fix: bundled plugins path for source runs and backend cleanup

src/backend/database/routes/credential-sidebar-preferences.ts

@@ -17,7 +17,7 @@ const authenticateJWT = authManager.createAuthMiddleware();
  * /credential-sidebar/preferences:
  *   get:
  *     summary: Get the credential sidebar preferences for the current user
- *     description: Returns the current user's saved credential sidebar preferences (sort, filters, open folders, display settings). Unlike /host-sidebar/preferences, there is no legacy-column migration to perform here — credentials never had exploded preference columns on userPreferences — so a first-time GET simply returns the defaults without writing a row; a row is only created once the user actually changes something via PUT.
+ *     description: Returns the current user's saved credential sidebar preferences (sort, filters, open folders, display settings). Unlike /host-sidebar/preferences, there is no legacy-column migration to perform here, credentials never had exploded preference columns on userPreferences, so a first-time GET simply returns the defaults without writing a row; a row is only created once the user actually changes something via PUT.
  *     tags:
  *       - Credential Sidebar
  *     responses:

src/backend/database/routes/open-tabs.ts

@@ -9,6 +9,14 @@ const router = express.Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 
+const DEFAULT_TAB_TTL_MINUTES = 30;
+
+// Tabs live as long as the terminal keeps a detached session.
+function getTabTtlMs(): number {
+  const minutes = liveTerminalSessions.idleTimeoutMinutes();
+  return (minutes && minutes > 0 ? minutes : DEFAULT_TAB_TTL_MINUTES) * 60_000;
+}
+
 /**
  * @openapi
  * /open-tabs:
@@ -20,14 +28,6 @@ const authenticateJWT = authManager.createAuthMiddleware();
  *       200:
  *         description: List of open tabs ordered by tab_order.
  */
-const DEFAULT_TAB_TTL_MINUTES = 30;
-
-// Tabs live as long as the terminal keeps a detached session.
-function getTabTtlMs(): number {
-  const minutes = liveTerminalSessions.idleTimeoutMinutes();
-  return (minutes && minutes > 0 ? minutes : DEFAULT_TAB_TTL_MINUTES) * 60_000;
-}
-
 router.get("/", authenticateJWT, async (req: Request, res: Response) => {
   const userId = (req as AuthenticatedRequest).userId;
   try {

src/backend/database/routes/plugins.ts

@@ -17,7 +17,7 @@ import { describePluginFrontend } from "../../plugins/assets.js";
 import { invalidatePluginPermissionCache } from "../../plugins/permissions.js";
 import { getPluginPublicHttpRoutes } from "../../plugins/http.js";
 import { getPluginPublicWsRoutes } from "../../plugins/ws.js";
-import { PluginManageError } from "../../plugins/manage.js";
+import { MAX_UPLOAD_BYTES, PluginManageError } from "../../plugins/manage.js";
 import { parsePluginChannel } from "../../plugins/registry-index.js";
 import {
   pluginDocsUrl,
@@ -2262,7 +2262,10 @@ router.post(
   "/upload",
   authenticateJWT,
   requireManagePlugins,
-  express.raw({ type: "application/octet-stream", limit: "50mb" }),
+  express.raw({
+    type: "application/octet-stream",
+    limit: MAX_UPLOAD_BYTES,
+  }),
   async (req: Request, res: Response) => {
     if (await refuseOnLinkedDesktop(res)) return;
     if (!Buffer.isBuffer(req.body) || req.body.length === 0) {