session_dialog.py

"""
session_dialog.py - Dialog creazione/modifica sessione PCM (GTK3)

Gtk.Dialog con Gtk.Notebook. Adatta i widget visibili al protocollo scelto.
"""

import os
import shutil

import gi
gi.require_version("Gtk", "3.0")
from gi.repository import Gtk, Gdk, GLib

import config_manager
import protocols
from themes import TERMINAL_THEMES
from translations import t
from pcm_logging import get_logger as _get_log
from plugins.plugin_base import pcm_dialog_pages as _plugin_dialog_pages, pcm_has_protocol as _has_plugin

_HERE      = os.path.dirname(os.path.abspath(__file__))
_ICONS_DIR = os.path.join(_HERE, "icons")

PROTOCOLLI = protocols.PROTOCOLS
PROTO_LABEL = protocols.PROTO_LABEL


def _available_tools(candidates: list, always_include: list | None = None) -> list:
    found = [c for c in candidates if shutil.which(c)]
    if always_include:
        result = list(always_include) + [c for c in found if c not in always_include]
    else:
        result = found
    return result or [candidates[0]]


def _make_grid() -> Gtk.Grid:
    g = Gtk.Grid()
    g.set_row_spacing(8)
    g.set_column_spacing(8)
    g.set_margin_start(12)
    g.set_margin_end(12)
    g.set_margin_top(12)
    g.set_margin_bottom(12)
    return g


def _form_row(label_text: str, widget: Gtk.Widget, grid: Gtk.Grid, row: int):
    lbl = Gtk.Label(label=label_text)
    lbl.set_xalign(1.0)
    lbl.set_margin_end(6)
    grid.attach(lbl, 0, row, 1, 1)
    grid.attach(widget, 1, row, 1, 1)


def _combo_idx_to_sftp_mode(combo: Gtk.ComboBoxText) -> str:
    idx = combo.get_active()
    return [protocols.MODE_BROWSER_INT, protocols.MODE_BROWSER_EXT,
            protocols.MODE_TERM_INT, protocols.MODE_TERM_EXT][max(0, idx)]


def _combo_idx_to_ftp_mode(combo: Gtk.ComboBoxText) -> str:
    idx = combo.get_active()
    return [protocols.MODE_BROWSER_INT, protocols.MODE_BROWSER_EXT,
            protocols.MODE_TERM_INT, protocols.MODE_TERM_EXT][max(0, idx)]


def _combo_idx_to_tunnel(combo: Gtk.ComboBoxText) -> str:
    return [protocols.TUNNEL_SOCKS, protocols.TUNNEL_LOCAL,
            protocols.TUNNEL_REMOTE][max(0, combo.get_active())]


_TUNNEL_LABELS = {
    protocols.TUNNEL_SOCKS: "Proxy SOCKS (-D)",
    protocols.TUNNEL_LOCAL: "Locale (-L)",
    protocols.TUNNEL_REMOTE: "Remoto (-R)",
}


def _tunnel_label(constant: str) -> str:
    return _TUNNEL_LABELS.get(constant, "Proxy SOCKS (-D)")


def _entry(placeholder: str = "", password: bool = False) -> Gtk.Entry:
    e = Gtk.Entry()
    e.set_hexpand(True)
    if placeholder:
        e.set_placeholder_text(placeholder)
    if password:
        e.set_visibility(False)
        e.set_input_purpose(Gtk.InputPurpose.PASSWORD)
    return e


def _combo(*items) -> Gtk.ComboBoxText:
    c = Gtk.ComboBoxText()
    for item in items:
        c.append_text(str(item))
    if items:
        c.set_active(0)
    c.set_hexpand(True)
    return c


def _check(label: str) -> Gtk.CheckButton:
    return Gtk.CheckButton(label=label)


class SessionDialog(Gtk.Dialog):

    def __init__(self, parent=None, nome: str = "", dati: dict = None):
        super().__init__(
            title=t("sd.new_title") if not nome else t("sd.edit_title", name=nome),
            transient_for=parent,
            modal=True,
            destroy_with_parent=True
        )
        self._nome_originale = nome
        self._dati_originali = dati or {}
        self._macros: list[dict] = []
        self._is_new = not bool(nome and dati)  # True = nuova sessione

        self.set_default_size(780, 800)
        self._init_ui()
        if nome and dati:
            self._popola(nome, dati)
        self.show_all()
        self._aggiorna_proto_fields()

    # ------------------------------------------------------------------
    # UI principale
    # ------------------------------------------------------------------

    def _init_ui(self):
        area = self.get_content_area()
        area.set_spacing(8)
        area.set_margin_start(12)
        area.set_margin_end(12)
        area.set_margin_top(12)
        area.set_margin_bottom(8)

        # --- Riga nome + gruppo + protocollo ---
        top_grid = _make_grid()

        self.entry_nome = _entry(t("sd.session_name_ph"))
        _form_row(t("sd.session_name"), self.entry_nome, top_grid, 0)

        self.combo_gruppo = Gtk.ComboBoxText.new_with_entry()
        self.combo_gruppo.set_hexpand(True)
        self._carica_gruppi()
        _form_row(t("sd.group"), self.combo_gruppo, top_grid, 1)

        self.combo_proto = Gtk.ComboBoxText()
        for k in PROTOCOLLI:
            self.combo_proto.append_text(PROTO_LABEL[k])
        self.combo_proto.set_active(0)
        self.combo_proto.set_hexpand(True)
        self.combo_proto.connect("changed", self._on_proto_changed)
        _form_row(t("sd.protocol"), self.combo_proto, top_grid, 2)

        self.combo_template = Gtk.ComboBoxText()
        self.combo_template.append("", t("sd.template.none"))
        self._carica_templates()
        self.combo_template.set_tooltip_text(t("tt.template"))
        self.combo_template.connect("changed", self._on_template_changed)
        _form_row(t("sd.template.label"), self.combo_template, top_grid, 3)

        area.pack_start(top_grid, False, False, 0)

        # --- Notebook tab ---
        self._nb = Gtk.Notebook()
        area.pack_start(self._nb, True, True, 0)

        self._nb.append_page(self._build_tab_connessione(), Gtk.Label(label=t("sd.tab.connection")))
        self._nb.append_page(self._build_tab_terminale(),   Gtk.Label(label=t("sd.tab.terminal")))
        self._nb.append_page(self._build_tab_advanced(),    Gtk.Label(label=t("sd.tab.advanced")))
        self._nb.append_page(self._build_tab_tunnel(),      Gtk.Label(label=t("sd.tab.tunnel")))
        self._nb.append_page(self._build_tab_pannelli(),    Gtk.Label(label=t("sd.tab.panels")))
        self._nb.append_page(self._build_tab_macros(),      Gtk.Label(label=t("sd.tab.macros")))
        self._nb.append_page(self._build_tab_expect(),      Gtk.Label(label=t("sd.tab.expect")))
        self._nb.append_page(self._build_tab_notes(),       Gtk.Label(label=t("sd.tab.notes")))

        self._plugin_nb_pages: dict[str, int] = {}
        for proto_id in protocols.PROTOCOLS:
            if _has_plugin(proto_id):
                for page_name, page_widget in _plugin_dialog_pages(proto_id, self, self._dati_originali):
                    idx = self._nb.get_n_pages()
                    self._nb.append_page(page_widget, Gtk.Label(label=page_name))
                    self._plugin_nb_pages.setdefault(proto_id, []).append(idx)

        # Pulsanti
        self.add_button(t("sd.cancel"), Gtk.ResponseType.CANCEL)
        self.add_button(t("sd.save"), Gtk.ResponseType.APPLY)
        self.add_button(t("sd.save_connect"), 101)
        self.add_button(t("sd.connect"), 100)
        self.add_button(t("sd.test_conn"), 102)
        self.add_button(t("sd.save_exit"), Gtk.ResponseType.OK)
        self.connect("response", self._on_response)

        self._connect_preview_signals()

    # ------------------------------------------------------------------
    # Tab Connessione
    # ------------------------------------------------------------------

    @staticmethod
    def _conn_row(label_text: str, widget: Gtk.Widget) -> Gtk.Box:
        """Riga label+widget nascondibile come unità."""
        box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=8)
        box.set_margin_start(4); box.set_margin_end(4)
        lbl = Gtk.Label(label=label_text)
        lbl.set_xalign(1.0); lbl.set_width_chars(14); lbl.set_margin_end(4)
        box.pack_start(lbl, False, False, 0)
        box.pack_start(widget, True, True, 0)
        return box

    def _build_tab_connessione(self) -> Gtk.Widget:
        vbox = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6)
        vbox.set_margin_start(12); vbox.set_margin_end(12)
        vbox.set_margin_top(12);  vbox.set_margin_bottom(12)

        self.entry_host = _entry("es. 192.168.1.100")
        self.entry_host.set_tooltip_text(t("tt.host"))

        self.entry_port = _entry("22")
        self.entry_port.set_width_chars(8); self.entry_port.set_hexpand(False)
        self.entry_port.set_tooltip_text(t("tt.port"))

        _LW = 14  # label width matches _conn_row
        self._row_host_port = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=8)
        self._row_host_port.set_margin_start(4); self._row_host_port.set_margin_end(4)
        _lbl_h = Gtk.Label(label=t("sd.host"))
        _lbl_h.set_xalign(1.0); _lbl_h.set_width_chars(_LW); _lbl_h.set_margin_end(4)
        _lbl_p = Gtk.Label(label=t("sd.port"))
        _lbl_p.set_xalign(1.0); _lbl_p.set_margin_start(12); _lbl_p.set_margin_end(4)
        self._row_host_port.pack_start(_lbl_h, False, False, 0)
        self._row_host_port.pack_start(self.entry_host, True, True, 0)
        self._row_host_port.pack_start(_lbl_p, False, False, 0)
        self._row_host_port.pack_start(self.entry_port, False, False, 0)
        vbox.pack_start(self._row_host_port, False, False, 0)

        self.entry_user = _entry()
        self.entry_user.set_tooltip_text(t("tt.user"))

        self.entry_password = _entry(password=True)
        self.entry_password.set_tooltip_text(t("tt.password"))

        btn_gen_pwd = Gtk.Button()
        btn_gen_pwd.set_tooltip_text("Genera password casuale")
        btn_gen_pwd.set_relief(Gtk.ReliefStyle.NONE)
        btn_gen_pwd.add(Gtk.Image.new_from_icon_name("changes-prevent-symbolic", Gtk.IconSize.BUTTON))
        btn_gen_pwd.connect("clicked", self._on_generate_password)

        btn_toggle_pwd = Gtk.Button()
        btn_toggle_pwd.set_tooltip_text("Mostra/Nascondi password")
        btn_toggle_pwd.set_relief(Gtk.ReliefStyle.NONE)
        self._pwd_toggle_img = Gtk.Image.new_from_icon_name("document-properties-symbolic", Gtk.IconSize.BUTTON)
        btn_toggle_pwd.add(self._pwd_toggle_img)
        btn_toggle_pwd.connect("clicked", self._on_toggle_password_visibility)

        pwd_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=1)
        pwd_box.pack_start(self.entry_password, True, True, 0)
        pwd_box.pack_start(btn_toggle_pwd, False, False, 0)
        pwd_box.pack_start(btn_gen_pwd, False, False, 0)

        self._row_user_pwd = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=8)
        self._row_user_pwd.set_margin_start(4); self._row_user_pwd.set_margin_end(4)
        _lbl_u = Gtk.Label(label=t("sd.user"))
        _lbl_u.set_xalign(1.0); _lbl_u.set_width_chars(_LW); _lbl_u.set_margin_end(4)
        _lbl_pw = Gtk.Label(label=t("sd.password"))
        _lbl_pw.set_xalign(1.0); _lbl_pw.set_margin_start(12); _lbl_pw.set_margin_end(4)
        self._row_user_pwd.pack_start(_lbl_u, False, False, 0)
        self._row_user_pwd.pack_start(self.entry_user, True, True, 0)
        self._row_user_pwd.pack_start(_lbl_pw, False, False, 0)
        self._row_user_pwd.pack_start(pwd_box, True, True, 0)
        vbox.pack_start(self._row_user_pwd, False, False, 0)

        self.entry_rdp_domain = _entry()
        self.entry_rdp_domain.set_tooltip_text(t("tt.rdp_domain"))
        self._row_rdp_domain = self._conn_row(t("sd.rdp.domain"), self.entry_rdp_domain)
        vbox.pack_start(self._row_rdp_domain, False, False, 0)

        # ── Opzioni extra (collassate di default) ──────────────────────
        self._expander_extra = Gtk.Expander(label=t("sd.extra.expander"))
        self._expander_extra.set_expanded(False)
        extra_vbox = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0)
        extra_vbox.set_margin_start(4); extra_vbox.set_margin_end(4)
        extra_vbox.set_margin_top(4)

        self.entry_totp_secret = _entry(placeholder="JBSWY3DPEHPK3PXP (opzionale)")
        self.entry_totp_secret.set_tooltip_text(t("tt.totp_secret"))
        self._row_totp = self._conn_row(t("sd.totp_secret") + ":", self.entry_totp_secret)
        extra_vbox.pack_start(self._row_totp, False, False, 0)

        self.entry_tags = _entry(placeholder="es. prod,database,critico")
        self.entry_tags.set_tooltip_text(t("tt.tags"))
        self._row_tags = self._conn_row(t("sd.tags") + ":", self.entry_tags)
        extra_vbox.pack_start(self._row_tags, False, False, 0)

        self.combo_credential_profile = Gtk.ComboBoxText()
        self.combo_credential_profile.append("", t("sd.cred.from_session"))
        self.combo_credential_profile.append("ask", t("sd.cred.ask"))
        self._refresh_credential_profiles()
        self.combo_credential_profile.set_tooltip_text(t("tt.credential_profile"))
        self._row_credential_profile = self._conn_row(t("settings.cred.edit_title") + ":", self.combo_credential_profile)
        extra_vbox.pack_start(self._row_credential_profile, False, False, 0)

        self._btn_keepass = Gtk.Button(label=t("sd.keepass.btn"))
        self._btn_keepass.set_tooltip_text(t("tt.keepass_btn"))
        self._btn_keepass.connect("clicked", lambda b: self._on_keepass_fetch())
        self._row_keepass = self._conn_row("", self._btn_keepass)
        extra_vbox.pack_start(self._row_keepass, False, False, 2)

        self.chk_is_template = _check(t("sd.template.checkbox"))
        self.chk_is_template.set_tooltip_text(t("tt.template_checkbox"))
        extra_vbox.pack_start(self.chk_is_template, False, False, 4)

        self._expander_extra.add(extra_vbox)
        vbox.pack_start(self._expander_extra, False, False, 0)

        pkey_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=4)
        self.entry_pkey = _entry()
        self.entry_pkey.set_tooltip_text(t("tt.pkey"))
        btn_pkey = Gtk.Button(label="…")
        btn_pkey.set_tooltip_text(t("tt.pkey_browse"))
        btn_pkey.connect("clicked", self._sfoglia_pkey)
        pkey_box.pack_start(self.entry_pkey, True, True, 0)
        pkey_box.pack_start(btn_pkey, False, False, 0)
        self._row_pkey = self._conn_row(t("sd.private_key"), pkey_box)
        vbox.pack_start(self._row_pkey, False, False, 0)

        # Sub-protocol selector for file_transfer
        self.combo_ft_proto = _combo("SFTP", "FTP", "FTPS")
        self.combo_ft_proto.set_tooltip_text(t("tt.ft_proto"))
        self.combo_ft_proto.connect("changed", self._on_ft_proto_changed)
        self._row_ft_proto = self._conn_row("Protocollo:", self.combo_ft_proto)
        vbox.pack_start(self._row_ft_proto, False, False, 0)

        # ── Gestione chiavi SSH ───────────────────────────────────────
        self._frame_chiavi = Gtk.Frame(label=t("sd.keys.frame_label"))
        self._frame_chiavi.set_label_align(0.02, 0.5)
        self._frame_chiavi.set_margin_top(6)
        chiavi_vbox = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6)
        chiavi_vbox.set_margin_start(8); chiavi_vbox.set_margin_end(8)
        chiavi_vbox.set_margin_top(6);   chiavi_vbox.set_margin_bottom(8)
        self._frame_chiavi.add(chiavi_vbox)

        # Riga 1: chiavi esistenti
        riga1 = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        lbl_esistenti = Gtk.Label(label=t("sd.keys.existing") if not t("sd.keys.existing").startswith("sd.") else "Chiavi in ~/.ssh:")
        lbl_esistenti.set_width_chars(16); lbl_esistenti.set_xalign(1.0)
        self.combo_chiavi = Gtk.ComboBoxText()
        self.combo_chiavi.set_hexpand(True)
        self.combo_chiavi.set_tooltip_text(t("tt.keys_list"))
        self.combo_chiavi.connect("changed", self._on_chiave_selezionata)
        btn_ricarica_chiavi = Gtk.Button(label="↺")
        btn_ricarica_chiavi.set_tooltip_text(t("tt.keys_reload"))
        btn_ricarica_chiavi.connect("clicked", lambda b: self._carica_chiavi_esistenti())
        riga1.pack_start(lbl_esistenti, False, False, 0)
        riga1.pack_start(self.combo_chiavi, True, True, 0)
        riga1.pack_start(btn_ricarica_chiavi, False, False, 0)
        chiavi_vbox.pack_start(riga1, False, False, 0)

        # Riga 2: genera nuova
        riga2 = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        lbl_genera = Gtk.Label(label=t("sd.keys.generate") if not t("sd.keys.generate").startswith("sd.") else "Genera nuova:")
        lbl_genera.set_width_chars(16); lbl_genera.set_xalign(1.0)
        self.combo_key_type = Gtk.ComboBoxText()
        for kt in [t("sd.keys.type_ed25519"), t("sd.keys.type_rsa"), t("sd.keys.type_ecdsa")]:
            self.combo_key_type.append_text(kt)
        self.combo_key_type.set_active(0)
        self.combo_key_type.set_hexpand(True)
        self.combo_key_type.set_tooltip_text(t("tt.key_type"))
        import socket as _socket
        _default_comment = f"{os.environ.get('USER','user')}@{_socket.gethostname()}"
        self.entry_key_comment = Gtk.Entry()
        self.entry_key_comment.set_text(_default_comment)
        self.entry_key_comment.set_placeholder_text(t("sd.keys.comment_ph"))
        self.entry_key_comment.set_width_chars(20)
        self.entry_key_comment.set_tooltip_text(t("tt.key_comment"))
        btn_genera_key = Gtk.Button(label=t("sd.keys.gen_btn"))
        btn_genera_key.set_tooltip_text(t("tt.key_generate"))
        btn_genera_key.connect("clicked", lambda b: self._genera_chiave_ssh())
        riga2.pack_start(lbl_genera, False, False, 0)
        riga2.pack_start(self.combo_key_type, True, True, 0)
        riga2.pack_start(self.entry_key_comment, False, False, 0)
        riga2.pack_start(btn_genera_key, False, False, 0)
        chiavi_vbox.pack_start(riga2, False, False, 0)

        # Riga 3: copia server + mostra pubblica
        riga3 = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        self.btn_copia_server = Gtk.Button(label=t("sd.keys.copy_server"))
        self.btn_copia_server.set_hexpand(True)
        self.btn_copia_server.set_tooltip_text(t("tt.key_copy_srv"))
        self.btn_copia_server.get_style_context().add_class("suggested-action")
        self.btn_copia_server.connect("clicked", lambda b: self._copia_chiave_server())
        self.btn_mostra_pub = Gtk.Button(label=t("sd.keys.show_pub"))
        self.btn_mostra_pub.set_hexpand(True)
        self.btn_mostra_pub.set_tooltip_text(t("tt.key_show_pub"))
        self.btn_mostra_pub.connect("clicked", lambda b: self._mostra_chiave_pubblica())
        riga3.pack_start(self.btn_copia_server, True, True, 0)
        riga3.pack_start(self.btn_mostra_pub, True, True, 0)
        chiavi_vbox.pack_start(riga3, False, False, 0)

        vbox.pack_start(self._frame_chiavi, False, False, 0)
        self._carica_chiavi_esistenti()

        # Seriale
        serial_dev_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=4)
        self.entry_serial_dev = _entry("/dev/ttyUSB0")
        self.entry_serial_dev.set_tooltip_text(t("tt.serial_dev"))
        btn_serial = Gtk.Button(label="…")
        btn_serial.set_tooltip_text(t("tt.serial_browse"))
        btn_serial.connect("clicked", lambda b: self._browse_serial_dev())
        serial_dev_box.pack_start(self.entry_serial_dev, True, True, 0)
        serial_dev_box.pack_start(btn_serial, False, False, 0)
        self._row_serial_dev = self._conn_row(t("sd.serial.device"), serial_dev_box)
        vbox.pack_start(self._row_serial_dev, False, False, 0)

        self.combo_baud = _combo("9600","19200","38400","57600","115200","230400","460800","921600")
        self.combo_baud.set_tooltip_text(t("tt.serial_baud"))
        self._row_baud = self._conn_row(t("sd.serial.baud"), self.combo_baud)
        vbox.pack_start(self._row_baud, False, False, 0)

        self.combo_data_bits = _combo("8","7","6","5")
        self.combo_data_bits.set_tooltip_text(t("tt.serial_data"))
        self._row_data_bits = self._conn_row(t("sd.serial.databits"), self.combo_data_bits)
        vbox.pack_start(self._row_data_bits, False, False, 0)

        self.combo_parity = _combo("None","Even","Odd","Mark","Space")
        self.combo_parity.set_tooltip_text(t("tt.serial_parity"))
        self._row_parity = self._conn_row(t("sd.serial.parity"), self.combo_parity)
        vbox.pack_start(self._row_parity, False, False, 0)

        self.combo_stop_bits = _combo("1","1.5","2")
        self.combo_stop_bits.set_tooltip_text(t("tt.serial_stop"))
        self._row_stop_bits = self._conn_row(t("sd.serial.stopbits"), self.combo_stop_bits)
        vbox.pack_start(self._row_stop_bits, False, False, 0)

        # Exec
        self.entry_exec_cmd = _entry(t("sd.exec.cmd_ph"))
        self.entry_exec_cmd.set_tooltip_text(t("tt.exec_cmd"))
        self._row_exec_cmd = self._conn_row(t("sd.exec.cmd"), self.entry_exec_cmd)
        vbox.pack_start(self._row_exec_cmd, False, False, 0)

        # ── Anteprima comando ───────────────────────────────────────────
        self._cmd_preview_frame = Gtk.Frame(label=t("sd.cmd_preview_title"))
        self._cmd_preview_frame.set_label_align(0.02, 0.5)
        self._cmd_preview_frame.set_margin_top(6)
        pv_box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        pv_box.set_margin_start(8); pv_box.set_margin_end(8)
        pv_box.set_margin_top(6);   pv_box.set_margin_bottom(8)

        self._cmd_preview_label = Gtk.Label()
        self._cmd_preview_label.set_xalign(0.0)
        self._cmd_preview_label.set_selectable(True)
        self._cmd_preview_label.set_line_wrap(True)
        self._cmd_preview_label.set_line_wrap_mode(2)  # WORD_CHAR
        self._cmd_preview_label.set_max_width_chars(80)
        self._cmd_preview_label.set_halign(Gtk.Align.FILL)

        pv_scroll = Gtk.ScrolledWindow()
        pv_scroll.set_policy(Gtk.PolicyType.AUTOMATIC, Gtk.PolicyType.AUTOMATIC)
        pv_scroll.set_min_content_height(50)
        pv_scroll.set_max_content_height(120)
        pv_scroll.add(self._cmd_preview_label)
        pv_box.pack_start(pv_scroll, True, True, 0)

        self._cmd_preview_frame.add(pv_box)
        vbox.pack_start(self._cmd_preview_frame, False, False, 0)
        vbox.set_child_packing(self._cmd_preview_frame, False, True, 0, Gtk.PackType.END)

        sw = Gtk.ScrolledWindow()
        sw.set_policy(Gtk.PolicyType.NEVER, Gtk.PolicyType.AUTOMATIC)
        sw.add(vbox)
        return sw

    # ------------------------------------------------------------------
    # Tab Terminale
    # ------------------------------------------------------------------

    def _build_tab_terminale(self) -> Gtk.Widget:
        # Griglia 4 colonne: [lbl|widget|lbl|widget]
        # Col 0 e col 2: label, width_chars fisso → stessa larghezza → allineamento perfetto
        # Col 1 e col 3: widget con hexpand=True → spazio residuo diviso al 50%
        # Checkbox: span 2 col con halign=START → si allineano con i label della stessa colonna
        grid = _make_grid()
        row = 0
        _LW = 13

        def _lbl(text):
            l = Gtk.Label(label=text)
            l.set_xalign(0.0)
            return l

        def _lbl_r(text):
            l = Gtk.Label(label=text)
            l.set_xalign(1.0); l.set_width_chars(_LW)
            return l

        # ── Theme ───────────────────────────────────────────────────────
        _ts = config_manager.load_settings().get('terminal', {})
        self.combo_tema = _combo(*TERMINAL_THEMES.keys())
        self.combo_tema.set_tooltip_text(t("tt.term_theme"))
        _def = _ts.get("default_theme", "")
        if _def:
            self._set_combo_active_text(self.combo_tema, _def)
        grid.attach(_lbl(t("sd.term.theme")), 0, row, 1, 1)
        grid.attach(self.combo_tema,          1, row, 3, 1); row += 1

        # ── Font | Font size ────────────────────────────────────────────
        _def_font = _ts.get('default_font', 'Monospace')
        _def_size = _ts.get('default_font_size', 11)

        self.combo_font = Gtk.ComboBoxText.new_with_entry()
        for f in ["Monospace","DejaVu Sans Mono","Hack","JetBrains Mono",
                  "Fira Code","Source Code Pro","Inconsolata","Terminus"]:
            self.combo_font.append_text(f)
        self._set_combo_active_text(self.combo_font, _def_font)
        self.combo_font.set_tooltip_text(t("tt.term_font"))
        self.combo_font.set_hexpand(True)

        self.spin_font_size = Gtk.SpinButton.new_with_range(6, 32, 1)
        self.spin_font_size.set_value(_def_size)
        self.spin_font_size.set_tooltip_text(t("tt.term_fsize"))
        self.spin_font_size.set_hexpand(True)

        grid.attach(_lbl(t("sd.term.font")),      0, row, 1, 1)
        grid.attach(self.combo_font,              1, row, 1, 1)
        grid.attach(_lbl_r(t("sd.term.font_size")), 2, row, 1, 1)
        grid.attach(self.spin_font_size,           3, row, 1, 1); row += 1

        # ── Unlimited scrollback | Scrollback lines ─────────────────────
        _inf_lbl = (t("settings.terminal.infinite_scrollback")
                    if not t("settings.terminal.infinite_scrollback").startswith("settings.")
                    else "Scrollback illimitato")
        self.chk_infinite_scrollback = _check(_inf_lbl)
        self.chk_infinite_scrollback.set_tooltip_text(t("tt.term_inf_sb"))
        self.chk_infinite_scrollback.set_halign(Gtk.Align.START)

        self.spin_scrollback_lines = Gtk.SpinButton.new_with_range(100, 100000, 1000)
        self.spin_scrollback_lines.set_value(10000)
        self.spin_scrollback_lines.set_tooltip_text(t("tt.term_sb_lines"))
        self.spin_scrollback_lines.set_hexpand(True)

        _sb_lbl = (t("settings.terminal.scrollback")
                   if not t("settings.terminal.scrollback").startswith("settings.")
                   else "Righe scrollback")
        self._lbl_scrollback = _lbl_r(_sb_lbl)

        grid.attach(self.chk_infinite_scrollback, 0, row, 2, 1)
        grid.attach(self._lbl_scrollback,         2, row, 1, 1)
        grid.attach(self.spin_scrollback_lines,   3, row, 1, 1); row += 1

        self.chk_infinite_scrollback.connect(
            "toggled",
            lambda c: [w.set_sensitive(not c.get_active())
                       for w in (self.spin_scrollback_lines, self._lbl_scrollback)]
        )

        # ── Encoding | Bell ─────────────────────────────────────────────
        self.combo_encoding = _combo(
            "UTF-8", "ISO-8859-1", "ISO-8859-15", "CP1252", "KOI8-R", "KOI8-U"
        )
        self.combo_encoding.set_tooltip_text(t("tt.term_encoding"))

        self.combo_bell = _combo(
            t("term.bell.none"), t("term.bell.audible"), t("term.bell.visual")
        )
        self.combo_bell.set_tooltip_text(t("tt.term_bell"))

        grid.attach(_lbl(t("sd.term.encoding")), 0, row, 1, 1)
        grid.attach(self.combo_encoding,         1, row, 1, 1)
        grid.attach(_lbl_r(t("sd.term.bell")),   2, row, 1, 1)
        grid.attach(self.combo_bell,             3, row, 1, 1); row += 1

        # ── Confirm close | Warn paste ──────────────────────────────────
        self.chk_confirm_close = _check(t("settings.terminal.confirm_close"))
        self.chk_confirm_close.set_active(True)
        self.chk_confirm_close.set_tooltip_text(t("tt.term_confirm"))
        self.chk_confirm_close.set_halign(Gtk.Align.START)

        self.chk_warn_paste = _check(t("settings.terminal.warn_paste"))
        self.chk_warn_paste.set_active(True)
        self.chk_warn_paste.set_tooltip_text(t("tt.term_warn_paste"))
        self.chk_warn_paste.set_halign(Gtk.Align.START)

        grid.attach(self.chk_confirm_close, 0, row, 2, 1)
        grid.attach(self.chk_warn_paste,    2, row, 2, 1); row += 1

        # ── Auto-reconnect | Reconnect delay ────────────────────────────
        self.chk_auto_reconnect = _check(t("sd.term.auto_reconnect"))
        self.chk_auto_reconnect.set_tooltip_text(t("tt.term_auto_reconnect"))
        self.chk_auto_reconnect.set_halign(Gtk.Align.START)

        self.spin_reconnect_delay = Gtk.SpinButton.new_with_range(1, 300, 1)
        self.spin_reconnect_delay.set_value(5)
        self.spin_reconnect_delay.set_tooltip_text(t("tt.term_reconnect_delay"))
        self.spin_reconnect_delay.set_hexpand(True)

        self._lbl_reconnect_delay = _lbl_r(t("sd.term.reconnect_delay"))

        grid.attach(self.chk_auto_reconnect,   0, row, 2, 1)
        grid.attach(self._lbl_reconnect_delay, 2, row, 1, 1)
        grid.attach(self.spin_reconnect_delay, 3, row, 1, 1); row += 1

        self.chk_auto_reconnect.connect(
            "toggled",
            lambda c: [w.set_sensitive(c.get_active())
                       for w in (self.spin_reconnect_delay, self._lbl_reconnect_delay)]
        )
        self.spin_reconnect_delay.set_sensitive(False)
        self._lbl_reconnect_delay.set_sensitive(False)

        # ── Log output | Paste with right-click ─────────────────────────
        self.chk_log = _check(t("sd.term.log"))
        self.chk_log.set_tooltip_text(t("tt.term_log"))
        self.chk_log.set_halign(Gtk.Align.START)

        self.chk_paste_right = _check(t("sd.term.paste_right"))
        self.chk_paste_right.set_tooltip_text(t("tt.term_paste_r"))
        self.chk_paste_right.set_halign(Gtk.Align.START)

        grid.attach(self.chk_log,         0, row, 2, 1)
        grid.attach(self.chk_paste_right, 2, row, 2, 1); row += 1

        # ── Log folder ───────────────────────────────────────────────────
        import os as _pcm_os
        _default_log = _pcm_os.path.join(_pcm_os.path.expanduser("~"), ".local", "share", "pcm", "logs")
        log_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=4)
        self.entry_log_dir = _entry(_default_log)
        self.entry_log_dir.set_tooltip_text(t("tt.term_log_dir"))
        btn_log = Gtk.Button(label="…")
        btn_log.connect("clicked", lambda b: self._browse_dir(self.entry_log_dir, "Log folder"))
        log_box.pack_start(self.entry_log_dir, True, True, 0)
        log_box.pack_start(btn_log, False, False, 0)
        grid.attach(_lbl(t("sd.term.log_dir")), 0, row, 1, 1)
        grid.attach(log_box,                    1, row, 3, 1); row += 1

        # ── SFTP open mode (visibile solo per SFTP) ──────────────────────
        self._lbl_sftp_open = _lbl(t("sd.grp.sftp_open"))
        self.combo_sftp_open = _combo(
            t("sd.open_int"),
            t("sd.open_browser_ext"),
            t("sd.sftp.open_term_int"),
            t("sd.sftp.open_term_ext"),
        )
        self.combo_sftp_open.set_tooltip_text(t("tt.sftp_open"))
        grid.attach(self._lbl_sftp_open,  0, row, 1, 1)
        grid.attach(self.combo_sftp_open, 1, row, 3, 1); row += 1

        return grid

    # ------------------------------------------------------------------
    # Tab Avanzate
    # ------------------------------------------------------------------

    @staticmethod
    def _section_frame(title: str) -> tuple:
        frame = Gtk.Frame()
        frame.set_margin_start(6); frame.set_margin_end(6)
        frame.set_margin_top(6);  frame.set_margin_bottom(2)
        lbl = Gtk.Label(); lbl.set_markup(f"<b> {title} </b>")
        frame.set_label_widget(lbl); frame.set_label_align(0.02, 0.5)
        vbox = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        vbox.set_margin_start(8); vbox.set_margin_end(8)
        vbox.set_margin_top(6);  vbox.set_margin_bottom(8)
        frame.add(vbox)
        return frame, vbox

    @staticmethod
    def _adv_row(label_text: str, widget: Gtk.Widget) -> Gtk.Box:
        box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=8)
        lbl = Gtk.Label(label=label_text)
        lbl.set_xalign(1.0); lbl.set_width_chars(16)
        box.pack_start(lbl, False, False, 0)
        box.pack_start(widget, True, True, 0)
        return box

    def _build_tab_advanced(self) -> Gtk.Widget:
        outer = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0)

        # ── SSH / Mosh / Telnet ──────────────────────────────────────
        self._frame_ssh, vbox = self._section_frame("SSH / Mosh / Telnet")
        outer.pack_start(self._frame_ssh, False, False, 0)
        self.chk_x11         = _check(t("sd.ssh.x11"))
        self.chk_x11.set_tooltip_text(t("tt.ssh_x11"))
        self.chk_compression = _check(t("sd.ssh.compression"))
        self.chk_compression.set_tooltip_text(t("tt.ssh_comp"))
        self.chk_keepalive   = _check(t("sd.ssh.keepalive"))
        self.chk_keepalive.set_tooltip_text(t("tt.ssh_ka"))
        self.chk_strict_host = _check(t("sd.ssh.strict"))
        self.chk_strict_host.set_active(
            config_manager.load_settings().get("ssh", {}).get("strict_host_check", True)
        )
        self.chk_strict_host.set_tooltip_text(t("tt.ssh_strict"))
        self.chk_agent_forward = _check(t("sd.ssh.agent_forward"))
        self.chk_agent_forward.set_tooltip_text(t("tt.ssh_agent"))
        for _chk in (self.chk_x11, self.chk_compression, self.chk_keepalive,
                     self.chk_strict_host, self.chk_agent_forward):
            _chk.set_halign(Gtk.Align.START)

        # Left column checkboxes (X11, Keepalive)
        _chk_left_box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        _chk_left_box.pack_start(self.chk_x11,      False, False, 0)
        _chk_left_box.pack_start(self.chk_keepalive, False, False, 0)

        # Right column checkboxes (Compression, Strict host, Agent forward)
        _chk_right_box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        _chk_right_box.pack_start(self.chk_compression,   False, False, 0)
        _chk_right_box.pack_start(self.chk_strict_host,   False, False, 0)
        _chk_right_box.pack_start(self.chk_agent_forward, False, False, 0)

        _ssh_chk_outer = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        _ssh_chk_outer.pack_start(_chk_left_box,  False, False, 0)
        _ssh_chk_outer.pack_start(_chk_right_box, True,  True,  0)
        vbox.pack_start(_ssh_chk_outer, False, False, 0)

        self.spin_keepalive_interval = Gtk.SpinButton.new_with_range(0, 3600, 10)
        self.spin_keepalive_interval.set_value(60)
        self.spin_keepalive_interval.set_tooltip_text(t("tt.ssh_ka_int"))
        self.entry_startup_cmd = _entry("es. htop")
        self.entry_startup_cmd.set_tooltip_text(t("tt.ssh_startup"))

        # Keepalive (sec) + Startup command — SizeGroup aligns right checkboxes
        # with entry_startup_cmd: _ka_pre and _chk_left_box share the same width.
        _sg_adv = Gtk.SizeGroup(mode=Gtk.SizeGroupMode.HORIZONTAL)
        _sg_adv.add_widget(_chk_left_box)

        _lbl_ka = Gtk.Label(label="Keepalive (s):")
        _lbl_ka.set_xalign(1.0); _lbl_ka.set_width_chars(16)
        self.spin_keepalive_interval.set_hexpand(False)
        _lbl_startup = Gtk.Label(label=t("sd.term.startup_cmd"))

        _ka_pre = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        _ka_pre.pack_start(_lbl_ka, False, False, 0)
        _ka_pre.pack_start(self.spin_keepalive_interval, False, False, 0)
        _ka_pre.pack_start(_lbl_startup, False, False, 0)
        _sg_adv.add_widget(_ka_pre)

        _ka_row = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        _ka_row.pack_start(_ka_pre, False, False, 0)
        _ka_row.pack_start(self.entry_startup_cmd, True, True, 0)
        vbox.pack_start(_ka_row, False, False, 0)

        self.entry_jump_host = _entry("jump.example.com")
        self.entry_jump_host.set_tooltip_text(t("tt.jump_host"))
        vbox.pack_start(self._adv_row(t("sd.jump.host"), self.entry_jump_host), False, False, 0)

        # Jump user + Jump port sulla stessa riga
        self.entry_jump_user = _entry()
        self.entry_jump_user.set_tooltip_text(t("tt.jump_user"))
        self.entry_jump_port = _entry("22")
        self.entry_jump_port.set_tooltip_text(t("tt.jump_port"))
        _jump_row = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        _lbl_ju = Gtk.Label(label=t("sd.jump.user"))
        _lbl_ju.set_xalign(1.0); _lbl_ju.set_width_chars(16)
        _jump_row.pack_start(_lbl_ju, False, False, 0)
        _jump_row.pack_start(self.entry_jump_user, True, True, 0)
        _lbl_jp = Gtk.Label(label=t("sd.jump.port"))
        _lbl_jp.set_margin_start(12)
        self.entry_jump_port.set_width_chars(6); self.entry_jump_port.set_hexpand(False)
        _jump_row.pack_start(_lbl_jp, False, False, 0)
        _jump_row.pack_start(self.entry_jump_port, False, False, 0)
        vbox.pack_start(_jump_row, False, False, 0)

        # ── SSH open mode + external terminal ──────────────────────────
        self._row_ssh_open = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=6)
        self.combo_ssh_open = _combo(t("sd.rdp.open_int"), t("sd.rdp.open_ext"))
        self.combo_ssh_open.set_tooltip_text(t("tt.ssh_open"))
        ext_tools = _available_tools(
            ["xterm","gnome-terminal","konsole","xfce4-terminal","alacritty","kitty","foot"]
        )
        self.combo_term_ext = _combo(*ext_tools)
        self.combo_term_ext.set_tooltip_text(t("tt.term_ext"))
        self.combo_term_ext.set_sensitive(False)

        self._lbl_ssh_open = Gtk.Label(label=t("sd.grp.ssh_open"))
        self._lbl_ssh_open.set_xalign(1.0); self._lbl_ssh_open.set_width_chars(16)
        self._lbl_term_ext = Gtk.Label(label=t("sd.terminal_lbl"))
        self._lbl_term_ext.set_sensitive(False)

        def _on_ssh_open_changed(combo):
            is_ext = combo.get_active() == 1
            self.combo_term_ext.set_sensitive(is_ext)
            self._lbl_term_ext.set_sensitive(is_ext)
        self.combo_ssh_open.connect("changed", _on_ssh_open_changed)

        self._row_ssh_open.pack_start(self._lbl_ssh_open, False, False, 0)
        self._row_ssh_open.pack_start(self.combo_ssh_open, True, True, 0)
        self._row_ssh_open.pack_start(self._lbl_term_ext, False, False, 0)
        self._row_ssh_open.pack_start(self.combo_term_ext, True, True, 0)
        vbox.pack_start(self._row_ssh_open, False, False, 0)

        # ── RDP ──────────────────────────────────────────────────────
        self._frame_rdp, vbox = self._section_frame("RDP")
        outer.pack_start(self._frame_rdp, False, False, 0)
        rdp_clients = _available_tools(["xfreerdp3","xfreerdp","rdesktop"])
        self.combo_rdp_client = _combo(*rdp_clients)
        self.combo_rdp_client.set_tooltip_text(t("tt.rdp_client"))
        self.combo_rdp_auth = _combo(t("sd.rdp.auth_ntlm"), t("sd.rdp.auth_kerberos"))
        self.combo_rdp_auth.set_tooltip_text(t("tt.rdp_auth"))
        self.chk_rdp_fs       = _check(t("sd.rdp.fullscreen"))
        self.chk_rdp_fs.set_tooltip_text(t("tt.rdp_fs"))
        self.chk_rdp_clip     = _check(t("sd.rdp.clipboard"))
        self.chk_rdp_clip.set_tooltip_text(t("tt.rdp_clip"))
        self.chk_rdp_drives   = _check(t("sd.rdp.drives"))
        self.chk_rdp_drives.set_tooltip_text(t("tt.rdp_drives"))
        self.combo_rdp_open   = _combo(t("sd.rdp.open_ext"), t("sd.rdp.open_int"))
        self.combo_rdp_open.set_tooltip_text(t("tt.rdp_open"))
        vbox.pack_start(self._adv_row(t("sd.rdp.client"),     self.combo_rdp_client), False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.rdp.auth"), self.combo_rdp_auth),   False, False, 0)
        self.combo_rdp_monitor = _combo(
            t("sd.rdp.monitor_single"), t("sd.rdp.monitor_all"), t("sd.rdp.monitor_custom")
        )
        self.combo_rdp_monitor.set_tooltip_text(t("tt.rdp_monitor"))
        self.entry_rdp_monitor_ids = _entry("0,1")
        self.entry_rdp_monitor_ids.set_tooltip_text(t("tt.rdp_monitor"))
        self._row_rdp_monitor_ids = self._adv_row(t("sd.rdp.monitor_ids"), self.entry_rdp_monitor_ids)
        self._row_rdp_monitor_ids.set_no_show_all(True)
        self.combo_rdp_monitor.connect("changed", self._on_rdp_monitor_changed)
        for chk in [self.chk_rdp_fs, self.chk_rdp_clip, self.chk_rdp_drives]:
            vbox.pack_start(chk, False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.rdp.monitor"), self.combo_rdp_monitor), False, False, 0)
        vbox.pack_start(self._row_rdp_monitor_ids, False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.grp.rdp_open"), self.combo_rdp_open), False, False, 0)

        # ── VNC ──────────────────────────────────────────────────────
        self._frame_vnc, vbox = self._section_frame("VNC")
        outer.pack_start(self._frame_vnc, False, False, 0)
        self.combo_vnc_mode = _combo(t("sd.vnc.ext"), t("sd.vnc.novnc"))
        self.combo_vnc_mode.set_tooltip_text(t("tt.vnc_mode"))
        vnc_clients = _available_tools(
            ["vncviewer","tigervnc","realvnc-viewer","remmina","krdc","xvnc4viewer"],
            always_include=[]
        ) or ["vncviewer"]
        self.combo_vnc_client  = _combo(*vnc_clients)
        self.combo_vnc_client.set_tooltip_text(t("tt.vnc_client"))
        self.combo_vnc_color   = _combo(t("sd.vnc.color_32"), t("sd.vnc.color_16"), t("sd.vnc.color_8"))
        self.combo_vnc_color.set_tooltip_text(t("tt.vnc_color"))
        self.combo_vnc_quality = _combo(t("sd.vnc.q_best"), t("sd.vnc.q_good"), t("sd.vnc.q_fast"))
        self.combo_vnc_quality.set_tooltip_text(t("tt.vnc_quality"))
        vbox.pack_start(self._adv_row(t("sd.open_with"),   self.combo_vnc_mode),   False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.vnc.client"), self.combo_vnc_client), False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.vnc.color"),     self.combo_vnc_color),  False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.vnc.quality"),    self.combo_vnc_quality),False, False, 0)
        self.combo_vnc_mode.connect("changed", self._on_vnc_mode_changed)
        self.chk_vnc_internal = _check("")
        self.chk_vnc_internal.set_no_show_all(True)

        # ── File Transfer (FTP / FTPS / SFTP) ───────────────────────
        self._frame_ftp, vbox = self._section_frame("File Transfer")
        outer.pack_start(self._frame_ftp, False, False, 0)
        self._ftp_chk_box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        self.chk_ftp_tls     = _check(t("sd.ftp.tls"))
        self.chk_ftp_tls.set_tooltip_text(t("tt.ftp_tls"))
        self.chk_ftp_passive = _check(t("sd.ftp.passive"))
        self.chk_ftp_passive.set_active(True)
        self.chk_ftp_passive.set_tooltip_text(t("tt.ftp_passive"))
        self._ftp_chk_box.pack_start(self.chk_ftp_tls, False, False, 0)
        self._ftp_chk_box.pack_start(self.chk_ftp_passive, False, False, 0)
        vbox.pack_start(self._ftp_chk_box, False, False, 0)
        self.combo_ftp_open = _combo(
            t("sd.open_int"),
            t("sd.open_browser_ext"),
            t("sd.ftp.open_term_int"),
            t("sd.ftp.open_term_ext"),
        )
        self.combo_ftp_open.set_tooltip_text(t("tt.ftp_open"))
        self._row_ftp_open = self._adv_row(t("sd.grp.ftp_open"), self.combo_ftp_open)
        vbox.pack_start(self._row_ftp_open, False, False, 0)

        # ── Wake-on-LAN ──────────────────────────────────────────────
        self._frame_wol, vbox = self._section_frame("Wake-on-LAN")
        outer.pack_start(self._frame_wol, False, False, 0)
        self.chk_wol       = _check(t("sd.wol.enable"))
        self.chk_wol.set_tooltip_text(t("tt.wol_enable"))
        self.entry_wol_mac = _entry("AA:BB:CC:DD:EE:FF")
        self.entry_wol_mac.set_tooltip_text(t("tt.wol_mac"))
        self.spin_wol_wait = Gtk.SpinButton.new_with_range(0, 120, 1)
        self.spin_wol_wait.set_value(20)
        self.spin_wol_wait.set_tooltip_text(t("tt.wol_wait"))
        vbox.pack_start(self.chk_wol, False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.wol.mac"), self.entry_wol_mac),   False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.wol.wait"), self.spin_wol_wait),  False, False, 0)

        # ── Pre-comando locale ───────────────────────────────────────
        self._frame_precmd, vbox = self._section_frame("Pre-comando locale")
        outer.pack_start(self._frame_precmd, False, False, 0)
        self.entry_pre_cmd = _entry("es. vpn-up.sh")
        self.entry_pre_cmd.set_tooltip_text(t("tt.precmd"))
        self.spin_pre_cmd_timeout = Gtk.SpinButton.new_with_range(0, 120, 1)
        self.spin_pre_cmd_timeout.set_value(15)
        self.spin_pre_cmd_timeout.set_tooltip_text(t("tt.precmd_to"))
        vbox.pack_start(self._adv_row(t("sd.term.pre_cmd"),       self.entry_pre_cmd),         False, False, 0)
        vbox.pack_start(self._adv_row(t("sd.term.timeout"), self.spin_pre_cmd_timeout),  False, False, 0)

        sw = Gtk.ScrolledWindow()
        sw.set_policy(Gtk.PolicyType.NEVER, Gtk.PolicyType.AUTOMATIC)
        sw.add(outer)
        return sw

    # ------------------------------------------------------------------
    # Tab Tunnel
    # ------------------------------------------------------------------

    def _build_tab_tunnel(self) -> Gtk.Widget:
        grid = _make_grid()
        row = 0

        self.combo_tunnel_type = _combo(
            "Proxy SOCKS (-D)", "Locale (-L)", "Remoto (-R)"
        )
        self.combo_tunnel_type.set_tooltip_text(t("tt.tunnel_type"))
        _form_row(t("sd.tunnel.type"), self.combo_tunnel_type, grid, row); row += 1

        self.entry_tunnel_lport = _entry("1080")
        self.entry_tunnel_lport.set_tooltip_text(t("tt.tunnel_lport"))
        _form_row(t("sd.tunnel.lport"), self.entry_tunnel_lport, grid, row); row += 1

        self.entry_tunnel_rhost = _entry("host.interno")
        self.entry_tunnel_rhost.set_tooltip_text(t("tt.tunnel_rhost"))
        _form_row(t("sd.tunnel.rhost"), self.entry_tunnel_rhost, grid, row); row += 1

        self.entry_tunnel_rport = _entry("80")
        self.entry_tunnel_rport.set_tooltip_text(t("tt.tunnel_rport"))
        _form_row(t("sd.tunnel.rport"), self.entry_tunnel_rport, grid, row); row += 1

        return grid

    # ------------------------------------------------------------------
    # Tab Macro
    # ------------------------------------------------------------------

    def _build_tab_pannelli(self) -> Gtk.Widget:
        box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=12)
        box.set_margin_start(12); box.set_margin_end(12)
        box.set_margin_top(12);   box.set_margin_bottom(12)

        def _section(title):
            frame = Gtk.Frame(label=f"  {title}  ")
            inner = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6)
            inner.set_margin_start(10); inner.set_margin_end(10)
            inner.set_margin_top(8);    inner.set_margin_bottom(10)
            frame.add(inner)
            box.pack_start(frame, False, False, 0)
            return frame, inner

        def _chk(label, tooltip=""):
            c = Gtk.CheckButton(label=label)
            c.set_halign(Gtk.Align.START)
            if tooltip:
                c.set_tooltip_text(tooltip)
            return c

        # --- Browser file (SSH/Mosh/VNC/RDP via OpenSSH) ---
        self._frame_panels_sftp, vb_sftp = _section(t("sd.panels.sftp_section"))
        self.chk_panel_sftp_side = _chk(t("sd.panels.sftp_side"))
        vb_sftp.pack_start(self.chk_panel_sftp_side, False, False, 0)

        # --- Pannello informazioni (SSH/Mosh/VNC Linux/RDP Windows) ---
        self._frame_panels_mon, vb_mon = _section(t("sd.panels.mon_section"))
        note = Gtk.Label()
        note.set_markup(f"<small><i>{t('sd.panels.mon_note')}</i></small>")
        note.set_xalign(0.0)
        vb_mon.pack_start(note, False, False, 0)

        # Porta SSH per VNC/RDP (stesse credenziali, porta diversa)
        self._row_panels_ssh_port = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=4)
        ssh_port_note = Gtk.Label()
        ssh_port_note.set_markup(f"<small><i>{t('sd.panels.ssh_port_note')}</i></small>")
        ssh_port_note.set_xalign(0.0)
        ssh_port_row = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=8)
        lbl_ssh_port = Gtk.Label(label=t("sd.panels.ssh_port"))
        lbl_ssh_port.set_xalign(0.0)
        lbl_ssh_port.set_width_chars(14)
        self.spin_panels_ssh_port = Gtk.SpinButton()
        self.spin_panels_ssh_port.set_adjustment(
            Gtk.Adjustment(value=22, lower=1, upper=65535,
                           step_increment=1, page_increment=10, page_size=0))
        self.spin_panels_ssh_port.set_digits(0)
        self.spin_panels_ssh_port.set_width_chars(6)
        ssh_port_row.pack_start(lbl_ssh_port, False, False, 0)
        ssh_port_row.pack_start(self.spin_panels_ssh_port, False, False, 0)
        self._row_panels_ssh_port.pack_start(ssh_port_note, False, False, 0)
        self._row_panels_ssh_port.pack_start(ssh_port_row, False, False, 0)
        vb_mon.pack_start(self._row_panels_ssh_port, False, False, 0)

        self.chk_panel_cpu_mem   = _chk(t("sd.panels.cpu_mem"),   t("tt.panel_cpu_mem"))
        self.chk_panel_processes = _chk(t("sd.panels.processes"), t("tt.panel_processes"))
        self.chk_panel_disk      = _chk(t("sd.panels.disk"),      t("tt.panel_disk"))
        self.chk_panel_network   = _chk(t("sd.panels.network"),   t("tt.panel_network"))
        self.chk_panel_log       = _chk(t("sd.panels.log"),       t("tt.panel_log"))
        for c in (self.chk_panel_cpu_mem, self.chk_panel_processes,
                  self.chk_panel_disk, self.chk_panel_network, self.chk_panel_log):
            vb_mon.pack_start(c, False, False, 0)

        # Label per protocolli senza pannelli
        self._lbl_panels_unavail = Gtk.Label()
        self._lbl_panels_unavail.set_markup(f"<i>{t('sd.panels.unavail')}</i>")
        self._lbl_panels_unavail.set_halign(Gtk.Align.CENTER)
        self._lbl_panels_unavail.set_valign(Gtk.Align.CENTER)
        self._lbl_panels_unavail.set_vexpand(True)
        box.pack_start(self._lbl_panels_unavail, True, True, 0)

        return box

    def _build_tab_macros(self) -> Gtk.Widget:
        box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6)
        box.set_margin_start(12)
        box.set_margin_end(12)
        box.set_margin_top(12)

        self._macro_store = Gtk.ListStore(str, str)
        self._macro_view = Gtk.TreeView(model=self._macro_store)
        self._macro_view.set_headers_visible(True)

        for i, title in enumerate([t("sd.macro.name"), t("sd.macro.cmd")]):
            cell = Gtk.CellRendererText()
            cell.set_property("editable", True)
            cell.connect("edited", self._on_macro_cell_edited, i)
            col = Gtk.TreeViewColumn(title, cell, text=i)
            col.set_expand(True)
            self._macro_view.append_column(col)

        scroll = Gtk.ScrolledWindow()
        scroll.set_min_content_height(150)
        scroll.set_policy(Gtk.PolicyType.AUTOMATIC, Gtk.PolicyType.AUTOMATIC)
        scroll.add(self._macro_view)
        box.pack_start(scroll, True, True, 0)

        tb = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=4)
        btn_add = Gtk.Button(label=t("sd.macro.add"))
        btn_add.connect("clicked", self._macro_aggiungi)
        btn_del = Gtk.Button(label=t("sd.macro.delete"))
        btn_del.connect("clicked", self._macro_rimuovi)
        tb.pack_start(btn_add, False, False, 0)
        tb.pack_start(btn_del, False, False, 0)
        box.pack_start(tb, False, False, 0)

        return box

    def _build_tab_expect(self) -> Gtk.Widget:
        box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6)
        box.set_margin_start(12)
        box.set_margin_end(12)
        box.set_margin_top(12)

        note = Gtk.Label()
        note.set_markup(f"<small><i>{t('sd.expect.note')}</i></small>")
        note.set_xalign(0.0)
        note.set_line_wrap(True)
        note.set_margin_bottom(4)
        box.pack_start(note, False, False, 0)

        self._expect_store = Gtk.ListStore(str, str, int, float)
        self._expect_view = Gtk.TreeView(model=self._expect_store)
        self._expect_view.set_headers_visible(True)

        cols = [
            (t("sd.expect.pattern"), str, True),
            (t("sd.expect.command"), str, True),
            (t("sd.expect.max"), int, True),
            (t("sd.expect.delay"), float, True),
        ]
        for i, (title, _type, editable) in enumerate(cols):
            cell = Gtk.CellRendererText()
            if editable:
                cell.set_property("editable", True)
                cell.connect("edited", self._on_expect_cell_edited, i)
            col = Gtk.TreeViewColumn(title, cell, text=i)
            col.set_expand(i < 2)
            col.set_min_width(60 if i >= 2 else 100)
            self._expect_view.append_column(col)

        scroll = Gtk.ScrolledWindow()
        scroll.set_min_content_height(120)
        scroll.set_policy(Gtk.PolicyType.AUTOMATIC, Gtk.PolicyType.AUTOMATIC)
        scroll.add(self._expect_view)
        box.pack_start(scroll, True, True, 0)

        tb = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=4)
        btn_add = Gtk.Button(label=t("sd.macro.add"))
        btn_add.connect("clicked", self._expect_aggiungi)
        btn_del = Gtk.Button(label=t("sd.macro.delete"))
        btn_del.connect("clicked", self._expect_rimuovi)
        tb.pack_start(btn_add, False, False, 0)
        tb.pack_start(btn_del, False, False, 0)
        box.pack_start(tb, False, False, 0)

        return box

    def _on_expect_cell_edited(self, cell, path, new_text, col):
        it = self._expect_store.get_iter_from_string(path)
        if it is None:
            return
        if col == 2:
            try:
                self._expect_store.set_value(it, col, int(new_text))
            except ValueError:
                pass
        elif col == 3:
            try:
                self._expect_store.set_value(it, col, float(new_text))
            except ValueError:
                pass
        else:
            self._expect_store.set_value(it, col, new_text)

    def _expect_aggiungi(self, btn):
        it = self._expect_store.append(["", "", 1, 0.5])
        path = self._expect_store.get_path(it)
        self._expect_view.set_cursor(path, self._expect_view.get_column(0), True)

    def _expect_rimuovi(self, btn):
        sel = self._expect_view.get_selection()
        model, it = sel.get_selected()
        if it:
            model.remove(it)

    def _on_macro_cell_edited(self, cell, path, new_text, col):
        it = self._macro_store.get_iter_from_string(path)
        if it is not None:
            self._macro_store.set_value(it, col, new_text)

    def _macro_aggiungi(self, btn):
        it = self._macro_store.append(["", ""])
        path = self._macro_store.get_path(it)
        self._macro_view.set_cursor(path, self._macro_view.get_column(0), True)

    def _macro_rimuovi(self, btn):
        sel = self._macro_view.get_selection()
        model, it = sel.get_selected()
        if it:
            model.remove(it)

    # ------------------------------------------------------------------
    # Tab Note
    # ------------------------------------------------------------------

    def _build_tab_notes(self) -> Gtk.Widget:
        self._textview_notes = Gtk.TextView()
        self._textview_notes.set_wrap_mode(Gtk.WrapMode.WORD)
        sw = Gtk.ScrolledWindow()
        sw.set_policy(Gtk.PolicyType.AUTOMATIC, Gtk.PolicyType.AUTOMATIC)
        sw.add(self._textview_notes)
        return sw

    # ------------------------------------------------------------------
    # Helper
    # ------------------------------------------------------------------

    def _on_vnc_mode_changed(self, combo):
        is_external = combo.get_active() == 0
        self.combo_vnc_client.set_visible(is_external)
        self.chk_vnc_internal.set_active(not is_external)

    # ------------------------------------------------------------------
    # Gestione chiavi SSH
    # ------------------------------------------------------------------

    def _carica_chiavi_esistenti(self):
        # Leggi il valore corrente PRIMA di qualsiasi set_active che triggera _on_chiave_selezionata
        pkey = self.entry_pkey.get_text().strip()

        self.combo_chiavi.remove_all()
        none_label = t("sd.keys.none") if not t("sd.keys.none").startswith("sd.") else "(nessuna — usa password)"
        self.combo_chiavi.append_text(none_label)
        ssh_dir = os.path.expanduser("~/.ssh")
        if not os.path.isdir(ssh_dir):
            self.combo_chiavi.set_active(0)
            return
        try:
            for f in sorted(os.listdir(ssh_dir)):
                path = os.path.join(ssh_dir, f)
                if not os.path.isfile(path):
                    continue
                if any(f.endswith(e) or f == e for e in {".pub", "known_hosts", "known_hosts.old", "authorized_keys", "config"}):
                    continue
                try:
                    with open(path, "r", errors="ignore") as fh:
                        prima = fh.readline().strip()
                    if "PRIVATE KEY" in prima or prima.startswith("-----BEGIN"):
                        self.combo_chiavi.append_text(f"~/.ssh/{f}")
                except Exception as e:
                    _get_log(__name__).debug("Lettura chiave SSH fallita '%s': %s", f, e)
        except Exception as e:
            _get_log(__name__).debug("Scansione ~/.ssh fallita: %s", e)
        self.combo_chiavi.set_active(0)
        # Seleziona la chiave salvata usando il valore letto prima che i segnali la svuotassero
        if pkey:
            nome = "~/.ssh/" + os.path.basename(pkey)
            model = self.combo_chiavi.get_model()
            for i, row in enumerate(model):
                if row[0] == nome:
                    self.combo_chiavi.set_active(i)
                    break

    def _on_chiave_selezionata(self, combo):
        testo = combo.get_active_text() or ""
        none_label = t("sd.keys.none") if not t("sd.keys.none").startswith("sd.") else "(nessuna — usa password)"
        if testo and testo != none_label:
            path = os.path.expanduser(testo.replace("~", os.path.expanduser("~"), 1))
            # normalizza ~/ prefix
            if testo.startswith("~/.ssh/"):
                path = os.path.join(os.path.expanduser("~/.ssh"), testo[7:])
            self.entry_pkey.set_text(path)
        else:
            self.entry_pkey.set_text("")

    def _refresh_credential_profiles(self):
        """Populate combo_credential_profile from settings."""
        combo = self.combo_credential_profile
        # Remove all items after the first two fixed ones (index 0 and 1)
        while combo.get_model() is not None and len(combo.get_model()) > 2:
            combo.remove(2)
        for p in config_manager.load_credential_profiles():
            name = p.get("name", "")
            if name:
                combo.append(name, name)
        combo.set_active_id("")

    def _genera_chiave_ssh(self):
        if not shutil.which("ssh-keygen"):
            self._alert("ssh-keygen non trovato. Installa openssh-client.")
            return
        tipo_raw = self.combo_key_type.get_active_text() or "ed25519"
        if "ed25519" in tipo_raw:
            tipo, bits = "ed25519", None
        elif "rsa" in tipo_raw:
            tipo, bits = "rsa", "4096"
        else:
            tipo, bits = "ecdsa", "521"

        commento = self.entry_key_comment.get_text().strip() or "pcm-key"
        ssh_dir  = os.path.expanduser("~/.ssh")
        os.makedirs(ssh_dir, mode=0o700, exist_ok=True)
        nome_default = f"id_{tipo}_pcm"

        # Dialog nome file
        nome = self._chiedi_testo("Nome file chiave", f"Nome del file in ~/.ssh/:", nome_default)
        if not nome:
            return
        percorso = os.path.join(ssh_dir, nome.strip())

        if os.path.exists(percorso):
            if not self._conferma(f"La chiave '{nome}' esiste già. Sovrascrivere?"):
                return

        # Dialog passphrase
        passphrase = self._chiedi_password_dlg("Passphrase (vuoto = nessuna)")
        if passphrase is None:
            return

        cmd = ["ssh-keygen", "-t", tipo, "-f", percorso, "-C", commento, "-N", passphrase or ""]
        if bits:
            cmd += ["-b", bits]

        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
            if result.returncode == 0:
                os.chmod(percorso, 0o600)
                self.entry_pkey.set_text(percorso)
                self._carica_chiavi_esistenti()
                # Seleziona la nuova chiave nel combo
                nome_combo = f"~/.ssh/{nome.strip()}"
                model = self.combo_chiavi.get_model()
                for i, row in enumerate(model):
                    if row[0] == nome_combo:
                        self.combo_chiavi.set_active(i)
                        break
                self._alert(f"✓ Chiave generata!\n\nPrivata: {percorso}\nPubblica: {percorso}.pub")
            else:
                self._alert(f"Errore ssh-keygen:\n{result.stderr}")
        except subprocess.TimeoutExpired:
            self._alert("Timeout: ssh-keygen ha impiegato troppo.")
        except Exception as e:
            self._alert(str(e))

    def _copia_chiave_server(self):
        if not shutil.which("ssh-copy-id"):
            self._alert("ssh-copy-id non trovato. Installa openssh-client.")
            return
        pkey = self.entry_pkey.get_text().strip()
        if not pkey:
            self._alert(t("sd.pubkey.no_key"))
            return
        pub_path = pkey + ".pub"
        if not os.path.exists(pub_path):
            self._alert(t("sd.pubkey.not_found", path=pub_path))
            return
        host = self.entry_host.get_text().strip()
        if not host:
            self._alert(t("sd.pubkey.host_required"))
            return
        user = self.entry_user.get_text().strip()
        port = self.entry_port.get_text().strip() or "22"
        target = f"{user}@{host}" if user else host

        try:
            with open(pub_path) as f:
                pub_content = f.read().strip()
        except Exception:
            pub_content = t("sd.pubkey.read_err")

        # Dialog conferma con contenuto chiave pubblica
        dlg = Gtk.Dialog(
            title=t("sd.pubkey.copy_title"),
            transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
            modal=True,
        )
        dlg.set_default_size(560, -1)
        box = dlg.get_content_area()
        box.set_spacing(8); box.set_margin_start(16); box.set_margin_end(16)
        box.set_margin_top(12); box.set_margin_bottom(8)

        lbl = Gtk.Label()
        lbl.set_markup(t("sd.pubkey.send_info", target=target, port=port, pub_key=pub_path))
        lbl.set_xalign(0.0); lbl.set_line_wrap(True)
        box.pack_start(lbl, False, False, 0)

        lbl_pub = Gtk.Label(label=t("sd.pubkey.content_lbl"))
        lbl_pub.set_xalign(0.0)
        box.pack_start(lbl_pub, False, False, 0)

        txt = Gtk.TextView()
        txt.set_editable(False)
        txt.get_buffer().set_text(pub_content)
        txt.set_wrap_mode(Gtk.WrapMode.CHAR)
        txt.set_monospace(True)
        scroll = Gtk.ScrolledWindow()
        scroll.set_min_content_height(60)
        scroll.set_max_content_height(80)
        scroll.add(txt)
        box.pack_start(scroll, False, False, 0)

        box.show_all()
        dlg.add_button(t("dialog.cancel"), Gtk.ResponseType.CANCEL)
        btn_manuale = dlg.add_button(t("sd.pubkey.copy_btn"), Gtk.ResponseType.APPLY)
        dlg.add_button(t("sd.pubkey.sshcopyid_btn"), Gtk.ResponseType.OK)
        dlg.set_default_response(Gtk.ResponseType.OK)

        resp = dlg.run()
        dlg.destroy()

        if resp == Gtk.ResponseType.APPLY:
            clipboard = Gtk.Clipboard.get(self.get_display().get_default_seat().get_keyboard().get_surface() if False else self.get_display())
            try:
                clipboard = Gtk.Clipboard.get_for_display(self.get_display(), Gdk.SELECTION_CLIPBOARD)
                clipboard.set_text(pub_content, -1)
            except Exception as e:
                _get_log(__name__).debug("Copia chiave pubblica fallita: %s", e)
            return

        if resp == Gtk.ResponseType.OK:
            import shlex
            cmd_str = f"ssh-copy-id -i {shlex.quote(pub_path)} -p {shlex.quote(port)} {shlex.quote(target)}"
            cmd_quoted = shlex.quote(cmd_str)
            # Apri in terminale
            for term in ["xterm", "gnome-terminal", "xfce4-terminal", "konsole"]:
                if shutil.which(term):
                    if term == "xterm":
                        subprocess.Popen([term, "-title", t("sd.pubkey.ssh_title"),
                                         "-e", f"bash -c {cmd_quoted}; echo; echo {shlex.quote(t('sd.pubkey.press_enter'))}; read"])
                    elif term in ("gnome-terminal", "xfce4-terminal"):
                        subprocess.Popen([term, "--", "bash", "-c",
                                         f"{cmd_str}; echo; echo '{t('sd.pubkey.press_enter')}'; read"])
                    else:
                        subprocess.Popen([term, "-e", f"bash -c {cmd_quoted}; read"])
                    break
            else:
                subprocess.Popen(["bash", "-c", cmd_str])

    def _mostra_chiave_pubblica(self):
        pkey = self.entry_pkey.get_text().strip()
        if not pkey:
            self._alert(t("sd.pubkey.no_key"))
            return
        pub_path = pkey + ".pub"
        if not os.path.exists(pub_path):
            self._alert(t("sd.pubkey.not_found", path=pub_path))
            return
        try:
            contenuto = open(pub_path).read().strip()
        except Exception as e:
            self._alert(str(e))
            return

        dlg = Gtk.Dialog(
            title=t("sd.pubkey.view_title", name=os.path.basename(pub_path)),
            transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
            modal=True,
        )
        dlg.set_default_size(620, 200)
        box = dlg.get_content_area()
        box.set_margin_start(16); box.set_margin_end(16)
        box.set_margin_top(12);   box.set_margin_bottom(8)

        lbl = Gtk.Label()
        lbl.set_markup(f"<b>{pub_path}</b>")
        lbl.set_xalign(0.0)
        box.pack_start(lbl, False, False, 4)

        txt = Gtk.TextView()
        txt.set_editable(False)
        txt.get_buffer().set_text(contenuto)
        txt.set_wrap_mode(Gtk.WrapMode.CHAR)
        txt.set_monospace(True)
        scroll = Gtk.ScrolledWindow()
        scroll.set_min_content_height(80)
        scroll.add(txt)
        box.pack_start(scroll, True, True, 0)

        box.show_all()
        dlg.add_button(t("sd.pubkey.close_btn"), Gtk.ResponseType.CLOSE)
        btn_copia = dlg.add_button(t("sd.pubkey.clipboard_btn"), Gtk.ResponseType.APPLY)

        def _on_resp(d, r):
            if r == Gtk.ResponseType.APPLY:
                try:
                    cb = Gtk.Clipboard.get_for_display(d.get_display(), Gdk.SELECTION_CLIPBOARD)
                    cb.set_text(contenuto, -1)
                    btn_copia.set_label(t("sd.pubkey.copied"))
                except Exception as e:
                    _get_log(__name__).debug("Copia chiave pubblica fallita: %s", e)
                return
            d.destroy()

        dlg.connect("response", _on_resp)
        dlg.run()

    def _chiedi_testo(self, titolo: str, label: str, default: str = "") -> str | None:
        dlg = Gtk.Dialog(title=titolo,
                         transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
                         modal=True)
        dlg.set_default_size(360, -1)
        box = dlg.get_content_area()
        box.set_spacing(6); box.set_margin_start(12); box.set_margin_end(12)
        box.set_margin_top(8); box.set_margin_bottom(6)
        lbl = Gtk.Label(label=label); lbl.set_xalign(0.0)
        entry = Gtk.Entry(); entry.set_text(default); entry.set_activates_default(True)
        box.pack_start(lbl, False, False, 0)
        box.pack_start(entry, False, False, 0)
        box.show_all()
        dlg.add_button(t("dialog.cancel"), Gtk.ResponseType.CANCEL)
        dlg.add_button("OK", Gtk.ResponseType.OK)
        dlg.set_default_response(Gtk.ResponseType.OK)
        resp = dlg.run()
        result = entry.get_text().strip() if resp == Gtk.ResponseType.OK else None
        dlg.destroy()
        return result

    def _chiedi_password_dlg(self, label: str) -> str | None:
        dlg = Gtk.Dialog(title=t("sd.passphrase.title"),
                         transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
                         modal=True)
        dlg.set_default_size(360, -1)
        box = dlg.get_content_area()
        box.set_spacing(6); box.set_margin_start(12); box.set_margin_end(12)
        box.set_margin_top(8); box.set_margin_bottom(6)
        lbl = Gtk.Label(label=label); lbl.set_xalign(0.0)
        entry = Gtk.Entry(); entry.set_visibility(False); entry.set_activates_default(True)
        box.pack_start(lbl, False, False, 0)
        box.pack_start(entry, False, False, 0)
        box.show_all()
        dlg.add_button(t("dialog.cancel"), Gtk.ResponseType.CANCEL)
        dlg.add_button("OK", Gtk.ResponseType.OK)
        dlg.set_default_response(Gtk.ResponseType.OK)
        resp = dlg.run()
        result = entry.get_text() if resp == Gtk.ResponseType.OK else None
        dlg.destroy()
        return result

    def _alert(self, msg: str):
        dlg = Gtk.MessageDialog(
            transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
            modal=True, message_type=Gtk.MessageType.INFO,
            buttons=Gtk.ButtonsType.OK, text=msg)
        dlg.run(); dlg.destroy()

    def _warn_validazione(self, widget: Gtk.Widget, msg: str):
        widget.grab_focus()
        ctx = widget.get_style_context()
        ctx.add_class("error")
        GLib.timeout_add(2500, lambda: ctx.remove_class("error"))
        widget.set_tooltip_text(msg)
        GLib.timeout_add(5000, lambda: widget.set_tooltip_text("") and False)

    def _conferma(self, msg: str) -> bool:
        dlg = Gtk.MessageDialog(
            transient_for=self.get_toplevel() if isinstance(self.get_toplevel(), Gtk.Window) else None,
            modal=True, message_type=Gtk.MessageType.QUESTION,
            buttons=Gtk.ButtonsType.YES_NO, text=msg)
        resp = dlg.run(); dlg.destroy()
        return resp == Gtk.ResponseType.YES

    def _sfoglia_pkey(self, btn):
        dlg = Gtk.FileChooserDialog(
            title=t("sd.browse_key"),
            parent=self,
            action=Gtk.FileChooserAction.OPEN
        )
        dlg.add_buttons(t("sd.filechooser.cancel"), Gtk.ResponseType.CANCEL, t("sd.filechooser.open"), Gtk.ResponseType.OK)
        if dlg.run() == Gtk.ResponseType.OK:
            self.entry_pkey.set_text(dlg.get_filename())
        dlg.destroy()

    def _browse_dir(self, entry: Gtk.Entry, title: str):
        dlg = Gtk.FileChooserDialog(
            title=title, parent=self,
            action=Gtk.FileChooserAction.SELECT_FOLDER
        )
        dlg.add_buttons(t("sd.filechooser.cancel"), Gtk.ResponseType.CANCEL, t("sd.filechooser.select"), Gtk.ResponseType.OK)
        if dlg.run() == Gtk.ResponseType.OK:
            entry.set_text(dlg.get_filename())
        dlg.destroy()

    def _browse_serial_dev(self):
        dlg = Gtk.FileChooserDialog(
            title=t("sd.serial.browse_title"),
            parent=self,
            action=Gtk.FileChooserAction.OPEN
        )
        if os.path.isdir("/dev"):
            dlg.set_current_folder("/dev")
        dlg.add_buttons(t("sd.filechooser.cancel"), Gtk.ResponseType.CANCEL,
                        t("sd.filechooser.open"), Gtk.ResponseType.OK)
        if dlg.run() == Gtk.ResponseType.OK:
            self.entry_serial_dev.set_text(dlg.get_filename())
        dlg.destroy()

    def _carica_gruppi(self):
        profili = config_manager.load_profiles()
        gruppi = sorted({d.get("group", "") for d in profili.values() if d.get("group")})
        for g in gruppi:
            self.combo_gruppo.append_text(g)

    def _carica_templates(self):
        try:
            from config_manager import get_templates
            templates = get_templates()
            for nome in sorted(templates.keys()):
                self.combo_template.append(nome, nome)
        except Exception as e:
            _get_log(__name__).debug("Caricamento template fallito: %s", e)

    def _on_template_changed(self, combo):
        """Apply template fields when a template is selected."""
        active = combo.get_active_text()
        if not active or active == t("sd.template.none"):
            return
        try:
            from config_manager import get_templates
            templates = get_templates()
            if active not in templates:
                return
            template = templates[active]

            # Apply template fields (except name, group)
            for field, value in template.items():
                if field in ("group", "notes", "macros", "expect_rules", "_inherits_from"):
                    continue
                if field == "protocol" and hasattr(self, "combo_proto"):
                    if value in PROTOCOLLI:
                        self.combo_proto.set_active(PROTOCOLLI.index(value))
                elif field == "host" and hasattr(self, "entry_host"):
                    if not self.entry_host.get_text():
                        self.entry_host.set_text(str(value) if value else "")
                elif field == "port" and hasattr(self, "entry_port"):
                    if not self.entry_port.get_text():
                        self.entry_port.set_text(str(value) if value else "")
                elif field == "user" and hasattr(self, "entry_user"):
                    if not self.entry_user.get_text():
                        self.entry_user.set_text(str(value) if value else "")
                elif field == "password" and hasattr(self, "entry_password"):
                    if not self.entry_password.get_text():
                        self.entry_password.set_text(str(value) if value else "")
                elif field == "private_key" and hasattr(self, "entry_pkey"):
                    if not self.entry_pkey.get_text():
                        self.entry_pkey.set_text(str(value) if value else "")
                elif field == "totp_secret" and hasattr(self, "entry_totp_secret"):
                    if not self.entry_totp_secret.get_text():
                        self.entry_totp_secret.set_text(str(value) if value else "")

            self._aggiorna_proto_fields()
        except Exception:
            from pcm_logging import get_logger
            _log = get_logger(__name__)
            _log.warning("Errore applicazione template '%s'", active, exc_info=True)

    def _on_proto_changed(self, combo):
        """Chiamato quando l'utente cambia manualmente il protocollo."""
        self._proto_changed_by_user = True
        self._aggiorna_proto_fields()
        self._proto_changed_by_user = False

    def _on_ft_proto_changed(self, combo):
        self._aggiorna_proto_fields()

    def _on_rdp_monitor_changed(self, combo):
        is_custom = combo.get_active() == 2
        self._row_rdp_monitor_ids.set_visible(is_custom)

    def _on_keepass_fetch(self):
        """Apre il dialog KeePassXC e compila user/password se trovate."""
        try:
            from keepassxc_manager import KeePassXCDialog
        except ImportError:
            from gi.repository import Gtk as _Gtk
            dlg = _Gtk.MessageDialog(
                transient_for=self, modal=True,
                message_type=_Gtk.MessageType.ERROR,
                buttons=_Gtk.ButtonsType.OK,
                text=t("sd.keepass.missing")
            )
            dlg.run(); dlg.destroy()
            return
        host = self.entry_host.get_text().strip()
        dlg = KeePassXCDialog(parent=self, query=host)
        if dlg.run() == Gtk.ResponseType.OK:
            username, password = dlg.get_credentials()
            if username:
                self.entry_user.set_text(username)
            if password:
                self.entry_password.set_text(password)
        dlg.destroy()

    def _on_generate_password(self, button):
        """Genera una password casuale e la inserisce nel campo password."""
        try:
            from password_tools import generate_password
        except ImportError:
            return

        menu = Gtk.Menu()

        def _gen(length, label_hint=""):
            pwd = generate_password(length=length)
            label = f"{label_hint} ({length} caratteri)" if label_hint else f"{length} caratteri"
            mi = Gtk.MenuItem(label=label)
            mi.connect("activate", lambda _: self.entry_password.set_text(pwd))
            menu.append(mi)

        _gen(16, "Standard")
        _gen(20, "Consigliata")
        _gen(32, "Massima")
        _gen(48, "Paranoica")
        menu.append(Gtk.SeparatorMenuItem())

        try:
            from password_tools import generate_passphrase
            phrase = generate_passphrase(num_words=4)
        except Exception:
            phrase = "word-word-word-word99"
        mi_pass = Gtk.MenuItem(label=f"Passphrase (4 parole)")
        mi_pass.connect("activate", lambda _: self.entry_password.set_text(phrase))
        menu.append(mi_pass)

        menu.show_all()
        menu.popup_at_widget(button, Gdk.Gravity.SOUTH, Gdk.Gravity.NORTH, None)

    def _on_toggle_password_visibility(self, button):
        visible = self.entry_password.get_visibility()
        self.entry_password.set_visibility(not visible)
        icon_name = "document-properties-symbolic" if not visible else "view-reveal-symbolic"
        self._pwd_toggle_img.set_from_icon_name(icon_name, Gtk.IconSize.BUTTON)

    def _test_connection(self):
        """Test TCP connectivity to the configured host:port."""
        import socket
        import threading
        host = self.entry_host.get_text().strip()
        port_str = self.entry_port.get_text().strip() or "22"
        if not host:
            self._show_test_result(False, t("sd.test_no_host"))
            return
        try:
            port = int(port_str)
        except (ValueError, TypeError):
            self._show_test_result(False, t("sd.test_bad_port"))
            return

        dlg = Gtk.MessageDialog(
            transient_for=self,
            modal=True,
            message_type=Gtk.MessageType.INFO,
            buttons=Gtk.ButtonsType.NONE,
            text=t("sd.test_testing", host=host, port=port),
        )
        dlg.set_default_size(300, -1)
        dlg.show_all()
        result = [False, ""]

        def _test():
            import time
            try:
                t0 = time.monotonic()
                with socket.create_connection((host, port), timeout=5):
                    ms = int((time.monotonic() - t0) * 1000)
                result[0] = True
                result[1] = f"{ms} ms"
            except socket.timeout:
                result[1] = t("sd.test_timeout")
            except Exception as e:
                result[1] = str(e)
            GLib.idle_add(_done)

        def _done():
            dlg.destroy()
            self._show_test_result(result[0], result[1])
            return False

        threading.Thread(target=_test, daemon=True).start()
        dlg.run()

    def _show_test_result(self, success: bool, detail: str):
        if success:
            markup = f"<span foreground='green'><b>{t('sd.test_ok')}</b> ({detail})</span>"
        else:
            markup = f"<span foreground='red'><b>{t('sd.test_fail')}</b>: {detail}</span>"
        dlg = Gtk.MessageDialog(
            transient_for=self,
            modal=True,
            message_type=Gtk.MessageType.INFO,
            buttons=Gtk.ButtonsType.OK,
            text="",
        )
        dlg.set_markup(markup)
        dlg.run()
        dlg.destroy()

    def _aggiorna_proto_fields(self):
        """Mostra/nasconde campi e sezioni in base al protocollo selezionato."""
        proto = PROTOCOLLI[self.combo_proto.get_active()]
        is_serial = proto == "serial"
        is_exec   = proto == "exec"
        is_net    = not is_serial and not is_exec

        ft_proto = ""
        if proto == "file_transfer" and hasattr(self, "combo_ft_proto"):
            ft_proto = self.combo_ft_proto.get_active_text() or "SFTP"
        is_ft_sftp = proto == "file_transfer" and ft_proto == "SFTP"
        is_ft_ftp  = proto == "file_transfer" and ft_proto in ("FTP", "FTPS")
        has_pkey   = proto in ("ssh", "mosh") or is_ft_sftp

        # Connection tab rows
        self._row_host_port.set_visible(is_net)
        self._row_user_pwd.set_visible(is_net)
        self._row_pkey.set_visible(has_pkey)
        self._frame_chiavi.set_visible(has_pkey)
        self._row_ft_proto.set_visible(proto == "file_transfer")
        self._row_serial_dev.set_visible(is_serial)
        self._row_baud.set_visible(is_serial)
        self._row_data_bits.set_visible(is_serial)
        self._row_parity.set_visible(is_serial)
        self._row_stop_bits.set_visible(is_serial)
        self._row_exec_cmd.set_visible(is_exec)
        self._row_keepass.set_visible(is_net and proto in ("ssh", "mosh", "telnet", "rdp", "vnc", "file_transfer"))
        # TOTP: solo per protocolli basati su SSH (dove 2FA è comune)
        self._row_totp.set_visible(proto in ("ssh", "mosh") or (proto == "file_transfer" and ft_proto == "SFTP"))
        # Tags: visibile per tutti i protocolli di rete
        self._row_tags.set_visible(is_net or proto == "exec")
        # Dominio RDP
        self._row_rdp_domain.set_visible(proto == "rdp")

        # Advanced frames
        self._frame_ssh.set_visible(proto in ("ssh", "mosh", "telnet", "serial", "rdp", "vnc"))
        self._frame_rdp.set_visible(proto == "rdp")
        self._frame_vnc.set_visible(proto == "vnc")
        self._frame_ftp.set_visible(proto == "file_transfer")
        self._frame_wol.set_visible(is_net)
        self._frame_precmd.set_visible(not is_exec)

        # File transfer frame internal visibility
        if proto == "file_transfer":
            self._ftp_chk_box.set_visible(is_ft_ftp)
            self._row_ftp_open.set_visible(is_ft_ftp)

        # Terminal tab open-mode combos
        if hasattr(self, "_lbl_sftp_open"):
            self._lbl_sftp_open.set_visible(is_ft_sftp)
            self.combo_sftp_open.set_visible(is_ft_sftp)
        if hasattr(self, "_row_ssh_open"):
            ssh_visible = proto in ("ssh", "mosh")
            self._row_ssh_open.set_visible(ssh_visible)

        # Panels tab: mostra sezioni in base al protocollo
        if hasattr(self, "_frame_panels_sftp"):
            is_panels_sftp = proto in ("ssh", "mosh", "vnc", "rdp")
            is_panels_mon  = proto in ("ssh", "mosh", "vnc", "rdp")
            is_panels_port = proto in ("vnc", "rdp")
            panels_any     = is_panels_sftp or is_panels_mon
            self._frame_panels_sftp.set_visible(is_panels_sftp)
            self._frame_panels_mon.set_visible(is_panels_mon)
            if is_panels_mon:
                self._row_panels_ssh_port.set_visible(is_panels_port)
                # Il log (journalctl/tail) è solo Linux; su Windows (RDP) si nasconde
                self.chk_panel_log.set_visible(proto != "rdp")
            self._lbl_panels_unavail.set_visible(not panels_any)

        # Port defaults
        if getattr(self, "_proto_changed_by_user", False) or getattr(self, "_is_new", True):
            if proto == "file_transfer":
                port = "22" if ft_proto in ("", "SFTP") else "21"
            else:
                default_port = {
                    "ssh": "22", "telnet": "23", "rdp": "3389",
                    "vnc": "5900", "mosh": "22", "serial": ""
                }
                port = default_port.get(proto, "")
            self.entry_port.set_text(port)

        # Reset tunnel e altri campi non comuni per nuove sessioni
        if getattr(self, "_is_new", False):
            self.entry_tunnel_lport.set_text("1080")
            self.entry_tunnel_rhost.set_text("")
            self.entry_tunnel_rport.set_text("")
            self.combo_tunnel_type.set_active(0)

        # Plugin notebook pages: show/hide based on selected protocol
        for plugin_proto_id, page_indices in self._plugin_nb_pages.items():
            visible = (proto == plugin_proto_id)
            for idx in page_indices:
                if idx < self._nb.get_n_pages():
                    child = self._nb.get_nth_page(idx)
                    child.set_visible(visible)
                    child.set_no_show_all(not visible)

    def _set_combo_active_text(self, combo: Gtk.ComboBoxText, text: str):
        model = combo.get_model()
        for i, row in enumerate(model):
            if row[0] == text:
                combo.set_active(i)
                return

    # ------------------------------------------------------------------
    # Popola dai dati esistenti
    # ------------------------------------------------------------------

    def _popola(self, nome: str, dati: dict):
        self.entry_nome.set_text(nome)

        gruppo = dati.get("group", "")
        child = self.combo_gruppo.get_child()
        if child:
            child.set_text(gruppo)

        proto = dati.get("protocol", "ssh")
        # Backward compat: map old sftp/ftp to file_transfer
        if proto == "sftp":
            proto = "file_transfer"
            ft_proto_default = "SFTP"
        elif proto == "ftp":
            proto = "file_transfer"
            ft_proto_default = "FTPS" if dati.get("ftp_tls") else "FTP"
        else:
            ft_proto_default = dati.get("ft_protocol", "SFTP")

        if proto in PROTOCOLLI:
            self.combo_proto.set_active(PROTOCOLLI.index(proto))
        # Set ft_protocol
        self._set_combo_active_text(self.combo_ft_proto, ft_proto_default)

        self.entry_host.set_text(dati.get("host", ""))
        self.entry_port.set_text(str(dati.get("port", "")))
        self.entry_user.set_text(dati.get("user", ""))
        self.entry_password.set_text(dati.get("password", ""))
        self.entry_pkey.set_text(dati.get("private_key", ""))
        self.entry_totp_secret.set_text(dati.get("totp_secret", ""))
        tags_raw = dati.get("tags", "")
        if isinstance(tags_raw, list):
            tags_raw = ", ".join(str(t).strip() for t in tags_raw if str(t).strip())
        self.entry_tags.set_text(tags_raw if isinstance(tags_raw, str) else "")
        self._carica_chiavi_esistenti()

        # Terminale
        self._set_combo_active_text(self.combo_tema, dati.get("term_theme", "Dark (Default)"))
        font_child = self.combo_font.get_child()
        if font_child:
            font_child.set_text(dati.get("term_font", "Monospace"))
        self.spin_font_size.set_value(int(dati.get("term_size", 11)))
        self.spin_scrollback_lines.set_value(int(dati.get("term_scrollback_lines", 10000)))
        _inf_sb = dati.get("term_infinite_scrollback", False)
        self.chk_infinite_scrollback.set_active(_inf_sb)
        self.spin_scrollback_lines.set_sensitive(not _inf_sb)
        self._lbl_scrollback.set_sensitive(not _inf_sb)
        self._set_combo_active_text(self.combo_encoding, dati.get("term_encoding", "UTF-8"))
        self.combo_bell.set_active({"none": 0, "audible": 1, "visual": 2}.get(dati.get("term_bell", "none"), 0))
        self.chk_confirm_close.set_active(dati.get("term_confirm_close", True))
        self.chk_warn_paste.set_active(dati.get("term_warn_paste", True))
        _auto_rec = dati.get("auto_reconnect", False)
        self.chk_auto_reconnect.set_active(_auto_rec)
        self.spin_reconnect_delay.set_value(int(dati.get("reconnect_delay", 5)))
        self.spin_reconnect_delay.set_sensitive(_auto_rec)
        self._lbl_reconnect_delay.set_sensitive(_auto_rec)
        self.entry_startup_cmd.set_text(dati.get("startup_cmd", ""))

        # Avanzate SSH
        self.chk_x11.set_active(dati.get("x11", False))
        self.chk_compression.set_active(dati.get("compression", False))
        self.chk_keepalive.set_active(dati.get("keepalive", False))
        self.spin_keepalive_interval.set_value(int(dati.get("keepalive_interval", 60)))
        strict_default = config_manager.load_settings().get("ssh", {}).get("strict_host_check", True)
        self.chk_strict_host.set_active(dati.get("strict_host", strict_default))
        self.chk_panel_sftp_side.set_active(dati.get("sftp_browser", True))
        self.spin_panels_ssh_port.set_value(int(dati.get("mon_ssh_port", 22)))
        self.chk_panel_cpu_mem.set_active(dati.get("panel_cpu_mem", False))
        self.chk_panel_processes.set_active(dati.get("panel_processes", False))
        self.chk_panel_disk.set_active(dati.get("panel_disk", False))
        self.chk_panel_network.set_active(dati.get("panel_network", False))
        self.chk_panel_log.set_active(dati.get("panel_log", False))
        self.chk_agent_forward.set_active(dati.get("agent_forward", False))

        # Jump
        self.entry_jump_host.set_text(dati.get("jump_host", ""))
        self.entry_jump_user.set_text(dati.get("jump_user", ""))
        self.entry_jump_port.set_text(str(dati.get("jump_port", "22")))

        # RDP
        self._set_combo_active_text(self.combo_rdp_client, dati.get("rdp_client", "xfreerdp"))
        rdp_auth = dati.get("rdp_auth", "ntlm")
        self.combo_rdp_auth.set_active(1 if rdp_auth == "kerberos" else 0)
        self.chk_rdp_fs.set_active(dati.get("fullscreen", True))
        self.chk_rdp_clip.set_active(dati.get("redirect_clipboard", True))
        self.chk_rdp_drives.set_active(dati.get("redirect_drives", False))
        self.entry_rdp_domain.set_text(dati.get("rdp_domain", ""))
        rdp_open = dati.get("rdp_open_mode", protocols.MODE_EXTERNAL)
        self.combo_rdp_open.set_active(1 if rdp_open == protocols.MODE_INTERNAL else 0)
        rdp_mon = dati.get("rdp_monitor_mode", "single")
        mon_idx = {"single": 0, "all": 1, "custom": 2}.get(rdp_mon, 0)
        self.combo_rdp_monitor.set_active(mon_idx)
        self.entry_rdp_monitor_ids.set_text(dati.get("rdp_monitor_ids", "0,1"))
        self._row_rdp_monitor_ids.set_visible(mon_idx == 2)

        # VNC — lettura unica del flag, default False (esterno)
        is_internal = dati.get("vnc_internal", False)
        self.combo_vnc_mode.set_active(1 if is_internal else 0)
        self.chk_vnc_internal.set_active(is_internal)
        self.combo_vnc_client.set_visible(not is_internal)
        self._set_combo_active_text(self.combo_vnc_client, dati.get("vnc_client", "vncviewer"))
        vnc_color = dati.get("vnc_color", 0)
        self.combo_vnc_color.set_active(vnc_color if isinstance(vnc_color, int) else 0)
        vnc_quality = dati.get("vnc_quality", 2)
        self.combo_vnc_quality.set_active(vnc_quality if isinstance(vnc_quality, int) else 2)

        # FTP
        self.chk_ftp_tls.set_active(dati.get("ftp_tls", False))
        self.chk_ftp_passive.set_active(dati.get("ftp_passive", True))
        self._set_combo_active_text(self.combo_ftp_open, dati.get("ftp_open_mode", protocols.MODE_BROWSER_INT))

        # WoL
        self.chk_wol.set_active(dati.get("wol_enabled", False))
        self.entry_wol_mac.set_text(dati.get("wol_mac", ""))
        self.spin_wol_wait.set_value(int(dati.get("wol_wait", 20)))

        # Seriale
        self.entry_serial_dev.set_text(dati.get("device", "/dev/ttyUSB0"))
        self._set_combo_active_text(self.combo_baud, str(dati.get("baud", "115200")))

        # Tunnel
        self._set_combo_active_text(self.combo_tunnel_type,
                                     _tunnel_label(dati.get("tunnel_type", protocols.TUNNEL_SOCKS)))
        self.entry_tunnel_lport.set_text(str(dati.get("tunnel_local_port", "1080")))
        self.entry_tunnel_rhost.set_text(dati.get("tunnel_remote_host", ""))
        self.entry_tunnel_rport.set_text(str(dati.get("tunnel_remote_port", "")))

        # Modalità apertura (tab Terminale)
        ssh_open = dati.get("ssh_open_mode", protocols.MODE_INTERNAL)
        self.combo_ssh_open.set_active(0 if ssh_open == protocols.MODE_INTERNAL else 1)
        self._set_combo_active_text(self.combo_sftp_open, dati.get("sftp_open_mode", protocols.MODE_BROWSER_INT))
        self._set_combo_active_text(
            self.combo_term_ext, dati.get("terminal_type", t("sd.open_int_terminal")))
        self.chk_log.set_active(dati.get("log_output", False))
        import os as _pcm_os
        _default_log = _pcm_os.path.join(_pcm_os.path.expanduser("~"), ".local", "share", "pcm", "logs")
        raw_log = dati.get("log_dir", "")
        if raw_log in ("/tmp/pcm_logs", ""):
            raw_log = _default_log
        self.entry_log_dir.set_text(raw_log)
        self.chk_paste_right.set_active(dati.get("paste_on_right_click", False))

        # Pre-cmd
        self.entry_pre_cmd.set_text(dati.get("pre_cmd", ""))
        self.spin_pre_cmd_timeout.set_value(int(dati.get("pre_cmd_timeout", 15)))

        # Exec
        self.entry_exec_cmd.set_text(dati.get("exec_cmd", ""))

        # Macro
        self._macro_store.clear()
        for m in dati.get("macros", []):
            self._macro_store.append([m.get("nome", ""), m.get("cmd", "")])

        # Expect
        self._expect_store.clear()
        for e in dati.get("expect_rules", []):
            self._expect_store.append([
                e.get("pattern", ""),
                e.get("command", ""),
                int(e.get("max_trigger", 1)),
                float(e.get("delay", 0.5)),
            ])

        # Note
        buf = self._textview_notes.get_buffer()
        buf.set_text(dati.get("notes", ""))

        # Profilo credenziali
        cred_prof = dati.get("credential_profile", "")
        self.combo_credential_profile.set_active_id(cred_prof if cred_prof else "")

        # Template
        template_name = dati.get("template_name", "")
        if template_name:
            self.combo_template.set_active_id(template_name)
        self.chk_is_template.set_active(dati.get("is_template", False))

        # Aggiorna anteprima comando dopo popolamento
        self._schedule_cmd_preview()

    # ------------------------------------------------------------------
    # Anteprima comando in tempo reale
    # ------------------------------------------------------------------

    def _schedule_cmd_preview(self):
        if getattr(self, "_cmd_preview_timer", None) is not None:
            GLib.source_remove(self._cmd_preview_timer)
        self._cmd_preview_timer = GLib.timeout_add(250, self._update_cmd_preview)

    def _build_preview_dict(self) -> dict:
        proto = PROTOCOLLI[self.combo_proto.get_active()]
        ft_proto = self.combo_ft_proto.get_active_text() or "SFTP"
        return {
            "protocol": proto,
            "host": self.entry_host.get_text().strip(),
            "port": self.entry_port.get_text().strip(),
            "user": self.entry_user.get_text().strip(),
            "password": "••••••••" if self.entry_password.get_text() else "",
            "private_key": self.entry_pkey.get_text().strip(),
            "totp_secret": "••••••••" if self.entry_totp_secret.get_text() else "",
            "startup_cmd": self.entry_startup_cmd.get_text().strip(),
            "jump_host": self.entry_jump_host.get_text().strip(),
            "jump_user": self.entry_jump_user.get_text().strip(),
            "jump_port": self.entry_jump_port.get_text().strip(),
            "x11": self.chk_x11.get_active(),
            "compression": self.chk_compression.get_active(),
            "keepalive": self.chk_keepalive.get_active(),
            "strict_host": self.chk_strict_host.get_active(),
            "agent_forward": self.chk_agent_forward.get_active(),
            "rdp_client": self.combo_rdp_client.get_active_text() or "xfreerdp",
            "rdp_auth": "kerberos" if self.combo_rdp_auth.get_active() == 1 else "ntlm",
            "rdp_domain": self.entry_rdp_domain.get_text().strip(),
            "fullscreen": self.chk_rdp_fs.get_active(),
            "redirect_clipboard": self.chk_rdp_clip.get_active(),
            "redirect_drives": self.chk_rdp_drives.get_active(),
            "rdp_open_mode": (protocols.MODE_INTERNAL if self.combo_rdp_open.get_active() == 1
                               else protocols.MODE_EXTERNAL),
            "rdp_monitor_mode": {0: "single", 1: "all", 2: "custom"}.get(
                self.combo_rdp_monitor.get_active(), "single"),
            "rdp_monitor_ids": self.entry_rdp_monitor_ids.get_text().strip(),
            "vnc_client": self.combo_vnc_client.get_active_text() or "vncviewer",
            "vnc_color": self.combo_vnc_color.get_active(),
            "vnc_quality": self.combo_vnc_quality.get_active(),
            "ssh_open_mode": (protocols.MODE_INTERNAL if self.combo_ssh_open.get_active() == 0
                               else protocols.MODE_EXTERNAL),
            "sftp_open_mode": _combo_idx_to_sftp_mode(self.combo_sftp_open),
            "ftp_open_mode": _combo_idx_to_ftp_mode(self.combo_ftp_open),
            "ft_protocol": ft_proto,
            "ftp_tls": self.chk_ftp_tls.get_active(),
            "ftp_passive": self.chk_ftp_passive.get_active(),
            "device": self.entry_serial_dev.get_text().strip(),
            "baud": self.combo_baud.get_active_text() or "115200",
            "exec_cmd": self.entry_exec_cmd.get_text().strip(),
            "pre_cmd": self.entry_pre_cmd.get_text().strip(),
        }

    def _update_cmd_preview(self) -> bool:
        from session_command import build_command
        try:
            d = self._build_preview_dict()
            proto = d["protocol"]
            if proto in ("serial", "exec"):
                cmd, mode = build_command(d)
                if proto == "serial" and "Nessun client" in (cmd or ""):
                    self._cmd_preview_label.set_markup(
                        "<span foreground='#c08030'><i>⚠ nessun client seriale trovato (picocom/minicom/screen)</i></span>")
                elif proto == "exec" and not d.get("exec_cmd"):
                    self._cmd_preview_label.set_text("(comando exec vuoto)")
                else:
                    self._cmd_preview_label.set_text(cmd or "")
            elif not d.get("host"):
                self._cmd_preview_label.set_text("(inserire host)")
            else:
                cmd, mode = build_command(d)
                text = cmd or ""
                if mode == "rdp_embedded":
                    text = "[RDP embedded — xfreerdp in finestra interna]"
                self._cmd_preview_label.set_text(text)
        except Exception:
            self._cmd_preview_label.set_text("")
        self._cmd_preview_timer = None
        return False

    def _connect_preview_signals(self):
        for w in (self.entry_host, self.entry_port, self.entry_user,
                  self.entry_password, self.entry_pkey, self.entry_startup_cmd,
                  self.entry_jump_host, self.entry_jump_user, self.entry_jump_port,
                  self.entry_rdp_domain, self.entry_rdp_monitor_ids,
                  self.entry_serial_dev, self.entry_exec_cmd, self.entry_pre_cmd):
            w.connect("changed", lambda _, *a: self._schedule_cmd_preview())
        for w in (self.combo_proto, self.combo_ft_proto, self.combo_rdp_client,
                  self.combo_rdp_auth, self.combo_rdp_open, self.combo_rdp_monitor,
                  self.combo_vnc_client, self.combo_vnc_color, self.combo_vnc_quality,
                  self.combo_ssh_open, self.combo_sftp_open, self.combo_ftp_open,
                  self.combo_baud):
            w.connect("changed", lambda _, *a: self._schedule_cmd_preview())
        for w in (self.chk_x11, self.chk_compression, self.chk_keepalive,
                  self.chk_strict_host, self.chk_agent_forward,
                  self.chk_rdp_fs, self.chk_rdp_clip, self.chk_rdp_drives,
                  self.chk_ftp_tls, self.chk_ftp_passive):
            w.connect("toggled", lambda _, *a: self._schedule_cmd_preview())

    # ------------------------------------------------------------------
    # Validazione e raccolta dati
    # ------------------------------------------------------------------

    def _validate(self) -> bool:
        nome = self.entry_nome.get_text().strip()
        proto = PROTOCOLLI[self.combo_proto.get_active()]
        if not nome:
            self.entry_nome.grab_focus()
            ctx = self.entry_nome.get_style_context()
            ctx.add_class("error")
            GLib.timeout_add(2000, lambda: ctx.remove_class("error"))
            return False
        if proto != "serial" and proto != "exec" and not self.entry_host.get_text().strip():
            self.entry_host.grab_focus()
            ctx = self.entry_host.get_style_context()
            ctx.add_class("error")
            GLib.timeout_add(2000, lambda: ctx.remove_class("error"))
            return False
        if proto not in ("serial", "exec"):
            port_str = self.entry_port.get_text().strip()
            if port_str:
                try:
                    port_num = int(port_str)
                    if port_num < 1 or port_num > 65535:
                        self._warn_validazione(
                            self.entry_port, t("sd.val.port_range"))
                        return False
                except ValueError:
                    self._warn_validazione(
                        self.entry_port, t("sd.val.port_invalid"))
                    return False
        if proto == "file_transfer":
            ft_proto = self.combo_ft_proto.get_active_text() or "SFTP"
            if ft_proto == "SFTP":
                pkey = self.entry_pkey.get_text().strip()
                pwd  = self.entry_password.get_text()
                if not pkey and not pwd:
                    self._warn_validazione(
                        self.entry_password, t("sd.val.sftp_no_cred"))
        return True

    def _on_response(self, dialog, response_id):
        if response_id == Gtk.ResponseType.CANCEL:
            return
        if response_id == 102:
            self.stop_emission_by_name("response")
            self._test_connection()
            return
        if not self._validate():
            self.stop_emission_by_name("response")
            return
        if response_id == Gtk.ResponseType.APPLY:
            self.stop_emission_by_name("response")

    def get_data(self) -> tuple[str, dict]:
        proto = PROTOCOLLI[self.combo_proto.get_active()]
        gruppo_child = self.combo_gruppo.get_child()
        gruppo = gruppo_child.get_text().strip() if gruppo_child else ""
        buf = self._textview_notes.get_buffer()
        notes = buf.get_text(buf.get_start_iter(), buf.get_end_iter(), True)

        macros = []
        for row in self._macro_store:
            macros.append({"nome": row[0], "cmd": row[1]})

        expect_rules = []
        for row in self._expect_store:
            expect_rules.append({
                "pattern": row[0],
                "command": row[1],
                "max_trigger": row[2],
                "delay": row[3],
            })

        ft_proto = self.combo_ft_proto.get_active_text() or "SFTP"

        d = {
            "protocol":       proto,
            "group":          gruppo,
            "host":           self.entry_host.get_text().strip(),
            "port":           self.entry_port.get_text().strip(),
            "user":           self.entry_user.get_text().strip(),
            "password":       self.entry_password.get_text(),
            "private_key":    self.entry_pkey.get_text().strip(),
            "totp_secret":    self.entry_totp_secret.get_text().strip(),
            "tags":           self.entry_tags.get_text().strip(),
            "is_template":    self.chk_is_template.get_active(),
            "template_name":  self.combo_template.get_active_text() or "",
            "jump_host":      self.entry_jump_host.get_text().strip(),
            "jump_user":      self.entry_jump_user.get_text().strip(),
            "jump_port":      self.entry_jump_port.get_text().strip(),
            "term_theme":     self.combo_tema.get_active_text() or "Dark (Default)",
            "term_font":      (self.combo_font.get_child().get_text()
                               if self.combo_font.get_child() else "Monospace"),
            "term_size":      int(self.spin_font_size.get_value()),
            "startup_cmd":    self.entry_startup_cmd.get_text().strip(),
            "sftp_browser":   self.chk_panel_sftp_side.get_active(),
            "mon_ssh_port":   int(self.spin_panels_ssh_port.get_value()),
            "panel_cpu_mem":   self.chk_panel_cpu_mem.get_active(),
            "panel_processes": self.chk_panel_processes.get_active(),
            "panel_disk":      self.chk_panel_disk.get_active(),
            "panel_network":   self.chk_panel_network.get_active(),
            "panel_log":       self.chk_panel_log.get_active(),
            "log_output":     self.chk_log.get_active(),
            "log_dir":        self.entry_log_dir.get_text().strip(),
            "paste_on_right_click": self.chk_paste_right.get_active(),
            "term_scrollback_lines": int(self.spin_scrollback_lines.get_value()),
            "term_infinite_scrollback": self.chk_infinite_scrollback.get_active(),
            "term_encoding":  self.combo_encoding.get_active_text() or "UTF-8",
            "term_bell":      ["none", "audible", "visual"][max(0, self.combo_bell.get_active())],
            "term_confirm_close": self.chk_confirm_close.get_active(),
            "term_warn_paste": self.chk_warn_paste.get_active(),
            "auto_reconnect":  self.chk_auto_reconnect.get_active(),
            "reconnect_delay": int(self.spin_reconnect_delay.get_value()),
            "x11":            self.chk_x11.get_active(),
            "compression":    self.chk_compression.get_active(),
            "keepalive":      self.chk_keepalive.get_active(),
            "keepalive_interval": int(self.spin_keepalive_interval.get_value()),
            "strict_host":    self.chk_strict_host.get_active(),
            "agent_forward":  self.chk_agent_forward.get_active(),
            "rdp_client":     self.combo_rdp_client.get_active_text() or "xfreerdp",
            "rdp_auth":       "kerberos" if self.combo_rdp_auth.get_active() == 1 else "ntlm",
            "fullscreen":     self.chk_rdp_fs.get_active(),
            "redirect_clipboard": self.chk_rdp_clip.get_active(),
            "redirect_drives":    self.chk_rdp_drives.get_active(),
            "rdp_domain":     self.entry_rdp_domain.get_text().strip(),
            "rdp_open_mode":  (protocols.MODE_INTERNAL if self.combo_rdp_open.get_active() == 1
                               else protocols.MODE_EXTERNAL),
            "rdp_monitor_mode": {0: "single", 1: "all", 2: "custom"}.get(
                self.combo_rdp_monitor.get_active(), "single"),
            "rdp_monitor_ids":  self.entry_rdp_monitor_ids.get_text().strip(),
            "exec_cmd":       self.entry_exec_cmd.get_text().strip(),
            "vnc_internal":   self.combo_vnc_mode.get_active() == 1,
            "vnc_client":     self.combo_vnc_client.get_active_text() or "vncviewer",
            "vnc_color":      self.combo_vnc_color.get_active(),
            "vnc_quality":    self.combo_vnc_quality.get_active(),
            "ssh_open_mode":  (protocols.MODE_INTERNAL if self.combo_ssh_open.get_active() == 0
                               else protocols.MODE_EXTERNAL),
            "sftp_open_mode": _combo_idx_to_sftp_mode(self.combo_sftp_open),
            "ftp_open_mode":  _combo_idx_to_ftp_mode(self.combo_ftp_open),
            "ft_protocol":    ft_proto,
            "ftp_tls":        self.chk_ftp_tls.get_active(),
            "ftp_passive":    self.chk_ftp_passive.get_active(),
            "tunnel_type":    _combo_idx_to_tunnel(self.combo_tunnel_type),
            "tunnel_local_port": self.entry_tunnel_lport.get_text().strip(),
            "tunnel_remote_host": self.entry_tunnel_rhost.get_text().strip(),
            "tunnel_remote_port": self.entry_tunnel_rport.get_text().strip(),
            "device":         self.entry_serial_dev.get_text().strip(),
            "baud":           self.combo_baud.get_active_text() or "115200",
            "data_bits":      self.combo_data_bits.get_active_text() or "8",
            "parity":         self.combo_parity.get_active_text() or "None",
            "stop_bits":      self.combo_stop_bits.get_active_text() or "1",
            "terminal_type":  self.combo_term_ext.get_active_text() or t("sd.open_int_terminal"),
            "wol_enabled":    self.chk_wol.get_active(),
            "wol_mac":        self.entry_wol_mac.get_text().strip(),
            "wol_wait":       int(self.spin_wol_wait.get_value()),
            "pre_cmd":        self.entry_pre_cmd.get_text().strip(),
            "pre_cmd_timeout": int(self.spin_pre_cmd_timeout.get_value()),
            "notes":          notes,
            "macros":         macros,
            "expect_rules":   expect_rules,
            "credential_profile": self.combo_credential_profile.get_active_id() or "",
        }

        # Conserva campi legacy compatibilità che esistevano già
        if proto == "file_transfer" and ft_proto == "SFTP":
            d["private_key"] = self.entry_pkey.get_text().strip()
            for f in ("jump_host", "jump_user", "jump_port", "strict_host",
                      "keepalive", "agent_forward"):
                if f in d:
                    pass

        # Raccogli campi dai plugin
        try:
            from plugins.plugin_base import pcm_get_protocol_plugins
            pplugin = pcm_get_protocol_plugins().get(proto)
            if pplugin and hasattr(pplugin, 'on_dialog_save'):
                d = pplugin.on_dialog_save(d)
        except Exception as e:
            _get_log(__name__).debug("Plugin on_dialog_save fallito: %s", e)

        # Filtra solo i campi rilevanti per il protocollo
        allowed = protocols.PROTO_FIELDS.get(proto, set(d.keys()))
        d = {k: v for k, v in d.items() if k in allowed}

        return self.entry_nome.get_text().strip(), d