v26.10.2 (#1672)

* fix: keep concurrent ssh pool connects from overwriting each other (#1619) * fix: stop auto-accepting changed jump host keys (#1620) A jump hop whose key no longer matched the pinned fingerprint was silently accepted and the pin overwritten. Background status probes reconnect to jump hosts every cycle, so a MITM on that hop got the credentials with no user interaction. Changed jump host keys now go through the same path as any other host: prompt when there is a terminal socket, otherwise refuse. * fix(electron): validate external login URL scheme and callback port (#1621) * fix(plugins): read artifact manifest with the same tar parser as the unpack (#1622) The consent check read the first manifest.json with a hand-written tar reader, while the unpack keeps the last one and also follows pax and long-name headers. An archive with two manifests could pass the check with one capability list and get granted another. Read the manifest with node-tar, count only plain files, and refuse archives that hold more than one manifest.json. * fix: only trust the server's origin in the desktop login frame (#1624) The desktop sign-in iframe accepted AUTH_SUCCESS and system browser requests from whatever page it had navigated to, and posted replies (including 2FA temp tokens) to any origin. Messages must now come from the server's origin and replies are posted to it. The web UI also treated any framing page as the desktop app and posted the JWT to it. It now also requires the Termix-Desktop user agent. * fix: check trusted proxy login against nginx's peer, not nginx (#1625) The backend only sees the bundled nginx on loopback, so the allowlist could only work by trusting 127.0.0.1, which let any client that reached nginx log in as anyone by sending the identity headers. nginx now passes its own TCP peer (before real_ip rewriting) in X-Termix-Proxy-Peer, and loopback connections are judged by that address instead. * fix: keep foreign keys on during user data import (#1626) Import credentials before hosts and remap the file's credential ids to the ones created here, so hosts and protocol logins no longer point at another server's ids. With rows written in dependency order, the import no longer turns off SQLite foreign keys on the shared connection. The uploaded file is now removed on every exit path. * fix: enforce unique usernames (#1628) * fix: enforce unique usernames Registration checked for a taken name, hashed the password, then inserted, with nothing in the schema enforcing uniqueness. Concurrent sign-ups could create two accounts with one name, after which login, password reset, proxy login and admin lookups by username picked between them arbitrarily. Add a unique index on users.username for every dialect. Existing duplicates are renamed (later rows get a -<id> suffix, the oldest keeps the name) rather than deleted. Registration and admin user creation now return the same 409 when the insert loses the race. * fix: avoid username collisions during migration * fix: don't auto-enable synced plugins signed only by a server-sent key (#1623) * fix: don't auto-enable synced plugins signed only by a server-sent key Registry keys a linked server sends still let its plugins load on the desktop, but no longer count as a signer for switching them on or copying their grants. Keys the desktop added itself keep their trust. * fix: enforce local plugin trust across remote source labels * fix: require positive local trust for synced plugin keys * fix(desktop): harden external editor and session cookie IPC (#1627) * fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie open-external-editor now launches only the editor saved from a file dialog and refuses to hand executable file types to the OS opener. The unused get-session-cookie and wait-session-cookie channels, which returned the httpOnly jwt, are removed. * fix: validate setting keys before editor authorization * fix(sidebar): sort hosts by IP address numerically (#1629) * fix(desktop): find spawn-helper in universal macOS builds (#1630) The universal build ships app-arm64.asar and app-x64.asar instead of app.asar, so node-pty's helper path rewrite never pointed at the unpacked copy and every local terminal failed with posix_spawnp failed. * fix(sync): send shared hosts with text columns in their stored form (#1631) resolveHostById turns forceKeyboardInteractive into a boolean, and the shared-host export passed it on as is. A desktop could not bind the boolean into the text column, so every shared host failed to apply. * fix: drop ssh_data.vault_profile_id so removing the vault plugin keeps hosts writable (#1633) The vault plugin renames vault_profiles to p_vault_profiles, and SQLite rewrites ssh_data's foreign key to follow it. Uninstalling the plugin then dropped p_vault_profiles and left ssh_data pointing at a missing table, so creating, cloning and deleting hosts failed with "no such table: main.p_vault_profiles". Postgres and MySQL refused the uninstall instead. The column was already copied into the vault plugin's host settings by 2.9, so retire it on every engine. The SQLite boot drop also repairs databases already in the broken state; MySQL drops the column's foreign key first. * fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own (#1632) * fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own * fix(sync): switch off an untrusted mirrored plugin when the server updates it * fix: require local consent for mirrored plugin activation * docs: describe consent fields on the plugin state endpoint * fix(i18n): keep Indonesian technical terms consistent (#1636) Use the English terms Indonesian users know for tunnel, snippet, deploy, file manager, remote desktop, jump host, passphrase, sidebar, toolbar, endpoint, browser and SSH agent, instead of mixing literal translations (terowongan, cuplikan, terapkan, bilah sisi, titik akhir, ...) with the English words. Match the split shortcuts to the split screen menu. Also fix the user data export description, which said secrets are encrypted while the English says they are decrypted. * fix(settings): leave user manage view when switching admin sections (#1649) The admin panel stays mounted across Settings pages, so an open user manage view kept replacing every other admin section until Back to users was clicked. Reset it whenever the selected section changes. * fix(sync): don't delete a local row when the server can't send its copy (#1650) * fix(sync): don't delete a local row when the server can't send its copy A push conflict on a live record whose server row failed to serialize came back as row: null, deleted: false, and the desktop treated that as a delete. The server now rejects that op as unavailable, the desktop never deletes on a conflict without a row, and serialization failures are logged. * fix(sync): retry temporarily unavailable records * fix: smooth host editor jumps to lower sections * chore: add changelog entries for 26.10.2 fixes * fix: stop building ssh2 native crypto in the docker image (#1644) * chore: test that an update keeps a changed auth type (#1601) * feat: option to hide the sidebar after opening a host (#1652) * feat: sort the dashboard host status card (Plugin-Host-Metrics#6) * fix: let the hover side menu overlay content instead of resizing it (Plugin-Remote-Desktop#2) * fix: say the server is down and keep retrying instead of a database error (#1637) * fix: show why a client tunnel failed to start (Plugin-Tunnels#2) * fix(sdk): skip comment-only chunks when splitting migrations * feat: setting to let the hover side menu push content again * fix: use the vite proxy for plugin sockets on any dev port * feat(sdk): let a plugin raise its public route rate limit * chore: update translations * chore: add the overview video to the readme * chore: update the overview video and add a play button to its thumbnail * feat: plugin builds bundle worker entries and import wasm and fonts as bytes * feat: plugin packs include LICENSE and NOTICE * chore: drop guacd from compose files and dev runner * chore: update remote desktop origin comment for the built-in engine * fix: show plugin names and descriptions in the UI language (#1658) * fix: show plugin names and descriptions in the UI language Read plugin.name and plugin.description from each plugin's own locale namespace, falling back to the manifest, everywhere core shows a plugin's name: the Plugins manager, onboarding picker, host editor tabs and sections, host filters and bulk actions, beta updates, interface presets and plugin crash/loading notices. * docs(sdk): document plugin.name and plugin.description locale keys --------- Co-authored-by: ZacharyZcR <zkl205305@gmail.com> * fix(hosts): reject or infer a missing authType on host create (#1664) Creating an SSH host through the API without authType hit the NOT NULL auth_type column and came back as a 500. The create route now infers the type from the credential, key or password in the body, falls back to the host defaults, and otherwise answers 400. A non-string authType is a 400 on create and update. * chore: changelog for merged plugin name and host auth type PRs * fix: move macOS split pane navigation to Cmd+Option+Arrow * fix: pick a free port for the desktop backend when 30001 is taken (#1663) * feat: build the Windows desktop app for ARM64 (#1615) * fix(sync): keep the changes cursor within the 32-bit seq column (#1665) The desktop learned the server's entity types by asking for changes after Number.MAX_SAFE_INTEGER. sync_records.seq is a 32-bit integer on Postgres, which rejects that bound value, so every pass needing the probe failed with 22003 out of range. The server now clamps the cursor to the largest seq the column holds and answers 400 for a cursor or limit that is not a non-negative integer. The desktop asks for a one-row page from its saved cursor instead. * fix(audit): coalesce identical plugin routine audits so they cannot flush the log (#1667) Successful plugin_as_user and plugin_service_* entries written by a plugin with the same user, action, resource and details are recorded once per 10 minutes. Failures and every other action are still written each time. * feat(plugins): publish host.created when a host is added (#1668) Plugins that keep an inventory of hosts had no way to hear about a new one short of polling. Core now publishes host.created with the same { hostId, userId } payload as host.updated wherever a host row is created: the host create route, ctx.hosts.create, JSON and SSH config bulk import, database file import, and sync writing a host it did not have yet. * fix: show the login for signed-out full-screen view links and return to them (#1669) A ?view= link opened without a session spun forever: the gate rendered the bare view when the session check failed, so the plugin runtime never started and the view never registered. A regular browser now keeps the link in sessionStorage, shows the normal login and opens the link again after any login, including redirect logins. Only same-origin paths with a view are restored. The desktop app, embedded sign-in frames and guest views keep their current behavior. * fix(desktop): apply linked server proxy headers and certificate exception to WebSockets (#1670) * fix(desktop): send linked server proxy headers on WebSocket upgrades isLinkedOrigin compared the request origin with the link's http(s) origin, so the terminal WebSocket (wss://host/...) never matched and its upgrade went out without the proxy headers and basic auth. Behind a forward-auth proxy that upgrade was redirected to the login and the terminal closed with "connection closed unexpectedly". ws and wss now count as http and https for the comparison, the same mapping the WebSocket handshake itself uses, with host and port still matched exactly. * fix(desktop): allow a linked server's self-signed certificate for its WebSockets isInvalidCertificateAllowedForUrl compared the URL with a local getOrigin copy, so wss://host never matched the link's https://host origin and an allowed self-signed certificate did not cover the terminal and tunnel sockets. It now uses linkedServer.isLinkedOrigin, which maps ws and wss the same way as the proxy headers, and the local copy is removed. * feat(sdk): let plugins mint a short-lived user session and read a user's locale (#1666) ctx.auth.issueUserToken(userId, { purpose, ttlSeconds }) gives background work a session for calling Termix's own API as an existing user. It needs users:impersonate, defaults to 300s and is capped at 900s, is stored as a normal session row marked as plugin-issued, and every issue is audited. Such sessions are refused on routes that change the user's password, second factors, API keys or linked logins. ctx.users.getLocale(userId) reads the user's UI language under users:read. SDK 1.0.11, plugin API 1.3.0. * chore: changelog for merged sync, audit, event and desktop PRs * feat: add shell.rightEdge slot so plugin panels can push the page over * chore: pin bundled plugins to the latest releases * chore: lint, format, and bump version to 26.10.2 --------- Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com> Co-authored-by: Ferdina Kusumah <19812460+FerdinaKusumah@users.noreply.github.com> Co-authored-by: ZacharyZcR <zkl205305@gmail.com> Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>
2026-10-29 06:35:24 +00:00 · 2026-10-18 00:34:50 -05:00
1 parent 3517b2f0ed
commit 66e8ce6df7
@@ -20,11 +20,10 @@ interface OriginResolvableHost {
 * the desktop-wide default.
 *
 * `defaultRemote` makes a host left on Default resolve to "remote" instead of
- * following the desktop-wide setting. Remote desktop passes it: it needs a
- * guacd, which the desktop does not ship, so originating it here only works
- * once the user has pointed Termix at one of their own. Making that opt-in
- * per host keeps an upgrade from moving working connections onto a guacd
- * that isn't there -- see Termix-SSH/Support#1240.
+ * following the desktop-wide setting. Remote desktop passes it when this
+ * desktop is set to use an external guacd, so a host is not moved onto a
+ * guacd that isn't there (see Termix-SSH/Support#1240). With the built-in
+ * engine it runs locally like SSH.
 */
 export async function resolveConnectionOrigin(
  host: OriginResolvableHost,
@@ -1,4 +1,5 @@
 import { getBasePath } from "./base-path";
+import { localBackendPort } from "./electron";

 type BrowserLocation = Pick<
  Location,
@@ -16,11 +17,14 @@ export function getDatabaseTransferUrl(
  { electron, configuredServerUrl, location }: DatabaseTransferUrlOptions,
 ): string {
  if (electron) {
-    const serverUrl = configuredServerUrl || "http://localhost:30001";
+    const serverUrl =
+      configuredServerUrl || `http://localhost:${localBackendPort()}`;
    return `${serverUrl.replace(/\/$/, "")}/database/${operation}`;
  }

-  const development = location.port === "5173";
+  // Vite moves off 5173 when another dev server holds it.
+  const development =
+    process.env.NODE_ENV === "development" || location.port === "5173";

  if (development) {
    return `http://localhost:30001/database/${operation}`;
@@ -3,6 +3,7 @@ type ElectronWindow = Window &
    IS_ELECTRON?: boolean;
    electronAPI?: {
      isElectron?: boolean;
+      backendPort?: number;
    };
  };

@@ -16,3 +17,20 @@ export function isElectron(): boolean {

  return hasISElectron || hasElectronAPI || isElectronProp;
 }
+
+const DEFAULT_LOCAL_BACKEND_PORT = 30001;
+
+/**
+ * The port of the desktop app's embedded backend. It moves off 30001 when
+ * another program holds that port.
+ */
+export function localBackendPort(): number {
+  if (typeof window === "undefined") return DEFAULT_LOCAL_BACKEND_PORT;
+  const port = (window as ElectronWindow).electronAPI?.backendPort;
+  return typeof port === "number" &&
+    Number.isInteger(port) &&
+    port > 0 &&
+    port < 65536
+    ? port
+    : DEFAULT_LOCAL_BACKEND_PORT;
+}
@@ -16,9 +16,14 @@ export function isInMobileWebView(): boolean {
  );
 }

+// Being framed alone is not enough: any site could frame this page and
+// receive the token posted to window.parent. The desktop app tags every
+// request and frame with its own user agent, which a web page cannot fake
+// in someone else's browser.
 export function isInElectronWebView(): boolean {
  if (isInMobileWebView()) return false;
  if ((window as EmbeddedFrameWindow).IS_ELECTRON_WEBVIEW) return true;
+  if (!/Termix-Desktop\//.test(navigator.userAgent)) return false;
  try {
    if (window.self !== window.top) return true;
  } catch {
@@ -0,0 +1,25 @@
+import { isMacPlatform } from "./tab-jump-hotkey";
+
+export type PaneNavDirection = "left" | "right" | "up" | "down";
+
+const ARROWS: Record<string, PaneNavDirection> = {
+  ArrowLeft: "left",
+  ArrowRight: "right",
+  ArrowUp: "up",
+  ArrowDown: "down",
+};
+
+/**
+ * The split pane to move to for this key, if any. Cmd+Option+Arrow on macOS,
+ * where Option+Arrow moves the shell cursor by word, Alt+Arrow elsewhere.
+ */
+export function getPaneNavDirection(e: KeyboardEvent): PaneNavDirection | null {
+  const direction = ARROWS[e.code];
+  if (!direction || e.ctrlKey || e.shiftKey || !e.altKey) return null;
+  if (e.metaKey !== isMacPlatform()) return null;
+  return direction;
+}
+
+export function paneNavHotkeyLabel(): string {
+  return isMacPlatform() ? "Cmd+Option+Arrows" : "Alt+Arrows";
+}
@@ -1,3 +1,5 @@
+import type { TFunction } from "i18next";
+
 /**
 * Where a plugin's i18n keys resolve from.
 *
@@ -19,3 +21,25 @@ export function pluginKey(
  if (!key) return key;
  return key.includes(":") ? key : `${pluginId}:${key}`;
 }
+
+/**
+ * A plugin's name in the UI language: "plugin.name" from its own locales,
+ * else the manifest's. A plugin whose strings are not loaded, like one only
+ * listed in a registry, shows the manifest name.
+ */
+export function pluginName(
+  t: TFunction,
+  plugin: { id: string; name: string },
+): string {
+  return t(pluginKey(plugin.id, "plugin.name"), { defaultValue: plugin.name });
+}
+
+/** Same as pluginName, for "plugin.description". */
+export function pluginDescription(
+  t: TFunction,
+  plugin: { id: string; description?: string | null },
+): string {
+  return t(pluginKey(plugin.id, "plugin.description"), {
+    defaultValue: plugin.description ?? "",
+  });
+}
@@ -19,7 +19,7 @@
 import type { AxiosInstance } from "axios";
 import { authApi, createRemoteOriginApiInstance } from "@/main-axios";
 import { getBasePath } from "@/lib/base-path";
-import { isElectron } from "@/lib/electron";
+import { isElectron, localBackendPort } from "@/lib/electron";
 import { getDeviceId } from "@/lib/device-id";
 import { websocketAuthProtocols } from "@/lib/ws-auth";
 import {
@@ -165,7 +165,7 @@ export async function pluginWsUrl(
  if (isElectron()) {
    return buildOriginWsUrl({
      origin: options.origin ?? "local",
-      localPort: BACKEND_PORT,
+      localPort: localBackendPort(),
      localPath: route,
      remotePath: route,
    });
@@ -175,11 +175,10 @@ export async function pluginWsUrl(
  const protocols = websocketAuthProtocols(token);

  // Dev without a configured API host goes through Vite's proxy, which is
-  // reached on the page's own origin rather than the backend port.
+  // reached on the page's own origin rather than the backend port. Vite moves
+  // to another port when 5173 is taken, so the port says nothing here.
  const devProxy =
-    process.env.NODE_ENV === "development" &&
-    !import.meta.env.VITE_API_HOST &&
-    (window.location.port === "3000" || window.location.port === "5173");
+    process.env.NODE_ENV === "development" && !import.meta.env.VITE_API_HOST;

  const wsProtocol = window.location.protocol === "https:" ? "wss" : "ws";

@@ -0,0 +1,56 @@
+/**
+ * Brings a signed-out full-screen `?view=` link back after sign-in. The link
+ * waits in sessionStorage, which survives a redirect login in the same tab,
+ * so no return path is ever sent to the server.
+ */
+
+const PENDING_VIEW_LINK_KEY = "termix-pending-view-link";
+
+/** The value as a same-origin path with a `view` parameter, or null. */
+export function toViewLinkPath(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  if (!value.startsWith("/") || value.startsWith("//")) return null;
+  let url: URL;
+  try {
+    url = new URL(value, window.location.origin);
+  } catch {
+    return null;
+  }
+  if (url.origin !== window.location.origin) return null;
+  if (!url.searchParams.get("view")) return null;
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function rememberViewLink(): void {
+  const { pathname, search, hash } = window.location;
+  const path = toViewLinkPath(`${pathname}${search}${hash}`);
+  if (!path) return;
+  try {
+    sessionStorage.setItem(PENDING_VIEW_LINK_KEY, path);
+  } catch {
+    // Without storage the user just lands on the app after signing in.
+  }
+}
+
+/** The remembered link, cleared whether or not it is still valid. */
+export function consumeViewLink(): string | null {
+  try {
+    const stored = sessionStorage.getItem(PENDING_VIEW_LINK_KEY);
+    sessionStorage.removeItem(PENDING_VIEW_LINK_KEY);
+    return toViewLinkPath(stored);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Opens the remembered link, if there is one. The navigation waits a tick so
+ * history updates the login callback makes right after sign-in cannot cancel
+ * it.
+ */
+export function resumeViewLink(): boolean {
+  const path = consumeViewLink();
+  if (!path) return false;
+  setTimeout(() => window.location.replace(path), 0);
+  return true;
+}