feat: convert wake-on-lan into a plugin (B20)

src/backend/database/database.ts

@@ -819,7 +819,6 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
           socks5_password TEXT,
           socks5_proxy_chain TEXT,
           domain TEXT,
-          mac_address TEXT,
           port_knock_sequence TEXT,
           created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
           updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
@@ -928,8 +927,8 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
       const sshHosts =
         await createCurrentHostRepository().listDecryptedByUserId(userId);
       const insertHost = exportDb.prepare(`
-        INSERT INTO ssh_data (id, user_id, connection_type, name, ip, port, username, folder, tags, pin, auth_type, force_keyboard_interactive, password, key, key_password, key_type, sudo_password, autostart_password, autostart_key, autostart_key_password, credential_id, override_credential_username, enable_terminal, enable_tunnel, tunnel_connections, jump_hosts, enable_file_manager, enable_web_ui, show_terminal_in_sidebar, show_file_manager_in_sidebar, show_tunnel_in_sidebar, show_docker_in_sidebar, show_server_stats_in_sidebar, default_path, status_check_enabled, status_check_interval, web_ui_config, terminal_config, quick_actions, notes, use_socks5, socks5_host, socks5_port, socks5_username, socks5_password, socks5_proxy_chain, domain, mac_address, port_knock_sequence, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        INSERT INTO ssh_data (id, user_id, connection_type, name, ip, port, username, folder, tags, pin, auth_type, force_keyboard_interactive, password, key, key_password, key_type, sudo_password, autostart_password, autostart_key, autostart_key_password, credential_id, override_credential_username, enable_terminal, enable_tunnel, tunnel_connections, jump_hosts, enable_file_manager, enable_web_ui, show_terminal_in_sidebar, show_file_manager_in_sidebar, show_tunnel_in_sidebar, show_docker_in_sidebar, show_server_stats_in_sidebar, default_path, status_check_enabled, status_check_interval, web_ui_config, terminal_config, quick_actions, notes, use_socks5, socks5_host, socks5_port, socks5_username, socks5_password, socks5_proxy_chain, domain, port_knock_sequence, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `);
 
       for (const decrypted of sshHosts) {
@@ -981,7 +980,6 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
           decrypted.socks5Password || null,
           decrypted.socks5ProxyChain || null,
           decrypted.domain || null,
-          decrypted.macAddress || null,
           decrypted.portKnockSequence || null,
           decrypted.createdAt,
           decrypted.updatedAt,

src/backend/database/db/index.ts

@@ -1473,7 +1473,6 @@ const migrateSchema = () => {
     { column: "host_key_first_seen", sql: "ALTER TABLE ssh_data ADD COLUMN host_key_first_seen TEXT" },
     { column: "host_key_last_verified", sql: "ALTER TABLE ssh_data ADD COLUMN host_key_last_verified TEXT" },
     { column: "host_key_changed_count", sql: "ALTER TABLE ssh_data ADD COLUMN host_key_changed_count INTEGER NOT NULL DEFAULT 0" },
-    { column: "mac_address", sql: "ALTER TABLE ssh_data ADD COLUMN mac_address TEXT" },
     { column: "port_knock_sequence", sql: "ALTER TABLE ssh_data ADD COLUMN port_knock_sequence TEXT" },
     { column: "enable_ssh", sql: "ALTER TABLE ssh_data ADD COLUMN enable_ssh INTEGER NOT NULL DEFAULT 1" },
     { column: "ssh_port", sql: "ALTER TABLE ssh_data ADD COLUMN ssh_port INTEGER DEFAULT 22" },
@@ -1486,7 +1485,6 @@ const migrateSchema = () => {
     { column: "telnet_password", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_password TEXT" },
     { column: "rdp_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN rdp_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
     { column: "vnc_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN vnc_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
-    { column: "wol_broadcast_address", sql: "ALTER TABLE ssh_data ADD COLUMN wol_broadcast_address TEXT" },
     { column: "use_warpgate", sql: "ALTER TABLE ssh_data ADD COLUMN use_warpgate INTEGER NOT NULL DEFAULT 0" },
     { column: "telnet_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
     { column: "rdp_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN rdp_auth_type TEXT" },

src/backend/database/db/schema.mysql.ts

@@ -332,8 +332,6 @@ export const hosts = mysqlTable(
     // Ignored for rdp/vnc/telnet, which always require the remote server.
     connectionOrigin: text("connection_origin"),
 
-    macAddress: text("mac_address"),
-    wolBroadcastAddress: text("wol_broadcast_address"),
     portKnockSequence: text("port_knock_sequence"),
 
     hostKeyFingerprint: text("host_key_fingerprint"),

src/backend/database/db/schema.pg.ts

@@ -333,8 +333,6 @@ export const hosts = pgTable(
     // Ignored for rdp/vnc/telnet, which always require the remote server.
     connectionOrigin: text("connection_origin"),
 
-    macAddress: text("mac_address"),
-    wolBroadcastAddress: text("wol_broadcast_address"),
     portKnockSequence: text("port_knock_sequence"),
 
     hostKeyFingerprint: text("host_key_fingerprint"),

src/backend/database/db/schema.ts

@@ -325,8 +325,6 @@ export const hosts = sqliteTable(
     // Ignored for rdp/vnc/telnet, which always require the remote server.
     connectionOrigin: text("connection_origin"),
 
-    macAddress: text("mac_address"),
-    wolBroadcastAddress: text("wol_broadcast_address"),
     portKnockSequence: text("port_knock_sequence"),
 
     hostKeyFingerprint: text("host_key_fingerprint"),

src/backend/database/routes/host-network-routes.ts

@@ -1,9 +1,7 @@
 import { getErrorMessage } from "../../utils/error-message.js";
 import type { AuthenticatedRequest } from "../../../types/index.js";
-import type { Request, RequestHandler, Response, Router } from "express";
-import { sendWakeOnLan, isValidMac } from "../../utils/wake-on-lan.js";
+import type { RequestHandler, Response, Router } from "express";
 import { sshLogger } from "../../utils/logger.js";
-import { createCurrentHostResolutionRepository } from "../repositories/factory.js";
 
 interface HostNetworkRoutesDeps {
   authenticateJWT: RequestHandler;
@@ -95,54 +93,4 @@ export function registerHostNetworkRoutes(
       }
     },
   );
-
-  router.post(
-    "/db/host/:id/wake",
-    authenticateJWT,
-    requireViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      const hostId = Number.parseInt(String(req.params.id), 10);
-      const userId = (req as AuthenticatedRequest).userId;
-
-      try {
-        const host = await createCurrentHostResolutionRepository().findHostById(
-          hostId,
-          userId,
-        );
-
-        if (!host || host.userId !== userId) {
-          return res.status(404).json({ error: "Host not found" });
-        }
-
-        if (!host.macAddress || !isValidMac(host.macAddress)) {
-          return res
-            .status(400)
-            .json({ error: "No valid MAC address configured" });
-        }
-
-        await sendWakeOnLan(
-          host.macAddress,
-          host.wolBroadcastAddress ?? undefined,
-        );
-
-        sshLogger.info("Wake-on-LAN packet sent", {
-          operation: "wake_on_lan",
-          userId,
-          hostId,
-        });
-
-        res.json({ success: true });
-      } catch (error) {
-        sshLogger.error("Wake-on-LAN failed", error, {
-          operation: "wake_on_lan",
-          userId,
-          hostId,
-        });
-        res.status(500).json({
-          error: getErrorMessage(error, "Failed to send WoL packet"),
-        });
-      }
-    },
-  );
 }

src/backend/database/routes/host.ts

@@ -227,8 +227,6 @@ router.post(
       connectionOrigin,
       portKnockSequence,
       overrideCredentialUsername,
-      macAddress,
-      wolBroadcastAddress,
       enableSsh,
       sshPort,
       rdpAuthType,
@@ -358,8 +356,6 @@ router.post(
         connectionOrigin === "local" || connectionOrigin === "remote"
           ? connectionOrigin
           : null,
-      macAddress: macAddress || null,
-      wolBroadcastAddress: wolBroadcastAddress || null,
       portKnockSequence: portKnockSequence
         ? JSON.stringify(portKnockSequence)
         : null,
@@ -908,8 +904,6 @@ router.put(
       connectionOrigin,
       portKnockSequence,
       overrideCredentialUsername,
-      macAddress,
-      wolBroadcastAddress,
       enableSsh,
       sshPort,
       rdpAuthType,
@@ -1040,8 +1034,6 @@ router.put(
         connectionOrigin === "local" || connectionOrigin === "remote"
           ? connectionOrigin
           : null,
-      macAddress: macAddress || null,
-      wolBroadcastAddress: wolBroadcastAddress || null,
       portKnockSequence: portKnockSequence
         ? JSON.stringify(portKnockSequence)
         : null,

src/backend/starter.ts

@@ -401,6 +401,10 @@ async function provisionLocalDesktopUserIfNeeded(): Promise<void> {
       const { runAiSettingsMigration } =
         await import("./utils/crypto-migration/ai-settings-migration.js");
       await runAiSettingsMigration();
+
+      const { runWakeOnLanSettingsMigration } =
+        await import("./utils/crypto-migration/wake-on-lan-settings-migration.js");
+      await runWakeOnLanSettingsMigration();
     } catch (error) {
       systemLogger.warn("Plugin runtime failed to initialize", {
         operation: "plugin_init",

src/backend/tests/utils/wake-on-lan-settings-migration.test.ts

@@ -0,0 +1,190 @@
+/**
+ * The Wake-on-LAN host settings migration.
+ *
+ * An upgrade must be lossless: every host with a MAC address or a broadcast
+ * address must come through into the wake-on-lan plugin's host settings.
+ * Running it twice must not duplicate or clobber what it moved.
+ */
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+  pluginRows: [] as Array<{
+    pluginId: string;
+    scope: string;
+    scopeId: string | null;
+    key: string;
+    value: string | null;
+  }>,
+  hostRows: [] as Array<Record<string, unknown>>,
+  pluginInstalled: true,
+  columnsGone: false,
+}));
+
+vi.mock("../../database/repositories/factory.js", () => ({
+  createCurrentPluginRepository: () => ({
+    findById: async (id: string) =>
+      state.pluginInstalled && id === "wake-on-lan" ? { id } : null,
+  }),
+  createCurrentPluginSettingsRepository: () => ({
+    getAll: async (_pluginId: string, scope: string, scopeId: string | null) =>
+      state.pluginRows.filter(
+        (row) => row.scope === scope && row.scopeId === scopeId,
+      ),
+    set: async (
+      pluginId: string,
+      scope: string,
+      scopeId: string | null,
+      key: string,
+      value: string | null,
+    ) => {
+      const existing = state.pluginRows.find(
+        (row) =>
+          row.scope === scope && row.scopeId === scopeId && row.key === key,
+      );
+      if (existing) {
+        existing.value = value;
+        return;
+      }
+      state.pluginRows.push({ pluginId, scope, scopeId, key, value });
+    },
+  }),
+}));
+
+vi.mock("../../utils/crypto-migration/raw-rows.js", () => ({
+  selectRows: async () => {
+    if (state.columnsGone) throw new Error("no such column: mac_address");
+    return state.hostRows;
+  },
+}));
+
+vi.mock("../../utils/logger.js", () => ({
+  databaseLogger: { info: vi.fn(), warn: vi.fn() },
+}));
+
+import {
+  wakeOnLanSettingsFromRow,
+  runWakeOnLanSettingsMigration,
+} from "../../utils/crypto-migration/wake-on-lan-settings-migration.js";
+
+const hostValues = (hostId: number) =>
+  Object.fromEntries(
+    state.pluginRows
+      .filter((row) => row.scope === "host" && row.scopeId === String(hostId))
+      .map((row) => [row.key, JSON.parse(row.value ?? "null")]),
+  );
+
+beforeEach(() => {
+  state.pluginRows = [];
+  state.hostRows = [];
+  state.pluginInstalled = true;
+  state.columnsGone = false;
+});
+
+describe("wakeOnLanSettingsFromRow", () => {
+  it("carries over a MAC address", () => {
+    expect(
+      wakeOnLanSettingsFromRow({
+        id: 1,
+        mac_address: "aa:bb:cc:dd:ee:ff",
+        wol_broadcast_address: null,
+      }),
+    ).toEqual({ macAddress: "aa:bb:cc:dd:ee:ff" });
+  });
+
+  it("carries over a broadcast address alongside the MAC address", () => {
+    expect(
+      wakeOnLanSettingsFromRow({
+        id: 1,
+        mac_address: "aa:bb:cc:dd:ee:ff",
+        wol_broadcast_address: "192.168.1.255",
+      }),
+    ).toEqual({
+      macAddress: "aa:bb:cc:dd:ee:ff",
+      broadcastAddress: "192.168.1.255",
+    });
+  });
+
+  it("produces nothing for a host with neither set", () => {
+    expect(
+      wakeOnLanSettingsFromRow({
+        id: 1,
+        mac_address: null,
+        wol_broadcast_address: null,
+      }),
+    ).toEqual({});
+  });
+});
+
+describe("runWakeOnLanSettingsMigration", () => {
+  it("moves every host's wake-on-lan settings and skips hosts with nothing set", async () => {
+    state.hostRows = [
+      { id: 1, mac_address: "aa:bb:cc:dd:ee:ff", wol_broadcast_address: null },
+      {
+        id: 2,
+        mac_address: "11:22:33:44:55:66",
+        wol_broadcast_address: "192.168.1.255",
+      },
+      { id: 3, mac_address: null, wol_broadcast_address: null },
+    ];
+
+    const result = await runWakeOnLanSettingsMigration();
+
+    expect(result).toEqual({ hostsMoved: 2, hostsSkipped: 0 });
+    expect(hostValues(1)).toEqual({ macAddress: "aa:bb:cc:dd:ee:ff" });
+    expect(hostValues(2)).toEqual({
+      macAddress: "11:22:33:44:55:66",
+      broadcastAddress: "192.168.1.255",
+    });
+    expect(hostValues(3)).toEqual({});
+  });
+
+  it("changes nothing when run twice", async () => {
+    state.hostRows = [
+      { id: 1, mac_address: "aa:bb:cc:dd:ee:ff", wol_broadcast_address: null },
+    ];
+    await runWakeOnLanSettingsMigration();
+    const before = JSON.stringify(state.pluginRows);
+
+    const second = await runWakeOnLanSettingsMigration();
+
+    expect(second).toEqual({ hostsMoved: 0, hostsSkipped: 1 });
+    expect(JSON.stringify(state.pluginRows)).toBe(before);
+  });
+
+  it("keeps a value already saved in the plugin", async () => {
+    state.pluginRows.push({
+      pluginId: "wake-on-lan",
+      scope: "host",
+      scopeId: "1",
+      key: "macAddress",
+      value: JSON.stringify("11:11:11:11:11:11"),
+    });
+    state.hostRows = [
+      { id: 1, mac_address: "aa:bb:cc:dd:ee:ff", wol_broadcast_address: null },
+    ];
+
+    await runWakeOnLanSettingsMigration();
+
+    expect(hostValues(1)).toEqual({ macAddress: "11:11:11:11:11:11" });
+  });
+
+  it("does nothing before the plugin row exists or once the columns are gone", async () => {
+    state.hostRows = [
+      { id: 1, mac_address: "aa:bb:cc:dd:ee:ff", wol_broadcast_address: null },
+    ];
+    state.pluginInstalled = false;
+    expect(await runWakeOnLanSettingsMigration()).toEqual({
+      hostsMoved: 0,
+      hostsSkipped: 0,
+    });
+
+    state.pluginInstalled = true;
+    state.columnsGone = true;
+    expect(await runWakeOnLanSettingsMigration()).toEqual({
+      hostsMoved: 0,
+      hostsSkipped: 0,
+    });
+    expect(state.pluginRows).toEqual([]);
+  });
+});

src/backend/tests/utils/wake-on-lan.test.ts

@@ -1,120 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-vi.mock("dgram", () => {
-  const socket = {
-    once: vi.fn(),
-    bind: vi.fn(),
-    setBroadcast: vi.fn(),
-    send: vi.fn(),
-    close: vi.fn(),
-  };
-  return { default: { createSocket: vi.fn(() => socket) } };
-});
-
-import dgram from "dgram";
-import {
-  isValidMac,
-  buildMagicPacket,
-  sendWakeOnLan,
-} from "../../utils/wake-on-lan.js";
-
-describe("isValidMac", () => {
-  it("accepts colon-separated MAC addresses", () => {
-    expect(isValidMac("01:23:45:67:89:AB")).toBe(true);
-    expect(isValidMac("aa:bb:cc:dd:ee:ff")).toBe(true);
-  });
-
-  it("accepts hyphen-separated MAC addresses", () => {
-    expect(isValidMac("01-23-45-67-89-AB")).toBe(true);
-  });
-
-  it("rejects malformed MAC addresses", () => {
-    expect(isValidMac("")).toBe(false);
-    expect(isValidMac("01:23:45:67:89")).toBe(false);
-    expect(isValidMac("01:23:45:67:89:AB:CD")).toBe(false);
-    expect(isValidMac("0123456789AB")).toBe(false);
-    expect(isValidMac("zz:23:45:67:89:ab")).toBe(false);
-    expect(isValidMac("01:23:45:67:89:AB ")).toBe(false);
-  });
-});
-
-describe("buildMagicPacket", () => {
-  it("produces a 102-byte packet", () => {
-    const packet = buildMagicPacket("01:23:45:67:89:AB");
-    expect(packet.length).toBe(102);
-  });
-
-  it("starts with six 0xFF bytes", () => {
-    const packet = buildMagicPacket("01:23:45:67:89:AB");
-    expect([...packet.subarray(0, 6)]).toEqual([
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-    ]);
-  });
-
-  it("repeats the MAC bytes 16 times after the header", () => {
-    const packet = buildMagicPacket("01:23:45:67:89:AB");
-    const mac = Buffer.from([0x01, 0x23, 0x45, 0x67, 0x89, 0xab]);
-    for (let i = 0; i < 16; i++) {
-      const offset = 6 + i * 6;
-      expect([...packet.subarray(offset, offset + 6)]).toEqual([...mac]);
-    }
-  });
-
-  it("treats colon and hyphen separators identically", () => {
-    const colon = buildMagicPacket("aa:bb:cc:dd:ee:ff");
-    const hyphen = buildMagicPacket("aa-bb-cc-dd-ee-ff");
-    expect(colon.equals(hyphen)).toBe(true);
-  });
-});
-
-describe("sendWakeOnLan", () => {
-  let mockSocket: ReturnType<typeof dgram.createSocket>;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSocket = (dgram.createSocket as ReturnType<typeof vi.fn>)();
-    (mockSocket.bind as ReturnType<typeof vi.fn>).mockImplementation(
-      (cb: () => void) => cb(),
-    );
-    (mockSocket.send as ReturnType<typeof vi.fn>).mockImplementation(
-      (
-        _buf: unknown,
-        _off: unknown,
-        _len: unknown,
-        _port: unknown,
-        _addr: unknown,
-        cb: (err: null) => void,
-      ) => cb(null),
-    );
-  });
-
-  it("rejects on invalid MAC address", async () => {
-    await expect(sendWakeOnLan("not-a-mac")).rejects.toThrow(
-      "Invalid MAC address",
-    );
-  });
-
-  it("sends to 255.255.255.255 by default", async () => {
-    await sendWakeOnLan("aa:bb:cc:dd:ee:ff");
-    expect(mockSocket.send).toHaveBeenCalledWith(
-      expect.any(Buffer),
-      0,
-      102,
-      9,
-      "255.255.255.255",
-      expect.any(Function),
-    );
-  });
-
-  it("sends to a custom broadcast address when provided", async () => {
-    await sendWakeOnLan("aa:bb:cc:dd:ee:ff", "192.168.1.255");
-    expect(mockSocket.send).toHaveBeenCalledWith(
-      expect.any(Buffer),
-      0,
-      102,
-      9,
-      "192.168.1.255",
-      expect.any(Function),
-    );
-  });
-});

src/backend/utils/crypto-migration/wake-on-lan-settings-migration.ts

@@ -0,0 +1,113 @@
+/**
+ * Moves each host's Wake-on-LAN settings out of ssh_data and into the
+ * wake-on-lan plugin's host settings: mac_address becomes macAddress and
+ * wol_broadcast_address becomes broadcastAddress.
+ *
+ * The columns stay in the database, unused: core's drizzle migrations run
+ * before this does, so dropping them there would lose the data first.
+ *
+ * Idempotent: a host that already has any wake-on-lan row is skipped, so
+ * this is safe on every boot.
+ */
+
+import { sql } from "drizzle-orm";
+import { databaseLogger } from "../logger.js";
+import {
+  createCurrentPluginRepository,
+  createCurrentPluginSettingsRepository,
+} from "../../database/repositories/factory.js";
+import { selectRows } from "./raw-rows.js";
+
+const PLUGIN_ID = "wake-on-lan";
+
+interface LegacyHostRow {
+  id: number;
+  mac_address: string | null;
+  wol_broadcast_address: string | null;
+}
+
+/** The plugin's host settings for one legacy row, defaults left out. */
+export function wakeOnLanSettingsFromRow(
+  row: LegacyHostRow,
+): Record<string, unknown> {
+  const values: Record<string, unknown> = {};
+  if (row.mac_address) values.macAddress = row.mac_address;
+  if (row.wol_broadcast_address) {
+    values.broadcastAddress = row.wol_broadcast_address;
+  }
+  return values;
+}
+
+export interface WakeOnLanSettingsMigrationResult {
+  hostsMoved: number;
+  hostsSkipped: number;
+}
+
+export async function runWakeOnLanSettingsMigration(): Promise<WakeOnLanSettingsMigrationResult> {
+  const result: WakeOnLanSettingsMigrationResult = {
+    hostsMoved: 0,
+    hostsSkipped: 0,
+  };
+
+  // plugin_settings has a foreign key to plugins: nothing to migrate into
+  // until the plugin row exists.
+  try {
+    const plugin = await createCurrentPluginRepository().findById(PLUGIN_ID);
+    if (!plugin) return result;
+  } catch {
+    return result;
+  }
+
+  const pluginSettings = createCurrentPluginSettingsRepository();
+
+  let rows: LegacyHostRow[];
+  try {
+    // Raw SQL: schema.ts no longer declares these columns.
+    rows = await selectRows<LegacyHostRow>(
+      sql`SELECT id, mac_address, wol_broadcast_address FROM ssh_data`,
+    );
+  } catch {
+    // A fresh install never had the columns.
+    return result;
+  }
+
+  for (const row of rows) {
+    const values = wakeOnLanSettingsFromRow(row);
+    if (Object.keys(values).length === 0) continue;
+    const scopeId = String(row.id);
+    try {
+      const existing = await pluginSettings.getAll(PLUGIN_ID, "host", scopeId);
+      if (existing.length > 0) {
+        result.hostsSkipped++;
+        continue;
+      }
+      for (const [key, value] of Object.entries(values)) {
+        await pluginSettings.set(
+          PLUGIN_ID,
+          "host",
+          scopeId,
+          key,
+          JSON.stringify(value),
+        );
+      }
+      result.hostsMoved++;
+    } catch (error) {
+      databaseLogger.warn(
+        "Wake-on-LAN host settings migration failed for a host",
+        {
+          operation: "wake_on_lan_settings_migration",
+          hostId: row.id,
+          error: error instanceof Error ? error.message : String(error),
+        },
+      );
+    }
+  }
+
+  if (result.hostsMoved > 0) {
+    databaseLogger.info(
+      `Moved Wake-on-LAN settings for ${result.hostsMoved} host(s) into plugin settings`,
+      { operation: "wake_on_lan_settings_migration" },
+    );
+  }
+  return result;
+}

src/backend/utils/wake-on-lan.ts

@@ -1,49 +0,0 @@
-import dgram from "dgram";
-
-const MAC_REGEX = /^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$/;
-
-function parseMac(mac: string): Buffer {
-  return Buffer.from(mac.replace(/[:-]/g, ""), "hex");
-}
-
-export function buildMagicPacket(mac: string): Buffer {
-  const macBytes = parseMac(mac);
-  const packet = Buffer.alloc(102);
-  packet.fill(0xff, 0, 6);
-  for (let i = 0; i < 16; i++) {
-    macBytes.copy(packet, 6 + i * 6);
-  }
-  return packet;
-}
-
-export function isValidMac(mac: string): boolean {
-  return MAC_REGEX.test(mac);
-}
-
-export function sendWakeOnLan(
-  mac: string,
-  broadcastAddress = "255.255.255.255",
-): Promise<void> {
-  return new Promise((resolve, reject) => {
-    if (!isValidMac(mac)) {
-      return reject(new Error("Invalid MAC address"));
-    }
-
-    const packet = buildMagicPacket(mac);
-    const socket = dgram.createSocket("udp4");
-
-    socket.once("error", (err) => {
-      socket.close();
-      reject(err);
-    });
-
-    socket.bind(() => {
-      socket.setBroadcast(true);
-      socket.send(packet, 0, packet.length, 9, broadcastAddress, (err) => {
-        socket.close();
-        if (err) reject(err);
-        else resolve();
-      });
-    });
-  });
-}

src/types/index.ts

@@ -238,8 +238,6 @@ export type Host = {
   socks5Password?: string;
   socks5ProxyChain?: ProxyNode[];
 
-  macAddress?: string;
-  wolBroadcastAddress?: string;
   portKnockSequence?: Array<{
     port: number;
     protocol?: "tcp" | "udp";
@@ -392,8 +390,6 @@ export interface HostData {
   socks5Password?: string;
   socks5ProxyChain?: ProxyNode[];
 
-  macAddress?: string;
-  wolBroadcastAddress?: string;
   portKnockSequence?: Array<{
     port: number;
     protocol?: "tcp" | "udp";

src/types/ui-types.ts

@@ -48,8 +48,6 @@ export type Host = {
   keyPassword?: string;
   keyType?: string;
   notes?: string;
-  macAddress?: string;
-  wolBroadcastAddress?: string;
   pin?: boolean;
   sortOrder?: number | null;
 

src/ui/api/ssh-host-management-api.ts

@@ -126,15 +126,6 @@ export async function updateSSHHost(
   }
 }
 
-export async function wakeOnLan(hostId: number): Promise<{ success: boolean }> {
-  try {
-    const response = await sshHostApi.post(`/db/host/${hostId}/wake`);
-    return response.data;
-  } catch (error) {
-    throw handleApiError(error, "wake on LAN");
-  }
-}
-
 export async function bulkImportSSHHosts(
   hosts: SSHHostData[],
   overwrite = false,

src/ui/locales/en.json

@@ -570,9 +570,6 @@
     "secureShell": "Secure Shell",
     "addressIp": "Address / IP",
     "friendlyName": "Friendly Name",
-    "macAddress": "MAC Address",
-    "wolBroadcastAddress": "WoL Broadcast Address",
-    "wolBroadcastAddressDesc": "Optional directed broadcast for Docker/routed networks (e.g. 192.168.1.255). Leave empty to use 255.255.255.255.",
     "folderAndAdvanced": "Folder & Advanced",
     "showAdvancedSettings": "Show advanced settings",
     "hideAdvancedSettings": "Hide advanced settings",
@@ -971,9 +968,6 @@
     "remoteDesktopUrlCopied": "Remote Desktop URL copied",
     "expandActions": "Expand actions",
     "collapseActions": "Collapse actions",
-    "wakeOnLanAction": "Wake on LAN",
-    "wakeOnLanSuccess": "Magic packet sent to {{name}}",
-    "wakeOnLanError": "Failed to send magic packet",
     "cloneHostAction": "Clone Host",
     "copyAddress": "Copy Address",
     "copyLink": "Copy Link",
@@ -2796,6 +2790,10 @@
         "title": "Accept connections",
         "consequence": "It opens a port on the Termix server."
       },
+      "network:broadcast": {
+        "title": "Send network broadcasts",
+        "consequence": "It can send packets to devices on the local network, such as a Wake-on-LAN signal."
+      },
       "users:read": {
         "title": "See usernames and roles",
         "consequence": "Never password hashes, never two factor state."

src/ui/main-axios.ts

@@ -1340,7 +1340,6 @@ export {
   getSSHHosts,
   createSSHHost,
   updateSSHHost,
-  wakeOnLan,
   bulkImportSSHHosts,
   importSSHConfigHosts,
   discoverProxmoxGuests,

src/ui/sidebar/HostEditorData.ts

@@ -143,8 +143,6 @@ export function createHostEditorForm(
     tagInput: "",
     notes: host?.notes ?? "",
     pin: host?.pin ?? false,
-    macAddress: host?.macAddress ?? "",
-    wolBroadcastAddress: host?.wolBroadcastAddress ?? "",
     useSocks5: host?.useSocks5 ?? d?.useSocks5 ?? false,
     socks5Host: host?.socks5Host ?? d?.socks5Host ?? "",
     socks5Port: host?.socks5Port ?? d?.socks5Port ?? 1080,
@@ -418,8 +416,6 @@ export function buildHostEditorPayload(
       usesVault && form.vaultProfileId ? Number(form.vaultProfileId) : null,
     overrideCredentialUsername: form.overrideCredentialUsername,
     notes: form.notes,
-    macAddress: form.macAddress || null,
-    wolBroadcastAddress: form.wolBroadcastAddress || null,
     enableTerminal: form.enableTerminal,
     enableSessionLogging: form.enableSessionLogging,
     enableCommandHistory: form.enableCommandHistory,

src/ui/sidebar/HostEditorGeneralTab.tsx

@@ -190,45 +190,6 @@ export function HostEditorGeneralTab({
                 onChange={(e) => setField("name", e.target.value)}
               />
             </div>
-            {protocols.enableSsh && !simpleMode && (
-              <div className="flex flex-col gap-1.5">
-                <div className="flex items-center justify-between">
-                  <label className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
-                    {t("hosts.macAddress")}
-                  </label>
-                  <a
-                    href="https://docs.termix.site/features/networking/wake-on-lan"
-                    target="_blank"
-                    rel="noreferrer"
-                    className="text-[10px] text-accent-brand hover:underline"
-                  >
-                    {t("hosts.docsLink")}
-                  </a>
-                </div>
-                <Input
-                  placeholder="AA:BB:CC:DD:EE:FF"
-                  value={form.macAddress}
-                  onChange={(e) => setField("macAddress", e.target.value)}
-                />
-              </div>
-            )}
-            {protocols.enableSsh && !simpleMode && form.macAddress && (
-              <div className="flex flex-col gap-1.5">
-                <label className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
-                  {t("hosts.wolBroadcastAddress")}
-                </label>
-                <Input
-                  placeholder="192.168.1.255"
-                  value={form.wolBroadcastAddress}
-                  onChange={(e) =>
-                    setField("wolBroadcastAddress", e.target.value)
-                  }
-                />
-                <p className="text-[10px] text-muted-foreground/60">
-                  {t("hosts.wolBroadcastAddressDesc")}
-                </p>
-              </div>
-            )}
           </div>
         </div>
       </SectionCard>

src/ui/sidebar/HostManagerData.ts

@@ -85,8 +85,6 @@ export function sshHostToHost(h: SSHHostWithStatus): Host {
     notes: h.notes,
     pin: h.pin ?? false,
     sortOrder: h.sortOrder ?? null,
-    macAddress: h.macAddress,
-    wolBroadcastAddress: h.wolBroadcastAddress,
     connectionOrigin: h.connectionOrigin ?? null,
     enableSsh: h.enableSsh != null ? h.enableSsh : isSshHost,
     enableTerminal:

src/ui/sidebar/tree/HostItem/HostItem.tsx

@@ -22,7 +22,6 @@ import {
   Terminal,
   Trash2,
   Users,
-  Zap,
 } from "lucide-react";
 import {
   DropdownMenu,
@@ -35,7 +34,7 @@ import {
   DropdownMenuTrigger,
 } from "@/components/dropdown-menu";
 import { toast } from "sonner";
-import { getHostPassword, wakeOnLan } from "@/main-axios";
+import { getHostPassword } from "@/main-axios";
 import type { Host, TabType } from "@/types/ui-types";
 import type {
   HostDensity,
@@ -366,16 +365,6 @@ export function HostItem({
     }
   }
 
-  async function handleWakeOnLan(e: MouseEvent) {
-    e.stopPropagation();
-    try {
-      await wakeOnLan(Number(host.id));
-      toast.success(t("hosts.wakeOnLanSuccess", { name: host.name }));
-    } catch {
-      toast.error(t("hosts.wakeOnLanError"));
-    }
-  }
-
   if (query && !hostMatchesQuery(host, query)) return null;
 
   const depthStyle =
@@ -506,15 +495,6 @@ export function HostItem({
         );
         return separator ? [separator, button] : button;
       })}
-      {host.macAddress && (
-        <button
-          title={t("hosts.wakeOnLanAction")}
-          onClick={handleWakeOnLan}
-          className={trayButtonClass}
-        >
-          <Zap className="size-3.5" />
-        </button>
-      )}
     </>
   );
 
@@ -704,12 +684,6 @@ export function HostItem({
               </DropdownMenuItem>
             );
           })}
-          {host.macAddress && (
-            <DropdownMenuItem onClick={handleWakeOnLan}>
-              <Zap className="size-3.5 mr-2" />
-              {t("hosts.wakeOnLanAction")}
-            </DropdownMenuItem>
-          )}
           <DropdownMenuSeparator />
           <DropdownMenuItem
             onClick={(e) => {

src/ui/sidebar/tree/SidebarTree.tsx

@@ -596,7 +596,6 @@ export function SidebarTree({
         tags: host.tags ?? [],
         pin: host.pin ?? false,
         notes: host.notes,
-        macAddress: host.macAddress,
         // Key material is never sent to the frontend, so a cloned key-auth
         // host would have authType "key" with no key — unusable. Reset to
         // password so the clone is in a connectable (editable) state.

src/ui/tests/sidebar/HostManagerData.test.ts

@@ -3,19 +3,6 @@ import type { SSHHostWithStatus } from "@/main-axios";
 import { sshHostToHost } from "@/sidebar/HostManagerData";
 
 describe("sshHostToHost", () => {
-  it("preserves the Wake-on-LAN broadcast address for editing", () => {
-    const host = sshHostToHost({
-      id: 1,
-      name: "server",
-      ip: "192.168.0.10",
-      port: 22,
-      username: "root",
-      wolBroadcastAddress: "192.168.0.255",
-    } as SSHHostWithStatus);
-
-    expect(host.wolBroadcastAddress).toBe("192.168.0.255");
-  });
-
   it.each(["local", "remote"] as const)(
     "preserves the %s connection origin for editing",
     (connectionOrigin) => {

src/ui/tests/sidebar/tree/HostItem/HostItem.test.tsx

@@ -36,7 +36,6 @@ vi.mock("@/hooks/use-status-color-scheme", () => ({
 
 vi.mock("@/main-axios", () => ({
   getHostPassword: vi.fn(),
-  wakeOnLan: vi.fn(),
 }));
 
 import { HostItem } from "../../../../sidebar/tree/HostItem/HostItem";
@@ -64,7 +63,6 @@ const baseHost: Host = {
   enableRdp: true,
   enableVnc: true,
   enableTelnet: true,
-  macAddress: "aa:bb:cc:dd:ee:ff",
   quickActions: [],
 } as unknown as Host;
 
@@ -140,7 +138,6 @@ describe("HostItem density parity", () => {
       0,
     );
     expect(screen.getAllByText("hosts.shareHost").length).toBeGreaterThan(0);
-    expect(screen.getByText("hosts.wakeOnLanAction")).toBeTruthy();
   });
 
   it.each(["comfortable", "compact"] as const)(
@@ -177,14 +174,6 @@ describe("HostItem density parity", () => {
     },
   );
 
-  it.each(["comfortable", "compact"] as const)(
-    "exposes the wake-on-LAN button when a MAC address is set, in %s density",
-    (density) => {
-      renderHostItem(density);
-      expect(screen.getByTitle("hosts.wakeOnLanAction")).toBeTruthy();
-    },
-  );
-
   it.each(["comfortable", "compact"] as const)(
     "exposes the copy-password action in %s density",
     (density) => {