await api(ep, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      });
+      if (r.conflict) {
+        toastEl.remove();
+        _conflictResolve = { destDir, conflictMode: null };
+        document.getElementById('conflict-name').textContent = r.name;
+        document.getElementById('conflict-dir-hint').style.display = r.isDir ? '' : 'none';
+        document.getElementById('conflict-merge').style.display = r.isDir ? '' : 'none';
+        openOverlay('conflict-overlay');
+        return;
+      }
+      if (r.success) succeeded++;
+      else failed++;
+    }
     toastEl.remove();
-    const label = fsClipboard.action === 'copy' ? 'Pasted' : 'Moved';
-    if (r.skipped) toast(label + ' (skipped existing)', 'info');
-    else toast(label, 'success');
+    const opLabel = fsClipboard.action === 'copy' ? 'Pasted' : 'Moved';
+    if (failed === 0) toast(opLabel + ` (${succeeded} item(s))`, 'success');
+    else if (succeeded === 0) toast(opLabel + ' failed', 'error');
+    else toast(`${opLabel} ${succeeded}, ${failed} failed`, 'warning');
     if (fsClipboard.action === 'cut') { fsClipboard = null; updatePasteUI(); }
     refreshFiles();
-  } else {
-    toastEl.remove();
-    toast(r.error || 'Operation failed', 'error');
+  } finally {
+    _pasteBusy = false;
   }
-  _pasteBusy = false;
 }
 
 function resolveConflict(mode) {
@@ -3102,18 +3182,24 @@ async function deleteFile(file) {
   else toast(r.error, 'error');
 }
 
-async function downloadFile(path) {
+async function downloadFile(filePath) {
   try {
-    const r = await fetch(`/api/files/download?path=${encodeURIComponent(path)}`, {
+    const r = await fetch(`/api/files/download?path=${encodeURIComponent(filePath)}`, {
       headers: { 'x-pin-token': authToken }
     });
     if (!r.ok) { toast('Download failed', 'error'); return; }
+    const ct = r.headers.get('content-type') || '';
     const blob = await r.blob();
     const url = URL.createObjectURL(blob);
     const a = document.createElement('a');
     a.href = url;
-    a.download = path.split(/[\\/]/).pop() || 'download';
+    let name = filePath.split(/[\\/]/).pop() || 'download';
+    // Server returns application/zip for directories — append .zip if missing
+    if (ct.includes('zip') && !name.endsWith('.zip')) name += '.zip';
+    a.download = name;
+    document.body.appendChild(a);
     a.click();
+    a.remove();
     URL.revokeObjectURL(url);
   } catch(e) { console.warn('Download failed:', e); toast('Download failed', 'error'); }
 }
@@ -3219,10 +3305,14 @@ async function deleteSelected() {
 }
 
 async function downloadSelected() {
-  for (const p of [...selectedFiles]) {
-    await downloadFile(p);
+  const files = [...selectedFiles];
+  if (!files.length) return;
+  toast(`Downloading ${files.length} item(s)…`, 'info');
+  for (let i = 0; i < files.length; i++) {
+    await downloadFile(files[i]);
+    // Small delay between downloads to avoid browser popup blocking
+    if (i < files.length - 1) await new Promise(r => setTimeout(r, 300));
   }
-  toast('Downloads started', 'success');
   clearSelection();
 }
 
@@ -3863,7 +3953,7 @@ function loadSettings() {
   document.getElementById('s-scrollback').value = settings.scrollback;
   document.getElementById('s-font').value = settings.font;
   document.getElementById('s-cursor').value = settings.cursor;
-  syncToggle('blink'); syncToggle('bell'); syncToggle('mobilekeys'); syncToggle('confirmclose'); syncToggle('datasaver');
+  syncToggle('blink'); syncToggle('bell'); syncToggle('mobilekeys'); syncToggle('confirmclose'); syncToggle('datasaver'); syncToggle('termRightClick');
   syncKeepAwakeUI();
   if (settings.keepAwake && hasWakeLock) { requestWakeLock(); }
   if (isElectron) {
@@ -5494,6 +5584,31 @@ async function refreshSystemStats(showLoading) {
   document.getElementById('sys-uptime-val').textContent = fmtUptime(data.uptime);
   document.getElementById('sys-uptime-sub').textContent = data.hostname + ' · ' + data.platform;
 
+  const gpuContainer = document.getElementById('sys-gpu-container');
+  gpuContainer.innerHTML = '';
+  const gpuList = data.gpus || (data.gpu ? [data.gpu] : []);
+  if (gpuList.length) {
+    gpuList.forEach((g, i) => {
+      const card = document.createElement('div');
+      card.className = 'sys-card';
+      const label = gpuList.length > 1 ? `GPU ${i + 1}` : 'GPU';
+      let sub = '';
+      if (g.memTotal > 0) sub += formatSize(g.memTotal * 1024 * 1024) + ' VRAM';
+      else if (g.memTotal === 0 && g.driver !== 'lspci') sub += 'Shared memory';
+      if (g.utilization != null) sub += (sub ? ' · ' : '') + g.utilization + '% util';
+      if (g.temp) sub += (sub ? ' · ' : '') + g.temp + '°C';
+      if (g.driver && g.driver !== 'nvidia' && g.driver !== 'macos' && g.driver !== 'lspci') sub += (sub ? ' · ' : '') + 'Driver: ' + g.driver;
+      let barHtml = '';
+      if (g.memTotal > 0 && g.memUsed) {
+        const pct = Math.round((g.memUsed / g.memTotal) * 100);
+        const cls = pct > 80 ? ' danger' : pct > 50 ? ' warn' : '';
+        barHtml = `<div class="sys-bar"><div class="sys-bar-fill${cls}" style="width:${Math.min(pct, 100)}%"></div></div>`;
+      }
+      card.innerHTML = `<h3>${label}</h3><div class="sys-val">${g.name}</div><div class="sys-sub">${sub || 'No details available'}</div>${barHtml}`;
+      gpuContainer.appendChild(card);
+    });
+  }
+
   const tbody = document.getElementById('sys-proc-body');
   tbody.innerHTML = '';
   if (data.processes) {

package/server.js

@@ -48,7 +48,7 @@ const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
 const { execSync, execFileSync, spawn } = require('child_process');
-const archiver = require('archiver');
+const { ZipArchive } = require('archiver');
 const yauzl = require('yauzl');
 const https = require('https');
 const http = require('http');
@@ -251,7 +251,7 @@ async function dirSize(dir) {
 function createZipArchive(entries, zipPath) {
   return new Promise((resolve, reject) => {
     const output = fs.createWriteStream(zipPath);
-    const archive = archiver('zip', { zlib: { level: 6 } });
+    const archive = new ZipArchive({ zlib: { level: 6 } });
     output.on('close', () => resolve());
     output.on('error', reject);
     archive.on('error', reject);
@@ -270,7 +270,7 @@ function createZipArchive(entries, zipPath) {
 }
 
 function streamZipDirectory(dirPath, res) {
-  const archive = archiver('zip', { zlib: { level: 6 } });
+  const archive = new ZipArchive({ zlib: { level: 6 } });
   archive.on('error', err => {
     if (!res.headersSent) res.status(500).json({ error: err.message });
     else res.end();
@@ -1605,12 +1605,69 @@ app.get('/api/system', checkPin, async (req, res) => {
     }
   } catch {}
 
+  let gpus = [];
+  try {
+    if (os.platform() === 'linux') {
+      // Try nvidia-smi first (NVIDIA GPUs — supports multi-GPU)
+      try {
+        const nvOut = await spawnRead('nvidia-smi', ['--query-gpu=name,memory.total,memory.used,memory.free,utilization.gpu,temperature.gpu', '--format=csv,noheader,nounits']);
+        if (nvOut && nvOut.trim()) {
+          for (const line of nvOut.trim().split('\n')) {
+            const parts = line.split(',').map(s => s.trim());
+            if (parts.length >= 6 && parts[0]) {
+              gpus.push({ name: parts[0], memTotal: +parts[1] || 0, memUsed: +parts[2] || 0, memFree: +parts[3] || 0, utilization: +parts[4] || 0, temp: +parts[5] || 0, driver: 'nvidia' });
+            }
+          }
+        }
+      } catch {}
+      // Fallback: lspci for any GPU (Intel, AMD, etc.)
+      if (!gpus.length) {
+        try {
+          const lspciOut = await spawnRead('lspci', []);
+          if (lspciOut && lspciOut.trim()) {
+            const lines = lspciOut.split('\n').filter(l => /VGA|3D|Display/i.test(l));
+            for (const line of lines) {
+              const name = line.replace(/^[\da-f]+:[\da-f]+\.[\da-f]+\s+/, '').trim();
+              if (name) gpus.push({ name, driver: 'lspci' });
+            }
+          }
+        } catch {}
+      }
+    } else if (os.platform() === 'darwin') {
+      const spOut = await spawnRead('system_profiler', ['SPDisplaysDataType']);
+      if (spOut) {
+        // Split by chipset sections to handle multiple GPUs
+        const sections = spOut.split(/(?=Chipset Model:)/);
+        for (const section of sections) {
+          const chipMatch = section.match(/Chipset Model:\s*(.+)/);
+          const vramMatch = section.match(/VRAM.*?:\s*(\d+)\s*MB/);
+          if (chipMatch) {
+            gpus.push({ name: chipMatch[1].trim(), memTotal: vramMatch ? +vramMatch[1] : 0, driver: 'macos' });
+          }
+        }
+      }
+    } else if (os.platform() === 'win32') {
+      const psGpu = await spawnRead('powershell.exe', ['-Command', "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name,AdapterRAM,DriverVersion | ConvertTo-Json"]);
+      if (psGpu) {
+        const data = JSON.parse(psGpu);
+        const list = Array.isArray(data) ? data : [data];
+        for (const d of list) {
+          if (d && d.Name) {
+            const vramBytes = d.AdapterRAM || 0;
+            gpus.push({ name: d.Name, memTotal: Math.round(vramBytes / (1024 * 1024)), driver: d.DriverVersion || '' });
+          }
+        }
+      }
+    }
+  } catch {}
+
   res.json({
     hostname: os.hostname(),
     platform: os.platform(),
     uptime: os.uptime(),
     cpu: { model: cpuModel, count: cpuCount, usage: cpuUsage, loadAvg },
     memory: { total: totalMem, free: freeMem, used: usedMem, percent: memPercent },
+    gpus,
     disk,
     processes
   });