v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view * feat: move the classic layout into its own bundled plugin * feat: move color themes into a bundled themes plugin * fix: plugin tests and type checks work with a linked sdk * fix: home tab, layout switch and missing layout fallbacks for looks * chore: add classic layout and themes to the readme * chore: drop example plugin links from the plugin guide * feat: plugin filters by type, paged browse, hide plugins needing newer termix * feat: move desktop, status, import, audit and branding features into plugins * feat: host lock api so a plugin can load hosts from a config file (#1581) * chore: add hosts config to the plugin table * feat: login policy hook for plugins and optional https redirect (#1584) * chore: add login security to the plugin table * feat: api key socket tickets so a master can open remote sessions (#1654) * feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654) * chore: add sync to the plugin table * feat: move the sync screens and wizard out of core into the plugin (#1580) * fix: add a neutral linked desktop hook for plugins (#1580) * fix: show the linked account's name and admin flag in the app (#1580) * feat: ssh transport providers, core ssh relay and plugin folders api * feat: support FIDO2 security keys through ssh agent * feat: add companion panels beside host tabs * feat: mTLS client certificates for desktop server links * feat: native web view for plugins in the desktop app * fix: detect the desktop link window by Electron's default user agent Fixes #1675 * fix: changelog for desktop link fix * fix: keep text primary keys in the plugin data export * fix: ship sharp binaries for Windows arm64 builds * feat: client cert on the sync link types (sdk 1.0.18) * chore: update translations * feat: themed title bar for the desktop app (#1690) * chore: changelog for the themed title bar * fix: draw the title bar in the sidebar color * feat: per host layout for the terminal panel bar * chore: sdk 1.0.19 for the panel bar layout * chore: bundle all 43 plugins for 26.10.3 * chore: update translations --------- Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com> Co-authored-by: Giovanny Aranda <garanda21@gmail.com>
2026-10-28 06:05:24 +00:00 · 2026-10-20 16:03:29 -05:00
1 parent aff29a9581
commit a89ccc6b07
@@ -276,6 +276,33 @@ describe("pinsFromIndex", () => {
    expect(pins[0]).not.toHaveProperty("onboarding");
  });

+  it("pins a release kept in gated", () => {
+    const pins = pinsFromIndex(
+      {
+        plugins: [
+          {
+            id: "look",
+            versions: [],
+            gated: [
+              {
+                version: "1.1.0-beta.1",
+                url: "https://example.test/look-1.1.0-beta.1.tmxplug",
+                sha256: "d".repeat(64),
+              },
+              {
+                version: "1.0.0",
+                url: "https://example.test/look-1.0.0.tmxplug",
+                sha256: "e".repeat(64),
+              },
+            ],
+          },
+        ],
+      },
+      null,
+    );
+    expect(pins[0].url).toBe("https://example.test/look-1.0.0.tmxplug");
+  });
+
  it("pins only the ids asked for", () => {
    expect(pinsFromIndex(index, ["beta"]).map((pin) => pin.id)).toEqual([
      "beta",
@@ -416,3 +443,71 @@ describe("rebuilding local plugins", () => {
    expect(run.sort()).toEqual(["a", "b"]);
  });
 });
+
+describe("default look", () => {
+  const entry = { source: "tmxplug", path: "a", sha256: SHA };
+
+  it("reads the defaultLook flag and refuses anything but a boolean", () => {
+    const { plugins, problems } = parseBundledPlugins({
+      plugins: [
+        { ...entry, id: "look", defaultLook: true },
+        { ...entry, id: "plain" },
+        { ...entry, id: "odd", defaultLook: "yes" },
+      ],
+    });
+    expect(problems).toEqual(["odd defaultLook must be a boolean"]);
+    expect(
+      plugins.map((p: { id: string; defaultLook: boolean }) => [
+        p.id,
+        p.defaultLook,
+      ]),
+    ).toEqual([
+      ["look", true],
+      ["plain", false],
+    ]);
+  });
+
+  it("carries it into the bundled index and through a re-pin", () => {
+    expect(
+      buildBundledIndex(
+        [
+          { id: "look", onboarding: null, defaultLook: true },
+          { id: "plain", onboarding: null, defaultLook: false },
+        ],
+        ["look", "plain"],
+      ),
+    ).toEqual({ version: 1, plugins: { look: { defaultLook: true } } });
+
+    const index = {
+      plugins: [
+        {
+          id: "look",
+          versions: [
+            { version: "1.0.0", url: "https://x/l.tmxplug", sha256: SHA },
+          ],
+        },
+      ],
+    };
+    expect(
+      pinsFromIndex(index, null, [{ id: "look", defaultLook: true }])[0],
+    ).toMatchObject({ id: "look", defaultLook: true });
+  });
+
+  it("copies a local build's theme files", () => {
+    const repo = tempDir();
+    fs.mkdirSync(path.join(repo, "dist"), { recursive: true });
+    fs.mkdirSync(path.join(repo, "themes"), { recursive: true });
+    fs.writeFileSync(path.join(repo, "dist", "backend.js"), "export {}");
+    fs.writeFileSync(path.join(repo, "themes", "paper.css"), ".paper{}");
+    fs.writeFileSync(
+      path.join(repo, "manifest.json"),
+      JSON.stringify({
+        id: "inks",
+        contributes: { themes: [{ id: "paper", css: "themes/paper.css" }] },
+      }),
+    );
+    const out = path.join(tempDir(), "inks");
+    copyLocalBuild(repo, out);
+    expect(fs.existsSync(path.join(out, "themes", "paper.css"))).toBe(true);
+  });
+});
@@ -32,12 +32,18 @@ const OFFICIAL_IDS = [
  "acme-ssl",
  "ai",
  "alerts",
+  "audit-tools",
  "automations",
+  "classic-layout",
+  "classic-themes",
+  "credential-tools",
  "docker",
  "file-manager",
  "fleets",
  "homepage",
  "host-metrics",
+  "host-status",
+  "import-export",
  "ldap",
  "network-topology",
  "opkssh",
@@ -19,8 +19,13 @@ const SDK_UI = path.join(ROOT, "src", "ui", "plugin-host", "sdk-ui.ts");
 const TSCONFIG = path.join(ROOT, "tsconfig.app.json");

 const ALLOWED = [
+  "ACCENT_PRESET_COLORS",
+  "APP_VERSION",
+  "AccessRecord",
  "ActionSlot",
+  "ActiveSessionInfo",
  "AddButton",
+  "AdminSection",
  "Alert",
  "AlertDescription",
  "AlertDialog",
@@ -35,14 +40,23 @@ const ALLOWED = [
  "AlertDialogTitle",
  "AlertDialogTrigger",
  "AlertTitle",
+  "ApiKey",
+  "AuditLog",
+  "AuditLogFilters",
+  "AuthEnrollmentSections",
+  "AuthOverrideProtocol",
  "BackButton",
  "Badge",
  "BarSeries",
  "BarSeriesItem",
  "BarSeriesProps",
+  "BrandingSettings",
  "BrowserSignInDialog",
  "Button",
  "ButtonProps",
+  "CORE_HOST_DEFAULTS",
+  "CORE_NAMESPACE",
+  "CREDENTIAL_ROW_FIELD_KEYS",
  "Card",
  "CardAction",
  "CardContent",
@@ -54,6 +68,12 @@ const ALLOWED = [
  "CardTitle",
  "Checkbox",
  "ColumnCountStepper",
+  "Command",
+  "CommandEmpty",
+  "CommandGroup",
+  "CommandItem",
+  "CommandList",
+  "CommandPrimitive",
  "ComponentSlot",
  "ConfirmOptions",
  "ConnectionGate",
@@ -66,9 +86,26 @@ const ALLOWED = [
  "ConnectionStage",
  "ConnectionStatus",
  "ConnectionUnavailable",
+  "CreatedApiKey",
+  "Credential",
+  "CredentialDensity",
+  "CredentialPermissionLevel",
+  "CredentialRowFields",
+  "CredentialSidebarFilterState",
+  "CredentialSidebarPreferences",
+  "CredentialSortKey",
+  "CredentialTrayTrigger",
  "CustomKeybinding",
+  "DASHBOARD_CARDS",
+  "DEFAULT_FOLDER_COLOR",
+  "DEFAULT_FOLDER_ICON",
+  "DashboardCardId",
  "DataColumn",
  "DataView",
+  "DefaultOverrides",
+  "DefaultsOnly",
+  "DesktopUpdateMode",
+  "DesktopUpdateState",
  "Dialog",
  "DialogClose",
  "DialogContent",
@@ -81,6 +118,7 @@ const ALLOWED = [
  "DialogTrigger",
  "DocsLink",
  "DocsLinkProps",
+  "DocsPage",
  "DropdownMenu",
  "DropdownMenuCheckboxItem",
  "DropdownMenuContent",
@@ -99,10 +137,14 @@ const ALLOWED = [
  "EditingWidth",
  "EmptyState",
  "FOLDER_COLORS",
+  "FONT_SIZES",
  "Facts",
  "FakeSwitch",
  "Field",
  "FieldPair",
+  "FolderAccessRule",
+  "FolderIconEl",
+  "FontSizeId",
  "FormFooter",
  "FullScreenAppPhase",
  "FullScreenAppWrapper",
@@ -112,11 +154,36 @@ const ALLOWED = [
  "GridLayout",
  "GridSlot",
  "GroupHeading",
+  "HexColorPicker",
+  "Host",
+  "HostActionDef",
+  "HostClickBehavior",
+  "HostData",
  "HostDefaultBadge",
  "HostDefaultField",
+  "HostDefaultsChange",
+  "HostDefaultsContext",
+  "HostDefaultsContextValue",
+  "HostDefaultsLevel",
+  "HostDefaultsTarget",
+  "HostDensity",
  "HostFeatureFields",
+  "HostLock",
+  "HostPolicy",
+  "HttpsSettings",
  "HostFeatureFieldsProps",
+  "HostFolder",
+  "HostGroupKey",
  "HostKeyVerificationDialog",
+  "HostOnly",
+  "HostProtocolAuthInput",
+  "HostProtocolDef",
+  "HostProtocols",
+  "HostRowFields",
+  "HostSidebarFilterState",
+  "HostSidebarPreferences",
+  "HostTrayTrigger",
+  "IconPicker",
  "InlineView",
  "Input",
  "Kbd",
@@ -124,10 +191,13 @@ const ALLOWED = [
  "KbdSeparator",
  "KeyCombo",
  "KeybindingAction",
+  "KeybindingActionDef",
  "KeybindingActionType",
+  "LANGUAGES",
  "Label",
  "LineChart",
  "LineChartSeries",
+  "LinkedAccountInfo",
  "ListBadge",
  "ListRow",
  "ListRowAction",
@@ -135,19 +205,29 @@ const ALLOWED = [
  "ListRowTone",
  "LogContext",
  "LogEntry",
+  "LookSettings",
+  "MANAGE_REQUEST_EVENT",
+  "MAX_PANES",
  "MFAPromptMode",
+  "ManageMode",
+  "ManageRequest",
  "ManagerCardError",
  "ManagerCardShell",
  "ManagerSearch",
  "Meter",
  "MetricCard",
  "MiniStat",
+  "NativeView",
+  "NativeViewProps",
  "NumberField",
+  "OPEN_PLUGINS_EVENT",
+  "OpenTabRecord",
  "PANEL",
-  "PanePrompt",
  "PROMPT_BUTTON",
  "PROMPT_DESTRUCTIVE_BUTTON",
  "PROMPT_PRIMARY_BUTTON",
+  "PaletteItemDef",
+  "PanePrompt",
  "PanelDensity",
  "PanelList",
  "PanelSearch",
@@ -155,18 +235,35 @@ const ALLOWED = [
  "PanelViewMode",
  "PassphraseDialog",
  "PasswordInput",
+  "PermissionCatalogEntry",
  "PluginComponent",
+  "PRESETS",
+  "PluginIcon",
+  "PluginSettingsErrors",
+  "PluginSettingsField",
+  "PluginSettingsValidationError",
+  "PluginSummary",
  "PluginViewPlaceholder",
  "Popover",
  "PopoverAnchor",
  "PopoverContent",
  "PopoverTrigger",
+  "ProxyNode",
  "RadialGauge",
  "RadialGaugeProps",
+  "RailGroup",
+  "RailItemDef",
  "RecentActivityItem",
+  "ReleaseInfo",
  "Repeater",
+  "ResolvedHostDefault",
  "RobustClipboardProvider",
+  "Role",
  "SSHAuthDialog",
+  "SSHHost",
+  "SSHHostData",
+  "SSHHostWithStatus",
+  "SSH_AUTH_PROTOCOL",
  "ScrollArea",
  "ScrollBar",
  "SecretField",
@@ -186,6 +283,9 @@ const ALLOWED = [
  "SelectValue",
  "Separator",
  "SettingRow",
+  "SettingsFieldRow",
+  "SharePermissionLevel",
+  "ShareTarget",
  "Sheet",
  "SheetClose",
  "SheetContent",
@@ -194,74 +294,363 @@ const ALLOWED = [
  "SheetHeader",
  "SheetTitle",
  "SheetTrigger",
+  "ShellConfirmCapture",
  "Skeleton",
  "Slider",
+  "SortKey",
  "Sparkline",
  "SparklineProps",
+  "SplitLayoutMenu",
+  "SplitOpenTarget",
+  "SplitSummary",
  "StatRow",
+  "StatusValue",
  "SurfaceKind",
  "SurfaceScope",
  "Switch",
  "SwitchRow",
  "TOTPDialog",
+  "Tab",
+  "TabShellCallbacks",
+  "TabSplitAction",
+  "TabStage",
  "TabStrip",
  "TabStripItem",
+  "TabType",
  "TagInput",
  "TextAreaField",
  "TextField",
  "Textarea",
  "TextareaProps",
+  "ThemeId",
+  "TlsStatus",
+  "ToolsTab",
  "Tooltip",
  "TooltipContent",
  "TooltipProvider",
  "TooltipTrigger",
+  "UI_AREA_KEYS",
+  "UI_FONTS",
+  "UiAreaKey",
+  "UiFontId",
+  "UiPreset",
+  "UpdateChannelState",
  "UptimeInfo",
  "UsagePair",
+  "UserPreferences",
+  "UserRole",
+  "UserSecondFactorSummary",
+  "VersionBadge",
  "VersionInfo",
  "ViewToggle",
  "WebSocketConnectionTarget",
  "WidgetTitle",
+  "actionOrder",
+  "activityTarget",
+  "adminCreateUser",
+  "adminCreateUserCredential",
+  "adminCreateUserHost",
+  "adminDeleteUserCredential",
+  "adminDeleteUserHost",
+  "adminExportUserData",
+  "adminGetHostPassword",
+  "adminGetUserCredentials",
+  "adminGetUserHosts",
+  "adminResetUserPassword",
+  "adminUpdateUserCredential",
+  "adminUpdateUserHost",
+  "applyAccentColor",
+  "applyFontSize",
+  "applyPresetSideEffects",
+  "applyUiFont",
+  "assignRoleToUser",
+  "beginSplitDrag",
  "buildOriginWsUrl",
+  "bulkUpdateSSHHosts",
+  "canConfigureUpdates",
+  "canJoinSplit",
+  "changeAppLanguage",
+  "changePassword",
+  "clearLocalAdaptivePreferences",
  "cn",
  "copyToClipboard",
+  "createApiKey",
+  "createCredential",
  "createFrontendLogger",
  "createQuickConnectHost",
+  "createRole",
+  "createSSHHost",
+  "defaultConnectAction",
+  "defaultCredentialRowFields",
+  "defaultCredentialSidebarPreferences",
+  "defaultHostRowFields",
+  "defaultHostSidebarPreferences",
+  "defaultValuesEqual",
+  "deleteAccount",
+  "deleteAllHostsInFolder",
+  "deleteApiKey",
+  "deleteCredential",
+  "deleteOpenTab",
+  "deleteRole",
+  "deleteSSHHost",
+  "deleteUser",
+  "desktopUpdates",
+  "docsUrl",
+  "duplicateCredential",
+  "enabledHostProtocols",
+  "endSplitDrag",
+  "filterPaletteItems",
+  "findCoreHostDefault",
  "findMatchingKeybinding",
+  "getActiveSessions",
  "getAdaptiveResourceBudget",
+  "getApiKeys",
+  "getAuditLogActions",
+  "getAuditLogs",
  "getBasePath",
+  "getBranding",
+  "getChannelReleases",
+  "getConnectedRemoteApi",
+  "getCredentialAccess",
+  "getCredentialDetails",
+  "getCredentialSidebarPreferences",
+  "getCredentials",
  "getDatabaseHealth",
+  "getDatabaseTransferUrl",
+  "getDefaultConnectionTab",
+  "getDeveloperMode",
  "getDeviceId",
+  "getErrorMessage",
+  "getExternalAutoProvision",
+  "getFolderAccess",
+  "getFolderDefaultsId",
+  "getHostAccess",
+  "getHostAuthOverride",
+  "getHostDefaultsLevel",
+  "getHostEditorSection",
+  "getHostPassword",
+  "getHostPolicy",
+  "getHostSidebarPreferences",
+  "getHostTags",
+  "getLiveHostStatus",
+  "getHttpsSettings",
+  "getLogLevel",
+  "getNotificationPrivateEndpoints",
+  "getPanel",
+  "getPasswordLoginAllowed",
+  "getPasswordResetAllowed",
+  "getPermissionsCatalog",
+  "getPluginAdminSettings",
+  "getPluginHostSettings",
+  "getPluginUserSettings",
+  "getPlugins",
  "getPollingEnvironmentMultiplier",
+  "getPreferredHostAction",
  "getRecentActivity",
+  "getRegisteredDashboardCard",
+  "getRegistrationAllowed",
+  "getRoles",
+  "getSSHFolders",
+  "getSSHHosts",
+  "getSecondFactorAfterExternalLogin",
+  "getSessionTimeout",
+  "getSessionTimeoutMinutes",
+  "getSessions",
+  "getStatusCheckSettings",
+  "getStatusClasses",
+  "getTabType",
+  "getTlsStatus",
+  "getUpdateChannel",
  "getUptime",
+  "getUserInfo",
+  "getUserList",
+  "getUserPreferences",
+  "getUserRoles",
+  "getUserSecondFactors",
  "getVersionInfo",
  "globalShortcutHandler",
+  "groupRailItems",
+  "hasVisibleFields",
+  "hostActionsFor",
+  "hostBadgesFor",
+  "hostEditorToolbarItemsFor",
+  "hostMenuItemsFor",
+  "hostProtocolFlags",
+  "hostStatusIndicatorsFor",
  "hydrateLocalSharedHostAuth",
+  "invalidateHostsAndStatusCaches",
+  "invalidateServerStatusCache",
+  "isCoreRailView",
  "isElectron",
+  "isFieldShown",
  "isMacPlatform",
+  "isPersistentTabType",
+  "isPrerelease",
+  "isSessionTabType",
+  "isSplitDragging",
+  "isSplitTab",
  "isTabJumpHotkey",
+  "linkExternalToPasswordAccount",
  "linkedServerUrl",
+  "listHostActions",
+  "listHostProtocols",
+  "loadPaletteGroup",
+  "logoutUser",
+  "makeHostSshSubTabs",
+  "makeHostTabs",
+  "makeUserAdmin",
+  "mapCredentials",
  "markAdaptiveResourceUsed",
+  "markTabSurfaceUsed",
+  "moveRailItem",
+  "moveSplitDrag",
+  "normalizeLanguageCode",
+  "notifySyncChanged",
+  "openInSplit",
+  "paletteEntriesFor",
+  "parseCustomKeybindings",
+  "parseServerTime",
+  "pluginKey",
+  "pluginName",
  "pluginWsUrl",
+  "preloadTabSurface",
+  "previewHostDefaultsLevel",
+  "promotableIds",
+  "protocolEnabled",
+  "protocolPort",
+  "quickConnectTargets",
+  "railItemLabel",
  "readFromClipboard",
+  "recordHostActionPreference",
+  "registerLayout",
+  "registerTabCloseGuard",
+  "releaseUrlFrom",
+  "rem",
+  "removeAdminStatus",
+  "removeRoleFromUser",
+  "renameCredentialFolder",
+  "renameFolder",
+  "reorderCredentials",
+  "reorderFolders",
+  "reorderSSHHosts",
+  "reportBetaFeedbackUrl",
+  "reportCoreIssueUrl",
+  "requestFromLegacyEvent",
+  "requestManage",
+  "resetHostToDefaults",
+  "resetRecentActivity",
+  "resetUserSecondFactors",
  "resolveConnectionOrigin",
+  "resolveHostDefaults",
+  "resolveHostTabType",
  "resolveRemoteHostId",
+  "revokeAllUserSessions",
+  "revokeCredentialAccess",
+  "revokeFolderAccess",
+  "revokeHostAccess",
+  "revokeSession",
+  "rightDockableIds",
+  "roleLabel",
  "runAdaptiveBackgroundTask",
  "runAdaptivePolling",
+  "runHostAction",
  "runVisibleInterval",
+  "sanitizeCredentialSidebarPreferences",
+  "sanitizeHostSidebarPreferences",
+  "saveCredentialSidebarPreferences",
+  "saveHostDefaultsLevel",
+  "saveHostSidebarPreferences",
+  "saveHostTags",
+  "saveUserPreferences",
+  "setAllPluginChannels",
+  "setDeveloperMode",
+  "setHostAuthOverride",
+  "setNotificationPrivateEndpoints",
+  "setPluginOptions",
+  "setUpdateChannel",
+  "shareCredential",
+  "shareFolder",
+  "shareHost",
+  "shell",
+  "splitDefaultKey",
+  "sshHostToHost",
+  "tabIcon",
+  "tabJumpHotkeyKeys",
+  "takePendingManageRequest",
+  "unlinkExternalFromPasswordAccount",
+  "updateCredential",
+  "updateExternalAutoProvision",
+  "updateFolderMetadata",
+  "updateHostAccess",
+  "updateLogLevel",
+  "updatePasswordLoginAllowed",
+  "updatePasswordResetAllowed",
+  "updatePluginAdminSettings",
+  "updatePluginHostSettings",
+  "updatePluginUserSettings",
+  "updateRegistrationAllowed",
+  "updateRole",
+  "updateSSHHost",
+  "updateSecondFactorAfterExternalLogin",
+  "updateSessionTimeout",
+  "updateHttpsSettings",
+  "updateStatusCheckSettings",
+  "uploadTlsCertificate",
  "usageBarColor",
  "usageColor",
+  "useActionSlot",
  "useAdaptivePolling",
  "useAppTheme",
+  "useAreaPreferences",
+  "useBranding",
+  "useChooseTheme",
  "useConfirm",
  "useConnectionGate",
  "useConnectionLog",
+  "useDesktopLinked",
+  "useDesktopUpdate",
+  "useEditorDefaultKeys",
+  "useHostActions",
+  "useHostBadges",
+  "useHostContextMenuItems",
+  "useHostEditorToolbarItems",
+  "useHostStatusIndicators",
+  "useHostEditorSections",
+  "useHostProtocols",
+  "useHostStatus",
+  "useInstalledPlugins",
  "useIsDefaultsEditor",
  "useIsMobile",
+  "useKeybindingActions",
+  "useKeybindingDefaults",
  "useOptionalConnectionLog",
+  "usePageVisibleInterval",
+  "usePaletteEntries",
+  "usePaletteGroups",
+  "usePanels",
+  "usePermissions",
+  "usePluginDocsUrl",
+  "usePluginHostSections",
+  "usePluginStore",
+  "useRailItems",
+  "useRegisteredDashboardCards",
+  "useServerStatus",
+  "useServerStatusMeta",
+  "useShellController",
+  "useSplitTargets",
+  "useSshAuthEditors",
+  "useSshAuthProviders",
+  "useStatusColorScheme",
  "useSurfaceKind",
+  "useTabHandlesVersion",
  "useTabs",
  "useTabsSafe",
+  "useTheme",
+  "useThemeOptions",
+  "useUiPreference",
+  "useUiPreferencesContext",
+  "waitForDefaultsJob",
+  "withProtocolSettings",
 ];

 /** Every name a module exports, resolved the way the compiler sees it. */
@@ -48,7 +48,11 @@ function start() {
      writeFileSync: vi.fn(),
    },
    fork: () => child,
-    app: { isPackaged: true, getVersion: () => "2.9.0" },
+    app: {
+      isPackaged: true,
+      getVersion: () => "2.9.0",
+      getPath: () => "/user-data",
+    },
    process: { env: { LOG_LEVEL: "error" } },
    isDev: false,
    appRoot: "/app",
@@ -1,40 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-
-const require = createRequire(import.meta.url);
-const { isLaunchableFileName } = require("../electron/external-editor.cjs") as {
-  isLaunchableFileName: (fileName: unknown) => boolean;
-};
-
-describe("Electron external editor", () => {
-  it("refuses remote file names the OS would run instead of open", () => {
-    for (const name of [
-      "payload.exe",
-      "run.BAT",
-      "script.ps1",
-      "a.exe. ",
-      "a.cmd...",
-      "../../evil.vbs",
-      "start.command",
-      "launch.desktop",
-      "install.sh",
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(true);
-    }
-  });
-
-  it("opens ordinary text files", () => {
-    for (const name of [
-      "nginx.conf",
-      "README.md",
-      "Dockerfile",
-      ".bashrc",
-      "config.json",
-      "index.ts",
-      "",
-      undefined,
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(false);
-    }
-  });
-});
@@ -39,12 +39,24 @@ describe("Electron security boundary", () => {
    }
  });

-  it("launches only the editor saved from a file dialog", () => {
-    expect(main).not.toContain("fileData?.editorPath");
-    expect(main).toContain("readSetting(EXTERNAL_EDITOR_SETTING)");
+  it("saves an external editor only if it was chosen in a file dialog", () => {
    expect(main).toContain("dialogChosenPaths.has(value)");
  });

+  it("keeps local files, the local terminal and the external editor out of Electron", () => {
+    for (const channel of [
+      "open-external-editor",
+      "close-external-editor",
+      "local-terminal-start",
+      "local-fs:",
+      "local-transfer:",
+      "list-local-directory",
+    ]) {
+      expect(main).not.toContain(channel);
+      expect(preload).not.toContain(channel);
+    }
+  });
+
  it("scopes proxy headers and basic auth to the linked origin", () => {
    expect(main).toContain('"sync-proxy-config"');
    expect(main).toContain("linkedServer.applyLinkHeaders(");
@@ -1,176 +0,0 @@
-#!/usr/bin/env node
-/**
- * Builds src/ui/settings/settings-search-index.ts: the i18n keys each core
- * settings section shows, so the Settings search can match on any label in
- * a section without mounting it. Run it after changing a settings section.
- *
- * --check fails when the committed file is out of date.
- */
-
-const fs = require("node:fs");
-const path = require("node:path");
-
-const ROOT = path.resolve(__dirname, "..");
-const SIDEBAR = path.join(ROOT, "src", "ui", "sidebar");
-const OUT = path.join(
-  ROOT,
-  "src",
-  "ui",
-  "settings",
-  "settings-search-index.ts",
-);
-
-function flatKeys(obj, prefix = "") {
-  return Object.entries(obj).flatMap(([key, value]) =>
-    typeof value === "object"
-      ? flatKeys(value, `${prefix}${key}.`)
-      : [`${prefix}${key}`],
-  );
-}
-
-const EN_KEYS = new Set(
-  flatKeys(require(path.join(ROOT, "src", "ui", "locales", "en.json"))),
-);
-
-// t("x", { count }) reads x_one or x_other, so index the plural key.
-function realKey(key) {
-  return EN_KEYS.has(key) || !EN_KEYS.has(`${key}_other`)
-    ? key
-    : `${key}_other`;
-}
-
-function keysIn(text) {
-  return [
-    ...new Set(
-      [...text.matchAll(/\bt\(\s*"([\w.-]+)"/g)].map((m) => realKey(m[1])),
-    ),
-  ];
-}
-
-function read(file) {
-  return fs.readFileSync(path.join(SIDEBAR, file), "utf8");
-}
-
-/** The body of one exported or local function, by name. */
-function functionBody(source, name) {
-  const start = source.search(new RegExp(`function ${name}\\b`));
-  if (start < 0) throw new Error(`No function ${name}`);
-  const next = source.slice(start + 1).search(/\n(export )?function \w+/);
-  return next < 0 ? source.slice(start) : source.slice(start, start + 1 + next);
-}
-
-/** Profile sections, split on their AccordionSection ids. */
-function profileSections() {
-  const source = read("UserProfilePanel.tsx");
-  const lines = source.split("\n");
-  const starts = [];
-  lines.forEach((line, i) => {
-    if (/^\s{6}<AccordionSection\b/.test(line)) starts.push(i);
-  });
-  const out = {};
-  starts.forEach((start, k) => {
-    const end = k + 1 < starts.length ? starts[k + 1] : lines.length;
-    const chunk = lines.slice(start, end).join("\n");
-    const id = (chunk.match(/\bid="([^"]+)"/) || [])[1];
-    if (id) out[id] = keysIn(chunk);
-  });
-  out.interface = [
-    ...new Set([
-      ...(out.interface ?? []),
-      ...keysIn(read("InterfacePresetSettings.tsx")),
-    ]),
-  ];
-  out.security = [
-    ...new Set([
-      ...(out.security ?? []),
-      ...keysIn(read("AuthEnrollmentSections.tsx")),
-      ...keysIn(functionBody(source, "PasswordChangeSection")),
-    ]),
-  ];
-  out["api-keys"] = [
-    ...new Set([
-      ...(out["api-keys"] ?? []),
-      ...keysIn(functionBody(source, "NewApiKeyDialog")),
-    ]),
-  ];
-  out.keybindings = keysIn(
-    fs.readFileSync(
-      path.join(ROOT, "src", "ui", "settings", "KeybindingsSettings.tsx"),
-      "utf8",
-    ),
-  );
-  return out;
-}
-
-function adminSections() {
-  const settings = read("AdminSettingsSections.tsx");
-  const management = read("AdminManagementSections.tsx");
-  return {
-    "admin-general": [
-      ...new Set([
-        ...keysIn(functionBody(settings, "AdminGeneralSettingsSection")),
-        ...keysIn(read("AdminPluginDeveloperMode.tsx")),
-      ]),
-    ],
-    "admin-users": [
-      ...new Set([
-        ...keysIn(functionBody(management, "AdminUsersSection")),
-        ...keysIn(read("AdminUserDialogs.tsx")),
-      ]),
-    ],
-    "admin-sessions": keysIn(functionBody(management, "AdminSessionsSection")),
-    "admin-roles": keysIn(functionBody(management, "AdminRolesSection")),
-    "admin-host-defaults": [
-      ...new Set([
-        ...keysIn(functionBody(settings, "AdminHostDefaultsSection")),
-        ...keysIn(read("AdminHostTags.tsx")),
-      ]),
-    ],
-    "admin-branding": keysIn(read("AdminBrandingSection.tsx")),
-    "admin-database": keysIn(functionBody(settings, "AdminDatabaseSection")),
-    "admin-ssl": keysIn(functionBody(settings, "AdminSSLSection")),
-    "admin-api-keys": keysIn(read("AdminApiKeysSection.tsx")),
-    "admin-audit-log": keysIn(read("AdminAuditLogSection.tsx")),
-    updates: [
-      ...new Set(
-        ["UpdatesSettings.tsx", "DesktopUpdatesCard.tsx"].flatMap((file) =>
-          keysIn(
-            fs.readFileSync(
-              path.join(ROOT, "src", "ui", "settings", file),
-              "utf8",
-            ),
-          ),
-        ),
-      ),
-    ],
-  };
-}
-
-function render() {
-  const index = { ...profileSections(), ...adminSections() };
-  const body = Object.entries(index)
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(
-      ([id, keys]) =>
-        `  ${JSON.stringify(id)}: [\n${keys
-          .sort()
-          .map((key) => `    ${JSON.stringify(key)},`)
-          .join("\n")}\n  ],`,
-    )
-    .join("\n");
-  return `// Generated by scripts/generate-settings-search-index.cjs. Do not edit.\n\n/** The i18n keys each core settings section shows, for search. */\nexport const SETTINGS_SEARCH_INDEX: Record<string, string[]> = {\n${body}\n};\n`;
-}
-
-const next = render();
-if (process.argv.includes("--check")) {
-  const current = fs.existsSync(OUT) ? fs.readFileSync(OUT, "utf8") : "";
-  if (current !== next) {
-    console.error(
-      "src/ui/settings/settings-search-index.ts is out of date. Run: node scripts/generate-settings-search-index.cjs",
-    );
-    process.exit(1);
-  }
-} else {
-  fs.writeFileSync(OUT, next);
-  console.log(`Wrote ${path.relative(ROOT, OUT)}`);
-}
@@ -0,0 +1,26 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { execFileSync } = require("node:child_process");
+
+function findPackage(start) {
+  let directory = path.dirname(start);
+  while (directory !== path.dirname(directory)) {
+    const manifest = path.join(directory, "package.json");
+    if (fs.existsSync(manifest)) return JSON.parse(fs.readFileSync(manifest));
+    directory = path.dirname(directory);
+  }
+  throw new Error("Could not locate the installed sharp package manifest");
+}
+
+// The build runs on x64 but ships arm64 and ia32 too, so npm ci alone
+// only installs the x64 binary.
+const sharpPackage = findPackage(require.resolve("sharp"));
+const packages = [
+  "@img/sharp-win32-arm64",
+  "@img/sharp-win32-ia32",
+  "@img/sharp-win32-x64",
+].map((name) => `${name}@${sharpPackage.optionalDependencies[name]}`);
+
+execFileSync("npm.cmd", ["install", "--force", "--no-save", ...packages], {
+  stdio: "inherit",
+});
@@ -15,11 +15,17 @@
 * enabledByEnv counts the plugin as recommended when any of those
 * environment variables is set, for a server configured before first boot.
 * Plugins without it start unchecked.
+ *
+ * "defaultLook": true marks the plugin whose layout (and that layout's
+ * theme) a fresh install shows. Core finds the default look this way, so it
+ * never names a plugin. Such a plugin always starts enabled and cannot be
+ * uninstalled, only swapped for another look.
 */

 const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
+const semver = require("semver");

 const ID = /^[a-z0-9][a-z0-9-]*$/;
 const ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
@@ -110,6 +116,12 @@ function parseBundledPlugins(raw) {
      }
      const before = problems.length;
      const onboarding = parseOnboarding(entry.onboarding, entry.id, problems);
+      if (
+        entry.defaultLook !== undefined &&
+        typeof entry.defaultLook !== "boolean"
+      ) {
+        problems.push(`${entry.id} defaultLook must be a boolean`);
+      }
      if (problems.length > before) continue;
      plugins.push({
        id: entry.id,
@@ -118,6 +130,7 @@ function parseBundledPlugins(raw) {
        path: hasPath ? entry.path : null,
        sha256: entry.sha256,
        onboarding,
+        defaultLook: entry.defaultLook === true,
      });
    } else {
      problems.push(`${entry.id} has an unknown source "${entry.source}"`);
@@ -218,8 +231,12 @@ function buildBundledIndex(plugins, stagedIds) {
  const staged = new Set(stagedIds);
  const out = {};
  for (const plugin of plugins) {
-    if (!staged.has(plugin.id) || !plugin.onboarding) continue;
-    out[plugin.id] = { onboarding: plugin.onboarding };
+    if (!staged.has(plugin.id)) continue;
+    if (!plugin.onboarding && !plugin.defaultLook) continue;
+    out[plugin.id] = {
+      ...(plugin.onboarding ? { onboarding: plugin.onboarding } : {}),
+      ...(plugin.defaultLook ? { defaultLook: true } : {}),
+    };
  }
  return { version: 1, plugins: out };
 }
@@ -235,15 +252,22 @@ function pinsFromIndex(index, ids, current = []) {
  const currentById = new Map(current.map((entry) => [entry.id, entry]));
  const wanted = ids ?? plugins.map((plugin) => plugin.id);
  return [...wanted].sort().map((id) => {
-    const latest = byId.get(id)?.versions?.[0];
+    const listed = byId.get(id);
+    // gated holds releases that need a newer Termix than old builds check for.
+    const latest = [...(listed?.versions ?? []), ...(listed?.gated ?? [])]
+      .filter((entry) => semver.valid(entry.version))
+      .filter((entry) => !semver.prerelease(entry.version))
+      .sort((a, b) => semver.rcompare(a.version, b.version))[0];
    if (!latest) throw new Error(`${id} is not in the registry index`);
    const onboarding = currentById.get(id)?.onboarding;
+    const defaultLook = currentById.get(id)?.defaultLook === true;
    return {
      id,
      source: "tmxplug",
      url: latest.url,
      sha256: latest.sha256,
      ...(onboarding ? { onboarding } : {}),
+      ...(defaultLook ? { defaultLook } : {}),
    };
  });
 }
@@ -357,9 +381,26 @@ function rebuildLocalPlugins(dir, ids, run) {
 }

 /** Copies a local plugin build into the staging folder. */
+/** Theme CSS files the repo's manifest declares, which ship with it too. */
+function localThemeFiles(repo) {
+  try {
+    const manifest = JSON.parse(
+      fs.readFileSync(path.join(repo, "manifest.json"), "utf8"),
+    );
+    const themes = manifest?.contributes?.themes;
+    return Array.isArray(themes)
+      ? themes
+          .map((theme) => theme?.css)
+          .filter((css) => typeof css === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
 function copyLocalBuild(repo, destination) {
  fs.mkdirSync(destination, { recursive: true });
-  for (const entry of LOCAL_FILES) {
+  for (const entry of new Set([...LOCAL_FILES, ...localThemeFiles(repo)])) {
    const from = path.join(repo, entry);
    if (fs.existsSync(from)) {
      fs.cpSync(from, path.join(destination, entry), { recursive: true });
@@ -0,0 +1,149 @@
+const fs = require("node:fs");
+
+const SK_ED = "sk-ssh-ed25519@openssh.com";
+const SK_EC = "sk-ecdsa-sha2-nistp256@openssh.com";
+
+function replaceOnce(source, from, to, label) {
+  const first = source.indexOf(from);
+  if (first === -1 || source.indexOf(from, first + 1) !== -1) {
+    throw new Error(`ssh2 changed (${label}); review the security key patch`);
+  }
+  return source.replace(from, () => to);
+}
+
+function patchKeyParserSource(source) {
+  if (source.includes("// termix-sk")) return source;
+  let out = replaceOnce(
+    source,
+    `    case 'ecdsa-sha2-nistp521':
+      return true;
+    case 'ssh-ed25519':
+      if (eddsaSupported)
+        return true;`,
+    `    case 'ecdsa-sha2-nistp521':
+      return true;
+    case '${SK_EC}': // termix-sk
+      return true;
+    case '${SK_ED}':
+    case 'ssh-ed25519':
+      if (eddsaSupported)
+        return true;`,
+    "key types",
+  );
+  out = replaceOnce(
+    out,
+    `    default:
+      return new Error(\`Unsupported OpenSSH public key type: \${baseType}\`);
+  }
+
+  return new OpenSSH_Public(`,
+    `    case '${SK_ED}':
+    case '${SK_EC}': {
+      // Public blob only; the security key signs, so there is no private half.
+      const rest = data.subarray(data._pos || 0);
+      const typeLen = Buffer.byteLength(baseType);
+      pubSSH = Buffer.allocUnsafe(4 + typeLen + rest.length);
+      writeUInt32BE(pubSSH, typeLen, 0);
+      pubSSH.utf8Write(baseType, 4, typeLen);
+      pubSSH.set(rest, 4 + typeLen);
+      algo = baseType === '${SK_ED}' ? null : 'sha256';
+      break;
+    }
+    default:
+      return new Error(\`Unsupported OpenSSH public key type: \${baseType}\`);
+  }
+
+  return new OpenSSH_Public(`,
+    "parseDER",
+  );
+  return out;
+}
+
+function patchAgentSource(source) {
+  if (source.includes("skTrailer")) return source;
+  return replaceOnce(
+    source,
+    `              binaryParser.init(signature, 0);
+              binaryParser.readString(true);
+              signature = binaryParser.readString();
+              binaryParser.clear();`,
+    `              binaryParser.init(signature, 0);
+              binaryParser.readString(true);
+              signature = binaryParser.readString();
+              // Security key signatures end with flags and a counter.
+              const skTrailer = signature === undefined
+                ? undefined
+                : binaryParser.readRaw();
+              binaryParser.clear();
+              if (skTrailer && skTrailer.length)
+                signature.skTrailer = Buffer.from(skTrailer);`,
+    "agent sign response",
+  );
+}
+
+function patchProtocolSource(source) {
+  if (source.includes("skTrailer")) return source;
+  const start = source.indexOf("  authPK(username, pubKey, keyAlgo, cbSign) {");
+  const end = source.indexOf("  authHostbased(", start);
+  if (start === -1 || end === -1) {
+    throw new Error("ssh2 changed (authPK); review the security key patch");
+  }
+  let region = source.slice(start, end);
+  region = replaceOnce(
+    region,
+    `      signature = convertSignature(signature, keyType);`,
+    `      const skTrailer = signature && signature.skTrailer;
+      signature = convertSignature(signature, keyType);`,
+    "authPK sign",
+  );
+  region = replaceOnce(
+    region,
+    `          + 4 + algoLen + 4 + sigLen
+      );`,
+    `          + 4 + algoLen + 4 + sigLen + (skTrailer ? skTrailer.length : 0)
+      );`,
+    "authPK alloc",
+  );
+  region = replaceOnce(
+    region,
+    `      writeUInt32BE(packet, 4 + algoLen + 4 + sigLen, p += pubKeyLen);`,
+    `      writeUInt32BE(
+        packet,
+        4 + algoLen + 4 + sigLen + (skTrailer ? skTrailer.length : 0),
+        p += pubKeyLen
+      );`,
+    "authPK length",
+  );
+  region = replaceOnce(
+    region,
+    `      packet.set(signature, p += 4);`,
+    `      packet.set(signature, p += 4);
+      if (skTrailer)
+        packet.set(skTrailer, p + sigLen);`,
+    "authPK copy",
+  );
+  return source.slice(0, start) + region + source.slice(end);
+}
+
+if (require.main === module) {
+  const targets = [
+    ["ssh2/lib/protocol/keyParser.js", patchKeyParserSource],
+    ["ssh2/lib/agent.js", patchAgentSource],
+    ["ssh2/lib/protocol/Protocol.js", patchProtocolSource],
+  ];
+  for (const [id, patch] of targets) {
+    const target = require.resolve(id);
+    const source = fs.readFileSync(target, "utf8");
+    const result = patch(source);
+    if (result !== source) fs.writeFileSync(target, result);
+  }
+  console.log(
+    "[patch-ssh2-sk] Security key public keys and signatures enabled",
+  );
+}
+
+module.exports = {
+  patchKeyParserSource,
+  patchAgentSource,
+  patchProtocolSource,
+};
@@ -35,6 +35,42 @@ function fixturePlugin(): string {
 }

 describe("termix-plugin build", () => {
+  it("builds a theme only plugin with an empty backend and no source", async () => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "termix-build-"));
+    cleanups.push(() => fs.rmSync(dir, { recursive: true, force: true }));
+    fs.writeFileSync(
+      path.join(dir, "manifest.json"),
+      JSON.stringify({
+        id: "theme-fixture",
+        capabilities: ["ui:theme"],
+        contributes: { themes: [{ id: "paper" }] },
+      }),
+    );
+
+    await build({ cwd: dir });
+
+    expect(
+      fs.readFileSync(path.join(dir, "dist", "backend.js"), "utf8"),
+    ).toContain("export function activate()");
+    expect(fs.existsSync(path.join(dir, "dist", "frontend.js"))).toBe(false);
+  });
+
+  it("still needs a backend entry once a plugin holds more than themes", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "termix-build-"));
+    cleanups.push(() => fs.rmSync(dir, { recursive: true, force: true }));
+    fs.writeFileSync(
+      path.join(dir, "manifest.json"),
+      JSON.stringify({
+        id: "mixed-fixture",
+        capabilities: ["ui:theme", "ui:layout"],
+        contributes: { themes: [{ id: "paper" }] },
+      }),
+    );
+
+    await expect(build({ cwd: dir })).rejects.toThrow("no backend entry");
+  });
+
  it("marks dist as ESM so Node loads backend.js without reparsing", async () => {
    vi.spyOn(console, "log").mockImplementation(() => {});
    const dir = fixturePlugin();
@@ -142,3 +142,29 @@ describe("termix-plugin pack", () => {
    expect(fs.readdirSync(out)).toEqual([]);
  });
 });
+
+describe("termix-plugin pack themes", () => {
+  it("ships the CSS files the manifest's themes declare", async () => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    const dir = fixturePlugin({
+      capabilities: ["ui:theme"],
+      contributes: {
+        themes: [
+          {
+            id: "paper",
+            label: "Paper",
+            mode: "light",
+            css: "styles/paper.css",
+          },
+        ],
+      },
+    });
+    writeFile(dir, "styles/paper.css", ".paper { --background: #fff; }\n");
+    writeFile(dir, "styles/draft.css", ".draft {}\n");
+    const file = await pack({ cwd: dir, args: ["--out", tempDir("t-")] });
+    const names = await entries(file);
+    expect(names).toContain("styles/paper.css");
+    expect(names).not.toContain("styles/draft.css");
+  });
+});
@@ -49,3 +49,98 @@ describe("termix-plugin validate migrations", () => {
    expect(output).not.toMatch(/migrations\/\w+ is missing/);
  });
 });
+
+describe("termix-plugin validate themes", () => {
+  function themed(css: string | null) {
+    const root = plugin([]);
+    fs.writeFileSync(
+      path.join(root, "manifest.json"),
+      JSON.stringify({
+        id: "fixture",
+        version: "1.0.0",
+        capabilities: ["ui:theme"],
+        contributes: {
+          themes: [
+            {
+              id: "paper",
+              label: "Paper",
+              mode: "light",
+              css: "themes/paper.css",
+            },
+          ],
+        },
+      }),
+    );
+    if (css !== null) {
+      fs.mkdirSync(path.join(root, "themes"));
+      fs.writeFileSync(path.join(root, "themes", "paper.css"), css);
+    }
+    return root;
+  }
+
+  it("reports a missing theme file", async () => {
+    expect(await problems(themed(null))).toContain(
+      "theme paper: themes/paper.css does not exist",
+    );
+  });
+
+  it("reports theme CSS that reaches outside or leaves its class", async () => {
+    const output = await problems(
+      themed('@import "x.css"; body { color: red }'),
+    );
+    expect(output).toContain("theme paper: @import is not allowed in a theme");
+    expect(output).toContain(
+      'theme paper: Selector "body" must start with .paper',
+    );
+  });
+
+  it("says nothing about CSS that is fine", async () => {
+    const output = await problems(themed(".paper { --background: #fff; }"));
+    expect(output).not.toContain("theme paper");
+  });
+});
+
+describe("termix-plugin validate layouts and capabilities", () => {
+  function withManifest(extra: Record<string, unknown>) {
+    const root = plugin([]);
+    fs.writeFileSync(
+      path.join(root, "manifest.json"),
+      JSON.stringify({ id: "fixture", version: "1.0.0", ...extra }),
+    );
+    return root;
+  }
+
+  it("flags ui:theme with no themes and ui:layout with no layouts", async () => {
+    const output = await problems(
+      withManifest({ capabilities: ["ui:theme", "ui:layout"] }),
+    );
+    expect(output).toContain(
+      '"ui:theme" is declared but contributes.themes is empty',
+    );
+    expect(output).toContain(
+      '"ui:layout" is declared but contributes.layouts is empty',
+    );
+  });
+
+  it("flags a layout plugin with no frontend source", async () => {
+    const output = await problems(
+      withManifest({
+        capabilities: ["ui:layout"],
+        contributes: { layouts: [{ id: "wide", label: "Wide" }] },
+      }),
+    );
+    expect(output).toContain("contributes.layouts needs a frontend");
+  });
+
+  it("accepts a layout plugin that has a frontend entry", async () => {
+    const root = withManifest({
+      capabilities: ["ui:layout"],
+      contributes: { layouts: [{ id: "wide", label: "Wide" }] },
+    });
+    fs.mkdirSync(path.join(root, "src", "frontend"), { recursive: true });
+    fs.writeFileSync(path.join(root, "src", "frontend", "index.tsx"), "");
+    const output = await problems(root);
+    expect(output).not.toContain("contributes.layouts needs a frontend");
+    expect(output).not.toContain("is declared but");
+  });
+});