fix: finish 2.9.0 plugin moves and get every check green

plugins/ssh-terminal/src/backend/index.ts

@@ -22,6 +22,7 @@ import {
 import { ADMIN_KEYS } from "./settings.js";
 import { commandHistory } from "./tables.js";
 import { createTerminalSocket } from "./terminal-socket.js";
+import { validateAdminSettings } from "./settings-validation.js";
 
 function toInfo(session: TerminalSession): LiveSessionInfo {
   return {
@@ -55,6 +56,7 @@ function optionalService<T extends object>(
 
 export async function activate(ctx: PluginContext) {
   const log = createTerminalLogger(ctx.log);
+  ctx.settings.onValidate("admin", validateAdminSettings);
 
   const table = await ctx.db.define(commandHistory);
   const history = createHistoryRepository(ctx.db, table);

plugins/ssh-terminal/src/backend/settings-validation.ts

@@ -0,0 +1,32 @@
+import {
+  parseImageHostPath,
+  parseImageLocalDir,
+} from "./images/image-storage-settings.js";
+import { ADMIN_KEYS } from "./settings.js";
+
+/**
+ * Save-time checks for the admin settings: the image storage paths must be
+ * absolute, since a relative one silently depends on the server's cwd.
+ */
+export function validateAdminSettings(
+  values: Record<string, unknown>,
+): Record<string, string> {
+  const errors: Record<string, string> = {};
+  const localDir = values[ADMIN_KEYS.imageLocalDir];
+  if (
+    typeof localDir === "string" &&
+    localDir.trim() !== "" &&
+    parseImageLocalDir(localDir) === null
+  ) {
+    errors[ADMIN_KEYS.imageLocalDir] = "Use an absolute path";
+  }
+  const hostPath = values[ADMIN_KEYS.imageHostPath];
+  if (
+    typeof hostPath === "string" &&
+    hostPath.trim() !== "" &&
+    parseImageHostPath(hostPath) === null
+  ) {
+    errors[ADMIN_KEYS.imageHostPath] = "Use an absolute path";
+  }
+  return errors;
+}

plugins/ssh-terminal/src/backend/terminal-socket.ts

@@ -81,7 +81,6 @@ interface ConnectToHostData {
       keepaliveCountMax?: number;
       [key: string]: unknown;
     };
-    enableSessionLogging?: boolean;
     /** When true, ignore key material and force password auth (fallback path). */
     passwordFallbackOnly?: boolean;
   };
@@ -1432,7 +1431,6 @@ export function createTerminalSocket(deps: TerminalSocketDeps) {
             socks5ProxyChain?: unknown;
             portKnockSequence?: ConnectToHostData["hostConfig"]["portKnockSequence"];
             terminalConfig?: ConnectToHostData["hostConfig"]["terminalConfig"];
-            enableSessionLogging?: boolean;
           })
         | null = null;
 
@@ -1776,10 +1774,8 @@ export function createTerminalSocket(deps: TerminalSocketDeps) {
 
           const hostDisplayName = `${username}@${ip}:${port}`;
           const tabInstanceId = hostConfig.instanceId;
-          const sessionLoggingEnabled =
-            resolvedHostData?.enableSessionLogging ??
-            hostConfig.enableSessionLogging ??
-            true;
+          // The recordings.writer provider decides per host and user.
+          const sessionLoggingEnabled = true;
           currentSessionId = sessionManager.createSession(
             userId,
             id,