v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

scripts/dev.mjs

@@ -404,6 +404,7 @@ function watchBackend() {
     { cwd: root, stdio: ["ignore", "pipe", "inherit"] },
   );
   let first = true;
+  let restartQueued = false;
   let buffer = "";
   tsc.stdout.on("data", (chunk) => {
     buffer += chunk.toString();
@@ -423,14 +424,21 @@ function watchBackend() {
         ? "starting the backend"
         : "backend changed, restarting it";
       first = false;
-      void queue(() => restartBackend(reason));
+      if (restartQueued) continue;
+      restartQueued = true;
+      void queue(() => {
+        restartQueued = false;
+        return restartBackend(reason);
+      });
     }
   });
 }
 
 function watchSdk() {
+  let buildStarted = Date.now();
   const changed = createDebouncer(300, () =>
     queue(async () => {
+      buildStarted = Date.now();
       try {
         await run("npm", ["run", "build:sdk"]);
       } catch (error) {
@@ -440,7 +448,16 @@ function watchSdk() {
       await restartBackend("SDK changed, restarting the backend");
     }),
   );
-  watch(SDK_SRC, true, () => changed("sdk"));
+  // Windows also reports reads (access time), so only a file saved after the last build counts
+  watch(SDK_SRC, true, (_event, filename) => {
+    try {
+      const stat = fs.statSync(path.join(SDK_SRC, String(filename ?? "")));
+      if (stat.isDirectory() || stat.mtimeMs < buildStarted) return;
+    } catch {
+      // deleted or renamed, still a change
+    }
+    changed("sdk");
+  });
 }
 
 function watchElectron() {
@@ -580,9 +597,18 @@ function watchPlugins(dir) {
     queue(() => rebuildPlugin(byId.get(id))),
   );
   for (const plugin of plugins) {
-    watch(plugin.repo, true, (_event, filename) => {
-      if (isPluginEdit(plugin.repo, filename)) changed(plugin.id);
-    });
+    // Only source folders, so node_modules and .git are never watched
+    const onEvent = (prefix) => (_event, filename) => {
+      const name = prefix
+        ? path.join(prefix, String(filename ?? ""))
+        : filename;
+      if (isPluginEdit(plugin.repo, name)) changed(plugin.id);
+    };
+    watch(plugin.repo, false, onEvent(""));
+    for (const sub of ["src", "locales", "migrations"]) {
+      const target = path.join(plugin.repo, sub);
+      if (fs.existsSync(target)) watch(target, true, onEvent(sub));
+    }
   }
   log(`watching ${plugins.length} plugin(s) in ${dir}`);
 }