v26.10.3 (#1692)

* feat: shell controller, TabStage, layout and theme plugins with repair view

* feat: move the classic layout into its own bundled plugin

* feat: move color themes into a bundled themes plugin

* fix: plugin tests and type checks work with a linked sdk

* fix: home tab, layout switch and missing layout fallbacks for looks

* chore: add classic layout and themes to the readme

* chore: drop example plugin links from the plugin guide

* feat: plugin filters by type, paged browse, hide plugins needing newer termix

* feat: move desktop, status, import, audit and branding features into plugins

* feat: host lock api so a plugin can load hosts from a config file (#1581)

* chore: add hosts config to the plugin table

* feat: login policy hook for plugins and optional https redirect (#1584)

* chore: add login security to the plugin table

* feat: api key socket tickets so a master can open remote sessions (#1654)

* feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654)

* chore: add sync to the plugin table

* feat: move the sync screens and wizard out of core into the plugin (#1580)

* fix: add a neutral linked desktop hook for plugins (#1580)

* fix: show the linked account's name and admin flag in the app (#1580)

* feat: ssh transport providers, core ssh relay and plugin folders api

* feat: support FIDO2 security keys through ssh agent

* feat: add companion panels beside host tabs

* feat: mTLS client certificates for desktop server links

* feat: native web view for plugins in the desktop app

* fix: detect the desktop link window by Electron's default user agent

Fixes #1675

* fix: changelog for desktop link fix

* fix: keep text primary keys in the plugin data export

* fix: ship sharp binaries for Windows arm64 builds

* feat: client cert on the sync link types (sdk 1.0.18)

* chore: update translations

* feat: themed title bar for the desktop app (#1690)

* chore: changelog for the themed title bar

* fix: draw the title bar in the sidebar color

* feat: per host layout for the terminal panel bar

* chore: sdk 1.0.19 for the panel bar layout

* chore: bundle all 43 plugins for 26.10.3

* chore: update translations

---------

Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com>
Co-authored-by: Giovanny Aranda <garanda21@gmail.com>

src/backend/plugins/ctx-credentials.ts

@@ -150,6 +150,37 @@ export function createPluginCredentials({
       }
     },
 
+    list: async () => {
+      try {
+        await assertCapability(pluginId, "credentials:use", declared);
+        const userId = actingUser();
+        await requireCorePermission(userId, "credentials.view");
+        const { createCurrentCredentialRepository } =
+          await import("../database/repositories/factory.js");
+        const rows =
+          await createCurrentCredentialRepository().listDecryptedByUserId(
+            userId,
+          );
+        const list = rows.map((row) => ({
+          id: row.id,
+          name: row.name,
+          username: row.username ?? null,
+          authType: String(row.authType ?? ""),
+          folder: row.folder ?? null,
+        }));
+        await audit("credentials_list", `${list.length} credentials`, {
+          success: true,
+        });
+        return list;
+      } catch (error) {
+        await audit("credentials_list", "saved credentials", {
+          success: false,
+          errorMessage: errorText(error),
+        });
+        throw error;
+      }
+    },
+
     createSshKey: async (input) => {
       const details = `SSH key "${input?.name ?? ""}"`;
       try {
@@ -194,6 +225,74 @@ export function createPluginCredentials({
       }
     },
 
+    publicKey: async (credentialId) => {
+      const details = `public key of credential ${credentialId}`;
+      try {
+        await assertCapability(pluginId, "credentials:use", declared);
+        const userId = actingUser();
+        await requireCorePermission(userId, "credentials.view");
+        if (!Number.isInteger(credentialId) || credentialId <= 0) {
+          throw new Error("A credential id is required");
+        }
+        const { createCurrentHostResolutionRepository } =
+          await import("../database/repositories/factory.js");
+        const credential =
+          await createCurrentHostResolutionRepository().findCredentialByIdForUser(
+            credentialId,
+            userId,
+          );
+        const row = credential as unknown as Record<string, unknown> | null;
+        if (!row || row.authType !== "key") {
+          await audit("credentials_public_key", details, { success: true });
+          return null;
+        }
+        let publicKey =
+          typeof row.publicKey === "string" && row.publicKey.trim()
+            ? row.publicKey.trim()
+            : null;
+        if (!publicKey) {
+          const stored = str(row.privateKey) || str(row.key);
+          if (stored) {
+            const { resolveKeyReferences } =
+              await import("../hosts/stored-ssh-key.js");
+            const resolved = await resolveKeyReferences(
+              userId,
+              stored,
+              typeof row.keyPassword === "string" ? row.keyPassword : null,
+            );
+            publicKey = derivePublicKey(resolved.key, resolved.passphrase);
+          }
+        }
+        await audit("credentials_public_key", details, { success: true });
+        return publicKey;
+      } catch (error) {
+        await audit("credentials_public_key", details, {
+          success: false,
+          errorMessage: errorText(error),
+        });
+        throw error;
+      }
+    },
+
+    resolveKeyRefs: async (key, passphrase) => {
+      const details = "resolved key references";
+      try {
+        await assertCapability(pluginId, "credentials:read", declared);
+        const userId = actingUser();
+        const { resolveKeyReferences } =
+          await import("../hosts/stored-ssh-key.js");
+        const resolved = await resolveKeyReferences(userId, key, passphrase);
+        await audit("credentials_resolve_key", details, { success: true });
+        return resolved;
+      } catch (error) {
+        await audit("credentials_resolve_key", details, {
+          success: false,
+          errorMessage: errorText(error),
+        });
+        throw error;
+      }
+    },
+
     registerSecretResolver: (scheme, resolve) => {
       if (!declared.includes("auth:provide")) {
         throw capabilityRefused(pluginId, "auth:provide");