release-2.9.1 (#1557)

* fix(sso): send the PKCE verifier for GitHub login (#1534)

* fix(remote-desktop): clip cursor overflow without disabling zoom (#1535)

* test(remote-desktop): preserve sessions beyond one hour (#1536)

* fix(hosts): expose controls for overflowing editor tabs (#1537)

* fix(hosts): expose controls for overflowing editor tabs

* test(hosts): mock resize observation in admin panel tests

* fix(status): skip TCP probes while host sessions are active (#1538)

* fix(database): batch session activity persistence (#1539)

* docs(api): describe cookie and API key authentication (#1540)

* fix(snippets): repair missing note column on SQLite upgrades (#1541)

* fix(docker): retain stored SSH credential association (#1543)

* fix(file-manager): render transfer toasts without plugin hooks (#1546)

* feat(hosts): keep compact row actions inline (#1547)

* fix(auth): allow retrying unavailable second-factor interfaces (#1549)

* fix(auth): reject unresolved legacy identity provisioning (#1550)

* fix(desktop): ship the plugin SDK inside Mac App Store builds (#1551)

* fix(tmux): pass full session info to the terminal's session picker (#1552)

The tmux.sessions service reduced detected sessions to bare names, but the
picker reads session.name, so every entry rendered blank and selecting one
sent an empty name, which created a new session instead of attaching.

* fix(ssh): read force keyboard-interactive as a boolean when resolving hosts (#1553)

The column holds the text "true"/"false", and the resolver passed it
through as-is. The string "false" is truthy, so the password provider
treated every saved host as forced keyboard-interactive and left the
password out. Jump hops are built straight from the resolved host, so a
password hop whose server doesn't offer keyboard-interactive failed with
"All configured authentication methods failed".

* fix(database): batch database saves for bulk host writes (#1554)

* fix(database): yield to the event loop between database saves

Each SQLite save serializes and encrypts the whole database into new
buffers, which V8 only releases once the event loop turns. Boot
migrations and bulk host import write plugin settings per host and per
key in an awaited loop, so hundreds of full copies piled up and the
container ran out of memory.

* fix(database): save once per bulk host write instead of once per row

On SQLite every repository write force-saves the whole database. Boot
plugin data migrations, host defaults materialization and the bulk
host routes write one row per host per setting, so they serialized and
encrypted the full database hundreds of times in a row.

DatabaseSaveTrigger.batched wraps a function so force saves made while
it runs collapse into a single save when it finishes. Nested scopes fold
into the outer one, and work that outlives its scope saves normally.

* feat(hosts): add instance-wide predefined tag suggestions (#1548)

* feat(hosts): add shared predefined tag suggestions

* style(hosts): format tag catalog routes

* test(database): advance fake timers past the save yield (#1555)

* fix(i18n): complete Simplified Chinese core and plugin translations (#1542)

* fix(i18n): complete Chinese onboarding and navigation labels

* fix(i18n): translate remaining Chinese core and plugin interfaces

* fix(i18n): translate host editor tab overflow controls

* fix(i18n): use consistent Chinese fleet terminology

* fix(i18n): localize hardcoded controls and plugin views

* fix(i18n): translate built-in homepage widget catalog

* test(homepage): follow translated timezone placeholder

* fix(i18n): translate plugin-provided homepage widgets

* fix(i18n): localize feature settings section titles

* fix: 2.8 oidc accounts unable to sign in after upgrading (#1381)

* fix: plugins losing the saved ssh login when copying a host (#1391)

* fix: fleets, proxmox and automations not getting the host sudo password

* fix: host imports running a defaults pass and metrics restart per host (#1384)

* fix: high cpu from status probes and full database saves on every sample (#1300)

* fix: user data export freezing the server (#1393)

* fix: op:// secret references rejected as ssh keys on credentials (#1394)

* fix: slow file deletes from the trash lookups on every delete (#1390)

* fix: add openapi docs and error handling to host tag routes

* test: compare download stream buffers directly so it stops timing out

* chore: drop em dash from host row comment

* chore: update release notes for 2.9.1

* fix: restore space to add host tags and redesign predefined tags editor

* fix: host key silently accepted when the host is missing from the database (#1397)

* fix: clearer host login failed status label and fix its translations (#1396)

* chore: add host key and status label fixes to release notes

* fix: sso and ldap provider dialogs overflowing the screen and using mismatched toggles

* chore: increment ver

* fix(audit): store plugin entries with no acting user as a null user_id (#1556)

Plugin audit entries written outside a request used the literal "system"
as user_id. That column references users.id, so the insert was refused
(Postgres logs it as an FK violation) and the entry was silently dropped.
Write null instead and keep "system" / plugin:<id> in username.

* chore: add sso/ldap dialog and audit log fixes to release notes

* fix: tunnels and host settings missing from shared hosts on desktop

* fix: remote desktop logins missing from shared hosts on desktop

* fix: simplify host status to online/offline and keep it live without a refresh

* chore: sync Crowdin translations for 2.9.1

---------

Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

plugins/step-ca/locales/en.json

@@ -44,5 +44,8 @@
       "label": "Use the old redirect URI",
       "description": "Keep sending /host/step-ca-callback, the redirect URI used before 2.9. Turn this off once your identity provider allows the new one."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/af_ZA.json

@@ -44,5 +44,8 @@
       "label": "Gebruik die ou aanstuur-URI",
       "description": "Hou aan om /host/step-ca-callback te stuur, die aanstuur-URI wat voor 2.9 gebruik is. Skakel dit af sodra jou identiteitsverskaffer die nuwe een toelaat."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ar_SA.json

@@ -44,5 +44,8 @@
       "label": "استخدم عنوان URI القديم لإعادة التوجيه",
       "description": "استمر في إرسال /host/step-ca-callback، وهو عنوان إعادة التوجيه المستخدم قبل الإصدار 2.9. قم بإيقاف تشغيل هذا بمجرد أن يسمح موفر الهوية الخاص بك بالعنوان الجديد."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/bg_BG.json

@@ -44,5 +44,8 @@
       "label": "Използвайте стария URI адрес за пренасочване",
       "description": "Продължавайте да изпращате /host/step-ca-callback, URI адресът за пренасочване, използван преди версия 2.9. Изключете това, след като вашият доставчик на идентичност разреши новия."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/bn_BD.json

@@ -44,5 +44,8 @@
       "label": "পুরানো রিডাইরেক্ট ইউআরআই ব্যবহার করুন",
       "description": "/host/step-ca-callback, অর্থাৎ ২.৯-এর আগে ব্যবহৃত রিডাইরেক্ট ইউআরআইটি পাঠানো চালিয়ে যান। আপনার আইডেন্টিটি প্রোভাইডার নতুনটির অনুমতি দিলে এটি বন্ধ করে দিন।"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ca_ES.json

@@ -44,5 +44,8 @@
       "label": "Utilitza l'URI de redirecció antiga",
       "description": "Continua enviant /host/step-ca-callback, l'URI de redirecció utilitzat abans de la versió 2.9. Desactiva-ho un cop el proveïdor d'identitat permeti el nou."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/cs_CZ.json

@@ -44,5 +44,8 @@
       "label": "Použít starý identifikátor URI pro přesměrování",
       "description": "Pokračujte v odesílání /host/step-ca-callback, což je URI pro přesměrování používané před verzí 2.9. Jakmile váš poskytovatel identity nový URI povolí, vypněte ho."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/da_DK.json

@@ -44,5 +44,8 @@
       "label": "Brug den gamle omdirigerings-URI",
       "description": "Fortsæt med at sende /host/step-ca-callback, den omdirigerings-URI, der blev brugt før 2.9. Slå dette fra, når din identitetsudbyder tillader den nye."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/de_DE.json

@@ -44,5 +44,8 @@
       "label": "Verwenden Sie die alte Umleitungs-URI.",
       "description": "Senden Sie weiterhin /host/step-ca-callback, die Umleitungs-URI, die vor Version 2.9 verwendet wurde. Deaktivieren Sie diese Funktion, sobald Ihr Identitätsanbieter die neue URI zulässt."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/el_GR.json

@@ -44,5 +44,8 @@
       "label": "Χρησιμοποιήστε το παλιό URI ανακατεύθυνσης",
       "description": "Συνεχίστε να στέλνετε το /host/step-ca-callback, το URI ανακατεύθυνσης που χρησιμοποιήθηκε πριν από την έκδοση 2.9. Απενεργοποιήστε αυτήν τη λειτουργία μόλις ο πάροχος ταυτότητάς σας επιτρέψει το νέο."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/es_ES.json

@@ -44,5 +44,8 @@
       "label": "Utilice la URI de redireccionamiento antigua",
       "description": "Sigue enviando /host/step-ca-callback, la URI de redireccionamiento que se usaba antes de la versión 2.9. Desactívala una vez que tu proveedor de identidad permita la nueva."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/fi_FI.json

@@ -44,5 +44,8 @@
       "label": "Käytä vanhaa uudelleenohjaus-URI:ta",
       "description": "Lähetä edelleen /host/step-ca-callback, ennen versiota 2.9 käytetty uudelleenohjaus-URI. Poista tämä käytöstä, kun identiteetintarjoajasi sallii uuden."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/fr_FR.json

@@ -44,5 +44,8 @@
       "label": "Utilisez l'ancienne URI de redirection",
       "description": "Continuez à envoyer /host/step-ca-callback, l'URI de redirection utilisée avant la version 2.9. Désactivez-la une fois que votre fournisseur d'identité autorisera la nouvelle."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/he_IL.json

@@ -44,5 +44,8 @@
       "label": "השתמש ב-URI להפניה הישן",
       "description": "המשך לשלוח את /host/step-ca-callback, URI ההפניה שהיה בשימוש לפני גרסה 2.9. כבה אפשרות זו לאחר שספק הזהויות שלך יאפשר את ה-URI החדש."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/hi_IN.json

@@ -44,5 +44,8 @@
       "label": "पुराने रीडायरेक्ट यूआरआई का उपयोग करें",
       "description": "पहले 2.9 से पहले इस्तेमाल होने वाले रीडायरेक्ट यूआरआई /host/step-ca-callback को भेजते रहें। जब आपका आइडेंटिटी प्रोवाइडर नए यूआरआई की अनुमति दे दे, तो इसे बंद कर दें।"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/hu_HU.json

@@ -44,5 +44,8 @@
       "label": "Használja a régi átirányítási URI-t",
       "description": "Továbbra is küldd a /host/step-ca-callback átirányítási URI-t, amely a 2.9 előtt használt. Kapcsold ki ezt, amint az identitásszolgáltatód engedélyezi az újat."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/id_ID.json

@@ -44,5 +44,8 @@
       "label": "Gunakan URI pengalihan lama.",
       "description": "Tetap kirimkan /host/step-ca-callback, URI pengalihan yang digunakan sebelum versi 2.9. Matikan ini setelah penyedia identitas Anda mengizinkan yang baru."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/it_IT.json

@@ -44,5 +44,8 @@
       "label": "Utilizzare il vecchio URI di reindirizzamento",
       "description": "Continua a inviare /host/step-ca-callback, l'URI di reindirizzamento utilizzato prima della versione 2.9. Disattivalo non appena il tuo provider di identità consentirà l'utilizzo del nuovo URI."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ja_JP.json

@@ -44,5 +44,8 @@
       "label": "古いリダイレクトURIを使用する",
       "description": "バージョン2.9以前に使用されていたリダイレクトURIである/host/step-ca-callbackを送信し続けてください。IDプロバイダーが新しいURIを許可したら、この設定を無効にしてください。"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ko_KR.json

@@ -44,5 +44,8 @@
       "label": "이전 리디렉션 URI를 사용하세요",
       "description": "2.9 이전 버전에서 사용했던 리디렉션 URI인 /host/step-ca-callback을 계속 전송하세요. ID 공급자가 새 URI를 허용하면 이 기능을 비활성화하십시오."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/nl_NL.json

@@ -44,5 +44,8 @@
       "label": "Gebruik de oude omleidings-URI",
       "description": "Blijf /host/step-ca-callback verzenden, de omleidings-URI die vóór versie 2.9 werd gebruikt. Schakel dit uit zodra uw identiteitsprovider de nieuwe URI toestaat."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/no_NO.json

@@ -44,5 +44,8 @@
       "label": "Bruk den gamle omdirigerings-URI-en",
       "description": "Fortsett å sende /host/step-ca-callback, omdirigerings-URI-en som ble brukt før 2.9. Slå av dette når identitetsleverandøren din tillater den nye."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/pl_PL.json

@@ -44,5 +44,8 @@
       "label": "Użyj starego adresu URI przekierowania",
       "description": "Nadal wysyłaj /host/step-ca-callback, czyli URI przekierowania używane przed wersją 2.9. Wyłącz tę opcję, gdy Twój dostawca tożsamości zezwoli na nową."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/pt_BR.json

@@ -44,5 +44,8 @@
       "label": "Use o URI de redirecionamento antigo",
       "description": "Continue enviando /host/step-ca-callback, o URI de redirecionamento usado antes da versão 2.9. Desative-o assim que seu provedor de identidade permitir o novo."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/pt_PT.json

@@ -44,5 +44,8 @@
       "label": "Utilize o URI de redirecionamento antigo",
       "description": "Continue a enviar /host/step-ca-callback, o URI de redireccionamento utilizado antes da versão 2.9. Desative-o assim que o seu fornecedor de identidade permitir o novo."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ro_RO.json

@@ -44,5 +44,8 @@
       "label": "Folosește vechiul URI de redirecționare",
       "description": "Continuă să trimiți /host/step-ca-callback, URI-ul de redirecționare folosit înainte de versiunea 2.9. Dezactivează această opțiune odată ce furnizorul de identitate îl permite pe cel nou."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/ru_RU.json

@@ -44,5 +44,8 @@
       "label": "Используйте старый URI перенаправления.",
       "description": "Продолжайте отправлять /host/step-ca-callback, URI перенаправления, использовавшийся до версии 2.9. Отключите эту функцию, как только ваш поставщик идентификации разрешит использование нового URI."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/sr_SP.json

@@ -44,5 +44,8 @@
       "label": "Користите стари URI за преусмеравање",
       "description": "Наставите да шаљете /host/step-ca-callback, URI за преусмеравање који је коришћен пре верзије 2.9. Искључите ово када ваш добављач идентитета дозволи нови."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/sv_SE.json

@@ -44,5 +44,8 @@
       "label": "Använd den gamla omdirigerings-URI:n",
       "description": "Fortsätt skicka /host/step-ca-callback, den omdirigerings-URI som användes före version 2.9. Stäng av detta när din identitetsleverantör tillåter den nya."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/th_TH.json

@@ -44,5 +44,8 @@
       "label": "ใช้ URI การเปลี่ยนเส้นทางแบบเดิม",
       "description": "ส่ง /host/step-ca-callback ต่อไป ซึ่งเป็น URI สำหรับการเปลี่ยนเส้นทางที่ใช้ก่อนเวอร์ชัน 2.9 ปิดใช้งานเมื่อผู้ให้บริการยืนยันตัวตนของคุณอนุญาตให้ใช้ URI ใหม่แล้ว"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/tr_TR.json

@@ -44,5 +44,8 @@
       "label": "Eski yönlendirme URI'sini kullanın.",
       "description": "2.9 öncesinde kullanılan yönlendirme URI'si olan /host/step-ca-callback'i göndermeye devam edin. Kimlik sağlayıcınız yenisine izin verdiğinde bunu kapatın."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/uk_UA.json

@@ -44,5 +44,8 @@
       "label": "Використовувати старий URI перенаправлення",
       "description": "Продовжуйте надсилати /host/step-ca-callback, URI перенаправлення, який використовувався до версії 2.9. Вимкніть цю функцію, щойно ваш постачальник ідентифікаційних даних дозволить новий."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/vi_VN.json

@@ -44,5 +44,8 @@
       "label": "Sử dụng URI chuyển hướng cũ.",
       "description": "Tiếp tục gửi /host/step-ca-callback, URI chuyển hướng được sử dụng trước phiên bản 2.9. Tắt chức năng này khi nhà cung cấp định danh của bạn cho phép sử dụng URI mới."
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/zh_CN.json

@@ -44,5 +44,8 @@
       "label": "使用旧的重定向 URI",
       "description": "继续发送 /host/step-ca-callback，这是 2.9 版本之前使用的重定向 URI。一旦您的身份提供商允许使用新的重定向 URI，就将其关闭。"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }

plugins/step-ca/locales/translated/zh_TW.json

@@ -44,5 +44,8 @@
       "label": "使用舊的重定向 URI",
       "description": "繼續發送 /host/step-ca-callback，這是 2.9 版本之前使用的重定向 URI。一旦您的身分提供者允許使用新的重定向 URI，就將其關閉。"
     }
+  },
+  "plugin": {
+    "name": "Step CA"
   }
 }