release-2.9.0 (#1532)

* fix(macos): skip single-instance lock in Mac App Store builds (#1454)

fix(macos): skip single-instance lock in Mac App Store builds

* Fix/backend optional sharp (#1455)

Fix/backend optional sharp

* feat: issue #1218 (#1218)

https://github.com/Termix-SSH/Support/issues/1218

* feat: Add option to use saved global custom theme under Connection Defaults (#1209)

https://github.com/Termix-SSH/Support/issues/1209

* feat: Add Fleet Sharing functionality to the UI (#1228)

https://github.com/Termix-SSH/Support/issues/1228

* feat: Add a list view to the Docker management page (#1237)

https://github.com/Termix-SSH/Support/issues/1237

* feat: issue #1264 (#1264)

https://github.com/Termix-SSH/Support/issues/1264

* feat: 2FA With FortiToken (#1288)

https://github.com/Termix-SSH/Support/issues/1288

* feat: Allow to disable showing paths to folders (#1274)

https://github.com/Termix-SSH/Support/issues/1274

* feat: Sync Network Graph between Desktop and Remote Server (#1245)

https://github.com/Termix-SSH/Support/issues/1245

* feat: Version Number on offline servers (#1291)

https://github.com/Termix-SSH/Support/issues/1291

* feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302)

https://github.com/Termix-SSH/Support/issues/1302

* feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289)

https://github.com/Termix-SSH/Support/issues/1289

* fix: Search in side bar shows overlapping hosts when grouped by tags (#1303)

https://github.com/Termix-SSH/Support/issues/1303

* fix: I can't send a file on its own. (#1304)

https://github.com/Termix-SSH/Support/issues/1304

* fix: sudo password not autofilling (#1248)

https://github.com/Termix-SSH/Support/issues/1248

* fix: node-MainThread (#1300)

https://github.com/Termix-SSH/Support/issues/1300

* fix: Tunnel authentication with shared credentials (#1295)

https://github.com/Termix-SSH/Support/issues/1295

* fix: host key updates not syncing, metrics 404 race on first connect

Host key writes never bumped updatedAt so sync never picked them up.
Also retry the first metrics fetch briefly instead of failing right away.

* chore: increment ver

* feat: add category and icon fields to plugin manifest schema

* ci(deps): bump the github-actions group with 2 updates (#1458)

Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script).


Updates `crowdin/github-action` from 2 to 3
- [Release notes](https://github.com/crowdin/github-action/releases)
- [Commits](https://github.com/crowdin/github-action/compare/v2...v3)

Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)

---
updated-dependencies:
- dependency-name: crowdin/github-action
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459)

Bumps the dev-patch-updates group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` |
| [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` |
| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` |


Updates `@codemirror/commands` from 6.11.0 to 6.11.1
- [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/commands/commits)

Updates `@codemirror/search` from 6.7.1 to 6.7.2
- [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/search/commits)

Updates `@codemirror/view` from 6.43.9 to 6.43.12
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.5 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7)

Updates `@types/ssh2` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `cytoscape` from 3.34.1 to 3.34.3
- [Release notes](https://github.com/cytoscape/cytoscape.js/releases)
- [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3)

Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7)

Updates `i18next` from 26.4.0 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2)

Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8)

Updates `react-i18next` from 17.0.12 to 17.0.14
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14)

---
updated-dependencies:
- dependency-name: "@codemirror/commands"
  dependency-version: 6.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@codemirror/search"
  dependency-version: 6.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/dom"
  dependency-version: 10.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@types/ssh2"
  dependency-version: 1.15.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: cytoscape
  dependency-version: 3.34.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: react-i18next
  dependency-version: 17.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump the prod-patch-updates group with 6 updates (#1461)

Bumps the prod-patch-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |


Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)

Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2)

Updates `socks` from 2.8.9 to 2.8.10
- [Release notes](https://github.com/JoshGlazebrook/socks/releases)
- [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10)

Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: socks
  dependency-version: 2.8.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add plugin worker protocol, bootstrap and plugin_storage table

Worker-side ctx proxy plus the message envelope it talks over, and the
per-plugin key/value table behind ctx.storage with migrations for all
three dialects. Rows cascade with the plugin so uninstalling leaves
nothing behind.

* feat: add allowlisted host view for plugins

An allowlist rather than a list of fields to strip. A blocklist rots:
the moment a new secret-bearing column lands on SSHHost it starts
leaking silently. With an allowlist a new field stays invisible to
plugins until someone adds it here on purpose.

* feat: add plugin loader with manifest validation and crash restart

Validates an unpacked plugin, spawns a worker_threads worker and manages
activate/deactivate/crash-restart with backoff, disabling after three
tries.

The crash counter clears only after a plugin stays up past a stability
window, not on activation. Clearing it on activation let a plugin that
activates cleanly and then dies restart forever, because every attempt
looked like the first.

loader.ts documents what the worker boundary does and does not buy you.
Node's permission model is process-wide, not per-worker, so it cannot be
enabled for plugin workers alone and is not claimed here.

* feat: route internal events through a shared plugin event bus

Formalises three ad-hoc publish paths that already existed:
automation-events.ts, metrics/automation-bridge.ts and the
hostSessionStatus singleton, now the host.session.status topic.

Both invariants the old code relied on are preserved. Publishing stays
fire-and-forget, so a failing subscriber cannot disturb a metrics poll or
a host delete. The automations engine subscribes to the bus at scheduler
start instead of being imported ad hoc, which keeps the edge
one-directional: automations may import repositories, hosts modules must
not import automations.

* feat: add plugin ctx broker with permission gate and audit

Every ctx call a plugin makes is checked against its granted
capabilities, performed by the main thread, then audited. A capability
must be both declared in the manifest and granted in the database, so
widening a plugin's reach always needs a new manifest the user can see,
never just a database row.

Audit attribution is set by the broker, not the plugin. The plugin
supplies only the details, so it cannot forge the actor.

fix: stop plugin workers seeing plaintext credentials in error messages

A failing ctx.ssh.connect handed the worker the raw error from deep in
the SSH stack, which embeds the connect config. The worker received, in
full:

  Authentication failed for root using password <SECRET>

where <SECRET> was the host's real plaintext password. Any plugin with
ssh.exec could read it by catching the error, defeating the whole point
of the handle-based ssh API.

Errors crossing the boundary are now sanitised. Only PluginFacingError
and PluginPermissionError, both authored here, reach a plugin verbatim;
anything else becomes a generic message and the real one goes to the
log. This uses a marker class rather than matching on message text,
because matching would start leaking again the moment an upstream error
happened to contain a familiar phrase.

Covered by credential-isolation.test.ts, which plants a sentinel in
every secret-bearing field and asserts it appears in no message the
worker ever receives.

* feat: dispatch plugin HTTP routes and wire the runtime into startup

ctx.http.route now registers a real router on the /plugin-api/:pluginId
dispatcher, replacing its stub 404. A plugin never touches the Express
req/res: it gets a plain summary and returns a plain object, so sockets
and session cookies stay on this side of the boundary. Authorization and
cookie headers are not forwarded.

Plugins load last in the start-up sequence, after the server is fully
wired, and are terminated before the database on shutdown so none can
outlive it. A plugin that fails to load cannot stop the backend.

fix: correct the nginx plugin-api location regex

The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so
never matched /plugin-api/<id>/<route>. Every other block in the file
uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and
404 only behind Docker.

* fix: update stale SFTP transfer test for single file destination paths

The test still asserted transferToHost was called with the destination
directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single
file transfer to send the full destination path including the filename,
so the correct expectation is "/srv/remote-1.txt". The code was right
and the test was left behind.

* feat: ship the ssh terminal as a first-party in-process plugin

Adds a hardcoded process:transport-owner tier so the terminal can own its
WebSocket server and ssh2 clients, which cannot cross the worker boundary.

* feat: ship docker as a first-party in-process plugin

Moves docker backend and frontend into plugins/docker/, alongside
ssh-terminal. Adds a host editor tab seam, a dashboard card registry,
and a build step to compile plugin backends into dist.

* feat: ship host metrics as a first-party in-process plugin

* fix: harden plugin auth and add per-request identity for ctx calls

Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.

* feat: ship the AI assistant as a first-party in-process plugin

Moves src/backend/ai and its routes into plugins/ai, mounted through a
small /ai dispatcher instead of its own port. Moves the ai-enabled and
ai-private-endpoints settings routes out of user-settings-routes.ts
into the plugin too, so it has no leftover core dependents.

* fix: remove compiled plugin JS left behind in plugins/ after build

copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in
place, copied it to dist/plugins, but never deleted the .js it had
just emitted next to the .ts sources. Those files shadowed the real
source for vitest/tsx and had import paths rewritten for the dist
layout, so tests failed with "Cannot find module" once a local build
had run. Affects docker, host-metrics and ai, not just this one.

* feat: add a permission-gated backend service registry for plugins

* feat: add a permission-gated UI action registry and action slots for plugins

Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal
plugin offers and the ai plugin fills, gated on ai.services.use.

* feat: add cross-plugin secret references gated by the provider's RBAC permission

* feat: move proxmox discovery/import/sync into a first-party plugin

* feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin

Relocates guacamole backend/frontend source and tests into
plugins/remote-desktop, following the ssh-terminal/docker pattern.

* feat: wire remote-desktop plugin into core and rename i18n keys

Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.

* feat: move fleets into a first-party plugin

* feat: move automations into a first-party plugin

* feat: remove legacy alert rules, superseded by automations

Alert rules already auto-migrate into automations on boot and the old
engine stands down after. Deletes the rule/firing tables, routes, UI,
and AI tools; keeps notification channels since automations still use
them. Also fixes automations' notify step, which still called the
deleted repository.

* feat: move network topology into a first-party plugin

* feat: move tailscale device discovery and settings into a plugin

Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.

* feat: move workspaces into a first-party plugin

* feat: move web endpoint into a first-party plugin

* feat: collapse plugin runtime to one tier behind a plugin SDK

* feat: make each plugin an npm workspace built by a termix-plugin CLI

* feat: give plugins their own tables, migrations and sync entities

* feat: serve plugin http and websockets from one mount instead of ports

* feat: namespace plugin permissions and keep them valid when a plugin is off

* feat: give plugins their own settings and one settings screen

* feat: load plugin frontends at runtime and remove plugin ids from the shell

* fix: mock the ai status fetch in its activate test

* feat: add auth extension points and one ssh connect pipeline

* feat: rebuild workspaces as the reference plugin

* fix: gate second factors after SSO/LDAP behind an admin setting

* feat: convert network-topology to a full plugin (B1)

* feat: move snippets backend and tables into a plugin (B2)

* feat: point core frontend snippets pickers at the plugin (B2)

* feat: add the snippets plugin (B2)

* feat: wire ai, automations, fleets and ssh-terminal to snippets (B2)

* feat: finish the tailscale plugin, including SSH auth (B3)

* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)

* chore: update proxmox and host-metrics locale files for B5

* chore: regenerate drizzle migration journals for B5

* feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox

* feat: move proxmox node stats and collectors into the proxmox plugin

* feat: drop proxmox host columns, use plugin settings instead

* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)

* feat: convert file manager into a plugin

* feat: convert ssh tunnels into a plugin

* feat: finish the web-endpoint plugin, add ctx.desktop (B8)

* feat: move the terminal fully into the ssh-terminal plugin (B9)

* feat: convert tmux monitoring into a plugin (B10)

* feat: convert serial console into the serial plugin

* feat: move session sharing and collab rooms into a plugin (B12)

* feat: turn session recording into a plugin (B13)

* feat: finish the remote-desktop plugin (B14)

* feat: finish the host-metrics plugin, move host status into core (B16)

* feat: finish the docker plugin (B15)

* feat: finish the automations plugin (B17)

* feat: finish the ai plugin (B18)

* feat: finish the homepage plugin, move service links and canvas out of core (B19)

* feat: convert wake-on-lan into a plugin (B20)

* feat: convert secret-sources into a plugin (B20)

* feat: move totp and passkeys into plugins (C1)

* feat: move sso and ldap logins into plugins (C2)

* feat: move opkssh and warpgate into plugins (C3)

* feat: move step-ca into a plugin (C4)

* feat: move vault ssh signing into a plugin (C5)

* feat: move termix identity into a plugin (C6)

* feat: move acme certificate automation into a plugin (C7)

* fix: finish 2.9.0 plugin moves and get every check green

* chore: lock the plugin boundary and remove 2.9.0 leftovers

* fix: harden the plugin runtime after the 2.9.0 security review

* feat: add plugin packing, signing, pinned trust and tmxplug bundling

* test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught

* fix: give bundled plugin backends a real require for CJS deps

* feat: improve UI loading time and jitter

* feat: show credential sharing inline in the sidebar like host sharing

* feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning

* feat: unify alerts into one plugin, channels, rules and inbox

* feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling

* fix: set blacksmith builder cache-key to stop broken gha cache fallback

* fix: link plugin-sdk workspace before npm ci in docker deps stage

* fix: link every plugin workspace before npm ci in docker deps stage

* fix(host-metrics): exclude image and firmware filesystems (#1469)

* fix(host-metrics): exclude image and firmware filesystems

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(hosts): normalize imported jump host references (#1470)

* fix(hosts): normalize imported jump host references

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(ci): build plugin SDK and repair MySQL settings migration (#1471)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): keep inline rename consistent (#1476)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): keep inline rename consistent

* fix(dashboard): reuse translated host status labels (#1475)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(dashboard): reuse translated host status labels

* docs(api): clarify local and remote version fields (#1474)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* docs(api): clarify local and remote version fields

* fix(file-manager): preserve selected backgrounds on hover (#1473)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): preserve selection feedback on hover

* test(ui): await dialog focus cleanup before teardown

* fix(file-manager): restore Ctrl/Cmd+F file search (#1472)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): focus file search with Ctrl or Cmd F

* fix: keep rounded-full circular in production builds

* fix(file-manager): cancel uploads and stop remote writes (#1477)

* fix(file-manager): cancel uploads and stop remote writes

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): apply compact density to directory tree (#1478)

* fix(file-manager): apply compact density to directory tree

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): preserve font sizes in compact mode (#1480)

* fix(file-manager): preserve font sizes in compact mode

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): prioritize file names in narrow lists (#1483)

* fix(file-manager): prioritize file names in narrow lists

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* fix(remote-desktop): probe the saved host guacd endpoint (#1481)

* fix(remote-desktop): probe the saved host guacd endpoint

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* fix(homepage): check allowlisted private service reachability (#1479)

* fix(homepage): check allowlisted private service reachability

* test(css): exercise the configured PostCSS plugin chain

* fix(remote-desktop): stop unsolicited clipboard read prompts (#1482)

* fix(remote-desktop): read clipboard only on explicit paste

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* chore: simplify plugin readmes, changelogs and manifest descriptions

* fix: keep plugins loaded after signing in from the login screen

* fix(file-manager): accept OS file drops over existing rows (#1484)

* fix(file-manager): accept OS file drops over existing rows

* test(file-manager): target the file label in drop tests

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* fix(file-manager): pipeline SFTP download reads (#1485)

* feat: add plugin sdk build to beta release

* fix: make link-store secret check immune to random base64 matches

* fix(ldap): preserve the directory-provided bind DN (#1486)

* fix: compute beta changes across dev branches and move the beta tag

* chore: untrack plugin sdk ARCHITECTURE.md

* chore: remove references to plugin sdk ARCHITECTURE.md

* feat: merge host editor terminal tabs into one owned by ssh-terminal

* feat: add descriptions to plugin host enable toggles

* fix(file-manager): show download progress in file viewers (#1487)

* fix(electron): signal backend readiness over IPC (#1488)

* fix(split-screen): allow layout creation without randomUUID (#1490)

* fix(split-screen): allow layout creation without randomUUID

* test(credentials): avoid flaky Ed25519 key generation

* fix(sidebar): remeasure visible rows after density changes (#1489)

* fix(sidebar): remeasure visible rows after density changes

* test(credentials): avoid flaky Ed25519 key generation

* feat(split-screen): redesign split screen with free-form panes and pane picker

* feat(sidebar): add host click behavior setting, default to always opening a new tab

* feat(snippets): redesign panel to match the host list

* fix(session-recording): stop session logs panel from refetching in a loop

* feat(snippets): bring back sharing, target hosts and drag reorder

* feat(ssh-terminal): add toolbar position, start state, display and fade host settings

* feat(ssh-terminal): add host setting to turn off password prompt auto-fill

* fix(ai): stop streams getting cut off and keep tool steps across messages

* feat: improve quick connect system using plugin api

* fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport

* feat: move terminal settings, look and ssh tools into ssh-terminal plugin

* feat: move snippets, keybinding actions and macros out of core into plugins

* feat: store rdp, vnc and telnet logins in a generic per-protocol table

* feat: type the plugin host record, move plugin strings out of core and add lint checks

* feat: replace core homepage widget registry with generic extension points

* feat: plugins only see their own host settings in the browser

* feat: harden plugin api for separate repos, signed updates and generic external login

* fix: keep plugin css below core utilities and version plugin assets by their css

* fix: load and save plugin host settings in the editor and tighten settings row spacing

* feat: redesign user host defaults system

* fix(remote-desktop): release held keys on focus loss (#1498)

* fix(session-sharing): replace local presentation after takeover (#1500)

* fix(file-manager): refresh disk usage with directory listing (#1503)

* fix(ssh-terminal): preserve input order during local echo reconciliation (#1505)

* feat(remote-desktop): expose display zoom controls for RDP (#1514)

* fix(file-manager): restore text selection and copying in Markdown previews (#1518)

* fix(sidebar): keep compact host addresses visible (#1524)

* fix(hosts): preserve plugin settings when reopening the editor (#1499)

* fix(ssh-terminal): close owner sockets when presentations unmount (#1501)

* fix(session-sharing): synchronize shared SSH terminal dimensions (#1502)

* fix(session-sharing): show participant presence in member terminals (#1504)

* fix(ai): sync provider configuration and keys across linked devices (#1506)

* feat(ssh-terminal): add a duplicate tab action (#1510)

* feat(file-manager): allow disabling move-to-trash confirmation (#1511)

* feat(file-manager): default to the remote login directory (#1512)

* feat(homepage): synchronize canvas layouts across devices (#1515)

* fix(shortcuts): prevent accidental double-Shift palette activation (#1519)

* feat(tmux-monitor): add a unified multi-host view (#1520)

* fix(electron): allow explicit quit with active connections (#1522)

* feat: reconnect all disconnected terminal tabs (#1523)

* fix(hosts): preserve recording and sharing settings in the dev editor (#1509)

* fix(database): preserve RDP domain during startup backfill (#1497)

* feat(sidebar): add keyboard type-ahead search for hosts (#1516)

* feat(automations): add per-host maintenance mode and recurring schedules (#1521)

* feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513)

* fix(session-sharing): use the linked server for desktop meetings and links (#1507)

* fix(tunnels): support TOTP for client tunnels and jump hosts (#1508)

* fix: type errors and lint failures from merged plugin prs

* feat(installer): make the Windows desktop shortcut optional (#1517)

* fix: ship the plugin sdk and serialport in desktop builds

* fix: prefer ipv4 when resolving ssh host names (#1365)

* fix: readable terminal selection with the light theme (#1319)

* fix: build desktop session share links on the linked server (#1350)

* fix: show meeting guests to members and hide the roster from guests (#1353)

* fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335)

* fix: show disk usage for the mount being browsed (#1347)

* fix: load the linux tray icon reliably and log tray failures (#1332)

* fix: cover the gnome close path in the desktop quit test (#1332)

* fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312)

* feat: optional auto reconnect for dropped ssh sessions (#1321)

* feat: tighter compact host rows with inline tags (#1325)

* feat: bring back the alert feed homepage widget

* feat: pick target terminals for snippets again

* feat: share button on connection tabs again

* feat: recent servers list when linking the desktop app

* feat: list the fixed app shortcuts in keyboard shortcuts

* fix: translate hardcoded toasts and drop em dashes from ui text

* fix: translate leftover hardcoded ui text

* fix: toolbar files button opens at the shell directory again

* fix: show the remote desktop note under connection origin again

* chore: openapi docs for host metrics manager routes

* chore: openapi docs for undocumented routes and fix two broken doc blocks

* fix: declare terminal.listSessions use for snippet targets

* revert: drop the alert feed widget, the notification center replaces it

* feat: restore the alert feed homepage widget

* fix: quick connect fills the host address from plugin auth editors like tailscale

* fix: docker container logs use the base background color

* chore: fix dependabot alerts and apply safe npm upgrades

* fix: proxmox stats tab reads its switch from plugin host settings

* fix: count plugin ssh logins toward host status and stop showing reachable as a warning

* fix: hide the built-in source pill in the host editor

* fix: host status shows online when the port answers and only warns on a failed login

* fix: drop the top border on the split layout menu

* fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default

* fix: remote desktop auth method labels and notes for vnc and telnet

* fix: add description to the web endpoint enable switch

* fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release

* feat: move telemetry out of core into a usage statistics plugin

* fix: recent activity card no longer cuts off host names early

* fix: remove duplicate top border on split screen menu

* fix: redesign session log player controls, fix tooltip overlap and drop dot separators

* fix: file manager and sftp text showing raw i18n keys

* fix: onboarding rerunning for existing users after upgrading

* fix: fleet detail buttons overflowing the sidebar

* fix: session log player scrolling off screen horizontally

* fix: network graph lag when adding hosts and on every render

* fix: maintenance index name, shared host read only view and badge polling

* fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag

* chore: update release notes

* fix: remote desktop tabs reconnecting on every tab switch

* fix: build plugin sdk before linting in release workflow

* chore: lint, format, and bump version to 2.9.0

* chore: skip crowdin pre-translate in release for now

* chore: sync Crowdin translations for 2.9.0

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

plugins/step-ca/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 1.0.0
+
+First release, bundled with Termix 2.9.0.
+
+Adds the Step CA login type. Termix signs you in through a smallstep step-ca OIDC provisioner and gets a short-lived SSH certificate from the CA.

plugins/step-ca/README.md

@@ -0,0 +1,31 @@
+# Step CA
+
+Connect to hosts with short-lived SSH certificates from a smallstep step-ca server, after signing in through its OIDC provisioner.
+
+## Features
+
+- Adds the Step CA login type to the host editor.
+- Signs you in through the identity provider behind a [smallstep step-ca](https://smallstep.com/docs/step-ca/) OIDC provisioner.
+- Has the CA sign a fresh key and keeps the certificate until it expires.
+- Talks to the CA's HTTPS API directly, so the `step` binary is never needed.
+
+## Setup
+
+When `REDIS_URL` is set and you run more than one Termix instance, a callback that reaches the wrong instance is handed to the one that started the sign-in. `TERMIX_STEP_CA_REDIS_PREFIX` changes the key prefix, which defaults to `termix:step-ca`.
+
+## Settings
+
+### Admin
+
+- CA URL, Root fingerprint and OIDC provisioner name: leave all three empty to turn Step CA off.
+- Allowed private Step CA hosts: the CA and, if it is internal, the identity provider. Private hosts not on this list are refused.
+- Redirect URI: register `<base URL>/plugin-api/step-ca/callback` with your identity provider.
+- Use the old redirect URI: keep sending the 2.8 URI `<base URL>/host/step-ca-callback`. Upgraded installs keep this on until you turn it off.
+
+## Development
+
+```bash
+npm run build      # build into dist/
+npm run test       # run this plugin's tests
+npm run typecheck  # type-check this plugin
+```

plugins/step-ca/locales/en.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/af_ZA.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Stap CA"
+  },
+  "editor": {
+    "label": "Stap CA",
+    "description": "Meld aan deur jou identiteitsverskaffer en laat jou Stap-CA 'n kortstondige SSH-sertifikaat vir hierdie gasheer uitreik. Die CA-URL, wortelvingerafdruk en OIDC-voorsiening word deur 'n administrateur in die Stap-CA-afdeling van Admin-instellings gestel.",
+    "docs": "Bekyk dokumente"
+  },
+  "dialog": {
+    "title": "Stap CA-verifikasie vereis",
+    "description": "Voltooi verifikasie in jou blaaier om voort te gaan. Die sertifikaat bly geldig solank jou CA dit toelaat.",
+    "openBrowser": "Maak blaaier oop om te verifieer",
+    "waiting": "Wag vir verifikasie in blaaier...",
+    "authenticating": "Verwerk verifikasie..."
+  },
+  "errors": {
+    "authFailed": "Verifikasie het misluk. Kontroleer asseblief jou geloofsbriewe en probeer weer.",
+    "timeout": "Verifikasie het verstryk. Probeer asseblief weer."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA-URL",
+      "description": "Die https-URL van jou smallstep CA. Los die CA-URL, vingerafdruk en voorsiener leeg om Step CA af te skakel.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Wortelvingerafdruk (SHA-256)",
+      "description": "Die wortelsertifikaat se vingerafdruk, soos getoon deur stap ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC-voorsieningsnaam",
+      "description": "Die naam van die CA se OIDC-voorsieningsverskaffer. Kies dan \"Stap CA\" as 'n gasheer se verifikasietipe."
+    },
+    "privateEndpoints": {
+      "label": "Toegelate private Step CA-gashere",
+      "description": "Privaat gashere, die Step CA-sertifikaatvloei, mag kontak maak met: die CA self en, indien intern, jou identiteitsverskaffer. Skei hulle met kommas of nuwe reëls."
+    },
+    "redirectUri": {
+      "label": "Herlei URI",
+      "description": "Registreer hierdie URL as 'n toegelate herleidings-URI by die identiteitsverskaffer agter die OIDC-voorsieningsverskaffer."
+    },
+    "legacyCallback": {
+      "label": "Gebruik die ou aanstuur-URI",
+      "description": "Hou aan om /host/step-ca-callback te stuur, die aanstuur-URI wat voor 2.9 gebruik is. Skakel dit af sodra jou identiteitsverskaffer die nuwe een toelaat."
+    }
+  }
+}

plugins/step-ca/locales/translated/ar_SA.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "الخطوة ج"
+  },
+  "editor": {
+    "label": "الخطوة ج",
+    "description": "سجّل الدخول باستخدام موفر الهوية الخاص بك، ودع جهة إصدار الشهادات المعتمدة (SA) التابعة لـ Step CA تُصدر شهادة SSH مؤقتة لهذا المضيف. يتم تحديد عنوان URL الخاص بجهة إصدار الشهادات المعتمدة، وبصمة الجذر، وموفر OIDC بواسطة مسؤول النظام في قسم Step CA ضمن إعدادات المسؤول.",
+    "docs": "عرض المستندات"
+  },
+  "dialog": {
+    "title": "الخطوة: مطلوب مصادقة CA",
+    "description": "أكمل عملية المصادقة في متصفحك للمتابعة. تبقى الشهادة صالحة طالما سمحت جهة إصدار الشهادات بذلك.",
+    "openBrowser": "افتح المتصفح للمصادقة",
+    "waiting": "في انتظار المصادقة في المتصفح...",
+    "authenticating": "جارٍ معالجة المصادقة..."
+  },
+  "errors": {
+    "authFailed": "فشلت المصادقة. يرجى التحقق من بيانات الاعتماد والمحاولة مرة أخرى.",
+    "timeout": "انتهت مهلة المصادقة. يرجى المحاولة مرة أخرى."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "عنوان URL لهيئة التصديق",
+      "description": "عنوان URL الخاص بـ HTTPS لشهادة المصادقة الصغيرة (Stallstep CA). اترك عنوان URL الخاص بشهادة المصادقة، وبصمة الإصبع، وموفر البيانات فارغة لإيقاف تشغيل شهادة المصادقة الصغيرة (Stall CA).",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "بصمة الجذر (SHA-256)",
+      "description": "بصمة الشهادة الجذرية، كما هو موضح في خطوة ca bootstrap."
+    },
+    "provisioner": {
+      "label": "اسم موفر OIDC",
+      "description": "اسم مُزوّد OIDC الخاص بـ CA. ثم اختر \"Step CA\" كنوع مصادقة المضيف."
+    },
+    "privateEndpoints": {
+      "label": "مضيفو شهادات الخطوة الخاصة المسموح بها",
+      "description": "قد تتصل جهات الاستضافة الخاصة بعملية شهادة Step CA بما يلي: جهة إصدار الشهادة نفسها، وإذا كانت داخلية، مزود الهوية الخاص بك. افصل بينهما بفواصل أو أسطر جديدة."
+    },
+    "redirectUri": {
+      "label": "عنوان إعادة التوجيه",
+      "description": "قم بتسجيل عنوان URL هذا كعنوان URI مسموح بإعادة التوجيه مع موفر الهوية الذي يقف وراء موفر OIDC."
+    },
+    "legacyCallback": {
+      "label": "استخدم عنوان URI القديم لإعادة التوجيه",
+      "description": "استمر في إرسال /host/step-ca-callback، وهو عنوان إعادة التوجيه المستخدم قبل الإصدار 2.9. قم بإيقاف تشغيل هذا بمجرد أن يسمح موفر الهوية الخاص بك بالعنوان الجديد."
+    }
+  }
+}

plugins/step-ca/locales/translated/bg_BG.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Стъпка CA"
+  },
+  "editor": {
+    "label": "Стъпка CA",
+    "description": "Влезте чрез вашия доставчик на самоличност и позволете на вашия Step CA да издаде краткотраен SSH сертификат за този хост. URL адресът на CA, root пръстовият отпечатък и OIDC provisioner се задават от администратор в секцията Step CA в администраторските настройки.",
+    "docs": "Преглед на документи"
+  },
+  "dialog": {
+    "title": "Изисква се удостоверяване на CA от стъпка 1",
+    "description": "За да продължите, завършете удостоверяването в браузъра си. Сертификатът остава валиден толкова дълго, колкото позволява вашият CA.",
+    "openBrowser": "Отворете браузъра за удостоверяване",
+    "waiting": "Чака се удостоверяване в браузъра...",
+    "authenticating": "Обработва се удостоверяване..."
+  },
+  "errors": {
+    "authFailed": "Удостоверяването не бе успешно. Моля, проверете идентификационните си данни и опитайте отново.",
+    "timeout": "Времето за изчакване на удостоверяването изтече. Моля, опитайте отново."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL адрес в Калифорния",
+      "description": "https URL адресът на вашия smallstep CA. Оставете URL адреса на CA, пръстовия отпечатък и провайдъра празни, за да изключите Step CA.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Коренен пръстов отпечатък (SHA-256)",
+      "description": "Пръстовият отпечатък на коренния сертификат, както е показано от стъпка ca bootstrap."
+    },
+    "provisioner": {
+      "label": "Име на доставчика на OIDC",
+      "description": "Името на OIDC доставчика на CA. След това изберете „Step CA“ като тип удостоверяване на хоста."
+    },
+    "privateEndpoints": {
+      "label": "Разрешени частни хостове на Step CA",
+      "description": "Частни хостове, с които потокът от сертификати на Step CA може да се свърже: самия CA и, ако е вътрешен, вашият доставчик на самоличност. Разделете ги със запетаи или нови редове."
+    },
+    "redirectUri": {
+      "label": "URI адрес за пренасочване",
+      "description": "Регистрирайте този URL адрес като разрешен URI адрес за пренасочване при доставчика на самоличност зад OIDC provisioner-а."
+    },
+    "legacyCallback": {
+      "label": "Използвайте стария URI адрес за пренасочване",
+      "description": "Продължавайте да изпращате /host/step-ca-callback, URI адресът за пренасочване, използван преди версия 2.9. Изключете това, след като вашият доставчик на идентичност разреши новия."
+    }
+  }
+}

plugins/step-ca/locales/translated/bn_BD.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/ca_ES.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Pas CA"
+  },
+  "editor": {
+    "label": "Pas CA",
+    "description": "Inicieu la sessió a través del vostre proveïdor d'identitat i deixeu que la vostra Step CA emeti un certificat SSH de curta durada per a aquest amfitrió. L'URL de la CA, l'empremta digital arrel i el proveïdor OIDC els defineix un administrador a la secció Step CA de la Configuració de l'administrador.",
+    "docs": "Veure documents"
+  },
+  "dialog": {
+    "title": "Autenticació de CA requerida",
+    "description": "Completeu l'autenticació al navegador per continuar. El certificat continua sent vàlid mentre ho permeti la vostra autoritat de certificació.",
+    "openBrowser": "Obre el navegador per autenticar-te",
+    "waiting": "Esperant l'autenticació al navegador...",
+    "authenticating": "Processant l'autenticació..."
+  },
+  "errors": {
+    "authFailed": "L'autenticació ha fallat. Si us plau, comproveu les vostres credencials i torneu-ho a intentar.",
+    "timeout": "S'ha esgotat el temps d'autenticació. Torna-ho a provar."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL de CA",
+      "description": "L'URL https de la vostra CA Smallstep. Deixeu l'URL de la CA, l'empremta digital i el proveïdor buits per desactivar la CA de Step.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Empremta digital arrel (SHA-256)",
+      "description": "L'empremta digital del certificat arrel, tal com es mostra al pas de bootstrap de CA."
+    },
+    "provisioner": {
+      "label": "Nom del proveïdor OIDC",
+      "description": "El nom del proveïdor OIDC de la CA. A continuació, trieu \"Step CA\" com a tipus d'autenticació de l'amfitrió."
+    },
+    "privateEndpoints": {
+      "label": "Amfitrions privats permesos de Step CA",
+      "description": "Amfitrions privats amb els quals el flux de certificats de la CA de Step pot contactar: la mateixa CA i, si és intern, el vostre proveïdor d'identitat. Separeu-los amb comes o noves línies."
+    },
+    "redirectUri": {
+      "label": "URI de redirecció",
+      "description": "Registra aquesta URL com a URI de redirecció permesa amb el proveïdor d'identitat darrere del proveidor OIDC."
+    },
+    "legacyCallback": {
+      "label": "Utilitza l'URI de redirecció antiga",
+      "description": "Continua enviant /host/step-ca-callback, l'URI de redirecció utilitzat abans de la versió 2.9. Desactiva-ho un cop el proveïdor d'identitat permeti el nou."
+    }
+  }
+}

plugins/step-ca/locales/translated/cs_CZ.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Krok CA"
+  },
+  "editor": {
+    "label": "Krok CA",
+    "description": "Přihlaste se prostřednictvím svého poskytovatele identity a nechte svou certifikační autoritu Step CA vydat krátkodobý SSH certifikát pro tohoto hostitele. URL certifikační autority CA, kořenový otisk prstu a zřizovatel OIDC nastavuje administrátor v sekci Step CA v Nastavení administrátora.",
+    "docs": "Zobrazit dokumenty"
+  },
+  "dialog": {
+    "title": "Krok Vyžadováno ověření CA",
+    "description": "Pro pokračování dokončete ověření ve vašem prohlížeči. Certifikát zůstává platný tak dlouho, jak to vaše certifikační autorita dovolí.",
+    "openBrowser": "Otevřít prohlížeč pro ověření",
+    "waiting": "Čekání na ověření v prohlížeči...",
+    "authenticating": "Zpracování ověřování..."
+  },
+  "errors": {
+    "authFailed": "Ověření se nezdařilo. Zkontrolujte prosím své přihlašovací údaje a zkuste to znovu.",
+    "timeout": "Časový limit ověření vypršel. Zkuste to prosím znovu."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL adresa CA",
+      "description": "URL adresa https vaší certifikační autority SmallStep. Chcete-li Step CA vypnout, ponechte URL adresu certifikační autority, otisk prstu a zřizovatel prázdné.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Kořenový otisk (SHA-256)",
+      "description": "Otisk kořenového certifikátu, jak je znázorněno v kroku ca bootstrap."
+    },
+    "provisioner": {
+      "label": "Název zřizovatele OIDC",
+      "description": "Název zřizovatele OIDC certifikační autority. Poté jako typ ověřování hostitele vyberte „Krok CA“."
+    },
+    "privateEndpoints": {
+      "label": "Povolení soukromí hostitelé Step CA",
+      "description": "Soukromí hostitelé, se kterými se může tok certifikátů Step CA spojit: samotná CA a v případě interního přístupu také váš poskytovatel identity. Oddělte je čárkami nebo novými řádky."
+    },
+    "redirectUri": {
+      "label": "URI přesměrování",
+      "description": "Zaregistrujte tuto URL jako povolený URI pro přesměrování u poskytovatele identity za zřizovatelem OIDC."
+    },
+    "legacyCallback": {
+      "label": "Použít starý identifikátor URI pro přesměrování",
+      "description": "Pokračujte v odesílání /host/step-ca-callback, což je URI pro přesměrování používané před verzí 2.9. Jakmile váš poskytovatel identity nový URI povolí, vypněte ho."
+    }
+  }
+}

plugins/step-ca/locales/translated/da_DK.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Trin CA"
+  },
+  "editor": {
+    "label": "Trin CA",
+    "description": "Log ind via din identitetsudbyder, og lad din Step CA udstede et kortvarigt SSH-certifikat til denne vært. CA-URL'en, rodfingeraftrykket og OIDC-provisioneren indstilles af en administrator i afsnittet Step CA i administratorindstillinger.",
+    "docs": "Se dokumenter"
+  },
+  "dialog": {
+    "title": "Trin CA-godkendelse påkrævet",
+    "description": "Fuldfør godkendelsen i din browser for at fortsætte. Certifikatet forbliver gyldigt, så længe din CA tillader det.",
+    "openBrowser": "Åbn browseren for at godkende",
+    "waiting": "Venter på godkendelse i browseren...",
+    "authenticating": "Behandler godkendelse..."
+  },
+  "errors": {
+    "authFailed": "Godkendelse mislykkedes. Tjek dine loginoplysninger, og prøv igen.",
+    "timeout": "Godkendelsen udløb. Prøv igen."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA-URL",
+      "description": "https-URL'en for din smallstep CA. Lad CA-URL'en, fingeraftrykket og provisioneren være tomme for at slå Step CA fra.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Rodfingeraftryk (SHA-256)",
+      "description": "Rodcertifikatets fingeraftryk, som vist i trin ca. bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC-provisioneringsnavn",
+      "description": "Navnet på CA'ens OIDC-provisioner. Vælg derefter \"Step CA\" som værtens godkendelsestype."
+    },
+    "privateEndpoints": {
+      "label": "Tilladte private Step CA-værter",
+      "description": "Private værter, som Step CA-certifikatflowet kan kontakte: selve CA'en og, hvis den er intern, din identitetsudbyder. Adskil dem med kommaer eller nye linjer."
+    },
+    "redirectUri": {
+      "label": "Omdirigerings-URI",
+      "description": "Registrer denne URL som en tilladt omdirigerings-URI hos identitetsudbyderen bag OIDC-provisioneren."
+    },
+    "legacyCallback": {
+      "label": "Brug den gamle omdirigerings-URI",
+      "description": "Fortsæt med at sende /host/step-ca-callback, den omdirigerings-URI, der blev brugt før 2.9. Slå dette fra, når din identitetsudbyder tillader den nye."
+    }
+  }
+}

plugins/step-ca/locales/translated/de_DE.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Schritt CA"
+  },
+  "editor": {
+    "label": "Schritt CA",
+    "description": "Melden Sie sich über Ihren Identitätsanbieter an und lassen Sie Ihre Step-Zertifizierungsstelle ein kurzlebiges SSH-Zertifikat für diesen Host ausstellen. Die CA-URL, der Root-Fingerabdruck und der OIDC-Provisioner werden von einem Administrator im Step-CA-Bereich der Administratoreinstellungen festgelegt.",
+    "docs": "Dokumentation ansehen"
+  },
+  "dialog": {
+    "title": "Schritt CA-Authentifizierung erforderlich",
+    "description": "Schließen Sie die Authentifizierung in Ihrem Browser ab, um fortzufahren. Das Zertifikat bleibt so lange gültig, wie Ihre Zertifizierungsstelle dies zulässt.",
+    "openBrowser": "Browser zum Authentifizieren öffnen",
+    "waiting": "Warten auf Authentifizierung im Browser...",
+    "authenticating": "Authentifizierung wird verarbeitet..."
+  },
+  "errors": {
+    "authFailed": "Authentifizierung fehlgeschlagen. Bitte überprüfen Sie Ihre Anmeldeinformationen und versuchen Sie es erneut.",
+    "timeout": "Authentifizierung abgelaufen. Bitte versuchen Sie es erneut."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA-URL",
+      "description": "Die HTTPS-URL Ihrer Smallstep-Zertifizierungsstelle. Lassen Sie die Felder für die Zertifizierungsstellen-URL, den Fingerabdruck und den Provisioner leer, um die Step-Zertifizierungsstelle zu deaktivieren.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root-Fingerabdruck (SHA-256)",
+      "description": "Der Fingerabdruck des Stammzertifikats, wie er durch den Schritt CA-Bootstrap angezeigt wird."
+    },
+    "provisioner": {
+      "label": "OIDC-Provisionername",
+      "description": "Der Name des OIDC-Provisioners der Zertifizierungsstelle. Wählen Sie anschließend „Step CA“ als Authentifizierungstyp des Hosts aus."
+    },
+    "privateEndpoints": {
+      "label": "Zulässige private Step CA-Hosts",
+      "description": "Private Hosts, die vom Step CA-Zertifikatsfluss kontaktiert werden, können Folgendes kontaktieren: die Zertifizierungsstelle selbst und, falls intern, Ihren Identitätsanbieter. Trennen Sie diese durch Kommas oder Zeilenumbrüche."
+    },
+    "redirectUri": {
+      "label": "Umleitungs-URI",
+      "description": "Registrieren Sie diese URL als zulässige Umleitungs-URI beim Identitätsanbieter hinter dem OIDC-Provisioner."
+    },
+    "legacyCallback": {
+      "label": "Verwenden Sie die alte Umleitungs-URI.",
+      "description": "Senden Sie weiterhin /host/step-ca-callback, die Umleitungs-URI, die vor Version 2.9 verwendet wurde. Deaktivieren Sie diese Funktion, sobald Ihr Identitätsanbieter die neue URI zulässt."
+    }
+  }
+}

plugins/step-ca/locales/translated/el_GR.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Βήμα CA"
+  },
+  "editor": {
+    "label": "Βήμα CA",
+    "description": "Συνδεθείτε μέσω του παρόχου ταυτότητας και αφήστε την Step CA σας να εκδώσει ένα βραχύβιο πιστοποιητικό SSH για αυτόν τον κεντρικό υπολογιστή. Η διεύθυνση URL CA, το δακτυλικό αποτύπωμα root και ο πάροχος OIDC ορίζονται από έναν διαχειριστή στην ενότητα Step CA των Ρυθμίσεων Διαχειριστή.",
+    "docs": "Προβολή εγγράφων"
+  },
+  "dialog": {
+    "title": "Απαιτείται έλεγχος ταυτότητας CA βήμα",
+    "description": "Ολοκληρώστε τον έλεγχο ταυτότητας στο πρόγραμμα περιήγησής σας για να συνεχίσετε. Το πιστοποιητικό παραμένει έγκυρο για όσο διάστημα το επιτρέπει η CA σας.",
+    "openBrowser": "Άνοιγμα προγράμματος περιήγησης για έλεγχο ταυτότητας",
+    "waiting": "Αναμονή για έλεγχο ταυτότητας στο πρόγραμμα περιήγησης...",
+    "authenticating": "Επεξεργασία ελέγχου ταυτότητας..."
+  },
+  "errors": {
+    "authFailed": "Ο έλεγχος ταυτότητας απέτυχε. Ελέγξτε τα διαπιστευτήριά σας και προσπαθήστε ξανά.",
+    "timeout": "Το χρονικό όριο ελέγχου ταυτότητας έληξε. Δοκιμάστε ξανά."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL CA",
+      "description": "Η διεύθυνση URL https της smallstep CA σας. Αφήστε τη διεύθυνση URL CA, το δακτυλικό αποτύπωμα και τον provisioner κενά για να απενεργοποιήσετε την Step CA.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Δακτυλικό αποτύπωμα ρίζας (SHA-256)",
+      "description": "Το δακτυλικό αποτύπωμα του πιστοποιητικού ρίζας, όπως φαίνεται στο βήμα ca bootstrap."
+    },
+    "provisioner": {
+      "label": "Όνομα παρόχου OIDC",
+      "description": "Το όνομα του παρόχου OIDC της CA. Στη συνέχεια, επιλέξτε \"Step CA\" ως τύπο ελέγχου ταυτότητας κεντρικού υπολογιστή."
+    },
+    "privateEndpoints": {
+      "label": "Επιτρεπόμενοι ιδιωτικοί κεντρικοί υπολογιστές Step CA",
+      "description": "Οι ιδιωτικοί κεντρικοί υπολογιστές που επικοινωνούν με τη ροή πιστοποιητικών Step CA ενδέχεται να επικοινωνήσουν με: την ίδια την CA και, εάν είναι εσωτερική, τον πάροχο ταυτότητάς σας. Διαχωρίστε τα με κόμματα ή νέες γραμμές."
+    },
+    "redirectUri": {
+      "label": "URI ανακατεύθυνσης",
+      "description": "Καταχωρίστε αυτήν τη διεύθυνση URL ως επιτρεπόμενο URI ανακατεύθυνσης στον πάροχο ταυτότητας πίσω από τον παροχέα OIDC."
+    },
+    "legacyCallback": {
+      "label": "Χρησιμοποιήστε το παλιό URI ανακατεύθυνσης",
+      "description": "Συνεχίστε να στέλνετε το /host/step-ca-callback, το URI ανακατεύθυνσης που χρησιμοποιήθηκε πριν από την έκδοση 2.9. Απενεργοποιήστε αυτήν τη λειτουργία μόλις ο πάροχος ταυτότητάς σας επιτρέψει το νέο."
+    }
+  }
+}

plugins/step-ca/locales/translated/es_ES.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Paso CA"
+  },
+  "editor": {
+    "label": "Paso CA",
+    "description": "Inicie sesión a través de su proveedor de identidad y permita que Step CA emita un certificado SSH de corta duración para este host. La URL de la CA, la huella digital raíz y el proveedor OIDC los configura un administrador en la sección Step CA de la configuración de administración.",
+    "docs": "Ver documentación"
+  },
+  "dialog": {
+    "title": "Se requiere autenticación de CA.",
+    "description": "Para continuar, complete la autenticación en su navegador. El certificado seguirá siendo válido mientras su autoridad de certificación lo permita.",
+    "openBrowser": "Abrir navegador para autenticarse",
+    "waiting": "Esperando autenticación en el navegador...",
+    "authenticating": "Procesando autenticación..."
+  },
+  "errors": {
+    "authFailed": "La autenticación falló. Revisa tus credenciales e inténtalo de nuevo.",
+    "timeout": "La autenticación expiró. Inténtalo de nuevo."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL de CA",
+      "description": "La URL HTTPS de su CA de Smallstep. Deje la URL de la CA, la huella digital y el aprovisionador vacíos para desactivar Step CA.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Huella digital de la raíz (SHA-256)",
+      "description": "La huella digital del certificado raíz, como se muestra en el paso ca bootstrap."
+    },
+    "provisioner": {
+      "label": "nombre del proveedor OIDC",
+      "description": "Nombre del proveedor OIDC de la CA. A continuación, seleccione \"Step CA\" como tipo de autenticación del host."
+    },
+    "privateEndpoints": {
+      "label": "Hosts de CA de paso privado permitidos",
+      "description": "Los hosts privados con los que puede contactar el flujo de certificados de Step CA son: la propia CA y, si es interna, su proveedor de identidad. Sepárelos con comas o saltos de línea."
+    },
+    "redirectUri": {
+      "label": "URI de redirección",
+      "description": "Registre esta URL como una URI de redireccionamiento permitida con el proveedor de identidad que se encuentra detrás del aprovisionador OIDC."
+    },
+    "legacyCallback": {
+      "label": "Utilice la URI de redireccionamiento antigua",
+      "description": "Sigue enviando /host/step-ca-callback, la URI de redireccionamiento que se usaba antes de la versión 2.9. Desactívala una vez que tu proveedor de identidad permita la nueva."
+    }
+  }
+}

plugins/step-ca/locales/translated/fi_FI.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Vaihe CA"
+  },
+  "editor": {
+    "label": "Vaihe CA",
+    "description": "Kirjaudu sisään identiteetintarjoajasi kautta ja anna vaiheittaisen varmentajan myöntää lyhytaikainen SSH-varmenne tälle isännälle. Järjestelmänvalvojan on määritettävä varmentajan URL-osoite, pääkäyttäjän sormenjälki ja OIDC-varmenne järjestelmävalvojan asetuksissa olevassa vaiheittaisen varmentajan osiossa.",
+    "docs": "Näytä dokumentit"
+  },
+  "dialog": {
+    "title": "Vaiheen CA-todennus vaaditaan",
+    "description": "Jatka suorittamalla todennus selaimessasi. Varmenne on voimassa niin kauan kuin varmenteen myöntäjäsi sallii.",
+    "openBrowser": "Avaa selain todennusta varten",
+    "waiting": "Odotetaan selaimen todennusta...",
+    "authenticating": "Todennusta käsitellään..."
+  },
+  "errors": {
+    "authFailed": "Todennus epäonnistui. Tarkista tunnistetietosi ja yritä uudelleen.",
+    "timeout": "Todennus aikakatkaistiin. Yritä uudelleen."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "Kalifornian URL-osoite",
+      "description": "Smallstep-CA:n https-URL-osoite. Jätä CA:n URL-osoite, sormenjälki ja tarjoaja tyhjiksi poistaaksesi Step CA:n käytöstä.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Juurisormenjälki (SHA-256)",
+      "description": "Juurivarmenteen sormenjälki, kuten vaiheessa ca bootstrap näyttää."
+    },
+    "provisioner": {
+      "label": "OIDC-palveluntarjoajan nimi",
+      "description": "Varmentajan OIDC-palveluntarjoajan nimi. Valitse sitten isännän todennustyypiksi \"Vaiheen varmentaja\"."
+    },
+    "privateEndpoints": {
+      "label": "Sallitut yksityiset Step CA -isännät",
+      "description": "Yksityiset isännöitsijät, joilla Step CA -varmennetyönkulku voi ottaa yhteyttä: itse CA:han ja, jos kyseessä on sisäinen varmenne, identiteetintarjoajaasi. Erota ne pilkuilla tai rivinvaihdolla."
+    },
+    "redirectUri": {
+      "label": "Uudelleenohjauksen URI",
+      "description": "Rekisteröi tämä URL-osoite sallituksi uudelleenohjauksen URI:ksi OIDC-tarjoajan takana olevalle identiteetintarjoajalle."
+    },
+    "legacyCallback": {
+      "label": "Käytä vanhaa uudelleenohjaus-URI:ta",
+      "description": "Lähetä edelleen /host/step-ca-callback, ennen versiota 2.9 käytetty uudelleenohjaus-URI. Poista tämä käytöstä, kun identiteetintarjoajasi sallii uuden."
+    }
+  }
+}

plugins/step-ca/locales/translated/fr_FR.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Étape CA"
+  },
+  "editor": {
+    "label": "Étape CA",
+    "description": "Connectez-vous via votre fournisseur d'identité et laissez votre autorité de certification Step CA émettre un certificat SSH temporaire pour cet hôte. L'URL de l'autorité de certification, l'empreinte racine et le provisionneur OIDC sont configurés par un administrateur dans la section « Autorité de certification Step CA » des paramètres d'administration.",
+    "docs": "Voir la documentation"
+  },
+  "dialog": {
+    "title": "Étape : Authentification CA requise",
+    "description": "Veuillez vous authentifier complètement dans votre navigateur pour continuer. Le certificat reste valide aussi longtemps que votre autorité de certification le permet.",
+    "openBrowser": "Ouvrir le navigateur pour s'authentifier",
+    "waiting": "En attente de l'authentification dans le navigateur...",
+    "authenticating": "Traitement de l'authentification..."
+  },
+  "errors": {
+    "authFailed": "Échec de l'authentification. Veuillez vérifier vos identifiants et réessayer.",
+    "timeout": "L'authentification a expiré. Veuillez réessayer."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL CA",
+      "description": "L'URL HTTPS de votre autorité de certification SmallStep. Laissez les champs URL de l'autorité de certification, empreinte digitale et provisionneur vides pour désactiver l'autorité de certification de Step.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Empreinte racine (SHA-256)",
+      "description": "L'empreinte du certificat racine, telle qu'elle apparaît lors de l'étape d'amorçage du certificat racine."
+    },
+    "provisioner": {
+      "label": "Nom du fournisseur OIDC",
+      "description": "Le nom du fournisseur OIDC de l'autorité de certification. Choisissez ensuite « Autorité de certification par étapes » comme type d'authentification de l'hôte."
+    },
+    "privateEndpoints": {
+      "label": "Hôtes d'autorité de certification privés autorisés",
+      "description": "Les hôtes privés pour lesquels le flux de certificats Step CA peut être sollicité peuvent contacter : l’autorité de certification elle-même et, si elle est interne, votre fournisseur d’identité. Séparez ces contacts par des virgules ou des sauts de ligne."
+    },
+    "redirectUri": {
+      "label": "URI de redirection",
+      "description": "Enregistrez cette URL comme URI de redirection autorisée auprès du fournisseur d'identité qui gère le provisionneur OIDC."
+    },
+    "legacyCallback": {
+      "label": "Utilisez l'ancienne URI de redirection",
+      "description": "Continuez à envoyer /host/step-ca-callback, l'URI de redirection utilisée avant la version 2.9. Désactivez-la une fois que votre fournisseur d'identité autorisera la nouvelle."
+    }
+  }
+}

plugins/step-ca/locales/translated/he_IL.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "שלב CA"
+  },
+  "editor": {
+    "label": "שלב CA",
+    "description": "היכנס דרך ספק הזהויות שלך ותן ל-Step CA שלך להנפיק אישור SSH קצר מועד עבור מארח זה. כתובת ה-URL של CA, טביעת האצבע של הבסיס וספק ה-OIDC מוגדרים על ידי מנהל מערכת במקטע Step CA בהגדרות המנהל.",
+    "docs": "הצג מסמכים"
+  },
+  "dialog": {
+    "title": "נדרש אימות CA של שלב",
+    "description": "השלם את האימות בדפדפן שלך כדי להמשיך. האישור נשאר בתוקף כל עוד רשות האישור שלך מאפשרת זאת.",
+    "openBrowser": "פתח את הדפדפן כדי לאמת",
+    "waiting": "ממתין לאימות בדפדפן...",
+    "authenticating": "מעבד אימות..."
+  },
+  "errors": {
+    "authFailed": "האימות נכשל. אנא בדוק את פרטי הגישה שלך ונסה שוב.",
+    "timeout": "הזמן שהוקצב לאימות הסתיים. אנא נסה שוב."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "כתובת URL של CA",
+      "description": "כתובת ה-https של רשות האישור של smallstep שלך. השאר את כתובת ה-URL של רשות האישור, טביעת האצבע והספק ריקים כדי לכבות את רשות האישור של Step.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "טביעת אצבע של שורש (SHA-256)",
+      "description": "טביעת האצבע של תעודת השורש, כפי שמוצג בשלב ca bootstrap."
+    },
+    "provisioner": {
+      "label": "שם ספק OIDC",
+      "description": "שם ספק האימות של ה-OIDC של רשות האישור. לאחר מכן בחר \"שלב רשות אישורים\" כסוג האימות של המארח."
+    },
+    "privateEndpoints": {
+      "label": "מארחים פרטיים של Step CA מורשים",
+      "description": "מארחים פרטיים, זרימת האישורים של Step CA עשויה ליצור קשר עם: רשות האישורים עצמה, ואם היא פנימית, עם ספק הזהויות שלך. הפרידו ביניהם באמצעות פסיקים או שורות חדשות."
+    },
+    "redirectUri": {
+      "label": "כתובת URL להפניה מחדש",
+      "description": "רשום כתובת URL זו כ-URI להפניה מחדש מותרת אצל ספק הזהויות שמאחורי ספק ה-OIDC."
+    },
+    "legacyCallback": {
+      "label": "השתמש ב-URI להפניה הישן",
+      "description": "המשך לשלוח את /host/step-ca-callback, URI ההפניה שהיה בשימוש לפני גרסה 2.9. כבה אפשרות זו לאחר שספק הזהויות שלך יאפשר את ה-URI החדש."
+    }
+  }
+}

plugins/step-ca/locales/translated/hi_IN.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "दस्तावेज़ देखें"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "प्रमाणीकरण के लिए ब्राउज़र खोलें",
+    "waiting": "ब्राउज़र में प्रमाणीकरण की प्रतीक्षा हो रही है...",
+    "authenticating": "प्रमाणीकरण प्रक्रिया में है..."
+  },
+  "errors": {
+    "authFailed": "प्रमाणीकरण विफल। कृपया अपने क्रेडेंशियल जाँचें और पुनः प्रयास करें।",
+    "timeout": "प्रमाणीकरण का समय समाप्त हो गया। कृपया पुनः प्रयास करें।"
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/hu_HU.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "CA lépés"
+  },
+  "editor": {
+    "label": "CA lépés",
+    "description": "Jelentkezzen be az identitásszolgáltatóján keresztül, és hagyja, hogy a Step CA rövid életű SSH-tanúsítványt állítson ki ehhez a gazdagéphez. A CA URL-címét, a root ujjlenyomatát és az OIDC-kiszolgálót a rendszergazda állítja be az Adminisztrátori beállítások Step CA szakaszában.",
+    "docs": "Dokumentumok megtekintése"
+  },
+  "dialog": {
+    "title": "Lépés CA hitelesítés szükséges",
+    "description": "A folytatáshoz fejezze be a hitelesítést a böngészőjében. A tanúsítvány mindaddig érvényes, ameddig a hitelesítésszolgáltató engedélyezi.",
+    "openBrowser": "Böngésző megnyitása a hitelesítéshez",
+    "waiting": "Várakozás a böngésző hitelesítésére...",
+    "authenticating": "Hitelesítés feldolgozása..."
+  },
+  "errors": {
+    "authFailed": "Sikertelen hitelesítés. Kérjük, ellenőrizze a hitelesítő adatait, és próbálja újra.",
+    "timeout": "A hitelesítés időtúllépést okozott. Kérjük, próbálja újra."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "Kaliforniai URL",
+      "description": "A smallstep CA https URL-címe. A Step CA kikapcsolásához hagyja üresen a CA URL-címét, az ujjlenyomatot és a kibocsátót.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Gyökér ujjlenyomat (SHA-256)",
+      "description": "A főtanúsítvány ujjlenyomata, ahogyan azt a ca. lépés bootstrap mutatja."
+    },
+    "provisioner": {
+      "label": "OIDC-szolgáltató neve",
+      "description": "A hitelesítésszolgáltató OIDC-szolgáltatójának neve. Ezután válassza a „Step CA” lehetőséget a gazdagép hitelesítési típusaként."
+    },
+    "privateEndpoints": {
+      "label": "Engedélyezett privát Step CA-hosztok",
+      "description": "A Step CA tanúsítványfolyamat által érintett privát hosztok a következőkkel vehetik fel a kapcsolatot: magával a CA-val, és ha belső, akkor az identitásszolgáltatóval. Válaszd el őket vesszővel vagy új sorral."
+    },
+    "redirectUri": {
+      "label": "Átirányítási URI",
+      "description": "Regisztrálja ezt az URL-címet engedélyezett átirányítási URI-ként az OIDC-kiszolgáló mögötti identitásszolgáltatónál."
+    },
+    "legacyCallback": {
+      "label": "Használja a régi átirányítási URI-t",
+      "description": "Továbbra is küldd a /host/step-ca-callback átirányítási URI-t, amely a 2.9 előtt használt. Kapcsold ki ezt, amint az identitásszolgáltatód engedélyezi az újat."
+    }
+  }
+}

plugins/step-ca/locales/translated/id_ID.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/it_IT.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Passo CA"
+  },
+  "editor": {
+    "label": "Passo CA",
+    "description": "Accedi tramite il tuo provider di identità e lascia che la tua CA Step rilasci un certificato SSH temporaneo per questo host. L'URL della CA, l'impronta digitale della radice e il provisioner OIDC vengono impostati da un amministratore nella sezione CA Step delle Impostazioni di amministrazione.",
+    "docs": "Vedi documenti"
+  },
+  "dialog": {
+    "title": "Passaggio: Autenticazione CA richiesta",
+    "description": "Completa l'autenticazione nel tuo browser per continuare. Il certificato rimarrà valido finché consentito dalla tua CA.",
+    "openBrowser": "Apri il browser per autenticarti",
+    "waiting": "In attesa dell'autenticazione nel browser...",
+    "authenticating": "Autenticazione in corso..."
+  },
+  "errors": {
+    "authFailed": "Autenticazione fallita. Controlla le credenziali e riprova.",
+    "timeout": "Autenticazione scaduta. Riprova."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL CA",
+      "description": "L'URL HTTPS della tua CA di smallstep. Lascia vuoti i campi URL CA, fingerprint e provisioner per disattivare Step CA.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Impronta digitale radice (SHA-256)",
+      "description": "L'impronta digitale del certificato radice, come mostrato dal passaggio ca bootstrap."
+    },
+    "provisioner": {
+      "label": "Nome del fornitore OIDC",
+      "description": "Il nome del provisioner OIDC dell'autorità di certificazione (CA). Quindi, selezionare \"Step CA\" come tipo di autenticazione dell'host."
+    },
+    "privateEndpoints": {
+      "label": "Host Step CA privati consentiti",
+      "description": "Gli host privati che utilizzano il flusso di certificati Step CA potrebbero contattare: la CA stessa e, se interna, il provider di identità. Separarli con virgole o a capo."
+    },
+    "redirectUri": {
+      "label": "URI di reindirizzamento",
+      "description": "Registra questo URL come URI di reindirizzamento consentito presso il provider di identità dietro il provisioner OIDC."
+    },
+    "legacyCallback": {
+      "label": "Utilizzare il vecchio URI di reindirizzamento",
+      "description": "Continua a inviare /host/step-ca-callback, l'URI di reindirizzamento utilizzato prima della versione 2.9. Disattivalo non appena il tuo provider di identità consentirà l'utilizzo del nuovo URI."
+    }
+  }
+}

plugins/step-ca/locales/translated/ja_JP.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "ステップCA"
+  },
+  "editor": {
+    "label": "ステップCA",
+    "description": "IDプロバイダー経由でサインインし、Step CAにこのホスト用の有効期限の短いSSH証明書を発行させてください。CA URL、ルートフィンガープリント、およびOIDCプロビジョナーは、管理者が管理設定のStep CAセクションで設定します。",
+    "docs": "ドキュメントを見る"
+  },
+  "dialog": {
+    "title": "ステップCA認証が必要です",
+    "description": "続行するには、ブラウザで認証を完了してください。証明書は、認証局が許可する限り有効です。",
+    "openBrowser": "ブラウザを開いて認証",
+    "waiting": "ブラウザでの認証を待機中...",
+    "authenticating": "認証を処理中..."
+  },
+  "errors": {
+    "authFailed": "認証に失敗しました。資格情報を確認して再試行してください。",
+    "timeout": "認証がタイムアウトしました。もう一度お試しください。"
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "SmallStep CAのHTTPS URL。Step CAを無効にするには、CA URL、フィンガープリント、プロビジョナーを空欄のままにしてください。",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "ルートフィンガープリント（SHA-256）",
+      "description": "ステップ ca bootstrap で示されるルート証明書のフィンガープリント。"
+    },
+    "provisioner": {
+      "label": "OIDCプロビジョナー名",
+      "description": "CAのOIDCプロビジョナーの名前を指定します。次に、ホストの認証タイプとして「ステップCA」を選択します。"
+    },
+    "privateEndpoints": {
+      "label": "許可されたプライベートStep CAホスト",
+      "description": "プライベートホストの場合、Step CA証明書フローは、認証局自体、および内部の場合はIDプロバイダーと連絡を取る可能性があります。これらはカンマまたは改行で区切ってください。"
+    },
+    "redirectUri": {
+      "label": "リダイレクトURI",
+      "description": "このURLを、OIDCプロビジョナーの背後にあるIDプロバイダーに、許可されたリダイレクトURIとして登録してください。"
+    },
+    "legacyCallback": {
+      "label": "古いリダイレクトURIを使用する",
+      "description": "バージョン2.9以前に使用されていたリダイレクトURIである/host/step-ca-callbackを送信し続けてください。IDプロバイダーが新しいURIを許可したら、この設定を無効にしてください。"
+    }
+  }
+}

plugins/step-ca/locales/translated/ko_KR.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "스텝 CA"
+  },
+  "editor": {
+    "label": "스텝 CA",
+    "description": "ID 공급자를 통해 로그인하고 Step CA에서 이 호스트에 대한 단기 SSH 인증서를 발급받으세요. CA URL, 루트 지문 및 OIDC 프로비저너는 관리자가 관리 설정의 Step CA 섹션에서 설정합니다.",
+    "docs": "문서 보기"
+  },
+  "dialog": {
+    "title": "단계 CA 인증 필요",
+    "description": "계속하려면 브라우저에서 인증을 완료하십시오. 인증서는 CA(인증 기관)에서 허용하는 기간 동안 유효합니다.",
+    "openBrowser": "브라우저로 인증하기",
+    "waiting": "브라우저에서 인증 대기 중...",
+    "authenticating": "인증 처리 중..."
+  },
+  "errors": {
+    "authFailed": "인증에 실패했습니다. 자격 증명을 확인하고 다시 시도하세요.",
+    "timeout": "인증 시간이 초과되었습니다. 다시 시도하세요."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "SmallStep CA의 HTTPS URL을 입력하십시오. Step CA를 비활성화하려면 CA URL, 지문 및 프로비저너 필드를 비워 두십시오.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "루트 지문(SHA-256)",
+      "description": "루트 인증서 지문은 CA 부트스트랩 단계에서 확인할 수 있습니다."
+    },
+    "provisioner": {
+      "label": "OIDC 프로비저너 이름",
+      "description": "CA의 OIDC 프로비저너 이름을 입력합니다. 그런 다음 호스트의 인증 유형으로 \"단계별 CA\"를 선택합니다."
+    },
+    "privateEndpoints": {
+      "label": "허용된 개인 Step CA 호스트",
+      "description": "Step CA 인증서 흐름이 접촉할 수 있는 개인 호스트는 CA 자체와 (내부 호스트인 경우) ID 공급자입니다. 쉼표 또는 줄 바꿈으로 구분하십시오."
+    },
+    "redirectUri": {
+      "label": "리디렉션 URI",
+      "description": "이 URL을 OIDC 프로비저너 뒤에 있는 ID 공급자에게 허용된 리디렉션 URI로 등록하십시오."
+    },
+    "legacyCallback": {
+      "label": "이전 리디렉션 URI를 사용하세요",
+      "description": "2.9 이전 버전에서 사용했던 리디렉션 URI인 /host/step-ca-callback을 계속 전송하세요. ID 공급자가 새 URI를 허용하면 이 기능을 비활성화하십시오."
+    }
+  }
+}

plugins/step-ca/locales/translated/nl_NL.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/no_NO.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/pl_PL.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Zobacz dokumentację"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Otwórz przeglądarkę, aby uwierzytelnić",
+    "waiting": "Oczekiwanie na uwierzytelnienie w przeglądarce...",
+    "authenticating": "Przetwarzanie uwierzytelniania..."
+  },
+  "errors": {
+    "authFailed": "Uwierzytelnienie nie powiodło się. Sprawdź poświadczenia i spróbuj ponownie.",
+    "timeout": "Upłynął limit czasu uwierzytelniania. Spróbuj ponownie."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/pt_BR.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Documentação"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/pt_PT.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Ver docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Abrir navegador para autenticar",
+    "waiting": "A aguardar autenticação no navegador...",
+    "authenticating": "A processar autenticação..."
+  },
+  "errors": {
+    "authFailed": "A autenticação falhou. Verifique as suas credenciais e tente novamente.",
+    "timeout": "A autenticação expirou. Tente novamente."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/ro_RO.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Pasul CA"
+  },
+  "editor": {
+    "label": "Pasul CA",
+    "description": "Conectați-vă prin intermediul furnizorului de identitate și permiteți ca autoritatea de certificare Step CA să emită un certificat SSH de scurtă durată pentru această gazdă. Adresa URL a autorității de certificare, amprenta rădăcină și furnizorul OIDC sunt setate de un administrator în secțiunea Step CA din Setări administrator.",
+    "docs": "Vizualizați documentele"
+  },
+  "dialog": {
+    "title": "Pasul Autentificare CA necesară",
+    "description": "Finalizați autentificarea în browser pentru a continua. Certificatul rămâne valabil atât timp cât permite autoritatea de certificare (CA).",
+    "openBrowser": "Deschideți browserul pentru autentificare",
+    "waiting": "Se așteaptă autentificarea în browser...",
+    "authenticating": "Se procesează autentificarea..."
+  },
+  "errors": {
+    "authFailed": "Autentificarea a eșuat. Verificați acreditările și încercați din nou.",
+    "timeout": "Autentificarea a expirat. Vă rugăm să încercați din nou."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "URL-ul CA",
+      "description": "URL-ul https al autorității dvs. de certificare Smallstep. Lăsați URL-ul CA, amprenta și aprovizionatorul necompletate pentru a dezactiva Step CA.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Amprentă digitală rădăcină (SHA-256)",
+      "description": "Amprenta electronică a certificatului rădăcină, așa cum se arată în pasul ca bootstrap."
+    },
+    "provisioner": {
+      "label": "Numele furnizorului OIDC",
+      "description": "Numele furnizorului OIDC al CA. Apoi, alegeți „Step CA” ca tip de autentificare al gazdei."
+    },
+    "privateEndpoints": {
+      "label": "Gazde private permise de Step CA",
+      "description": "Gazde private pe care fluxul de certificate Step CA le poate contacta: CA-ul în sine și, dacă este intern, furnizorul dvs. de identitate. Separați-le prin virgule sau linii noi."
+    },
+    "redirectUri": {
+      "label": "URI de redirecționare",
+      "description": "Înregistrați această adresă URL ca URI de redirecționare permisă la furnizorul de identitate din spatele furnizorului OIDC."
+    },
+    "legacyCallback": {
+      "label": "Folosește vechiul URI de redirecționare",
+      "description": "Continuă să trimiți /host/step-ca-callback, URI-ul de redirecționare folosit înainte de versiunea 2.9. Dezactivează această opțiune odată ce furnizorul de identitate îl permite pe cel nou."
+    }
+  }
+}

plugins/step-ca/locales/translated/ru_RU.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Документация"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Открыть браузер для аутентификации",
+    "waiting": "Ожидание аутентификации в браузере...",
+    "authenticating": "Обработка аутентификации..."
+  },
+  "errors": {
+    "authFailed": "Аутентификация не удалась. Проверьте учётные данные и попробуйте снова.",
+    "timeout": "Время аутентификации истекло. Попробуйте снова."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/sr_SP.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/sv_SE.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/th_TH.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/tr_TR.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Belgelere bak"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Kimlik Doğrulaması için Tarayıcı Aç",
+    "waiting": "Tarayıcıda kimlik doğrulaması bekleniyor...",
+    "authenticating": "Kimlik doğrulaması işleniyor..."
+  },
+  "errors": {
+    "authFailed": "Kimlik doğrulaması başarısız oldu. Lütfen kimlik bilgilerinizi kontrol edip tekrar deneyin.",
+    "timeout": "Kimlik doğrulaması zaman aşımına uğradı. Lütfen tekrar deneyin."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/uk_UA.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "View docs"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Open Browser to Authenticate",
+    "waiting": "Waiting for authentication in browser...",
+    "authenticating": "Processing authentication..."
+  },
+  "errors": {
+    "authFailed": "Authentication failed. Please check your credentials and try again.",
+    "timeout": "Authentication timed out. Please try again."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/vi_VN.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "Xem tài liệu"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "Mở trình duyệt để xác thực",
+    "waiting": "Đang chờ xác thực trên trình duyệt...",
+    "authenticating": "Đang xử lý xác thực..."
+  },
+  "errors": {
+    "authFailed": "Xác thực thất bại. Vui lòng kiểm tra thông tin đăng nhập và thử lại.",
+    "timeout": "Xác thực đã hết thời gian chờ. Vui lòng thử lại."
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/zh_CN.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "查看文档"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "打开浏览器进行认证",
+    "waiting": "等待浏览器认证...",
+    "authenticating": "正在处理认证..."
+  },
+  "errors": {
+    "authFailed": "认证失败，请检查凭据并重试。",
+    "timeout": "认证超时，请重试。"
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/locales/translated/zh_TW.json

@@ -0,0 +1,48 @@
+{
+  "hosts": {
+    "filterAuthStepca": "Step CA"
+  },
+  "editor": {
+    "label": "Step CA",
+    "description": "Sign in through your identity provider and let your Step CA issue a short-lived SSH certificate for this host. The CA URL, root fingerprint and OIDC provisioner are set by an administrator in the Step CA section of Admin Settings.",
+    "docs": "檢視文件"
+  },
+  "dialog": {
+    "title": "Step CA Authentication Required",
+    "description": "Complete authentication in your browser to continue. The certificate stays valid for as long as your CA allows.",
+    "openBrowser": "開啟瀏覽器以進行驗證",
+    "waiting": "正在等待瀏覽器中的驗證…",
+    "authenticating": "正在處理驗證…"
+  },
+  "errors": {
+    "authFailed": "驗證失敗。請檢查您的憑證並再試一次。",
+    "timeout": "驗證逾時。請再試一次。"
+  },
+  "settings": {
+    "caUrl": {
+      "label": "CA URL",
+      "description": "The https URL of your smallstep CA. Leave the CA URL, fingerprint and provisioner empty to turn Step CA off.",
+      "placeholder": "https://ca.internal:9000"
+    },
+    "fingerprint": {
+      "label": "Root fingerprint (SHA-256)",
+      "description": "The root certificate fingerprint, as shown by step ca bootstrap."
+    },
+    "provisioner": {
+      "label": "OIDC provisioner name",
+      "description": "The name of the CA's OIDC provisioner. Then choose \"Step CA\" as a host's authentication type."
+    },
+    "privateEndpoints": {
+      "label": "Allowed private Step CA hosts",
+      "description": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas or new lines."
+    },
+    "redirectUri": {
+      "label": "Redirect URI",
+      "description": "Register this URL as an allowed redirect URI with the identity provider behind the OIDC provisioner."
+    },
+    "legacyCallback": {
+      "label": "Use the old redirect URI",
+      "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
+    }
+  }
+}

plugins/step-ca/manifest.json

@@ -0,0 +1,86 @@
+{
+  "id": "step-ca",
+  "name": "Step CA",
+  "version": "1.0.0",
+  "description": "Connect to hosts with short-lived SSH certificates from a smallstep step-ca server, after signing in through its OIDC provisioner.",
+  "author": {
+    "name": "Termix"
+  },
+  "license": "MIT",
+  "repository": "https://github.com/Termix-SSH/Termix",
+  "category": "Access & Security",
+  "icon": "ShieldCheck",
+  "engine": {
+    "termix": ">=2.9.0",
+    "api": "1"
+  },
+  "capabilities": [
+    "db:own",
+    "secrets:own",
+    "network:outbound",
+    "network:serve",
+    "auth:provide",
+    "ui:surface"
+  ],
+  "contributes": {
+    "auth": {
+      "sshAuthTypes": ["stepca"]
+    },
+    "settings": {
+      "admin": [
+        {
+          "key": "caUrl",
+          "type": "string",
+          "labelKey": "settings.caUrl.label",
+          "descriptionKey": "settings.caUrl.description",
+          "placeholderKey": "settings.caUrl.placeholder",
+          "default": ""
+        },
+        {
+          "key": "fingerprint",
+          "type": "string",
+          "labelKey": "settings.fingerprint.label",
+          "descriptionKey": "settings.fingerprint.description",
+          "default": ""
+        },
+        {
+          "key": "provisioner",
+          "type": "string",
+          "labelKey": "settings.provisioner.label",
+          "descriptionKey": "settings.provisioner.description",
+          "default": ""
+        },
+        {
+          "key": "privateEndpoints",
+          "type": "textarea",
+          "labelKey": "settings.privateEndpoints.label",
+          "descriptionKey": "settings.privateEndpoints.description",
+          "default": ""
+        },
+        {
+          "key": "redirectUri",
+          "type": "custom",
+          "component": "redirectUri"
+        },
+        {
+          "key": "legacyCallback",
+          "type": "boolean",
+          "labelKey": "settings.legacyCallback.label",
+          "descriptionKey": "settings.legacyCallback.description",
+          "default": false
+        }
+      ]
+    },
+    "http": {
+      "legacyRedirects": [
+        {
+          "from": "/host/step-ca-callback",
+          "to": "/callback"
+        }
+      ]
+    },
+    "uses": ["terminal.overlay"]
+  },
+  "locales": "locales",
+  "platforms": ["linux", "win32", "darwin"]
+}

plugins/step-ca/migrations/mysql/0001_create_certs.sql

@@ -0,0 +1,16 @@
+-- step-ca 0001: create_certs
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS `p_step_ca_certs` (
+  `id` int AUTO_INCREMENT PRIMARY KEY,
+  `user_id` varchar(255) NOT NULL,
+  `host_id` int NOT NULL,
+  `ssh_cert` text NOT NULL,
+  `private_key` text NOT NULL,
+  `email` text,
+  `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+  `expires_at` varchar(255) NOT NULL,
+  FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
+  FOREIGN KEY (`host_id`) REFERENCES `ssh_data` (`id`) ON DELETE CASCADE
+);
+CREATE UNIQUE INDEX `idx_step_ca_certs_user_host` ON `p_step_ca_certs` (`user_id`, `host_id`);

plugins/step-ca/migrations/postgres/0001_create_certs.sql

@@ -0,0 +1,16 @@
+-- step-ca 0001: create_certs
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS "p_step_ca_certs" (
+  "id" serial PRIMARY KEY,
+  "user_id" varchar(255) NOT NULL,
+  "host_id" integer NOT NULL,
+  "ssh_cert" text NOT NULL,
+  "private_key" text NOT NULL,
+  "email" text,
+  "created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "expires_at" varchar(255) NOT NULL,
+  FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE,
+  FOREIGN KEY ("host_id") REFERENCES "ssh_data" ("id") ON DELETE CASCADE
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "idx_step_ca_certs_user_host" ON "p_step_ca_certs" ("user_id", "host_id");

plugins/step-ca/migrations/snapshot.json

@@ -0,0 +1,51 @@
+{
+  "version": 1,
+  "tables": {
+    "certs": {
+      "columns": {
+        "id": {
+          "type": "id",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "userId": {
+          "type": "refUser",
+          "length": 255,
+          "notNull": true
+        },
+        "hostId": {
+          "type": "refHost",
+          "notNull": true
+        },
+        "sshCert": {
+          "type": "text",
+          "notNull": true
+        },
+        "privateKey": {
+          "type": "text",
+          "notNull": true
+        },
+        "email": {
+          "type": "text"
+        },
+        "createdAt": {
+          "type": "text",
+          "notNull": true,
+          "defaultNow": true
+        },
+        "expiresAt": {
+          "type": "varchar",
+          "length": 255,
+          "notNull": true
+        }
+      },
+      "indexes": [
+        {
+          "name": "idx_step_ca_certs_user_host",
+          "columns": ["userId", "hostId"],
+          "unique": true
+        }
+      ]
+    }
+  }
+}

plugins/step-ca/migrations/sqlite/0001_create_certs.sql

@@ -0,0 +1,16 @@
+-- step-ca 0001: create_certs
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS "p_step_ca_certs" (
+  "id" integer PRIMARY KEY AUTOINCREMENT,
+  "user_id" text NOT NULL,
+  "host_id" integer NOT NULL,
+  "ssh_cert" text NOT NULL,
+  "private_key" text NOT NULL,
+  "email" text,
+  "created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "expires_at" text NOT NULL,
+  FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE,
+  FOREIGN KEY ("host_id") REFERENCES "ssh_data" ("id") ON DELETE CASCADE
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "idx_step_ca_certs_user_host" ON "p_step_ca_certs" ("user_id", "host_id");

plugins/step-ca/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@termix-plugin/step-ca",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "termix-plugin build",
+    "test": "termix-plugin test",
+    "typecheck": "tsc -p .",
+    "validate": "termix-plugin validate"
+  },
+  "dependencies": {
+    "lucide-react": "^1.33.0",
+    "redis": "^6.2.1"
+  },
+  "devDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "better-sqlite3": "^13.0.3",
+    "jsdom": "^30.0.1",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "drizzle-orm": "^0.45.2",
+    "express": "^5.2.1",
+    "react": "^19.2.8",
+    "sonner": "^2.0.8"
+  }
+}

plugins/step-ca/src/backend/auth-session.ts

@@ -0,0 +1,378 @@
+import { randomBytes } from "node:crypto";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import type { CertStore } from "./cert-store.js";
+import type { CallbackQuery, CallbackResult, Runtime } from "./runtime.js";
+import {
+  buildAuthorizationUrl,
+  createPkce,
+  decodeJwtClaims,
+  discoverOidcEndpoints,
+  exchangeCodeForIdToken,
+  fetchRootCertificate,
+  findOidcProvisioner,
+  generateSshKeyPair,
+  parseSshCertificate,
+  signSshCertificate,
+  type StepCaTarget,
+} from "./client.js";
+
+/** The redirect URI 2.8 registered with identity providers. */
+export const LEGACY_CALLBACK_PATH = "/host/step-ca-callback";
+export const CALLBACK_PATH = "/plugin-api/step-ca/callback";
+
+const AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+const REMOTE_CALLBACK_WAIT_MS = 30_000;
+const REMOTE_POLL_MS = 250;
+
+/** The terminal socket, as far as a sign-in needs it. */
+export interface SignInSocket {
+  send: (data: string) => void;
+  on: (event: "close", listener: () => void) => void;
+}
+
+export interface StartRequest {
+  userId: string;
+  hostId: number;
+  username: string;
+  socket: SignInSocket;
+  requestOrigin: string;
+}
+
+interface Session {
+  state: string;
+  userId: string;
+  hostId: number;
+  username: string;
+  socket: SignInSocket;
+  target: StepCaTarget;
+  rootPem: string;
+  clientId: string;
+  clientSecret?: string;
+  tokenEndpoint: string;
+  redirectUri: string;
+  codeVerifier: string;
+  nonce: string;
+  keyPair: { publicKeyLine: string; privateKeyPem: string };
+  timeout: ReturnType<typeof setTimeout>;
+  commandPoll: ReturnType<typeof setInterval> | null;
+  processing: boolean;
+  completed: boolean;
+}
+
+export interface StepCaSettings {
+  caUrl: string;
+  fingerprint: string;
+  provisioner: string;
+  privateEndpoints: string[];
+}
+
+/** Comma or newline separated hosts, lower-cased. */
+export function parseHostList(raw: unknown): string[] {
+  if (typeof raw !== "string") return [];
+  return raw
+    .split(/[\s,]+/)
+    .map((entry) => entry.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function send(socket: SignInSocket, message: Record<string, unknown>): void {
+  try {
+    socket.send(JSON.stringify(message));
+  } catch {
+    // socket already gone
+  }
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export type AuthSessions = ReturnType<typeof createAuthSessions>;
+
+/**
+ * Step CA sign-ins in flight: the OIDC authorization-code flow against the
+ * CA's provisioner, then the CA signs a fresh key. Created per activation.
+ */
+export function createAuthSessions(
+  ctx: PluginContext,
+  deps: { certs: CertStore; runtime: Runtime },
+) {
+  const sessions = new Map<string, Session>();
+
+  async function readSettings(): Promise<StepCaSettings | null> {
+    const [caUrl, fingerprint, provisioner, privateEndpoints] =
+      await Promise.all([
+        ctx.settings.get<string>("caUrl"),
+        ctx.settings.get<string>("fingerprint"),
+        ctx.settings.get<string>("provisioner"),
+        ctx.settings.get<string>("privateEndpoints"),
+      ]);
+    if (!caUrl?.trim() || !fingerprint?.trim() || !provisioner?.trim()) {
+      return null;
+    }
+    return {
+      caUrl: caUrl.trim(),
+      fingerprint: fingerprint.trim(),
+      provisioner: provisioner.trim(),
+      privateEndpoints: parseHostList(privateEndpoints),
+    };
+  }
+
+  async function callbackPath(): Promise<string> {
+    const legacy = await ctx.settings.get<boolean>("legacyCallback");
+    return legacy ? LEGACY_CALLBACK_PATH : CALLBACK_PATH;
+  }
+
+  function end(session: Session, removeRuntime = true): void {
+    clearTimeout(session.timeout);
+    if (session.commandPoll) clearInterval(session.commandPoll);
+    sessions.delete(session.state);
+    if (removeRuntime) void deps.runtime.remove(session.state);
+  }
+
+  async function finish(
+    session: Session,
+    query: CallbackQuery,
+    removeRuntime = true,
+  ): Promise<CallbackResult> {
+    if (query.error || !query.code) {
+      const message =
+        query.error_description || query.error || "Sign-in failed";
+      send(session.socket, {
+        type: "stepca_error",
+        requestId: session.state,
+        error: `Step CA: ${message}`,
+      });
+      end(session, removeRuntime);
+      return { ok: false, message };
+    }
+
+    try {
+      send(session.socket, {
+        type: "stepca_status",
+        requestId: session.state,
+        stage: "authenticating",
+      });
+      const idToken = await exchangeCodeForIdToken({
+        fetch: ctx.fetch,
+        tokenEndpoint: session.tokenEndpoint,
+        clientId: session.clientId,
+        clientSecret: session.clientSecret,
+        code: query.code,
+        redirectUri: session.redirectUri,
+        codeVerifier: session.codeVerifier,
+        allowedPrivateHosts: session.target.allowedPrivateHosts,
+      });
+      const claims = decodeJwtClaims(idToken);
+      if (claims.nonce !== session.nonce) {
+        throw new Error("The identity token does not match this sign-in");
+      }
+      const email = typeof claims.email === "string" ? claims.email : undefined;
+
+      const certificate = await signSshCertificate(
+        session.target,
+        session.rootPem,
+        {
+          publicKeyLine: session.keyPair.publicKeyLine,
+          ott: idToken,
+          principals: [session.username],
+          keyId: email ?? session.username,
+        },
+      );
+
+      const info = parseSshCertificate(certificate);
+      if (info.publicKeyLine !== session.keyPair.publicKeyLine) {
+        throw new Error("The CA returned a certificate for a different key");
+      }
+      if (!info.principals.includes(session.username)) {
+        throw new Error(
+          "The CA certificate does not include the host username",
+        );
+      }
+      const now = Date.now();
+      if (
+        info.validBefore.getTime() <= now ||
+        info.validAfter.getTime() > now + 60_000
+      ) {
+        throw new Error(
+          "The CA returned a certificate outside its validity window",
+        );
+      }
+
+      await deps.certs.save(
+        session.userId,
+        session.hostId,
+        { sshCert: certificate, privateKey: session.keyPair.privateKeyPem },
+        info.validBefore,
+        email,
+      );
+
+      session.completed = true;
+      send(session.socket, {
+        type: "stepca_completed",
+        requestId: session.state,
+        expiresAt: info.validBefore.toISOString(),
+      });
+      end(session, removeRuntime);
+      return { ok: true, message: "Signed in. You can close this window." };
+    } catch (error) {
+      const message = errorMessage(error);
+      ctx.log.error(`Step CA certificate issuance failed: ${message}`);
+      send(session.socket, {
+        type: "stepca_error",
+        requestId: session.state,
+        error: `Step CA: ${message}`,
+      });
+      end(session, removeRuntime);
+      return { ok: false, message };
+    }
+  }
+
+  return {
+    async start(request: StartRequest): Promise<void> {
+      const settings = await readSettings();
+      if (!settings) {
+        send(request.socket, {
+          type: "stepca_config_error",
+          requestId: "",
+          error:
+            "Step CA is not configured. An administrator must set the CA URL, root fingerprint and OIDC provisioner in the Step CA plugin settings.",
+        });
+        return;
+      }
+
+      const state = randomBytes(24).toString("base64url");
+      try {
+        const target: StepCaTarget = {
+          fetch: ctx.fetch,
+          caUrl: settings.caUrl,
+          fingerprint: settings.fingerprint,
+          allowedPrivateHosts: settings.privateEndpoints,
+        };
+        const rootPem = await fetchRootCertificate(target);
+        const provisioner = await findOidcProvisioner(
+          target,
+          rootPem,
+          settings.provisioner,
+        );
+        const endpoints = await discoverOidcEndpoints(
+          ctx.fetch,
+          provisioner.configurationEndpoint,
+          target.allowedPrivateHosts,
+        );
+        const pkce = createPkce();
+        const nonce = randomBytes(16).toString("base64url");
+        const redirectUri = `${request.requestOrigin}${await callbackPath()}`;
+
+        const session: Session = {
+          state,
+          userId: request.userId,
+          hostId: request.hostId,
+          username: request.username,
+          socket: request.socket,
+          target,
+          rootPem,
+          clientId: provisioner.clientID,
+          clientSecret: provisioner.clientSecret,
+          tokenEndpoint: endpoints.tokenEndpoint,
+          redirectUri,
+          codeVerifier: pkce.verifier,
+          nonce,
+          keyPair: generateSshKeyPair(),
+          processing: false,
+          completed: false,
+          commandPoll: null,
+          timeout: setTimeout(() => {
+            const current = sessions.get(state);
+            if (!current || current.completed || current.processing) return;
+            send(request.socket, { type: "stepca_timeout", requestId: state });
+            end(current);
+          }, AUTH_TIMEOUT_MS),
+        };
+        sessions.set(state, session);
+        await deps.runtime.register(state);
+        // Another instance may receive the callback and queue it for us.
+        session.commandPoll = setInterval(() => {
+          if (session.processing || session.completed) return;
+          void deps.runtime.takeCommand(state).then(async (query) => {
+            if (!query || session.processing || session.completed) return;
+            session.processing = true;
+            const result = await finish(session, query, false);
+            await deps.runtime.complete(state, result);
+          });
+        }, REMOTE_POLL_MS);
+        session.commandPoll.unref?.();
+        request.socket.on("close", () => {
+          const current = sessions.get(state);
+          if (current && !current.completed) end(current);
+        });
+
+        send(request.socket, {
+          type: "stepca_status",
+          requestId: state,
+          stage: "chooser",
+          url: buildAuthorizationUrl({
+            authorizationEndpoint: endpoints.authorizationEndpoint,
+            clientId: provisioner.clientID,
+            redirectUri,
+            state,
+            nonce,
+            codeChallenge: pkce.challenge,
+          }),
+        });
+      } catch (error) {
+        ctx.log.error(
+          `Failed to start Step CA authentication: ${errorMessage(error)}`,
+        );
+        send(request.socket, {
+          type: "stepca_error",
+          requestId: state,
+          error: `Step CA: ${errorMessage(error)}`,
+        });
+      }
+    },
+
+    cancel(requestId: string): boolean {
+      const session = sessions.get(requestId);
+      if (!session) return false;
+      end(session);
+      return true;
+    },
+
+    /**
+     * The identity provider's redirect: exchanges the code, has the CA sign
+     * the key and stores the certificate. A sign-in another instance started
+     * is handed to it through the runtime.
+     */
+    async complete(query: CallbackQuery): Promise<CallbackResult> {
+      const session = query.state ? sessions.get(query.state) : undefined;
+      if (!session) {
+        if (!query.state || !(await deps.runtime.submit(query.state, query))) {
+          return {
+            ok: false,
+            message: "This sign-in request is no longer active.",
+          };
+        }
+        const deadline = Date.now() + REMOTE_CALLBACK_WAIT_MS;
+        while (Date.now() < deadline) {
+          const result = await deps.runtime.takeResult(query.state);
+          if (result) return result;
+          await new Promise((resolve) => setTimeout(resolve, REMOTE_POLL_MS));
+        }
+        return {
+          ok: false,
+          message: "The Termix instance handling this sign-in did not respond.",
+        };
+      }
+      if (session.processing || session.completed) {
+        return { ok: false, message: "This sign-in request was already used." };
+      }
+      session.processing = true;
+      return finish(session, query);
+    },
+
+    closeAll(): void {
+      for (const session of [...sessions.values()]) end(session);
+    },
+  };
+}

plugins/step-ca/src/backend/cert-store.ts

@@ -0,0 +1,96 @@
+import { and, eq } from "drizzle-orm";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// ctx.db.define hands the table back untyped and the drizzle handle is the
+// server's own, so both are typed at this module's edge.
+type Table = any;
+type Drizzle = any;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export interface IssuedCertificate {
+  sshCert: string;
+  privateKey: string;
+}
+
+export type CertStore = ReturnType<typeof createCertStore>;
+
+export function createCertStore(ctx: PluginContext, table: Table) {
+  const client = () => ctx.db.client<Drizzle>();
+  const byUserAndHost = (userId: string, hostId: number) =>
+    and(eq(table.userId, userId), eq(table.hostId, hostId));
+
+  async function find(userId: string, hostId: number) {
+    const rows = await (
+      await client()
+    )
+      .select()
+      .from(table)
+      .where(byUserAndHost(userId, hostId))
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  async function remove(userId: string, hostId: number): Promise<boolean> {
+    if (!(await find(userId, hostId))) return false;
+    await (await client()).delete(table).where(byUserAndHost(userId, hostId));
+    await ctx.db.persist();
+    return true;
+  }
+
+  return {
+    async save(
+      userId: string,
+      hostId: number,
+      certificate: IssuedCertificate,
+      expiresAt: Date,
+      email?: string,
+    ): Promise<void> {
+      const values = {
+        sshCert: await ctx.secrets.seal(certificate.sshCert),
+        privateKey: await ctx.secrets.seal(certificate.privateKey),
+        email: email ?? null,
+        createdAt: new Date().toISOString(),
+        expiresAt: expiresAt.toISOString(),
+      };
+      if (await find(userId, hostId)) {
+        await (
+          await client()
+        )
+          .update(table)
+          .set(values)
+          .where(byUserAndHost(userId, hostId));
+      } else {
+        await (
+          await client()
+        )
+          .insert(table)
+          .values({ userId, hostId, ...values });
+      }
+      await ctx.db.persist();
+    },
+
+    /** The usable certificate, or null. Expired or unreadable rows are deleted. */
+    async get(
+      userId: string,
+      hostId: number,
+    ): Promise<IssuedCertificate | null> {
+      const row = await find(userId, hostId);
+      if (!row) return null;
+      const expiresAt = new Date(row.expiresAt).getTime();
+      if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+        await remove(userId, hostId);
+        return null;
+      }
+      const sshCert = await ctx.secrets.unseal(row.sshCert);
+      const privateKey = await ctx.secrets.unseal(row.privateKey);
+      if (!sshCert || !privateKey) {
+        await remove(userId, hostId);
+        return null;
+      }
+      return { sshCert, privateKey };
+    },
+
+    remove,
+  };
+}

plugins/step-ca/src/backend/client.ts

@@ -0,0 +1,417 @@
+import crypto from "node:crypto";
+import type { PluginFetch } from "@termix/plugin-sdk/backend";
+
+/**
+ * A minimal client for smallstep's step-ca SSH user-certificate flow, done
+ * over its HTTP API rather than the `step` binary:
+ *
+ *   1. bootstrap the CA's root certificate by fingerprint (GET /root/{fp})
+ *   2. read the OIDC provisioner's client settings (GET /provisioners)
+ *   3. run the OIDC authorization-code flow against the provider
+ *   4. POST the id_token as the one-time token to /1.0/ssh/sign
+ */
+
+export interface StepCaTarget {
+  /** ctx.fetch: core's SSRF guard. */
+  fetch: PluginFetch;
+  caUrl: string;
+  fingerprint: string;
+  /** Hosts the SSRF guard may reach even when they resolve to private ranges. */
+  allowedPrivateHosts: readonly string[];
+}
+
+export interface StepCaOidcProvisioner {
+  name: string;
+  clientID: string;
+  clientSecret?: string;
+  configurationEndpoint: string;
+}
+
+export interface OidcEndpoints {
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+}
+
+const FETCH_TIMEOUT_MS = 15_000;
+
+/** Display-only claims; the CA is the component that verifies the token. */
+export function decodeJwtClaims(token: string): Record<string, unknown> {
+  const payload = token.split(".")[1];
+  if (!payload) return {};
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    return {};
+  }
+}
+
+export function normalizeCaUrl(raw: string): string {
+  const url = new URL(raw.trim());
+  if (url.protocol !== "https:") {
+    throw new Error("Step CA URL must use https");
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+export function normalizeFingerprint(raw: string): string {
+  const hex = raw.replace(/[^0-9a-fA-F]/g, "").toLowerCase();
+  if (hex.length !== 64) {
+    throw new Error("CA fingerprint must be a SHA-256 hex digest");
+  }
+  return hex;
+}
+
+export function pemToDer(pem: string): Buffer {
+  const body = pem
+    .replace(/-----BEGIN [^-]+-----/g, "")
+    .replace(/-----END [^-]+-----/g, "")
+    .replace(/\s+/g, "");
+  return Buffer.from(body, "base64");
+}
+
+export function certificateFingerprint(pem: string): string {
+  return crypto.createHash("sha256").update(pemToDer(pem)).digest("hex");
+}
+
+async function readJson<T>(response: Response, what: string): Promise<T> {
+  if (!response.ok) {
+    throw new Error(`${what} failed: HTTP ${response.status}`);
+  }
+  return (await response.json()) as T;
+}
+
+/**
+ * The root endpoint is served under the CA's own TLS certificate, which
+ * nothing trusts yet - so this one request skips verification and trusts
+ * the fingerprint instead, exactly like `step ca bootstrap`.
+ */
+export async function fetchRootCertificate(
+  target: StepCaTarget,
+): Promise<string> {
+  const fingerprint = normalizeFingerprint(target.fingerprint);
+  const response = await target.fetch(
+    `${normalizeCaUrl(target.caUrl)}/root/${fingerprint}`,
+    {
+      timeoutMs: FETCH_TIMEOUT_MS,
+      allowPrivateHosts: target.allowedPrivateHosts,
+      tls: { rejectUnauthorized: false },
+    },
+  );
+  const { ca } = await readJson<{ ca?: string }>(
+    response,
+    "Fetching the CA root",
+  );
+  if (!ca || certificateFingerprint(ca) !== fingerprint) {
+    throw new Error("CA root certificate does not match the fingerprint");
+  }
+  return ca;
+}
+
+export async function findOidcProvisioner(
+  target: StepCaTarget,
+  rootPem: string,
+  name: string,
+): Promise<StepCaOidcProvisioner> {
+  const base = normalizeCaUrl(target.caUrl);
+  let cursor = "";
+  for (let page = 0; page < 20; page++) {
+    const response = await target.fetch(
+      `${base}/provisioners?limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
+      {
+        timeoutMs: FETCH_TIMEOUT_MS,
+        allowPrivateHosts: target.allowedPrivateHosts,
+        tls: { ca: rootPem },
+      },
+    );
+    const body = await readJson<{
+      provisioners?: Array<Record<string, unknown>>;
+      nextCursor?: string;
+    }>(response, "Listing CA provisioners");
+    const match = (body.provisioners ?? []).find(
+      (p) => p.name === name && p.type === "OIDC",
+    );
+    if (match) {
+      if (
+        typeof match.clientID !== "string" ||
+        typeof match.configurationEndpoint !== "string"
+      ) {
+        throw new Error("The OIDC provisioner is missing its client settings");
+      }
+      return {
+        name,
+        clientID: match.clientID,
+        clientSecret:
+          typeof match.clientSecret === "string"
+            ? match.clientSecret
+            : undefined,
+        configurationEndpoint: match.configurationEndpoint,
+      };
+    }
+    if (!body.nextCursor) break;
+    cursor = body.nextCursor;
+  }
+  throw new Error(`OIDC provisioner "${name}" not found on the CA`);
+}
+
+export async function discoverOidcEndpoints(
+  fetch: PluginFetch,
+  configurationEndpoint: string,
+  allowedPrivateHosts: readonly string[],
+): Promise<OidcEndpoints> {
+  const response = await fetch(configurationEndpoint, {
+    timeoutMs: FETCH_TIMEOUT_MS,
+    allowPrivateHosts: allowedPrivateHosts,
+  });
+  const doc = await readJson<{
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+  }>(response, "OIDC discovery");
+  if (!doc.authorization_endpoint || !doc.token_endpoint) {
+    throw new Error("OIDC discovery document is incomplete");
+  }
+  return {
+    authorizationEndpoint: doc.authorization_endpoint,
+    tokenEndpoint: doc.token_endpoint,
+  };
+}
+
+export function createPkce(): { verifier: string; challenge: string } {
+  const verifier = crypto.randomBytes(48).toString("base64url");
+  const challenge = crypto
+    .createHash("sha256")
+    .update(verifier)
+    .digest("base64url");
+  return { verifier, challenge };
+}
+
+export function buildAuthorizationUrl(input: {
+  authorizationEndpoint: string;
+  clientId: string;
+  redirectUri: string;
+  state: string;
+  nonce: string;
+  codeChallenge: string;
+}): string {
+  const url = new URL(input.authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", "openid email profile");
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("nonce", input.nonce);
+  url.searchParams.set("code_challenge", input.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+
+export async function exchangeCodeForIdToken(input: {
+  fetch: PluginFetch;
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret?: string;
+  code: string;
+  redirectUri: string;
+  codeVerifier: string;
+  allowedPrivateHosts: readonly string[];
+}): Promise<string> {
+  const form = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri,
+    client_id: input.clientId,
+    code_verifier: input.codeVerifier,
+  });
+  if (input.clientSecret) form.set("client_secret", input.clientSecret);
+  const response = await input.fetch(input.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: form.toString(),
+    timeoutMs: FETCH_TIMEOUT_MS,
+    allowPrivateHosts: input.allowedPrivateHosts,
+  });
+  const body = await readJson<{ id_token?: string }>(
+    response,
+    "OIDC token exchange",
+  );
+  if (!body.id_token) {
+    throw new Error("The identity provider returned no id_token");
+  }
+  return body.id_token;
+}
+
+// --- SSH keys and certificates ---------------------------------------------
+
+function sshString(value: Buffer | string): Buffer {
+  const data = Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(data.length, 0);
+  return Buffer.concat([len, data]);
+}
+
+export function generateSshKeyPair(): {
+  publicKeyLine: string;
+  privateKeyPem: string;
+} {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const jwk = publicKey.export({ format: "jwk" }) as { x: string };
+  const raw = Buffer.from(jwk.x, "base64url");
+  const blob = Buffer.concat([sshString("ssh-ed25519"), sshString(raw)]);
+  return {
+    publicKeyLine: `ssh-ed25519 ${blob.toString("base64")}`,
+    privateKeyPem: privateKey
+      .export({ format: "pem", type: "pkcs8" })
+      .toString(),
+  };
+}
+
+export async function signSshCertificate(
+  target: StepCaTarget,
+  rootPem: string,
+  input: {
+    publicKeyLine: string;
+    ott: string;
+    principals: string[];
+    keyId: string;
+  },
+): Promise<string> {
+  const blob = input.publicKeyLine.trim().split(/\s+/)[1];
+  if (!blob) throw new Error("Invalid public key line");
+  const response = await target.fetch(
+    `${normalizeCaUrl(target.caUrl)}/1.0/ssh/sign`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        publicKey: blob,
+        ott: input.ott,
+        certType: "user",
+        principals: input.principals,
+        keyID: input.keyId,
+      }),
+      timeoutMs: FETCH_TIMEOUT_MS,
+      allowPrivateHosts: target.allowedPrivateHosts,
+      tls: { ca: rootPem },
+    },
+  );
+  if (!response.ok) {
+    let detail = "";
+    try {
+      const err = (await response.json()) as { message?: string };
+      detail = err.message ? `: ${err.message}` : "";
+    } catch {
+      /* no body */
+    }
+    throw new Error(
+      `The CA refused to sign the key (HTTP ${response.status})${detail}`,
+    );
+  }
+  const body = (await response.json()) as { crt?: string };
+  if (!body.crt) throw new Error("The CA returned no certificate");
+  return body.crt.trim();
+}
+
+export interface SshCertificateInfo {
+  keyType: string;
+  publicKeyLine: string;
+  keyId: string;
+  principals: string[];
+  validAfter: Date;
+  validBefore: Date;
+}
+
+/** Reads the identity and validity window out of an OpenSSH certificate line. */
+export function parseSshCertificate(line: string): SshCertificateInfo {
+  const blob = Buffer.from(line.trim().split(/\s+/)[1] ?? "", "base64");
+  if (blob.length === 0) throw new Error("Invalid SSH certificate");
+  let offset = 0;
+  const readString = (): Buffer => {
+    if (offset + 4 > blob.length) throw new Error("Truncated SSH certificate");
+    const len = blob.readUInt32BE(offset);
+    offset += 4;
+    if (offset + len > blob.length) {
+      throw new Error("Truncated SSH certificate");
+    }
+    const value = blob.subarray(offset, offset + len);
+    offset += len;
+    return value;
+  };
+  const readUint64 = (): bigint => {
+    if (offset + 8 > blob.length) throw new Error("Truncated SSH certificate");
+    const value = blob.readBigUInt64BE(offset);
+    offset += 8;
+    return value;
+  };
+
+  const keyType = readString().toString();
+  if (!keyType.endsWith("-cert-v01@openssh.com")) {
+    throw new Error("The CA returned a public key instead of a certificate");
+  }
+  readString(); // nonce
+  // Public key fields differ by algorithm; consume them by shape.
+  const publicKeyParts: Buffer[] = [];
+  let plainKeyType: string;
+  if (keyType.startsWith("ssh-rsa")) {
+    plainKeyType = "ssh-rsa";
+    publicKeyParts.push(readString(), readString()); // e, n
+  } else if (keyType.startsWith("ecdsa-")) {
+    plainKeyType = keyType.replace(/-cert-v01@openssh\.com$/, "");
+    publicKeyParts.push(readString(), readString()); // curve, Q
+  } else {
+    plainKeyType = keyType.replace(/-cert-v01@openssh\.com$/, "");
+    publicKeyParts.push(readString()); // ed25519 pk
+  }
+  const publicKeyBlob = Buffer.concat([
+    sshString(plainKeyType),
+    ...publicKeyParts.map(sshString),
+  ]);
+  readUint64(); // serial
+  offset += 4; // type
+  const keyId = readString().toString();
+  const principalsBlob = readString();
+  const principals: string[] = [];
+  for (let p = 0; p < principalsBlob.length;) {
+    if (p + 4 > principalsBlob.length) {
+      throw new Error("Invalid SSH certificate principals");
+    }
+    const len = principalsBlob.readUInt32BE(p);
+    if (p + 4 + len > principalsBlob.length) {
+      throw new Error("Invalid SSH certificate principals");
+    }
+    principals.push(principalsBlob.subarray(p + 4, p + 4 + len).toString());
+    p += 4 + len;
+  }
+  const validAfter = readUint64();
+  const validBefore = readUint64();
+  const toDate = (seconds: bigint) =>
+    new Date(
+      Number(seconds > 8_640_000_000_000n ? 8_640_000_000_000n : seconds) *
+        1000,
+    );
+  return {
+    keyType,
+    publicKeyLine: `${plainKeyType} ${publicKeyBlob.toString("base64")}`,
+    keyId,
+    principals,
+    validAfter: toDate(validAfter),
+    validBefore: toDate(validBefore),
+  };
+}
+
+/** Save-time checks for the admin page: a bad URL or fingerprint says so there. */
+export function validateCaSettings(
+  values: Record<string, unknown>,
+): Record<string, string> {
+  const errors: Record<string, string> = {};
+  const check = (key: string, normalize: (raw: string) => string) => {
+    const value = values[key];
+    if (typeof value !== "string" || value.trim() === "") return;
+    try {
+      normalize(value);
+    } catch (error) {
+      errors[key] = error instanceof Error ? error.message : String(error);
+    }
+  };
+  check("caUrl", normalizeCaUrl);
+  check("fingerprint", normalizeFingerprint);
+  return errors;
+}

plugins/step-ca/src/backend/index.ts

@@ -0,0 +1,30 @@
+import type { Router } from "express";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import { certs as certsTable } from "./tables.js";
+import { createCertStore } from "./cert-store.js";
+import { createRuntime } from "./runtime.js";
+import { createAuthSessions } from "./auth-session.js";
+import { createStepCaProvider } from "./provider.js";
+import { PUBLIC_PATHS, registerRoutes } from "./routes.js";
+import { validateCaSettings } from "./client.js";
+
+export async function activate(ctx: PluginContext) {
+  ctx.settings.onValidate("admin", validateCaSettings);
+  const table = await ctx.db.define(certsTable);
+  const certs = createCertStore(ctx, table);
+
+  const runtime = createRuntime(ctx);
+  const sessions = createAuthSessions(ctx, { certs, runtime });
+  ctx.disposables.add(async () => {
+    sessions.closeAll();
+    await runtime.close();
+  });
+
+  ctx.auth.registerSshAuthProvider(createStepCaProvider(ctx, certs, sessions));
+
+  registerRoutes(ctx.http.router<Router>({ public: PUBLIC_PATHS }), sessions);
+}
+
+export async function deactivate() {
+  // Everything above was registered through ctx and is disposed by core.
+}

plugins/step-ca/src/backend/provider.ts

@@ -0,0 +1,88 @@
+import type {
+  PluginContext,
+  PluginSshAuthProvider,
+} from "@termix/plugin-sdk/backend";
+import { applyCertificateAuth } from "@termix/plugin-sdk/ssh-certs";
+import type { AuthSessions, SignInSocket } from "./auth-session.js";
+import type { CertStore } from "./cert-store.js";
+
+export const AUTH_TYPE = "stepca";
+
+const REQUIRED_MESSAGE =
+  "Step CA authentication required. Please open a Terminal connection to this host first to complete browser-based authentication.";
+
+const AUTH_FAILED_PATTERN = /All configured authentication methods failed/i;
+
+/**
+ * Hosts with auth type "stepca" connect with the certificate the CA issued.
+ * Without one, the terminal is asked for a browser sign-in
+ * ("stepca_auth_required"), which startInteraction runs.
+ */
+export function createStepCaProvider(
+  ctx: PluginContext,
+  certs: CertStore,
+  sessions: AuthSessions,
+): PluginSshAuthProvider {
+  return {
+    type: AUTH_TYPE,
+    labelKey: "hosts.filterAuthStepca",
+    needsUserInteraction: true,
+    supportsBackground: false,
+    interaction: AUTH_TYPE,
+    prepare: async (config, host, env) => {
+      const certificate = await certs.get(env.userId, env.hostId);
+      if (!certificate) {
+        env.log("info", "No valid certificate found, requesting sign-in");
+        return {
+          status: "interaction-required",
+          interaction: AUTH_TYPE,
+          message: REQUIRED_MESSAGE,
+        };
+      }
+      try {
+        await applyCertificateAuth(
+          config as never,
+          env.client as never,
+          {
+            privateKey: certificate.privateKey,
+            certificate: certificate.sshCert,
+          },
+          host.username,
+        );
+      } catch (error) {
+        return {
+          status: "error",
+          code: "failed",
+          message:
+            "Step CA authentication failed: " +
+            (error instanceof Error ? error.message : String(error)),
+        };
+      }
+      env.log("info", "Using cached SSH certificate");
+      return { status: "ready" };
+    },
+    onAuthFailed: (_host, env, context) => {
+      if (!AUTH_FAILED_PATTERN.test(context.error.message)) return undefined;
+      ctx.log.warn("Step CA authentication failed, forgetting the certificate");
+      void certs.remove(env.userId, env.hostId).catch(() => undefined);
+      return {
+        status: "interaction-required",
+        interaction: AUTH_TYPE,
+        message:
+          "Step CA authentication failed or expired. Please authenticate again.",
+      };
+    },
+    startInteraction: async (request) => {
+      await sessions.start({
+        userId: request.userId,
+        hostId: request.hostId,
+        username: request.host.username,
+        socket: request.socket as SignInSocket,
+        requestOrigin: request.requestOrigin,
+      });
+    },
+    cancelInteraction: async (request) => {
+      if (request.requestId) sessions.cancel(request.requestId);
+    },
+  };
+}

plugins/step-ca/src/backend/routes.ts

@@ -0,0 +1,65 @@
+import type { Request, Response, Router } from "express";
+import type { AuthSessions } from "./auth-session.js";
+
+/**
+ * The identity provider redirects here without a Termix session: the sign-in
+ * may finish in another browser, so it is matched by the OAuth state.
+ */
+export const PUBLIC_PATHS = ["/callback"];
+
+export function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+export function resultPage(ok: boolean, message: string): string {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Termix</title>
+<style>body{font-family:system-ui,sans-serif;background:#111;color:#eee;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
+main{max-width:28rem;padding:2rem;border:1px solid #333;background:#181818}h1{font-size:1.1rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style></head>
+<body><main><h1>${ok ? "Signed in" : "Sign-in failed"}</h1><p>${escapeHtml(message)}</p></main></body></html>`;
+}
+
+export function registerRoutes(router: Router, sessions: AuthSessions): void {
+  /**
+   * @openapi
+   * /plugin-api/step-ca/callback:
+   *   get:
+   *     summary: OIDC callback for a Step CA sign-in
+   *     description: Public. The redirect URI registered with the identity provider behind the CA's OIDC provisioner. Exchanges the code, has the CA sign the key and tells the terminal to reconnect. The 2.8 URI /host/step-ca-callback redirects here.
+   *     tags: [Step CA]
+   *     parameters:
+   *       - name: state
+   *         in: query
+   *         schema:
+   *           type: string
+   *       - name: code
+   *         in: query
+   *         schema:
+   *           type: string
+   *     responses:
+   *       200:
+   *         description: Signed in; an HTML page the browser can close.
+   *       400:
+   *         description: The sign-in failed or is no longer active.
+   */
+  router.get("/callback", async (req: Request, res: Response) => {
+    const query = (name: string): string | undefined => {
+      const value = req.query[name];
+      return typeof value === "string" ? value : undefined;
+    };
+    const result = await sessions.complete({
+      state: query("state"),
+      code: query("code"),
+      error: query("error"),
+      error_description: query("error_description"),
+    });
+    res
+      .status(result.ok ? 200 : 400)
+      .type("html")
+      .send(resultPage(result.ok, result.message));
+  });
+}

plugins/step-ca/src/backend/runtime.ts

@@ -0,0 +1,164 @@
+import { createClient } from "redis";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+
+export interface CallbackQuery {
+  state?: string;
+  code?: string;
+  error?: string;
+  error_description?: string;
+}
+
+export interface CallbackResult {
+  ok: boolean;
+  message: string;
+}
+
+const SESSION_TTL_SECONDS = 5 * 60;
+const RESULT_TTL_SECONDS = 60;
+const CONNECT_RETRY_MS = 15_000;
+
+export type Runtime = ReturnType<typeof createRuntime>;
+
+/**
+ * Hands an identity provider callback to the Termix instance that started
+ * the sign-in, through Redis when REDIS_URL is set. With one instance, or no
+ * Redis, every call is a no-op and the callback is handled locally.
+ */
+export function createRuntime(ctx: PluginContext) {
+  const prefix =
+    process.env.TERMIX_STEP_CA_REDIS_PREFIX?.trim() || "termix:step-ca";
+  let client: ReturnType<typeof createClient> | null = null;
+  let connecting: Promise<boolean> | null = null;
+  let nextConnectAttempt = 0;
+
+  const routeKey = (state: string) => `${prefix}:route:${state}`;
+  const commandKey = (state: string) => `${prefix}:command:${state}`;
+  const resultKey = (state: string) => `${prefix}:result:${state}`;
+
+  function logFailure(operation: string, error: unknown): void {
+    ctx.log.warn(
+      `Step CA Redis runtime unavailable (${operation}): ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
+  async function seal(value: unknown): Promise<string> {
+    return ctx.secrets.seal(JSON.stringify(value));
+  }
+
+  async function unseal<T>(raw: string): Promise<T | null> {
+    const plain = await ctx.secrets.unseal(raw);
+    if (!plain) return null;
+    try {
+      return JSON.parse(plain) as T;
+    } catch {
+      return null;
+    }
+  }
+
+  async function connect(url: string): Promise<boolean> {
+    try {
+      client = createClient({
+        url,
+        socket: { connectTimeout: 1500, reconnectStrategy: false },
+      });
+      client.on("error", (error) => logFailure("client", error));
+      await client.connect();
+      nextConnectAttempt = 0;
+      return true;
+    } catch (error) {
+      nextConnectAttempt = Date.now() + CONNECT_RETRY_MS;
+      logFailure("connect", error);
+      await client?.disconnect().catch(() => {});
+      client = null;
+      return false;
+    }
+  }
+
+  async function ready(): Promise<boolean> {
+    const url = process.env.REDIS_URL?.trim();
+    if (!url) return false;
+    if (client?.isReady) return true;
+    if (Date.now() < nextConnectAttempt) return false;
+    if (connecting) return connecting;
+    connecting = connect(url).finally(() => {
+      connecting = null;
+    });
+    return connecting;
+  }
+
+  return {
+    async register(state: string): Promise<void> {
+      if (!(await ready()) || !client) return;
+      await client
+        .set(routeKey(state), "active", { EX: SESSION_TTL_SECONDS })
+        .catch((error) => logFailure("register", error));
+    },
+
+    /** Queues a callback for the instance that owns the sign-in. */
+    async submit(state: string, query: CallbackQuery): Promise<boolean> {
+      if (!(await ready()) || !client) return false;
+      try {
+        if (!(await client.exists(routeKey(state)))) return false;
+        const stored = await client.set(commandKey(state), await seal(query), {
+          EX: SESSION_TTL_SECONDS,
+          NX: true,
+        });
+        return stored === "OK";
+      } catch (error) {
+        logFailure("submit", error);
+        return false;
+      }
+    },
+
+    async takeCommand(state: string): Promise<CallbackQuery | null> {
+      if (!(await ready()) || !client) return null;
+      try {
+        const raw = await client.getDel(commandKey(state));
+        return raw ? unseal<CallbackQuery>(raw.toString()) : null;
+      } catch (error) {
+        logFailure("take_command", error);
+        return null;
+      }
+    },
+
+    async complete(state: string, result: CallbackResult): Promise<void> {
+      if (!(await ready()) || !client) return;
+      try {
+        await client
+          .multi()
+          .set(resultKey(state), await seal(result), {
+            EX: RESULT_TTL_SECONDS,
+          })
+          .del(routeKey(state))
+          .del(commandKey(state))
+          .exec();
+      } catch (error) {
+        logFailure("complete", error);
+      }
+    },
+
+    async takeResult(state: string): Promise<CallbackResult | null> {
+      if (!(await ready()) || !client) return null;
+      try {
+        const raw = await client.getDel(resultKey(state));
+        return raw ? unseal<CallbackResult>(raw.toString()) : null;
+      } catch (error) {
+        logFailure("take_result", error);
+        return null;
+      }
+    },
+
+    async remove(state: string): Promise<void> {
+      if (!(await ready()) || !client) return;
+      await client
+        .del([routeKey(state), commandKey(state), resultKey(state)])
+        .catch((error) => logFailure("remove", error));
+    },
+
+    async close(): Promise<void> {
+      const current = client;
+      client = null;
+      if (current?.isOpen) await current.quit().catch(() => {});
+    },
+  };
+}

plugins/step-ca/src/backend/tables.ts

@@ -0,0 +1,34 @@
+import {
+  defineTable,
+  id,
+  refHost,
+  refUser,
+  text,
+  varchar,
+} from "@termix/plugin-sdk/db";
+
+/**
+ * One issued certificate per user and host. sshCert and privateKey are
+ * sealed with ctx.secrets.seal. 2.8 kept Step CA certificates in
+ * opkssh_tokens; those are left to expire.
+ */
+export const certs = defineTable(
+  "certs",
+  {
+    id: id(),
+    userId: refUser(),
+    hostId: refHost(),
+    sshCert: text().notNull(),
+    privateKey: text().notNull(),
+    email: text(),
+    createdAt: text().notNull().defaultNow(),
+    expiresAt: varchar().notNull(),
+  },
+  {
+    uniques: [
+      { name: "idx_step_ca_certs_user_host", columns: ["userId", "hostId"] },
+    ],
+  },
+);
+
+export const tables = [certs];

plugins/step-ca/src/frontend/RedirectUriSetting.tsx

@@ -0,0 +1,54 @@
+import { toast } from "sonner";
+import {
+  useTranslation,
+  type SettingsComponentProps,
+} from "@termix/plugin-sdk/frontend";
+import { Button, Input, copyToClipboard } from "@termix/plugin-sdk/ui";
+
+const CALLBACK_PATH = "plugin-api/step-ca/callback";
+const LEGACY_CALLBACK_PATH = "host/step-ca-callback";
+
+/** The callback URI to register with the provisioner's identity provider. */
+export function redirectUri(
+  legacy: boolean,
+  baseUri = document.baseURI,
+): string {
+  return new URL(
+    legacy ? LEGACY_CALLBACK_PATH : CALLBACK_PATH,
+    baseUri,
+  ).toString();
+}
+
+export function RedirectUriSetting({ values }: SettingsComponentProps) {
+  const { t } = useTranslation();
+  const uri = redirectUri(values.legacyCallback === true);
+
+  return (
+    <div className="flex flex-col gap-2">
+      <span className="text-xs font-medium">
+        {t("settings.redirectUri.label")}
+      </span>
+      <div className="flex gap-2">
+        <Input
+          value={uri}
+          readOnly
+          className="min-w-0 flex-1 rounded-none font-mono text-xs"
+        />
+        <Button
+          type="button"
+          variant="outline"
+          className="rounded-none"
+          onClick={async () => {
+            if (await copyToClipboard(uri)) toast.success(t("common.copied"));
+            else toast.error(t("common.copyFailed"));
+          }}
+        >
+          {t("common.copy")}
+        </Button>
+      </div>
+      <p className="text-[10px] text-muted-foreground">
+        {t("settings.redirectUri.description")}
+      </p>
+    </div>
+  );
+}

plugins/step-ca/src/frontend/StepCaAuthEditor.tsx

@@ -0,0 +1,29 @@
+import { useTranslation } from "@termix/plugin-sdk/frontend";
+
+const DOCS_URL =
+  "https://smallstep.com/docs/step-ca/provisioners/#oauthoidc-single-sign-on";
+
+/** The host editor's "stepca" auth method: nothing to fill in, just a pointer. */
+export function StepCaAuthEditor() {
+  const { t } = useTranslation();
+  return (
+    <div className="flex flex-col gap-2 border-t border-border pt-3">
+      <div className="flex items-center justify-between">
+        <span className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
+          {t("editor.label")}
+        </span>
+        <a
+          href={DOCS_URL}
+          target="_blank"
+          rel="noreferrer"
+          className="text-[10px] text-accent-brand hover:underline"
+        >
+          {t("editor.docs")}
+        </a>
+      </div>
+      <p className="text-[10px] text-muted-foreground">
+        {t("editor.description")}
+      </p>
+    </div>
+  );
+}

plugins/step-ca/src/frontend/StepCaDialog.tsx

@@ -0,0 +1,102 @@
+import { Shield, ExternalLink, Loader2, AlertCircle } from "lucide-react";
+import { useTranslation } from "@termix/plugin-sdk/frontend";
+import { Button } from "@termix/plugin-sdk/ui";
+
+export type SignInStage = "chooser" | "waiting" | "authenticating" | "error";
+
+interface StepCaDialogProps {
+  stage: SignInStage;
+  error?: string;
+  onCancel: () => void;
+  onOpenUrl: () => void;
+  backgroundColor?: string;
+}
+
+const actionButton =
+  "border-accent-brand/40 text-accent-brand hover:bg-accent-brand/10 rounded-none text-[10px] font-bold uppercase tracking-widest w-full flex items-center gap-2";
+const footerButton =
+  "rounded-none text-[10px] font-bold uppercase tracking-widest";
+
+/** The browser sign-in the terminal shows while Step CA waits. */
+export function StepCaDialog({
+  stage,
+  error,
+  onCancel,
+  onOpenUrl,
+  backgroundColor,
+}: StepCaDialogProps) {
+  const { t } = useTranslation();
+
+  return (
+    <div className="absolute inset-0 flex items-center justify-center z-500 animate-in fade-in duration-200">
+      <div
+        className="absolute inset-0 bg-canvas"
+        style={{ backgroundColor: backgroundColor || undefined }}
+      />
+      <div className="bg-card border border-border w-full max-w-md mx-4 relative z-10 animate-in fade-in zoom-in-95 duration-200">
+        <div className="p-4 border-b border-border">
+          <div className="flex items-center gap-2">
+            <Shield className="size-4 text-accent-brand" />
+            <h3 className="text-xs font-bold uppercase tracking-widest">
+              {t("dialog.title")}
+            </h3>
+          </div>
+          {stage === "chooser" && (
+            <p className="text-[10px] font-bold uppercase tracking-tight text-muted-foreground mt-1">
+              {t("dialog.description")}
+            </p>
+          )}
+        </div>
+        <div className="p-4 flex flex-col gap-4">
+          {stage === "chooser" && (
+            <Button
+              type="button"
+              variant="outline"
+              onClick={onOpenUrl}
+              className={actionButton}
+            >
+              <ExternalLink className="size-3.5" />
+              {t("dialog.openBrowser")}
+            </Button>
+          )}
+
+          {(stage === "waiting" || stage === "authenticating") && (
+            <div className="flex items-center gap-3 py-2">
+              <Loader2 className="size-4 animate-spin text-accent-brand shrink-0" />
+              <p className="text-xs text-muted-foreground">
+                {stage === "waiting"
+                  ? t("dialog.waiting")
+                  : t("dialog.authenticating")}
+              </p>
+            </div>
+          )}
+
+          {stage === "error" && error && (
+            <div className="flex items-start gap-3 p-3 border border-destructive/20 bg-destructive/10">
+              <AlertCircle className="size-4 text-destructive shrink-0 mt-0.5" />
+              <div className="flex-1 min-w-0">
+                <p className="text-[10px] font-bold uppercase tracking-widest text-destructive">
+                  {t("common.error")}
+                </p>
+                <p className="text-xs text-destructive/90 mt-1 whitespace-pre-wrap break-words">
+                  {error}
+                </p>
+              </div>
+            </div>
+          )}
+
+          <div className="flex justify-end">
+            <Button
+              type="button"
+              variant="ghost"
+              onClick={onCancel}
+              className={footerButton}
+            >
+              {stage === "error" ? t("common.close") : t("common.cancel")}
+            </Button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}

plugins/step-ca/src/frontend/StepCaOverlay.tsx

@@ -0,0 +1,187 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "@termix/plugin-sdk/frontend";
+import { StepCaDialog, type SignInStage } from "./StepCaDialog";
+
+/** What the ssh-terminal plugin hands a "terminal.overlay" component. */
+export interface TerminalOverlayProps {
+  host: { id: number | string; [key: string]: unknown } | undefined;
+  backgroundColor?: string;
+  subscribe: (
+    listener: (message: { type: string; [key: string]: unknown }) => void,
+  ) => () => void;
+  holdConnectTimeout: (held: boolean) => void;
+  fail: (message: string) => void;
+  disconnect: () => void;
+  send: (type: string, data?: unknown) => void;
+  connectPayload: () => Record<string, unknown>;
+}
+
+interface DialogState {
+  authUrl: string;
+  requestId: string;
+  stage: SignInStage;
+  error?: string;
+}
+
+/** How long the sign-in dialog waits before giving up on the connection. */
+const DIALOG_TIMEOUT_MS = 300_000;
+
+/**
+ * Runs the Step CA browser sign-in for a terminal: asks the server to start
+ * it, opens the identity provider, and reconnects once the CA has issued the
+ * certificate.
+ */
+export function StepCaOverlay({
+  subscribe,
+  holdConnectTimeout,
+  fail,
+  disconnect,
+  send,
+  connectPayload,
+  backgroundColor,
+}: TerminalOverlayProps) {
+  const { t } = useTranslation();
+  const [dialog, setDialog] = useState<DialogState | null>(null);
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const heldRef = useRef(false);
+  // A second "auth required" after a sign-in means the certificate did not work.
+  const failedRef = useRef(false);
+
+  useEffect(() => {
+    const clearTimer = () => {
+      if (timerRef.current) clearTimeout(timerRef.current);
+      timerRef.current = null;
+    };
+    const hold = (held: boolean) => {
+      if (heldRef.current === held) return;
+      heldRef.current = held;
+      holdConnectTimeout(held);
+    };
+    const showError = (requestId: unknown, error: string) => {
+      clearTimer();
+      setDialog((current) =>
+        current
+          ? { ...current, stage: "error", error }
+          : {
+              authUrl: "",
+              requestId: typeof requestId === "string" ? requestId : "",
+              stage: "error",
+              error,
+            },
+      );
+    };
+
+    const unsubscribe = subscribe((message) => {
+      switch (message.type) {
+        case "stepca_auth_required":
+          hold(true);
+          if (failedRef.current) {
+            clearTimer();
+            setDialog(null);
+            hold(false);
+            fail(t("errors.authFailed"));
+          } else {
+            failedRef.current = true;
+            send("stepca_start_auth", { hostId: message.hostId });
+          }
+          break;
+        case "stepca_status":
+          if (message.stage === "chooser") {
+            setDialog({
+              authUrl: typeof message.url === "string" ? message.url : "",
+              requestId:
+                typeof message.requestId === "string" ? message.requestId : "",
+              stage: "chooser",
+            });
+            clearTimer();
+            timerRef.current = setTimeout(() => {
+              setDialog(null);
+              hold(false);
+              disconnect();
+            }, DIALOG_TIMEOUT_MS);
+          } else {
+            setDialog((current) =>
+              current
+                ? { ...current, stage: message.stage as SignInStage }
+                : null,
+            );
+          }
+          break;
+        case "stepca_completed":
+          clearTimer();
+          setDialog(null);
+          send("stepca_auth_completed", connectPayload());
+          break;
+        case "stepca_error":
+          failedRef.current = true;
+          showError(message.requestId, String(message.error ?? ""));
+          break;
+        case "stepca_timeout":
+          failedRef.current = true;
+          showError(message.requestId, t("errors.timeout"));
+          break;
+        case "stepca_config_error":
+          showError(message.requestId, String(message.error ?? ""));
+          break;
+        case "connected":
+        case "sessionAttached":
+          failedRef.current = false;
+          hold(false);
+          break;
+        case "session_closed":
+          clearTimer();
+          setDialog(null);
+          hold(false);
+          break;
+      }
+    });
+
+    return () => {
+      unsubscribe();
+      clearTimer();
+      if (heldRef.current) {
+        heldRef.current = false;
+        holdConnectTimeout(false);
+      }
+    };
+  }, [
+    subscribe,
+    holdConnectTimeout,
+    fail,
+    disconnect,
+    send,
+    connectPayload,
+    t,
+  ]);
+
+  if (!dialog) return null;
+
+  const close = () => {
+    if (timerRef.current) clearTimeout(timerRef.current);
+    timerRef.current = null;
+    if (dialog.requestId) {
+      send("stepca_cancel", { requestId: dialog.requestId });
+    }
+    setDialog(null);
+    if (heldRef.current) {
+      heldRef.current = false;
+      holdConnectTimeout(false);
+    }
+  };
+
+  return (
+    <StepCaDialog
+      stage={dialog.stage}
+      error={dialog.error}
+      onCancel={close}
+      onOpenUrl={() => {
+        if (!dialog.authUrl) return;
+        window.open(dialog.authUrl, "_blank");
+        setDialog((current) =>
+          current ? { ...current, stage: "waiting" } : null,
+        );
+      }}
+      backgroundColor={backgroundColor}
+    />
+  );
+}

plugins/step-ca/src/frontend/index.tsx

@@ -0,0 +1,29 @@
+import type { ComponentType } from "react";
+import type { TermixApp } from "@termix/plugin-sdk/frontend";
+import { StepCaAuthEditor } from "./StepCaAuthEditor";
+import { StepCaOverlay } from "./StepCaOverlay";
+import { RedirectUriSetting } from "./RedirectUriSetting";
+
+export function activate(app: TermixApp): void {
+  app.registerSshAuthEditor({
+    authType: "stepca",
+    titleKey: "hosts.filterAuthStepca",
+    component: StepCaAuthEditor,
+  });
+
+  // The browser sign-in while a terminal connects to a Step CA host.
+  app.registerSlotContribution("terminal.overlay", {
+    actionId: "step-ca.signIn",
+    titleKey: "dialog.title",
+    kind: "component",
+    component: StepCaOverlay as unknown as ComponentType<
+      Record<string, unknown>
+    >,
+  });
+
+  app.registerSettingsComponent("redirectUri", RedirectUriSetting);
+}
+
+export function deactivate(): void {
+  // Registrations through app are disposed by core.
+}

plugins/step-ca/tests/backend/client.test.ts

@@ -0,0 +1,136 @@
+import crypto from "node:crypto";
+import { describe, expect, it } from "vitest";
+import {
+  buildAuthorizationUrl,
+  certificateFingerprint,
+  createPkce,
+  decodeJwtClaims,
+  fetchRootCertificate,
+  findOidcProvisioner,
+  generateSshKeyPair,
+  normalizeCaUrl,
+  normalizeFingerprint,
+  parseSshCertificate,
+} from "../../src/backend/client.js";
+import { parseHostList } from "../../src/backend/auth-session.js";
+import { CA_URL, createFakeCa, createSshCa, fakeRoot } from "./fake-ca.js";
+
+describe("step-ca client helpers", () => {
+  it("normalizes the CA url and fingerprint the way step does", () => {
+    expect(normalizeCaUrl(" https://ca.internal:9000/ ")).toBe(
+      "https://ca.internal:9000",
+    );
+    expect(() => normalizeCaUrl("http://ca.internal")).toThrow(/https/);
+    const fp = "AB:cd".repeat(16).replace(/:/g, "");
+    expect(normalizeFingerprint("AB:cd".repeat(16))).toBe(fp.toLowerCase());
+    expect(() => normalizeFingerprint("abcd")).toThrow(/SHA-256/);
+  });
+
+  it("fingerprints a PEM certificate by the sha256 of its DER", () => {
+    const root = fakeRoot();
+    expect(certificateFingerprint(root.pem)).toBe(root.fingerprint);
+  });
+
+  it("builds a PKCE authorization request", () => {
+    const { verifier, challenge } = createPkce();
+    expect(challenge).toBe(
+      crypto.createHash("sha256").update(verifier).digest("base64url"),
+    );
+    const url = new URL(
+      buildAuthorizationUrl({
+        authorizationEndpoint: "https://idp.example/auth?tenant=x",
+        clientId: "cid",
+        redirectUri: "https://termix.example/callback",
+        state: "s",
+        nonce: "n",
+        codeChallenge: challenge,
+      }),
+    );
+    expect(url.searchParams.get("tenant")).toBe("x");
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(url.searchParams.get("scope")).toContain("openid");
+  });
+
+  it("generates an ed25519 key a CA can certify, and reads the cert back", () => {
+    const { publicKeyLine, privateKeyPem } = generateSshKeyPair();
+    expect(publicKeyLine).toMatch(/^ssh-ed25519 [A-Za-z0-9+/=]+$/);
+    expect(privateKeyPem).toContain("BEGIN PRIVATE KEY");
+
+    const cert = createSshCa().sign({
+      publicKeyBlob: publicKeyLine.split(" ")[1],
+      keyId: "alice@example",
+      principals: ["alice", "ops"],
+      validAfter: 1_700_000_000,
+      validBefore: 1_700_057_600,
+    });
+    const info = parseSshCertificate(cert);
+    expect(info).toMatchObject({
+      keyType: "ssh-ed25519-cert-v01@openssh.com",
+      publicKeyLine,
+      keyId: "alice@example",
+      principals: ["alice", "ops"],
+    });
+    expect(info.validAfter.toISOString()).toBe("2023-11-14T22:13:20.000Z");
+    expect(info.validBefore.getTime() - info.validAfter.getTime()).toBe(
+      16 * 3600 * 1000,
+    );
+    expect(() => parseSshCertificate(publicKeyLine)).toThrow(/certificate/);
+    expect(() =>
+      parseSshCertificate("ssh-ed25519-cert-v01@openssh.com AAAA"),
+    ).toThrow(/certificate/);
+  });
+
+  it("reads the private endpoint list with commas or new lines", () => {
+    expect(parseHostList("ca.internal, SSO.internal\nidp.lan")).toEqual([
+      "ca.internal",
+      "sso.internal",
+      "idp.lan",
+    ]);
+    expect(parseHostList(undefined)).toEqual([]);
+  });
+});
+
+describe("talking to the CA", () => {
+  it("refuses a root whose fingerprint does not match", async () => {
+    const ca = createFakeCa({ nonce: () => "" });
+    await expect(
+      fetchRootCertificate({
+        fetch: ca.fetch,
+        caUrl: CA_URL,
+        fingerprint: "b".repeat(64),
+        allowedPrivateHosts: [],
+      }),
+    ).rejects.toThrow();
+  });
+
+  it("finds the OIDC provisioner by name and passes the private hosts", async () => {
+    const ca = createFakeCa({ nonce: () => "" });
+    const target = {
+      fetch: ca.fetch,
+      caUrl: CA_URL,
+      fingerprint: ca.root.fingerprint,
+      allowedPrivateHosts: ["ca.test"],
+    };
+    const root = await fetchRootCertificate(target);
+    const provisioner = await findOidcProvisioner(target, root, "oidc");
+    expect(provisioner.clientID).toBe("termix");
+    expect(ca.calls.every((call) => call.init?.allowPrivateHosts)).toBe(true);
+    await expect(findOidcProvisioner(target, root, "jwk")).rejects.toThrow(
+      /not found/,
+    );
+  });
+});
+
+describe("decodeJwtClaims", () => {
+  it("reads the payload without verifying and tolerates junk", () => {
+    const payload = Buffer.from(
+      JSON.stringify({ email: "a@b.c", nonce: "n1" }),
+    ).toString("base64url");
+    expect(decodeJwtClaims(`x.${payload}.y`)).toEqual({
+      email: "a@b.c",
+      nonce: "n1",
+    });
+    expect(decodeJwtClaims("not-a-jwt")).toEqual({});
+  });
+});

plugins/step-ca/tests/backend/fake-ca.ts

@@ -0,0 +1,160 @@
+import crypto from "node:crypto";
+import type { PluginFetchInit } from "@termix/plugin-sdk/backend";
+
+const CERT_TYPE = "ssh-ed25519-cert-v01@openssh.com";
+
+function sshString(value: Buffer | string): Buffer {
+  const data = Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(data.length, 0);
+  return Buffer.concat([len, data]);
+}
+
+function uint64(value: bigint): Buffer {
+  const out = Buffer.alloc(8);
+  out.writeBigUInt64BE(value, 0);
+  return out;
+}
+
+function uint32(value: number): Buffer {
+  const out = Buffer.alloc(4);
+  out.writeUInt32BE(value, 0);
+  return out;
+}
+
+/** An ed25519 CA that signs OpenSSH user certificates, like step-ca does. */
+export function createSshCa() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const raw = Buffer.from(
+    (publicKey.export({ format: "jwk" }) as { x: string }).x,
+    "base64url",
+  );
+  const caBlob = Buffer.concat([sshString("ssh-ed25519"), sshString(raw)]);
+
+  return {
+    sign(input: {
+      publicKeyBlob: string;
+      keyId: string;
+      principals: string[];
+      validAfter: number;
+      validBefore: number;
+    }): string {
+      const userBlob = Buffer.from(input.publicKeyBlob, "base64");
+      // ssh-ed25519 blob: string type, string pk
+      const pk = userBlob.subarray(4 + 11 + 4);
+      const body = Buffer.concat([
+        sshString(CERT_TYPE),
+        sshString(crypto.randomBytes(32)),
+        sshString(pk),
+        uint64(1n),
+        uint32(1),
+        sshString(input.keyId),
+        sshString(Buffer.concat(input.principals.map((p) => sshString(p)))),
+        uint64(BigInt(input.validAfter)),
+        uint64(BigInt(input.validBefore)),
+        sshString(Buffer.alloc(0)),
+        sshString(Buffer.alloc(0)),
+        sshString(Buffer.alloc(0)),
+        sshString(caBlob),
+      ]);
+      const signature = Buffer.concat([
+        sshString("ssh-ed25519"),
+        sshString(crypto.sign(null, body, privateKey)),
+      ]);
+      return `${CERT_TYPE} ${Buffer.concat([body, sshString(signature)]).toString("base64")}`;
+    },
+  };
+}
+
+/** A root "certificate" the client fingerprints by the sha256 of its DER. */
+export function fakeRoot() {
+  const der = crypto.randomBytes(128);
+  return {
+    pem: `-----BEGIN CERTIFICATE-----\n${der.toString("base64")}\n-----END CERTIFICATE-----\n`,
+    fingerprint: crypto.createHash("sha256").update(der).digest("hex"),
+  };
+}
+
+export function jwt(claims: Record<string, unknown>): string {
+  const part = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${part({ alg: "none" })}.${part(claims)}.sig`;
+}
+
+export const CA_URL = "https://ca.test";
+export const DISCOVERY_URL =
+  "https://idp.test/.well-known/openid-configuration";
+
+export interface FakeCaOptions {
+  /** Principals the CA puts on the certificate; defaults to what was asked. */
+  principals?: string[];
+  /** Nonce the identity provider puts in the id token. */
+  nonce: () => string;
+  /** Status for /1.0/ssh/sign. */
+  signStatus?: number;
+}
+
+/**
+ * Answers ctx.fetch as a step-ca server plus its identity provider would.
+ * Records every call so a test can check the TLS options.
+ */
+export function createFakeCa(options: FakeCaOptions) {
+  const root = fakeRoot();
+  const ca = createSshCa();
+  const calls: Array<{ url: string; init?: PluginFetchInit }> = [];
+  const json = (body: unknown, status = 200) =>
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    });
+
+  const fetch = async (url: string, init?: PluginFetchInit) => {
+    calls.push({ url, init });
+    if (url === `${CA_URL}/root/${root.fingerprint}`) {
+      return json({ ca: root.pem });
+    }
+    if (url.startsWith(`${CA_URL}/provisioners`)) {
+      return json({
+        provisioners: [
+          { name: "jwk", type: "JWK" },
+          {
+            name: "oidc",
+            type: "OIDC",
+            clientID: "termix",
+            configurationEndpoint: DISCOVERY_URL,
+          },
+        ],
+      });
+    }
+    if (url === DISCOVERY_URL) {
+      return json({
+        authorization_endpoint: "https://idp.test/authorize",
+        token_endpoint: "https://idp.test/token",
+      });
+    }
+    if (url === "https://idp.test/token") {
+      return json({
+        id_token: jwt({ email: "alice@example.com", nonce: options.nonce() }),
+      });
+    }
+    if (url === `${CA_URL}/1.0/ssh/sign`) {
+      if (options.signStatus && options.signStatus !== 200) {
+        return json({ message: "not allowed" }, options.signStatus);
+      }
+      const body = JSON.parse(init?.body ?? "{}");
+      const now = Math.floor(Date.now() / 1000);
+      return json({
+        crt: ca.sign({
+          publicKeyBlob: body.publicKey,
+          keyId: body.keyID,
+          principals: options.principals ?? body.principals,
+          validAfter: now - 60,
+          validBefore: now + 16 * 3600,
+        }),
+      });
+    }
+    return new Response("not found", { status: 404 });
+  };
+
+  return { fetch, calls, root, ca };
+}

plugins/step-ca/tests/backend/helpers.ts

@@ -0,0 +1,105 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { fileURLToPath } from "node:url";
+import express, { type Router } from "express";
+import {
+  createMockCtx,
+  createTestDb,
+  type MockPluginContext,
+  type TestDb,
+} from "@termix/plugin-sdk/testing";
+import type {
+  PluginFetchInit,
+  PluginSshAuthProvider,
+} from "@termix/plugin-sdk/backend";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import manifestJson from "../../manifest.json";
+
+export const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
+export const manifest = manifestJson as unknown as PluginManifest;
+
+/** A fake terminal socket that records what it was sent. */
+export function fakeSocket() {
+  const sent: Array<Record<string, unknown>> = [];
+  const closers: Array<() => void> = [];
+  return {
+    sent,
+    socket: {
+      send: (data: string) => sent.push(JSON.parse(data)),
+      on: (_event: "close", listener: () => void) => closers.push(listener),
+    },
+    close: () => closers.forEach((listener) => listener()),
+  };
+}
+
+export interface TestServer {
+  db: TestDb;
+  mock: MockPluginContext;
+  provider: () => PluginSshAuthProvider;
+  get: (path: string) => Promise<{ status: number; body: string }>;
+  close: () => Promise<void>;
+}
+
+export async function startServer(
+  options: {
+    settings?: Record<string, unknown>;
+    fetch?: (url: string, init?: PluginFetchInit) => Promise<Response>;
+  } = {},
+): Promise<TestServer> {
+  const db = await createTestDb(pluginDir);
+  db.sqlite
+    .prepare("INSERT OR IGNORE INTO users (id) VALUES (?)")
+    .run("user-1");
+  db.sqlite.prepare("INSERT OR IGNORE INTO ssh_data (id) VALUES (?)").run(7);
+
+  let router: Router | null = null;
+  const mock = createMockCtx({
+    pluginId: manifest.id,
+    manifest,
+    capabilities: manifest.capabilities,
+    db: db.database,
+    router: () => (router = express.Router()),
+    settings: options.settings,
+    fetch: options.fetch,
+    baseUrl: "https://termix.test",
+  });
+
+  const { activate } = await import("../../src/backend/index.js");
+  await activate(mock.ctx);
+
+  const app = express();
+  app.use((req, res, next) => router!(req, res, next));
+  const server = http.createServer(app);
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const { port } = server.address() as AddressInfo;
+
+  return {
+    db,
+    mock,
+    provider: () =>
+      mock.auth.sshAuthProviders.find(
+        (provider) => provider.type === "stepca",
+      )!,
+    async get(path) {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+        redirect: "manual",
+      });
+      return { status: response.status, body: await response.text() };
+    },
+    async close() {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+      db.close();
+    },
+  };
+}
+
+export const env = (hostId = 7) => ({
+  client: {},
+  userId: "user-1",
+  hostId,
+  purpose: "terminal",
+  interactive: true,
+  log: () => {},
+});
+
+export const HOST = { id: 7, ip: "10.0.0.7", port: 22, username: "root" };

plugins/step-ca/tests/backend/legacy-urls.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { validateManifest } from "@termix/plugin-sdk/manifest";
+import manifest from "../../manifest.json";
+
+// Old URLs something outside Termix still calls keep reaching the plugin.
+const redirects = manifest.contributes.http.legacyRedirects as unknown[];
+
+describe("legacy URLs", () => {
+  it("declares them in a manifest that validates", () => {
+    expect(validateManifest(manifest)).toEqual([]);
+  });
+
+  it("redirects /host/step-ca-callback, which Step CA identity providers were set up with before 2.9", () => {
+    expect(redirects).toContainEqual({
+      from: "/host/step-ca-callback",
+      to: "/callback",
+    });
+  });
+});

plugins/step-ca/tests/backend/settings-validation.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { validateCaSettings } from "../../src/backend/client.js";
+
+describe("validateCaSettings", () => {
+  it("accepts an https URL and a SHA-256 fingerprint", () => {
+    expect(
+      validateCaSettings({
+        caUrl: "https://ca.example.com:9000/",
+        fingerprint: "ab".repeat(32),
+      }),
+    ).toEqual({});
+  });
+
+  it("rejects a plain http URL and a short fingerprint at save time", () => {
+    const errors = validateCaSettings({
+      caUrl: "http://ca.example.com",
+      fingerprint: "abcd",
+    });
+    expect(Object.keys(errors).sort()).toEqual(["caUrl", "fingerprint"]);
+  });
+
+  it("leaves empty fields to the not-configured message", () => {
+    expect(validateCaSettings({ caUrl: "", fingerprint: " " })).toEqual({});
+  });
+});

plugins/step-ca/tests/backend/step-ca.test.ts

@@ -0,0 +1,295 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { PluginCapabilityError } from "@termix/plugin-sdk/backend";
+import { createMockCtx, createTestDb } from "@termix/plugin-sdk/testing";
+import { CA_URL, createFakeCa } from "./fake-ca.js";
+import {
+  HOST,
+  env,
+  fakeSocket,
+  manifest,
+  pluginDir,
+  startServer,
+  type TestServer,
+} from "./helpers.js";
+
+const certs = vi.hoisted(() => ({ applyCertificateAuth: vi.fn() }));
+vi.mock("@termix/plugin-sdk/ssh-certs", () => certs);
+
+let server: TestServer | null = null;
+let nonce = "";
+
+beforeEach(() => {
+  certs.applyCertificateAuth.mockReset();
+  nonce = "";
+});
+
+afterEach(async () => {
+  await server?.close();
+  server = null;
+});
+
+async function startWithCa(
+  options: {
+    principals?: string[];
+    signStatus?: number;
+    wrongNonce?: boolean;
+    settings?: Record<string, unknown>;
+  } = {},
+) {
+  const ca = createFakeCa({
+    principals: options.principals,
+    signStatus: options.signStatus,
+    nonce: () => (options.wrongNonce ? "other" : nonce),
+  });
+  server = await startServer({
+    fetch: ca.fetch,
+    settings: {
+      caUrl: CA_URL,
+      fingerprint: ca.root.fingerprint,
+      provisioner: "oidc",
+      ...options.settings,
+    },
+  });
+  return ca;
+}
+
+/** Starts a sign-in and returns the socket and the authorization URL. */
+async function startSignIn() {
+  const socket = fakeSocket();
+  await server!.provider().startInteraction!({
+    userId: "user-1",
+    hostId: 7,
+    host: { name: "box", ip: "10.0.0.7", username: "root" },
+    socket: socket.socket,
+    requestOrigin: "https://termix.test",
+    payload: {},
+  });
+  const chooser = socket.sent.find((m) => m.stage === "chooser");
+  const url = chooser ? new URL(String(chooser.url)) : null;
+  nonce = url?.searchParams.get("nonce") ?? "";
+  return { socket, url, state: url?.searchParams.get("state") ?? "" };
+}
+
+describe("the certs table", () => {
+  it("is created on a fresh install", async () => {
+    const db = await createTestDb(pluginDir);
+    expect(
+      db.sqlite
+        .prepare(
+          "SELECT name FROM sqlite_master WHERE name = 'p_step_ca_certs'",
+        )
+        .get(),
+    ).toBeTruthy();
+    db.close();
+  });
+});
+
+describe("activate", () => {
+  it("registers the stepca auth type and its callback route", async () => {
+    server = await startServer();
+    expect(server.provider()).toMatchObject({
+      type: "stepca",
+      interaction: "stepca",
+      supportsBackground: false,
+    });
+    expect(server.mock.httpRouters).toHaveLength(1);
+  });
+
+  it.each(["db:own", "auth:provide", "network:serve"])(
+    "fails closed without %s",
+    async (capability) => {
+      const mock = createMockCtx({
+        pluginId: manifest.id,
+        manifest,
+        capabilities: manifest.capabilities.filter((c) => c !== capability),
+        db: (await createTestDb(pluginDir)).database,
+      });
+      const { activate } = await import("../../src/backend/index.js");
+      await expect(activate(mock.ctx)).rejects.toThrow(PluginCapabilityError);
+    },
+  );
+});
+
+describe("issuing a certificate", () => {
+  it("runs the OIDC flow against the CA and stores the certificate sealed", async () => {
+    const ca = await startWithCa();
+    const { socket, url, state } = await startSignIn();
+
+    expect(url?.origin + url?.pathname).toBe("https://idp.test/authorize");
+    expect(url?.searchParams.get("client_id")).toBe("termix");
+    expect(url?.searchParams.get("redirect_uri")).toBe(
+      "https://termix.test/plugin-api/step-ca/callback",
+    );
+    expect(url?.searchParams.get("code_challenge_method")).toBe("S256");
+
+    // The root is fetched unverified and checked by fingerprint, then pinned.
+    expect(ca.calls[0].init?.tls).toEqual({ rejectUnauthorized: false });
+    expect(ca.calls[1].init?.tls).toEqual({ ca: ca.root.pem });
+
+    const response = await server!.get(`/callback?state=${state}&code=abc`);
+    expect(response.status).toBe(200);
+    expect(response.body).toContain("Signed in");
+    expect(socket.sent.at(-1)).toMatchObject({
+      type: "stepca_completed",
+      requestId: state,
+    });
+
+    const sign = ca.calls.find((call) => call.url.endsWith("/1.0/ssh/sign"));
+    expect(JSON.parse(sign!.init!.body!)).toMatchObject({
+      certType: "user",
+      principals: ["root"],
+      keyID: "alice@example.com",
+    });
+    expect(sign!.init!.tls).toEqual({ ca: ca.root.pem });
+
+    const row = server!.db.sqlite
+      .prepare("SELECT * FROM p_step_ca_certs")
+      .get() as Record<string, string>;
+    expect(row.user_id).toBe("user-1");
+    expect(row.email).toBe("alice@example.com");
+    expect(row.ssh_cert).toMatch(/^sealed:/);
+    expect(row.private_key).toMatch(/^sealed:/);
+  });
+
+  it("answers a second use of the same callback with an error", async () => {
+    await startWithCa();
+    const { state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+    const again = await server!.get(`/callback?state=${state}&code=abc`);
+    expect(again.status).toBe(400);
+    expect(again.body).toContain("no longer active");
+  });
+
+  it("refuses an id token issued for another sign-in", async () => {
+    await startWithCa({ wrongNonce: true });
+    const { socket, state } = await startSignIn();
+    const response = await server!.get(`/callback?state=${state}&code=abc`);
+    expect(response.status).toBe(400);
+    expect(socket.sent.at(-1)).toMatchObject({
+      type: "stepca_error",
+      error: expect.stringContaining("does not match"),
+    });
+    expect(
+      server!.db.sqlite.prepare("SELECT * FROM p_step_ca_certs").all(),
+    ).toHaveLength(0);
+  });
+
+  it("reports the CA refusing to sign", async () => {
+    await startWithCa({ signStatus: 403 });
+    const { socket, state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+    expect(socket.sent.at(-1)).toMatchObject({
+      type: "stepca_error",
+      error: expect.stringContaining("HTTP 403"),
+    });
+  });
+
+  it("rejects a certificate without the host username", async () => {
+    await startWithCa({ principals: ["someone-else"] });
+    const { socket, state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+    expect(socket.sent.at(-1)).toMatchObject({
+      type: "stepca_error",
+      error: expect.stringContaining("host username"),
+    });
+  });
+
+  it("passes an identity provider error through", async () => {
+    await startWithCa();
+    const { socket, state } = await startSignIn();
+    const response = await server!.get(
+      `/callback?state=${state}&error=access_denied&error_description=Denied`,
+    );
+    expect(response.status).toBe(400);
+    expect(socket.sent.at(-1)).toMatchObject({
+      type: "stepca_error",
+      error: "Step CA: Denied",
+    });
+  });
+
+  it("sends the 2.8 redirect URI while legacyCallback is on", async () => {
+    await startWithCa({ settings: { legacyCallback: true } });
+    const { url } = await startSignIn();
+    expect(url?.searchParams.get("redirect_uri")).toBe(
+      "https://termix.test/host/step-ca-callback",
+    );
+  });
+
+  it("tells the terminal when Step CA is not configured", async () => {
+    server = await startServer();
+    const { socket } = await startSignIn();
+    expect(socket.sent).toEqual([
+      expect.objectContaining({ type: "stepca_config_error" }),
+    ]);
+  });
+
+  it("lets a pending sign-in be cancelled", async () => {
+    await startWithCa();
+    const { state } = await startSignIn();
+    await server!.provider().cancelInteraction!({
+      userId: "user-1",
+      requestId: state,
+    });
+    const response = await server!.get(`/callback?state=${state}&code=abc`);
+    expect(response.status).toBe(400);
+  });
+});
+
+describe("the stepca provider", () => {
+  it("asks for a sign-in without a certificate", async () => {
+    server = await startServer();
+    const outcome = await server.provider().prepare({}, HOST, env());
+    expect(outcome).toMatchObject({
+      status: "interaction-required",
+      interaction: "stepca",
+    });
+    expect(certs.applyCertificateAuth).not.toHaveBeenCalled();
+  });
+
+  it("connects with the issued certificate", async () => {
+    await startWithCa();
+    const { state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+
+    const config: Record<string, unknown> = {};
+    const outcome = await server!.provider().prepare(config, HOST, env());
+    expect(outcome).toEqual({ status: "ready" });
+    const [passedConfig, , credentials, username] =
+      certs.applyCertificateAuth.mock.calls[0];
+    expect(passedConfig).toBe(config);
+    expect(username).toBe("root");
+    expect(credentials.certificate).toMatch(
+      /^ssh-ed25519-cert-v01@openssh\.com /,
+    );
+    expect(credentials.privateKey).toContain("BEGIN PRIVATE KEY");
+  });
+
+  it("forgets an expired certificate", async () => {
+    await startWithCa();
+    const { state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+    server!.db.sqlite
+      .prepare("UPDATE p_step_ca_certs SET expires_at = ?")
+      .run("2000-01-01T00:00:00.000Z");
+    const outcome = await server!.provider().prepare({}, HOST, env());
+    expect(outcome.status).toBe("interaction-required");
+    expect(
+      server!.db.sqlite.prepare("SELECT * FROM p_step_ca_certs").all(),
+    ).toHaveLength(0);
+  });
+
+  it("drops the certificate when the host rejects it", async () => {
+    await startWithCa();
+    const { state } = await startSignIn();
+    await server!.get(`/callback?state=${state}&code=abc`);
+    const decision = server!.provider().onAuthFailed!(HOST, env(), {
+      error: new Error("All configured authentication methods failed"),
+    } as never);
+    expect(decision).toMatchObject({ status: "interaction-required" });
+    await vi.waitFor(() =>
+      expect(
+        server!.db.sqlite.prepare("SELECT * FROM p_step_ca_certs").all(),
+      ).toHaveLength(0),
+    );
+  });
+});

plugins/step-ca/tests/frontend/activate.test.tsx

@@ -0,0 +1,137 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { act, fireEvent, render, screen } from "@testing-library/react";
+import {
+  renderWithApp,
+  type RenderedPluginApp,
+} from "@termix/plugin-sdk/testing";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import * as plugin from "../../src/frontend/index";
+import { StepCaOverlay } from "../../src/frontend/StepCaOverlay";
+import { redirectUri } from "../../src/frontend/RedirectUriSetting";
+import manifestJson from "../../manifest.json";
+import locales from "../../locales/en.json";
+
+vi.mock("@termix/plugin-sdk/frontend", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@termix/plugin-sdk/frontend")>()),
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+const manifest = manifestJson as unknown as PluginManifest;
+
+let rendered: RenderedPluginApp | null = null;
+
+afterEach(async () => {
+  await rendered?.deactivate();
+  rendered = null;
+});
+
+describe("step-ca activate", () => {
+  it("registers the auth editor, the terminal overlay and the settings field", async () => {
+    rendered = await renderWithApp(plugin, { manifest, locales });
+    expect(rendered.registered.settingsComponents()).toEqual(["redirectUri"]);
+    expect(rendered.registered.slot("terminal.overlay")).toEqual([
+      "step-ca.signIn",
+    ]);
+    await rendered.deactivate();
+    expect(rendered.registered.settingsComponents()).toEqual([]);
+    expect(rendered.registered.slot("terminal.overlay")).toEqual([]);
+    rendered = null;
+  });
+});
+
+describe("redirectUri", () => {
+  it("names the plugin callback, or the 2.8 one", () => {
+    expect(redirectUri(false, "https://t.example/app/")).toBe(
+      "https://t.example/app/plugin-api/step-ca/callback",
+    );
+    expect(redirectUri(true, "https://t.example/")).toBe(
+      "https://t.example/host/step-ca-callback",
+    );
+  });
+});
+
+describe("StepCaOverlay", () => {
+  function setup() {
+    let listener: (message: {
+      type: string;
+      [key: string]: unknown;
+    }) => void = () => {};
+    const props = {
+      host: { id: 7 },
+      subscribe: vi.fn((next: typeof listener) => {
+        listener = next;
+        return () => {};
+      }),
+      holdConnectTimeout: vi.fn(),
+      fail: vi.fn(),
+      disconnect: vi.fn(),
+      send: vi.fn(),
+      connectPayload: vi.fn(() => ({ hostId: 7, cols: 80, rows: 24 })),
+    };
+    render(<StepCaOverlay {...props} />);
+    const emit = (message: { type: string; [key: string]: unknown }) =>
+      act(() => listener(message));
+    return { props, emit };
+  }
+
+  it("starts the sign-in once, then reports a second request as a failure", () => {
+    const { props, emit } = setup();
+    emit({ type: "stepca_auth_required", hostId: 7 });
+    expect(props.send).toHaveBeenCalledWith("stepca_start_auth", { hostId: 7 });
+    expect(props.holdConnectTimeout).toHaveBeenCalledWith(true);
+
+    emit({ type: "stepca_auth_required", hostId: 7 });
+    expect(props.fail).toHaveBeenCalledWith("errors.authFailed");
+  });
+
+  it("opens the identity provider, waits, and reconnects once signed in", () => {
+    const open = vi.spyOn(window, "open").mockReturnValue(null);
+    const { props, emit } = setup();
+    emit({ type: "stepca_auth_required", hostId: 7 });
+    emit({
+      type: "stepca_status",
+      stage: "chooser",
+      requestId: "req-1",
+      url: "https://idp.test/authorize?state=req-1",
+    });
+    fireEvent.click(screen.getByText("dialog.openBrowser"));
+    expect(open).toHaveBeenCalledWith(
+      "https://idp.test/authorize?state=req-1",
+      "_blank",
+    );
+    expect(screen.getByText("dialog.waiting")).toBeTruthy();
+
+    emit({ type: "stepca_completed", requestId: "req-1" });
+    expect(props.send).toHaveBeenCalledWith("stepca_auth_completed", {
+      hostId: 7,
+      cols: 80,
+      rows: 24,
+    });
+    expect(screen.queryByText("dialog.title")).toBeNull();
+    open.mockRestore();
+  });
+
+  it("cancels a pending sign-in", () => {
+    const { props, emit } = setup();
+    emit({
+      type: "stepca_status",
+      stage: "chooser",
+      requestId: "req-2",
+      url: "https://idp.test/authorize",
+    });
+    fireEvent.click(screen.getByText("common.cancel"));
+    expect(props.send).toHaveBeenCalledWith("stepca_cancel", {
+      requestId: "req-2",
+    });
+  });
+
+  it("shows a config error", () => {
+    const { emit } = setup();
+    emit({
+      type: "stepca_config_error",
+      requestId: "",
+      error: "Step CA is not configured.",
+    });
+    expect(screen.getByText("Step CA is not configured.")).toBeTruthy();
+  });
+});

plugins/step-ca/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "extends": "@termix/plugin-sdk/tsconfig.plugin.json",
+  "include": ["src/**/*.ts", "src/**/*.tsx", "tests/**/*.ts", "tests/**/*.tsx"]
+}

plugins/step-ca/vitest.config.ts

@@ -0,0 +1,3 @@
+import { pluginVitestConfig } from "@termix/plugin-sdk/vitest-preset";
+
+export default pluginVitestConfig(import.meta.url);