v26.10.2 (#1672)

* fix: keep concurrent ssh pool connects from overwriting each other (#1619)

* fix: stop auto-accepting changed jump host keys (#1620)

A jump hop whose key no longer matched the pinned fingerprint was
silently accepted and the pin overwritten. Background status probes
reconnect to jump hosts every cycle, so a MITM on that hop got the
credentials with no user interaction. Changed jump host keys now go
through the same path as any other host: prompt when there is a
terminal socket, otherwise refuse.

* fix(electron): validate external login URL scheme and callback port (#1621)

* fix(plugins): read artifact manifest with the same tar parser as the unpack (#1622)

The consent check read the first manifest.json with a hand-written tar
reader, while the unpack keeps the last one and also follows pax and
long-name headers. An archive with two manifests could pass the check
with one capability list and get granted another. Read the manifest
with node-tar, count only plain files, and refuse archives that hold
more than one manifest.json.

* fix: only trust the server's origin in the desktop login frame (#1624)

The desktop sign-in iframe accepted AUTH_SUCCESS and system browser requests from whatever page it had navigated to, and posted replies (including 2FA temp tokens) to any origin. Messages must now come from the server's origin and replies are posted to it.

The web UI also treated any framing page as the desktop app and posted the JWT to it. It now also requires the Termix-Desktop user agent.

* fix: check trusted proxy login against nginx's peer, not nginx (#1625)

The backend only sees the bundled nginx on loopback, so the allowlist
could only work by trusting 127.0.0.1, which let any client that reached
nginx log in as anyone by sending the identity headers. nginx now passes
its own TCP peer (before real_ip rewriting) in X-Termix-Proxy-Peer, and
loopback connections are judged by that address instead.

* fix: keep foreign keys on during user data import (#1626)

Import credentials before hosts and remap the file's credential ids to
the ones created here, so hosts and protocol logins no longer point at
another server's ids. With rows written in dependency order, the import
no longer turns off SQLite foreign keys on the shared connection. The
uploaded file is now removed on every exit path.

* fix: enforce unique usernames (#1628)

* fix: enforce unique usernames

Registration checked for a taken name, hashed the password, then
inserted, with nothing in the schema enforcing uniqueness. Concurrent
sign-ups could create two accounts with one name, after which login,
password reset, proxy login and admin lookups by username picked
between them arbitrarily.

Add a unique index on users.username for every dialect. Existing
duplicates are renamed (later rows get a -<id> suffix, the oldest keeps
the name) rather than deleted. Registration and admin user creation now
return the same 409 when the insert loses the race.

* fix: avoid username collisions during migration

* fix: don't auto-enable synced plugins signed only by a server-sent key (#1623)

* fix: don't auto-enable synced plugins signed only by a server-sent key

Registry keys a linked server sends still let its plugins load on the desktop, but no longer count as a signer for switching them on or copying their grants. Keys the desktop added itself keep their trust.

* fix: enforce local plugin trust across remote source labels

* fix: require positive local trust for synced plugin keys

* fix(desktop): harden external editor and session cookie IPC (#1627)

* fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie

open-external-editor now launches only the editor saved from a file dialog
and refuses to hand executable file types to the OS opener. The unused
get-session-cookie and wait-session-cookie channels, which returned the
httpOnly jwt, are removed.

* fix: validate setting keys before editor authorization

* fix(sidebar): sort hosts by IP address numerically (#1629)

* fix(desktop): find spawn-helper in universal macOS builds (#1630)

The universal build ships app-arm64.asar and app-x64.asar instead of
app.asar, so node-pty's helper path rewrite never pointed at the
unpacked copy and every local terminal failed with posix_spawnp failed.

* fix(sync): send shared hosts with text columns in their stored form (#1631)

resolveHostById turns forceKeyboardInteractive into a boolean, and the
shared-host export passed it on as is. A desktop could not bind the boolean
into the text column, so every shared host failed to apply.

* fix: drop ssh_data.vault_profile_id so removing the vault plugin keeps hosts writable (#1633)

The vault plugin renames vault_profiles to p_vault_profiles, and SQLite
rewrites ssh_data's foreign key to follow it. Uninstalling the plugin then
dropped p_vault_profiles and left ssh_data pointing at a missing table, so
creating, cloning and deleting hosts failed with "no such table:
main.p_vault_profiles". Postgres and MySQL refused the uninstall instead.

The column was already copied into the vault plugin's host settings by 2.9,
so retire it on every engine. The SQLite boot drop also repairs databases
already in the broken state; MySQL drops the column's foreign key first.

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own (#1632)

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own

* fix(sync): switch off an untrusted mirrored plugin when the server updates it

* fix: require local consent for mirrored plugin activation

* docs: describe consent fields on the plugin state endpoint

* fix(i18n): keep Indonesian technical terms consistent (#1636)

Use the English terms Indonesian users know for tunnel, snippet, deploy,
file manager, remote desktop, jump host, passphrase, sidebar, toolbar,
endpoint, browser and SSH agent, instead of mixing literal translations
(terowongan, cuplikan, terapkan, bilah sisi, titik akhir, ...) with the
English words. Match the split shortcuts to the split screen menu.

Also fix the user data export description, which said secrets are
encrypted while the English says they are decrypted.

* fix(settings): leave user manage view when switching admin sections (#1649)

The admin panel stays mounted across Settings pages, so an open user
manage view kept replacing every other admin section until Back to users
was clicked. Reset it whenever the selected section changes.

* fix(sync): don't delete a local row when the server can't send its copy (#1650)

* fix(sync): don't delete a local row when the server can't send its copy

A push conflict on a live record whose server row failed to serialize
came back as row: null, deleted: false, and the desktop treated that as
a delete. The server now rejects that op as unavailable, the desktop
never deletes on a conflict without a row, and serialization failures
are logged.

* fix(sync): retry temporarily unavailable records

* fix: smooth host editor jumps to lower sections

* chore: add changelog entries for 26.10.2 fixes

* fix: stop building ssh2 native crypto in the docker image (#1644)

* chore: test that an update keeps a changed auth type (#1601)

* feat: option to hide the sidebar after opening a host (#1652)

* feat: sort the dashboard host status card (Plugin-Host-Metrics#6)

* fix: let the hover side menu overlay content instead of resizing it (Plugin-Remote-Desktop#2)

* fix: say the server is down and keep retrying instead of a database error (#1637)

* fix: show why a client tunnel failed to start (Plugin-Tunnels#2)

* fix(sdk): skip comment-only chunks when splitting migrations

* feat: setting to let the hover side menu push content again

* fix: use the vite proxy for plugin sockets on any dev port

* feat(sdk): let a plugin raise its public route rate limit

* chore: update translations

* chore: add the overview video to the readme

* chore: update the overview video and add a play button to its thumbnail

* feat: plugin builds bundle worker entries and import wasm and fonts as bytes

* feat: plugin packs include LICENSE and NOTICE

* chore: drop guacd from compose files and dev runner

* chore: update remote desktop origin comment for the built-in engine

* fix: show plugin names and descriptions in the UI language (#1658)

* fix: show plugin names and descriptions in the UI language

Read plugin.name and plugin.description from each plugin's own locale
namespace, falling back to the manifest, everywhere core shows a plugin's
name: the Plugins manager, onboarding picker, host editor tabs and
sections, host filters and bulk actions, beta updates, interface presets
and plugin crash/loading notices.

* docs(sdk): document plugin.name and plugin.description locale keys

---------

Co-authored-by: ZacharyZcR <zkl205305@gmail.com>

* fix(hosts): reject or infer a missing authType on host create (#1664)

Creating an SSH host through the API without authType hit the NOT NULL
auth_type column and came back as a 500. The create route now infers the
type from the credential, key or password in the body, falls back to the
host defaults, and otherwise answers 400. A non-string authType is a 400
on create and update.

* chore: changelog for merged plugin name and host auth type PRs

* fix: move macOS split pane navigation to Cmd+Option+Arrow

* fix: pick a free port for the desktop backend when 30001 is taken (#1663)

* feat: build the Windows desktop app for ARM64 (#1615)

* fix(sync): keep the changes cursor within the 32-bit seq column (#1665)

The desktop learned the server's entity types by asking for changes after
Number.MAX_SAFE_INTEGER. sync_records.seq is a 32-bit integer on Postgres,
which rejects that bound value, so every pass needing the probe failed with
22003 out of range.

The server now clamps the cursor to the largest seq the column holds and
answers 400 for a cursor or limit that is not a non-negative integer. The
desktop asks for a one-row page from its saved cursor instead.

* fix(audit): coalesce identical plugin routine audits so they cannot flush the log (#1667)

Successful plugin_as_user and plugin_service_* entries written by a plugin
with the same user, action, resource and details are recorded once per
10 minutes. Failures and every other action are still written each time.

* feat(plugins): publish host.created when a host is added (#1668)

Plugins that keep an inventory of hosts had no way to hear about a new
one short of polling. Core now publishes host.created with the same
{ hostId, userId } payload as host.updated wherever a host row is
created: the host create route, ctx.hosts.create, JSON and SSH config
bulk import, database file import, and sync writing a host it did not
have yet.

* fix: show the login for signed-out full-screen view links and return to them (#1669)

A ?view= link opened without a session spun forever: the gate rendered
the bare view when the session check failed, so the plugin runtime never
started and the view never registered. A regular browser now keeps the
link in sessionStorage, shows the normal login and opens the link again
after any login, including redirect logins. Only same-origin paths with
a view are restored. The desktop app, embedded sign-in frames and guest
views keep their current behavior.

* fix(desktop): apply linked server proxy headers and certificate exception to WebSockets (#1670)

* fix(desktop): send linked server proxy headers on WebSocket upgrades

isLinkedOrigin compared the request origin with the link's http(s)
origin, so the terminal WebSocket (wss://host/...) never matched and its
upgrade went out without the proxy headers and basic auth. Behind a
forward-auth proxy that upgrade was redirected to the login and the
terminal closed with "connection closed unexpectedly". ws and wss now
count as http and https for the comparison, the same mapping the
WebSocket handshake itself uses, with host and port still matched
exactly.

* fix(desktop): allow a linked server's self-signed certificate for its WebSockets

isInvalidCertificateAllowedForUrl compared the URL with a local
getOrigin copy, so wss://host never matched the link's https://host
origin and an allowed self-signed certificate did not cover the
terminal and tunnel sockets. It now uses linkedServer.isLinkedOrigin,
which maps ws and wss the same way as the proxy headers, and the local
copy is removed.

* feat(sdk): let plugins mint a short-lived user session and read a user's locale (#1666)

ctx.auth.issueUserToken(userId, { purpose, ttlSeconds }) gives background
work a session for calling Termix's own API as an existing user. It needs
users:impersonate, defaults to 300s and is capped at 900s, is stored as a
normal session row marked as plugin-issued, and every issue is audited.
Such sessions are refused on routes that change the user's password,
second factors, API keys or linked logins.

ctx.users.getLocale(userId) reads the user's UI language under users:read.

SDK 1.0.11, plugin API 1.3.0.

* chore: changelog for merged sync, audit, event and desktop PRs

* feat: add shell.rightEdge slot so plugin panels can push the page over

* chore: pin bundled plugins to the latest releases

* chore: lint, format, and bump version to 26.10.2

---------

Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: Ferdina Kusumah <19812460+FerdinaKusumah@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zkl205305@gmail.com>
Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>

src/ui/locales/translated/id_ID.json

@@ -72,7 +72,7 @@
     "deleteFolder": "Hapus folder",
     "deleteCredentialConfirm": "Hapus kredensial \"{{name}}\"?",
     "deletedCredential": "{{name}} telah dihapus",
-    "deploySSHKeyTitle": "Terapkan kunci ke host",
+    "deploySSHKeyTitle": "Deploy kunci ke host",
     "loadingCredentials": "Memuat kredensial...",
     "noCredentialsFound": "Tidak ada kredensial ditemukan",
     "noCredentialsMatchSearch": "Tidak ada kredensial yang cocok dengan pencarian Anda",
@@ -80,7 +80,7 @@
     "failedToReorder": "Gagal mengurutkan ulang kredensial",
     "failedToMoveCredential": "Gagal memindahkan kredensial",
     "sortManual": "Manual (seret untuk mengurutkan)",
-    "customizeSidebar": "Sesuaikan Bilah Samping",
+    "customizeSidebar": "Sesuaikan Sidebar",
     "customizeSidebarDescription": "Pilih tampilan dan perilaku daftar kredensial.",
     "customizeDensityTitle": "Kepadatan",
     "densityComfortableDesc": "Satu kredensial per baris, dengan detail tambahan.",
@@ -108,20 +108,20 @@
     "actionsOnly": "Hanya sambung, lainnya saat diklik",
     "actionsHover": "Tampilkan saat kursor di atas",
     "actionsClick": "Tampilkan saat diklik",
-    "customizeSortHint": "Urutan pengurutan ada di menu urutkan pada bilah alat.",
+    "customizeSortHint": "Urutan pengurutan ada di menu urutkan pada toolbar.",
     "expandActions": "Bentangkan tindakan",
     "collapseActions": "Ciutkan tindakan",
     "backToHosts": "Kembali ke Host",
     "backToCredentials": "Kembali ke Kredensial",
     "searchCredentialsPlaceholder": "Cari kredensial…",
-    "deployDialogTitle": "Terapkan Kunci SSH",
-    "deployDialogDesc": "Terapkan {{name}} ke authorized_keys host.",
+    "deployDialogTitle": "Deploy Kunci SSH",
+    "deployDialogDesc": "Deploy {{name}} ke authorized_keys host.",
     "targetHostLabel": "Host Target",
     "selectHostOption": "Pilih host...",
-    "deployingBtn": "Menerapkan...",
-    "deployBtn": "Terapkan",
-    "keyDeployedSuccess": "Kunci berhasil diterapkan",
-    "failedToDeployKey": "Gagal menerapkan kunci",
+    "deployingBtn": "Men-deploy...",
+    "deployBtn": "Deploy",
+    "keyDeployedSuccess": "Kunci berhasil di-deploy",
+    "failedToDeployKey": "Gagal men-deploy kunci",
     "folderRenamedTo": "Folder diubah namanya menjadi \"{{name}}\"",
     "failedToRenameFolder": "Gagal mengubah nama folder",
     "arrangeUnlockedSwitchedToManual": "Beralih ke pengurutan manual agar urutan Anda tetap terjaga",
@@ -181,9 +181,9 @@
     "add": "Tambah",
     "update": "Perbarui",
     "noResults": "Tidak ada hasil ditemukan",
-    "sidebar": "Bilah sisi",
-    "mobileSidebarDescription": "Menampilkan bilah sisi mobile.",
-    "toggleSidebar": "Alihkan Bilah Sisi",
+    "sidebar": "Sidebar",
+    "mobileSidebarDescription": "Menampilkan sidebar mobile.",
+    "toggleSidebar": "Alihkan Sidebar",
     "search": "Cari...",
     "new": "Baru",
     "docs": "Dokumentasi"
@@ -225,7 +225,7 @@
     "securityTitle": "Amankan akun Anda",
     "securityIntro": "Tambahkan passkey atau aplikasi autentikator ke akun Anda. Anda juga dapat melakukan ini nanti di Pengaturan, di bawah Keamanan.",
     "desktopTitle": "Bagaimana Anda ingin menggunakan Termix?",
-    "desktopBody": "Anda dapat mengubah ini kapan saja dari Sinkronisasi di bilah sisi.",
+    "desktopBody": "Anda dapat mengubah ini kapan saja dari Sinkronisasi di sidebar.",
     "desktopLocalTitle": "Hanya di perangkat ini",
     "desktopLocalBody": "Semuanya disimpan di sini. Tidak perlu pengaturan.",
     "desktopLinkTitle": "Dengan server Termix saya",
@@ -297,8 +297,8 @@
     "fullscreenUnsupported": "Layar penuh tidak didukung oleh browser ini",
     "fullscreenFailed": "Gagal mengubah mode layar penuh",
     "resetSidebarWidth": "Atur ulang lebar",
-    "collapseSidebar": "Ciutkan bilah sisi",
-    "openSidebar": "Buka bilah sisi",
+    "collapseSidebar": "Ciutkan sidebar",
+    "openSidebar": "Buka sidebar",
     "confirmCloseHost": "Tutup {{host}}?",
     "enterFullscreen": "Masuk layar penuh (Ctrl+Shift+F)",
     "exitFullscreen": "Keluar layar penuh (Ctrl+Shift+F)",
@@ -310,11 +310,11 @@
     "searchEverything": "Cari host, tab, dan tindakan",
     "search": "Cari",
     "hiddenCount_other": "{{count}} disembunyikan",
-    "showInRail": "Tampilkan di bilah sisi",
+    "showInRail": "Tampilkan di sidebar",
     "moveUp": "Pindah ke atas",
     "moveDown": "Pindah ke bawah",
     "resetRailOrder": "Atur ulang urutan",
-    "hideFromRail": "Sembunyikan dari bilah sisi",
+    "hideFromRail": "Sembunyikan dari sidebar",
     "openSettings": "Buka pengaturan",
     "settings": "Pengaturan",
     "manage": "Kelola",
@@ -359,7 +359,7 @@
     "tabSharing": "Berbagi",
     "tabAuthentication": "Autentikasi",
     "terminal": "Terminal",
-    "tunnel": "Terowongan",
+    "tunnel": "Tunnel",
     "serverStats": "Metrik Host",
     "status": {
       "online": "Online",
@@ -377,8 +377,8 @@
     "editHostTooltip": "Edit host",
     "behavior": "Perilaku",
     "scrollbackBuffer": "Buffer Gulir",
-    "sshAgentForwarding": "Penerusan Agen SSH",
-    "selectSnippet": "Pilih cuplikan",
+    "sshAgentForwarding": "SSH Agent Forwarding",
+    "selectSnippet": "Pilih snippet",
     "forceKeyboardInteractive": "Paksa Keyboard-Interaktif",
     "overrideCredentialUsername": "Timpa Nama Pengguna Kredensial",
     "overrideCredentialUsernameDesc": "Gunakan nama pengguna yang ditentukan di atas daripada nama pengguna kredensial",
@@ -474,8 +474,8 @@
     "insecure": "Tidak Aman",
     "syntaxHighlightingCategories": "Kategori Sorotan",
     "syntaxHighlightingCategoriesDesc": "Pilih jenis konten yang akan diberi warna",
-    "sshAgentForwardingLabel": "Penerusan Agen SSH",
-    "sshAgentForwardingShortDesc": "Izinkan host jarak jauh ini menggunakan agen SSH lokal Anda untuk koneksi lebih lanjut. Ini tidak diperlukan untuk autentikasi Agen.",
+    "sshAgentForwardingLabel": "SSH Agent Forwarding",
+    "sshAgentForwardingShortDesc": "Izinkan host jarak jauh ini menggunakan SSH agent lokal Anda untuk koneksi lebih lanjut. Ini tidak diperlukan untuk autentikasi Agent.",
     "sudoPasswordAutoFillShortDesc": "Sediakan otomatis kata sandi sudo saat diminta",
     "sudoPasswordLabel": "Kata Sandi Sudo",
     "sudoPasswordSaved": "Kata sandi disimpan, ketik untuk mengubah",
@@ -615,13 +615,13 @@
     "GroupByProtocol": "Protokol",
     "GroupByAuth": "Jenis autentikasi",
     "groupUngrouped": "Tidak dikelompokkan",
-    "customizeSidebar": "Sesuaikan bilah sisi",
+    "customizeSidebar": "Sesuaikan sidebar",
     "customizeSidebarDescription": "Pilih tampilan dan perilaku daftar host.",
     "customizeDensityTitle": "Kepadatan",
     "customizeBehaviorTitle": "Perilaku",
     "connectBarTitle": "Bilah koneksi",
     "connectBarDesc": "Pilih tindakan mana yang ditampilkan sebagai tombol pada host. Semua tindakan tetap ada di menu host.",
-    "customizeSortHint": "Urutan pengurutan dan pengelompokan terdapat di menu urutkan dan kelompokkan pada bilah alat.",
+    "customizeSortHint": "Urutan pengurutan dan pengelompokan terdapat di menu urutkan dan kelompokkan pada toolbar.",
     "densityComfortableDesc": "Detail lebih banyak per host: alamat, tag, dan penggunaan sumber daya.",
     "densityCompactDesc": "Satu baris per host, untuk daftar yang lebih panjang.",
     "display": "Tampilan",
@@ -638,6 +638,8 @@
     "actionsClick": "Klik untuk memperluas/menciutkan",
     "openOnDoubleClick": "Buka saat diklik dua kali",
     "openOnDoubleClickDesc": "Memerlukan klik dua kali untuk membuka sesi host, bukan klik tunggal",
+    "closeOnOpen": "Sembunyikan bilah sisi setelah membuka",
+    "closeOnOpenDesc": "Tutup bilah sisi setelah Anda membuka host darinya",
     "showFolderPaths": "Tampilkan jalur folder",
     "showFolderPathsDesc": "Tampilkan jalur folder induk di atas nama subfolder bersarang. Subfolder tetap menjorok ke dalam dalam kedua kasus.",
     "rowDetailsTitle": "Detail baris",
@@ -725,7 +727,7 @@
       "groupNotes": "Catatan",
       "groupTags": "Tag & sematan",
       "groupProxy": "Proxy",
-      "groupJumpHosts": "Host lompat",
+      "groupJumpHosts": "Jump host",
       "groupFeatureFlags": "Pengaturan plugin",
       "groupAdvanced": "Konfigurasi lanjutan",
       "preview": "Pratinjau",
@@ -804,7 +806,7 @@
       "levels": {
         "connect": {
           "label": "Sambungkan",
-          "description": "Hanya membuka sesi: terminal, desktop jarak jauh, pengelola file, terowongan, dan Docker. Tidak ada akses ke konfigurasi host."
+          "description": "Hanya membuka sesi: terminal, remote desktop, file manager, tunnel, dan Docker. Tidak ada akses ke konfigurasi host."
         },
         "view": {
           "label": "Lihat",
@@ -872,14 +874,14 @@
     "arrangeUnlockedSwitchedToManual": "Beralih ke pengurutan manual agar urutan Anda tetap",
     "dragToRearrange": "Seret untuk mengatur ulang",
     "arrangeUnlocked": "Buka kunci seret untuk mengatur ulang",
-    "webUiBindHostUnreachable": "Browser Anda tidak dapat menjangkau 127.0.0.1 pada mesin yang menjalankan Termix, sehingga titik akhir ini tidak akan dimuat. Gunakan alamat yang dijawab oleh mesin tersebut, seperti 0.0.0.0.",
-    "webUiBindHostSharesSessionCookie": "Dari browser ini, terowongan akan dijangkau di nama host yang sama tempat Termix disajikan, sehingga layanan terowongan akan menerima sesi Termix Anda. Cookie mengabaikan port. Titik akhir ini akan menolak untuk dibuka di sini; ini berfungsi dari aplikasi desktop Termix, atau ketika Termix dibuka di localhost.",
-    "webUiErrorLabelRequired": "Titik akhir {{row}} memerlukan label.",
-    "webUiErrorLabelDuplicate": "Setiap titik akhir memerlukan nama yang berbeda.",
-    "webUiErrorPortRange": "Titik akhir {{row}} memerlukan port antara 1 dan 65535.",
-    "webUiErrorPathInvalid": "Titik akhir {{row}} memiliki jalur yang tidak valid. Gunakan jalur seperti /admin.",
+    "webUiBindHostUnreachable": "Browser Anda tidak dapat menjangkau 127.0.0.1 pada mesin yang menjalankan Termix, sehingga endpoint ini tidak akan dimuat. Gunakan alamat yang dijawab oleh mesin tersebut, seperti 0.0.0.0.",
+    "webUiBindHostSharesSessionCookie": "Dari browser ini, forward akan dijangkau di nama host yang sama tempat Termix disajikan, sehingga layanan yang di-tunnel akan menerima sesi Termix Anda. Cookie mengabaikan port. Endpoint ini akan menolak untuk dibuka di sini; ini berfungsi dari aplikasi desktop Termix, atau ketika Termix dibuka di localhost.",
+    "webUiErrorLabelRequired": "Endpoint {{row}} memerlukan label.",
+    "webUiErrorLabelDuplicate": "Setiap endpoint memerlukan nama yang berbeda.",
+    "webUiErrorPortRange": "Endpoint {{row}} memerlukan port antara 1 dan 65535.",
+    "webUiErrorPathInvalid": "Endpoint {{row}} memiliki jalur yang tidak valid. Gunakan jalur seperti /admin.",
     "copyViewUrlAction": "Salin tautan {{name}}",
-    "filterAuthAgent": "Agen SSH",
+    "filterAuthAgent": "SSH Agent",
     "authTypeNeedsPlugin": "Host ini menggunakan {{type}}, yang memerlukan {{plugin}}. Fitur ini dinonaktifkan di server ini.",
     "authTypeUnknown": "Host ini menggunakan {{type}}, yang tidak tersedia di server ini.",
     "authFieldsAfterSave": "Simpan host terlebih dahulu, lalu isi bidang-bidang ini.",
@@ -932,7 +934,7 @@
     "newPaneRight": "Panel baru di sebelah kanan",
     "newPaneBelow": "Panel baru di bawah",
     "emptyTitle": "Panel kosong",
-    "emptyHint": "Pilih sesuatu untuk ditampilkan di sini. Saat panel ini dipilih, apa pun yang Anda buka dari bilah sisi juga akan terbuka di sini.",
+    "emptyHint": "Pilih sesuatu untuk ditampilkan di sini. Saat panel ini dipilih, apa pun yang Anda buka dari sidebar juga akan terbuka di sini.",
     "openTabs": "Buka tab",
     "noOpenTabs": "Tidak ada tab lain yang terbuka",
     "hosts": "Host",
@@ -972,7 +974,7 @@
   },
   "connections": {
     "noConnections": "Tidak ada koneksi",
-    "noConnectionsDesc": "Buka terminal, manajer file, atau remote desktop untuk melihat koneksi di sini",
+    "noConnectionsDesc": "Buka terminal, file manager, atau remote desktop untuk melihat koneksi di sini",
     "connectedFor": "Terhubung selama {{duration}}",
     "connected": "Terhubung",
     "disconnected": "Terputus",
@@ -1038,7 +1040,7 @@
     "sshTimeoutDescription": "Upaya autentikasi habis waktu. Silakan coba lagi.",
     "sshProvideCredentialsDescription": "Silakan masukkan kredensial SSH Anda untuk terhubung ke server ini.",
     "sshPasswordDescription": "Masukkan kata sandi untuk koneksi SSH ini.",
-    "sshKeyPasswordDescription": "Jika kunci SSH Anda terenkripsi, masukkan frasa sandi di sini.",
+    "sshKeyPasswordDescription": "Jika kunci SSH Anda terenkripsi, masukkan passphrase di sini.",
     "passphraseRequired": "Passphrase Diperlukan",
     "passphraseRequiredDescription": "Kunci SSH terenkripsi. Masukkan passphrase untuk membukanya.",
     "external": "Eksternal",
@@ -1083,7 +1085,7 @@
     "acceptNewKey": "Terima Kunci Baru & Lanjutkan"
   },
   "errors": {
-    "databaseConnection": "Tidak dapat terhubung ke database",
+    "databaseConnection": "Server Termix tidak merespons",
     "embeddedServerFailed": "Server lokal Termix tidak dapat dimulai",
     "unknownError": "Kesalahan tidak diketahui",
     "syncedHostMissing": "Host yang disinkronkan tidak ada di server yang terhubung",
@@ -1110,7 +1112,7 @@
   "messages": {
     "registrationDisabled": "Anda belum memiliki akun Termix. Mintalah admin untuk mengaktifkan pembuatan otomatis akun eksternal.",
     "userNotAllowed": "Akun Anda tidak diizinkan untuk mendaftar. Hubungi administrator.",
-    "databaseConnectionFailed": "Gagal terhubung ke server database",
+    "databaseConnectionFailed": "Server mungkin masih sedang dimulai atau telah berhenti. Halaman ini akan terus mencoba dan kembali normal secara otomatis setelah server aktif kembali.",
     "embeddedServerPortInUse": "Port {{port}} sudah digunakan oleh program lain. Biasanya ini adalah kontainer Docker Termix atau proses Termix yang tersisa dari sesi sebelumnya. Tutup program tersebut, lalu mulai ulang Termix.",
     "embeddedServerPortInUseUnknownPort": "Salah satu port yang dibutuhkan Termix sudah digunakan oleh program lain. Tutup program yang menggunakannya, lalu mulai ulang Termix.",
     "embeddedServerOldDatabase": "Data lokal Anda berasal dari Termix 2.8 atau lebih lama dan harus diproses melalui versi 2.9 terlebih dahulu. Instal Termix 2.9.1, buka sekali agar data Anda dapat dipindahkan, lalu perbarui ke versi ini lagi.",
@@ -1401,7 +1403,7 @@
     "manageTabDanger": "Bahaya",
     "manageEditorBack": "Kembali ke data {{username}}",
     "dataLockedBadge": "TERKUNCI",
-    "dataLockedNotice": "Data {{username}} tetap terkunci hingga mereka masuk berikutnya. Host, kredensial, dan cuplikan mereka tidak dapat dilihat atau diedit hingga saat itu.",
+    "dataLockedNotice": "Data {{username}} tetap terkunci hingga mereka masuk berikutnya. Host, kredensial, dan snippet mereka tidak dapat dilihat atau diedit hingga saat itu.",
     "resetPasswordTitle": "Reset Kata Sandi",
     "resetPasswordExternalOnly": "Pengguna ini masuk melalui penyedia eksternal dan tidak memiliki kata sandi.",
     "resetPasswordPlaceholder": "Kata sandi baru",
@@ -1410,14 +1412,14 @@
     "resetPasswordSuccess": "Kata sandi direset",
     "resetPasswordSuccessWiped": "Kata sandi direset. Data terenkripsi pengguna dihapus.",
     "resetPasswordFailed": "Gagal mereset kata sandi",
-    "resetPasswordConfirmWipe": "{{username}} belum masuk sejak peningkatan enkripsi, sehingga data mereka tidak dapat dipulihkan. Mereset sekarang akan menghapus host, kredensial, dan cuplikan mereka. Lanjutkan?",
+    "resetPasswordConfirmWipe": "{{username}} belum masuk sejak peningkatan enkripsi, sehingga data mereka tidak dapat dipulihkan. Mereset sekarang akan menghapus host, kredensial, dan snippet mereka. Lanjutkan?",
     "manageApiKeys": "Kunci API",
     "apiKeyNamePlaceholder": "Nama kunci",
     "apiKeyCopyNotice": "Salin kunci ini sekarang, karena tidak akan ditampilkan lagi.",
     "noApiKeysForUser": "Tidak ada kunci API",
     "apiKeyDeleteFailed": "Gagal menghapus kunci API",
     "exportUserData": "Ekspor Data",
-    "exportUserDataDesc": "Unduh host, kredensial, dan data manajer file pengguna ini sebagai JSON. Rahasia telah dienkripsi.",
+    "exportUserDataDesc": "Unduh host, kredensial, dan data file manager pengguna ini sebagai JSON. Rahasia sudah didekripsi.",
     "exportUserDataSuccess": "Data pengguna berhasil diekspor",
     "exportUserDataFailed": "Gagal mengekspor data pengguna",
     "hostsCount_other": "{{count}} host",
@@ -1438,7 +1440,7 @@
     "deleteSuccessorMe": "Saya (admin yang menghapus)",
     "deleteSuccessorNone": "Tidak ada, hapus saja",
     "deleteSuccessorDesc": "Semua yang dibagikan pengguna ini akan tetap berfungsi di bawah pemilik baru; memilih tidak ada akan menghapus host, kredensial, dan berbagi mereka.",
-    "deleteUserDangerDesc": "Hapus {{username}} dan semua datanya (host, kredensial, cuplikan, riwayat) secara permanen. Tindakan ini tidak dapat dibatalkan.",
+    "deleteUserDangerDesc": "Hapus {{username}} dan semua datanya (host, kredensial, snippet, riwayat) secara permanen. Tindakan ini tidak dapat dibatalkan.",
     "deleteUserConfirm": "Hapus {{username}} dan semua datanya secara permanen?",
     "deleteUserAdminBlocked": "Hapus status admin sebelum menghapus pengguna ini.",
     "createRoleRequired": "Nama dan nama tampilan wajib diisi",
@@ -1482,7 +1484,7 @@
     "secondFactorsResetFailed": "Gagal mereset faktor kedua",
     "passwordLoginForced": "Login dengan kata sandi dimatikan, tetapi tidak ada metode login lain yang diaktifkan, jadi tetap menyala untuk saat ini. Tidak ada yang terkunci keluar.",
     "sslNotRenewed": "Tidak ada yang memperbarui sertifikat ini. Sertifikat ini kedaluwarsa pada {{date}}. Aktifkan perpanjangan otomatis di bagian Sertifikat ACME, atau unggah yang baru sebelum waktu itu.",
-    "sslSelfSigned": "Sertifikat tanda tangan sendiri yang dibuat oleh Termix. Peramban akan memperingatkan tentang hal ini.",
+    "sslSelfSigned": "Sertifikat tanda tangan sendiri yang dibuat oleh Termix. Browser akan memperingatkan tentang hal ini.",
     "sslRenewedBy": "Diperbarui secara otomatis oleh {{plugin}}",
     "sslIssuer": "Diterbitkan oleh {{issuer}}",
     "sslNames": "Meliputi {{names}}",
@@ -1527,8 +1529,8 @@
         "defaultsHeading": "Pintasan Bawaan",
         "fixedHeading": "Pintasan Aplikasi",
         "fixed": {
-          "splitRight": "Pembagian ke kanan",
-          "splitDown": "Pembagian ke bawah",
+          "splitRight": "Bagi ke kanan",
+          "splitDown": "Bagi ke bawah",
           "zoomPane": "Perbesar panel yang difokuskan",
           "navigatePane": "Pindah antar panel",
           "nextTab": "Tab berikutnya",
@@ -1588,7 +1590,7 @@
         "presetOverridesTitle": "Disesuaikan",
         "presetRevertArea": "Kembalikan",
         "presetConfirmTitle": "Beralih ke {{preset}}?",
-        "presetConfirmDesc": "Ini akan mengembalikan sidebar, navigasi, tata letak dasbor, bilah alat terminal, dan tampilan manajer file Anda. Host, kredensial, dan beranda Anda tidak akan tersentuh.",
+        "presetConfirmDesc": "Ini akan mengembalikan sidebar, navigasi, tata letak dasbor, toolbar terminal, dan tampilan file manager Anda. Host, kredensial, dan beranda Anda tidak akan tersentuh.",
         "presetConfirmApply": "Terapkan preset",
         "runSetupAgainDesc": "Lakukan pengaturan awal lagi.",
         "runSetupAgainButton": "Jalankan pengaturan",
@@ -1598,7 +1600,7 @@
         "uiArea_rail": "Navigasi",
         "uiArea_dashboard": "Dasbor",
         "uiArea_terminal": "Terminal",
-        "uiArea_fileManager": "Manajer file",
+        "uiArea_fileManager": "File manager",
         "uiArea_hostEditor": "Editor host",
         "sectionAppearance": "Tampilan",
         "sectionSecurity": "Keamanan",
@@ -1649,6 +1651,8 @@
         "pinAppRailDesc": "Jaga agar rel aplikasi di sidebar kiri tetap terbuka, bukan hanya saat kursor diarahkan",
         "expandAppRailOnHover": "Perluas Rel Aplikasi saat Kursor Diarahkan",
         "expandAppRailOnHoverDesc": "Izinkan rel aplikasi di sidebar kiri untuk diperluas saat kursor diarahkan",
+        "appRailHoverPushesContent": "Geser konten saat diperluas",
+        "appRailHoverPushesContentDesc": "Buat ruang untuk rel yang diperluas alih-alih menampilkannya di atas halaman. Sesi terbuka, seperti desktop jarak jauh, akan menyesuaikan ukuran setiap kali",
         "showPinAppRailButton": "Tampilkan Tombol Sematkan Rel Aplikasi",
         "showPinAppRailButtonDesc": "Tampilkan tombol di rel aplikasi untuk menyematkannya agar tetap terbuka. Nonaktif secara default.",
         "settingsNavigation": "Navigasi",
@@ -1932,6 +1936,7 @@
         "syncEntities_other": "Sinkronisasi desktop"
       },
       "consent": {
+        "enableTitle": "Aktifkan {{name}}?",
         "installTitle": "Pasang {{name}}",
         "updateTitle": "Perbarui {{name}}",
         "agreeUpdate": "Setuju dan perbarui",