v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view

* feat: move the classic layout into its own bundled plugin

* feat: move color themes into a bundled themes plugin

* fix: plugin tests and type checks work with a linked sdk

* fix: home tab, layout switch and missing layout fallbacks for looks

* chore: add classic layout and themes to the readme

* chore: drop example plugin links from the plugin guide

* feat: plugin filters by type, paged browse, hide plugins needing newer termix

* feat: move desktop, status, import, audit and branding features into plugins

* feat: host lock api so a plugin can load hosts from a config file (#1581)

* chore: add hosts config to the plugin table

* feat: login policy hook for plugins and optional https redirect (#1584)

* chore: add login security to the plugin table

* feat: api key socket tickets so a master can open remote sessions (#1654)

* feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654)

* chore: add sync to the plugin table

* feat: move the sync screens and wizard out of core into the plugin (#1580)

* fix: add a neutral linked desktop hook for plugins (#1580)

* fix: show the linked account's name and admin flag in the app (#1580)

* feat: ssh transport providers, core ssh relay and plugin folders api

* feat: support FIDO2 security keys through ssh agent

* feat: add companion panels beside host tabs

* feat: mTLS client certificates for desktop server links

* feat: native web view for plugins in the desktop app

* fix: detect the desktop link window by Electron's default user agent

Fixes #1675

* fix: changelog for desktop link fix

* fix: keep text primary keys in the plugin data export

* fix: ship sharp binaries for Windows arm64 builds

* feat: client cert on the sync link types (sdk 1.0.18)

* chore: update translations

* feat: themed title bar for the desktop app (#1690)

* chore: changelog for the themed title bar

* fix: draw the title bar in the sidebar color

* feat: per host layout for the terminal panel bar

* chore: sdk 1.0.19 for the panel bar layout

* chore: bundle all 43 plugins for 26.10.3

* chore: update translations

---------

Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com>
Co-authored-by: Giovanny Aranda <garanda21@gmail.com>

src/backend/hosts/locks.ts

@@ -0,0 +1,173 @@
+/**
+ * Host locks: hosts a plugin manages itself (for example from a config file)
+ * through ctx.hosts.locks.provide. Core refuses edits, deletes and share
+ * changes on a locked host everywhere, except from the plugin that locks it,
+ * and a provider can block adding hosts by hand. Pins and order stay with the
+ * user.
+ */
+
+import type { PluginHostLockProvider } from "@termix-ssh/plugin-sdk/backend";
+import { pluginLogger } from "../utils/logger.js";
+
+export interface HostLockInfo {
+  pluginId: string;
+  pluginName: string;
+  note: string | null;
+}
+
+interface Entry {
+  pluginId: string;
+  pluginName: string;
+  provider: PluginHostLockProvider;
+}
+
+const providers = new Map<symbol, Entry>();
+
+export class HostLockedError extends Error {
+  readonly status = 403;
+  readonly code = "HOST_LOCKED";
+  constructor(
+    message: string,
+    readonly lock: { pluginId: string; pluginName: string },
+  ) {
+    super(message);
+    this.name = "HostLockedError";
+  }
+}
+
+export function provideHostLocks(
+  pluginId: string,
+  pluginName: string,
+  provider: PluginHostLockProvider,
+): () => void {
+  const key = Symbol(pluginId);
+  providers.set(key, { pluginId, pluginName, provider });
+  return () => {
+    providers.delete(key);
+  };
+}
+
+/** Test seam. */
+export function clearHostLocks(): void {
+  providers.clear();
+}
+
+// A provider that throws never locks: a broken plugin must not freeze hosts.
+function safely<T>(entry: Entry, fallback: T, read: () => T): T {
+  try {
+    return read();
+  } catch (error) {
+    pluginLogger.warn("Host lock provider failed", {
+      operation: "host_lock",
+      pluginId: entry.pluginId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return fallback;
+  }
+}
+
+export function hostLock(
+  hostId: number,
+  exemptPluginId?: string,
+): HostLockInfo | null {
+  if (!Number.isInteger(hostId)) return null;
+  for (const entry of providers.values()) {
+    if (entry.pluginId === exemptPluginId) continue;
+    if (!safely(entry, false, () => entry.provider.isLocked(hostId))) continue;
+    return {
+      pluginId: entry.pluginId,
+      pluginName: entry.pluginName,
+      note: safely(entry, null, () => entry.provider.note(hostId) ?? null),
+    };
+  }
+  return null;
+}
+
+export function hasHostLocks(): boolean {
+  return providers.size > 0;
+}
+
+/** Throws HostLockedError for the first locked host. */
+export function assertHostsUnlocked(
+  hostIds: Iterable<number>,
+  exemptPluginId?: string,
+): void {
+  if (providers.size === 0) return;
+  for (const hostId of hostIds) {
+    const lock = hostLock(Number(hostId), exemptPluginId);
+    if (lock) {
+      throw new HostLockedError(
+        `This host is managed by ${lock.pluginName} and can't be changed here`,
+        lock,
+      );
+    }
+  }
+}
+
+/** The plugin that blocks adding hosts by hand, if any. */
+export function manualCreateBlockedBy(
+  exemptPluginId?: string,
+): { pluginId: string; pluginName: string } | null {
+  for (const entry of providers.values()) {
+    if (entry.pluginId === exemptPluginId) continue;
+    if (!safely(entry, true, () => entry.provider.allowManualCreate())) {
+      return { pluginId: entry.pluginId, pluginName: entry.pluginName };
+    }
+  }
+  return null;
+}
+
+export function assertManualCreateAllowed(exemptPluginId?: string): void {
+  const blocked = manualCreateBlockedBy(exemptPluginId);
+  if (blocked) {
+    throw new HostLockedError(
+      `Hosts are managed by ${blocked.pluginName}, so new hosts can't be added here`,
+      blocked,
+    );
+  }
+}
+
+type Res = { status: (code: number) => { json: (body: unknown) => unknown } };
+type Next = () => void;
+
+/** Route guard for creating hosts by hand. */
+export function requireManualCreate(_req: unknown, res: Res, next: Next) {
+  try {
+    assertManualCreateAllowed();
+  } catch (error) {
+    if (sendHostLocked(res, error)) return;
+    throw error;
+  }
+  next();
+}
+
+/** Route guard for routes that change the host named by :id. */
+export function requireUnlockedHost(
+  req: { params: Record<string, string | string[]> },
+  res: Res,
+  next: Next,
+) {
+  const raw = req.params.id;
+  const hostId = Number(Array.isArray(raw) ? raw[0] : raw);
+  try {
+    assertHostsUnlocked([hostId]);
+  } catch (error) {
+    if (sendHostLocked(res, error)) return;
+    throw error;
+  }
+  next();
+}
+
+/** Sends a HostLockedError as a 403. False when the error is something else. */
+export function sendHostLocked(
+  res: { status: (code: number) => { json: (body: unknown) => unknown } },
+  error: unknown,
+): boolean {
+  if (!(error instanceof HostLockedError)) return false;
+  res.status(403).json({
+    error: error.message,
+    code: error.code,
+    lockedBy: error.lock.pluginId,
+  });
+  return true;
+}