release-2.9.1 (#1557)

* fix(sso): send the PKCE verifier for GitHub login (#1534)

* fix(remote-desktop): clip cursor overflow without disabling zoom (#1535)

* test(remote-desktop): preserve sessions beyond one hour (#1536)

* fix(hosts): expose controls for overflowing editor tabs (#1537)

* fix(hosts): expose controls for overflowing editor tabs

* test(hosts): mock resize observation in admin panel tests

* fix(status): skip TCP probes while host sessions are active (#1538)

* fix(database): batch session activity persistence (#1539)

* docs(api): describe cookie and API key authentication (#1540)

* fix(snippets): repair missing note column on SQLite upgrades (#1541)

* fix(docker): retain stored SSH credential association (#1543)

* fix(file-manager): render transfer toasts without plugin hooks (#1546)

* feat(hosts): keep compact row actions inline (#1547)

* fix(auth): allow retrying unavailable second-factor interfaces (#1549)

* fix(auth): reject unresolved legacy identity provisioning (#1550)

* fix(desktop): ship the plugin SDK inside Mac App Store builds (#1551)

* fix(tmux): pass full session info to the terminal's session picker (#1552)

The tmux.sessions service reduced detected sessions to bare names, but the
picker reads session.name, so every entry rendered blank and selecting one
sent an empty name, which created a new session instead of attaching.

* fix(ssh): read force keyboard-interactive as a boolean when resolving hosts (#1553)

The column holds the text "true"/"false", and the resolver passed it
through as-is. The string "false" is truthy, so the password provider
treated every saved host as forced keyboard-interactive and left the
password out. Jump hops are built straight from the resolved host, so a
password hop whose server doesn't offer keyboard-interactive failed with
"All configured authentication methods failed".

* fix(database): batch database saves for bulk host writes (#1554)

* fix(database): yield to the event loop between database saves

Each SQLite save serializes and encrypts the whole database into new
buffers, which V8 only releases once the event loop turns. Boot
migrations and bulk host import write plugin settings per host and per
key in an awaited loop, so hundreds of full copies piled up and the
container ran out of memory.

* fix(database): save once per bulk host write instead of once per row

On SQLite every repository write force-saves the whole database. Boot
plugin data migrations, host defaults materialization and the bulk
host routes write one row per host per setting, so they serialized and
encrypted the full database hundreds of times in a row.

DatabaseSaveTrigger.batched wraps a function so force saves made while
it runs collapse into a single save when it finishes. Nested scopes fold
into the outer one, and work that outlives its scope saves normally.

* feat(hosts): add instance-wide predefined tag suggestions (#1548)

* feat(hosts): add shared predefined tag suggestions

* style(hosts): format tag catalog routes

* test(database): advance fake timers past the save yield (#1555)

* fix(i18n): complete Simplified Chinese core and plugin translations (#1542)

* fix(i18n): complete Chinese onboarding and navigation labels

* fix(i18n): translate remaining Chinese core and plugin interfaces

* fix(i18n): translate host editor tab overflow controls

* fix(i18n): use consistent Chinese fleet terminology

* fix(i18n): localize hardcoded controls and plugin views

* fix(i18n): translate built-in homepage widget catalog

* test(homepage): follow translated timezone placeholder

* fix(i18n): translate plugin-provided homepage widgets

* fix(i18n): localize feature settings section titles

* fix: 2.8 oidc accounts unable to sign in after upgrading (#1381)

* fix: plugins losing the saved ssh login when copying a host (#1391)

* fix: fleets, proxmox and automations not getting the host sudo password

* fix: host imports running a defaults pass and metrics restart per host (#1384)

* fix: high cpu from status probes and full database saves on every sample (#1300)

* fix: user data export freezing the server (#1393)

* fix: op:// secret references rejected as ssh keys on credentials (#1394)

* fix: slow file deletes from the trash lookups on every delete (#1390)

* fix: add openapi docs and error handling to host tag routes

* test: compare download stream buffers directly so it stops timing out

* chore: drop em dash from host row comment

* chore: update release notes for 2.9.1

* fix: restore space to add host tags and redesign predefined tags editor

* fix: host key silently accepted when the host is missing from the database (#1397)

* fix: clearer host login failed status label and fix its translations (#1396)

* chore: add host key and status label fixes to release notes

* fix: sso and ldap provider dialogs overflowing the screen and using mismatched toggles

* chore: increment ver

* fix(audit): store plugin entries with no acting user as a null user_id (#1556)

Plugin audit entries written outside a request used the literal "system"
as user_id. That column references users.id, so the insert was refused
(Postgres logs it as an FK violation) and the entry was silently dropped.
Write null instead and keep "system" / plugin:<id> in username.

* chore: add sso/ldap dialog and audit log fixes to release notes

* fix: tunnels and host settings missing from shared hosts on desktop

* fix: remote desktop logins missing from shared hosts on desktop

* fix: simplify host status to online/offline and keep it live without a refresh

* chore: sync Crowdin translations for 2.9.1

---------

Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

plugins/secret-sources/locales/en.json

@@ -23,5 +23,8 @@
         "description": "Private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its own address listed here."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/af_ZA.json

@@ -23,5 +23,8 @@
         "description": "Privaat of teruglusgashere wat 'n geheime bron mag bereik, een per lyn. 'n Selfgehosteerde 1Password Connect-bediener benodig gewoonlik sy eie adres wat hier gelys word."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ar_SA.json

@@ -23,5 +23,8 @@
         "description": "قد يصل مصدر سري إلى مضيفات خاصة أو مضيفات ذات اتصال داخلي، واحد لكل سطر. عادةً ما يحتاج خادم 1Password Connect المستضاف ذاتيًا إلى عنوانه الخاص المدرج هنا."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/bg_BG.json

@@ -23,5 +23,8 @@
         "description": "Частни или loopback хостове, до които може да достигне таен източник, по един на ред. Самостоятелно хостван 1Password Connect сървър обикновено се нуждае от собствен адрес, посочен тук."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/bn_BD.json

@@ -23,5 +23,8 @@
         "description": "একটি গোপন উৎস যেসব প্রাইভেট বা লুপব্যাক হোস্টে পৌঁছাতে পারে, প্রতি লাইনে একটি করে। একটি সেলফ-হোস্টেড 1Password Connect সার্ভারের জন্য সাধারণত এখানে তার নিজস্ব ঠিকানা তালিকাভুক্ত করার প্রয়োজন হয়।"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ca_ES.json

@@ -23,5 +23,8 @@
         "description": "Amfitrions privats o de bucle que una font secreta pot assolir, un per línia. Un servidor 1Password Connect autoallotjat normalment necessita la seva pròpia adreça llistada aquí."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/cs_CZ.json

@@ -23,5 +23,8 @@
         "description": "Soukromé nebo zpětně loopbackové hostitele, na které může tajný zdroj dosáhnout, jeden na řádek. Samostatně hostovaný server 1Password Connect zde obvykle potřebuje uvedenou vlastní adresu."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/da_DK.json

@@ -23,5 +23,8 @@
         "description": "Private eller loopback-værter, som en hemmelig kilde kan nå, én pr. linje. En selvhostet 1Password Connect-server skal normalt have sin egen adresse angivet her."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/de_DE.json

@@ -23,5 +23,8 @@
         "description": "Private oder Loopback-Hosts, die eine geheime Quelle erreichen kann, jeweils einer pro Zeile. Ein selbst gehosteter 1Password Connect-Server benötigt in der Regel eine eigene Adresse, die hier aufgeführt wird."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/el_GR.json

@@ -23,5 +23,8 @@
         "description": "Ιδιωτικοί ή loopback hosts στους οποίους μπορεί να φτάσει μια μυστική πηγή, ένας ανά γραμμή. Ένας αυτοφιλοξενούμενος διακομιστής 1Password Connect συνήθως χρειάζεται τη δική του διεύθυνση να αναφέρεται εδώ."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/es_ES.json

@@ -23,5 +23,8 @@
         "description": "Hosts privados o de bucle invertido a los que puede acceder una fuente secreta, uno por línea. Un servidor 1Password Connect autohospedado generalmente necesita su propia dirección IP que aparezca aquí."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/fi_FI.json

@@ -23,5 +23,8 @@
         "description": "Yksityiset tai loopback-isännät, joihin salainen lähde voi tavoittaa, yksi riviä kohden. Itse isännöity 1Password Connect -palvelin tarvitsee yleensä oman osoitteensa, joka luetellaan tässä."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/fr_FR.json

@@ -23,5 +23,8 @@
         "description": "Hôtes privés ou de bouclage auxquels une source secrète peut accéder, un par ligne. Un serveur 1Password Connect auto-hébergé nécessite généralement sa propre adresse indiquée ici."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/he_IL.json

@@ -23,5 +23,8 @@
         "description": "מארחים פרטיים או לולאה-חוזרים אליהם מקור סודי עשוי להגיע, אחד בכל שורה. שרת 1Password Connect המתארח באופן עצמאי זקוק בדרך כלל לכתובת משלו הרשומה כאן."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/hi_IN.json

@@ -23,5 +23,8 @@
         "description": "निजी या लूपबैक होस्ट तक एक गुप्त स्रोत पहुंच सकता है, प्रति पंक्ति एक। एक स्व-होस्टेड 1Password Connect सर्वर को आमतौर पर यहां अपना पता सूचीबद्ध करने की आवश्यकता होती है।"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/hu_HU.json

@@ -23,5 +23,8 @@
         "description": "Privát vagy visszacsatolásos hosztok, amelyeket egy titkos forrás elérhet, soronként egy. Egy saját hosztolt 1Password Connect szervernek általában saját címre van szüksége, amely itt szerepel."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/id_ID.json

@@ -23,5 +23,8 @@
         "description": "Host privat atau loopback yang dapat dijangkau oleh sumber rahasia, satu per baris. Server 1Password Connect yang dihosting sendiri biasanya memerlukan alamatnya sendiri yang tercantum di sini."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/it_IT.json

@@ -23,5 +23,8 @@
         "description": "Host privati o di loopback raggiungibili da una fonte segreta, uno per riga. Un server 1Password Connect self-hosted di solito necessita di un proprio indirizzo elencato qui."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ja_JP.json

@@ -23,5 +23,8 @@
         "description": "秘密情報源がアクセスできるプライベートホストまたはループバックホストを、1行に1つずつ記述します。自己ホスト型の1Password Connectサーバーの場合、通常はここに独自のIPアドレスを記載する必要があります。"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ko_KR.json

@@ -23,5 +23,8 @@
         "description": "비밀 소스가 접근할 수 있는 개인 또는 루프백 호스트를 한 줄에 하나씩 나열합니다. 자체 호스팅 1Password Connect 서버는 일반적으로 여기에 자체 주소를 나열해야 합니다."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/nl_NL.json

@@ -23,5 +23,8 @@
         "description": "Privé- of loopback-hosts die een geheime bron kunnen bereiken, één per regel. Een zelfgehoste 1Password Connect-server heeft meestal een eigen adres nodig dat hier vermeld moet worden."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/no_NO.json

@@ -23,5 +23,8 @@
         "description": "Private verter eller loopback-verter en hemmelig kilde kan nå, én per linje. En selvhostet 1Password Connect-server trenger vanligvis sin egen adresse oppført her."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/pl_PL.json

@@ -23,5 +23,8 @@
         "description": "Prywatne lub zwrotne hosty, do których może dotrzeć tajne źródło, po jednym na linię. Samodzielnie hostowany serwer 1Password Connect zazwyczaj wymaga podania tutaj własnego adresu."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/pt_BR.json

@@ -23,5 +23,8 @@
         "description": "Hosts privados ou de loopback que uma fonte secreta pode acessar, um por linha. Um servidor 1Password Connect autohospedado geralmente precisa ter seu próprio endereço listado aqui."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/pt_PT.json

@@ -23,5 +23,8 @@
         "description": "Hosts privados ou de loopback a que uma fonte secreta pode aceder, um por linha. Um servidor 1Password Connect auto-hospedado precisa geralmente de ter o seu próprio endereço listado aqui."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ro_RO.json

@@ -23,5 +23,8 @@
         "description": "Gazde private sau loopback la care poate ajunge o sursă secretă, câte una pe linie. Un server 1Password Connect auto-găzduit are nevoie de obicei de propria adresă listată aici."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/ru_RU.json

@@ -23,5 +23,8 @@
         "description": "Доступ к секретному источнику может осуществляться через частные или замыкающие хосты, по одному на строку. Самостоятельно размещенному серверу 1Password Connect обычно требуется собственный адрес, указанный здесь."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/sr_SP.json

@@ -23,5 +23,8 @@
         "description": "Приватни или loopback хостови које тајни извор може досегнути, по један у сваком реду. Самостално хостовани 1Password Connect сервер обично захтева сопствену адресу наведену овде."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/sv_SE.json

@@ -23,5 +23,8 @@
         "description": "Privata eller loopback-värdar som en hemlig källa kan nå, en per rad. En självhostad 1Password Connect-server behöver vanligtvis sin egen adress listad här."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/th_TH.json

@@ -23,5 +23,8 @@
         "description": "โฮสต์ส่วนตัวหรือโฮสต์แบบลูปแบ็กที่แหล่งข้อมูลลับสามารถเข้าถึงได้ หนึ่งโฮสต์ต่อบรรทัด โดยปกติแล้วเซิร์ฟเวอร์ 1Password Connect ที่ติดตั้งเองจะต้องมีที่อยู่ของตัวเองระบุไว้ที่นี่"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/tr_TR.json

@@ -23,5 +23,8 @@
         "description": "Gizli bir kaynağın erişebileceği özel veya geri döngü sunucuları, her satıra bir tane. Kendi kendine barındırılan bir 1Password Connect sunucusunun genellikle burada listelenen kendi adresine ihtiyacı vardır."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/uk_UA.json

@@ -23,5 +23,8 @@
         "description": "Приватні або петлеві хости, до яких може звернутися секретне джерело, по одному на рядок. Власному серверу 1Password Connect зазвичай потрібна власна адреса, вказана тут."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/vi_VN.json

@@ -23,5 +23,8 @@
         "description": "Các máy chủ riêng tư hoặc máy chủ vòng lặp mà nguồn bí mật có thể truy cập được, mỗi dòng một máy chủ. Máy chủ 1Password Connect tự lưu trữ thường cần có địa chỉ riêng được liệt kê ở đây."
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/zh_CN.json

@@ -23,5 +23,8 @@
         "description": "私有或回环地址，秘密来源可以访问，每行一个。自托管的 1Password Connect 服务器通常需要在此处列出其自己的地址。"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }

plugins/secret-sources/locales/translated/zh_TW.json

@@ -23,5 +23,8 @@
         "description": "私有或回環位址，秘密來源可以訪問，每行一個。自託管的 1Password Connect 伺服器通常需要在此列出自己的位址。"
       }
     }
+  },
+  "plugin": {
+    "name": "Secret Sources"
   }
 }