v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

src/backend/tests/database/routes/rbac-host-auth-override.test.ts

@@ -8,9 +8,14 @@ const state = vi.hoisted(() => ({
     isShared: true,
     isAdminBypass: false,
   },
-  credentialOwned: true,
+  credentialUsable: true,
   credentialId: 7 as number | null,
   writes: [] as Array<{ protocol: string; credentialId: number | null }>,
+  folderWrites: [] as Array<{
+    folder: string;
+    protocol: string;
+    credentialId: number | null;
+  }>,
   auditCalls: [] as Array<Record<string, unknown>>,
 }));
 
@@ -70,11 +75,12 @@ vi.mock("../../../utils/permission-manager.js", () => ({
   },
 }));
 
+vi.mock("../../../hosts/usable-credential.js", () => ({
+  findUsableCredential: async (credentialId: number) =>
+    state.credentialUsable ? { id: credentialId } : null,
+}));
+
 vi.mock("../../../database/repositories/factory.js", () => ({
-  createCurrentCredentialRepository: () => ({
-    findByIdForUser: async () =>
-      state.credentialOwned ? { id: state.credentialId } : null,
-  }),
   createCurrentSharedHostAuthOverrideRepository: () => ({
     findCredentialId: async () => state.credentialId,
     setCredential: async (
@@ -96,6 +102,25 @@ vi.mock("../../../database/repositories/factory.js", () => ({
       return true;
     },
   }),
+  createCurrentSharedFolderAuthOverrideRepository: () => ({
+    findCredentialId: async () => 7,
+    setCredential: async (
+      _userId: string,
+      folder: string,
+      protocol: string,
+      credentialId: number,
+    ) => {
+      state.folderWrites.push({ folder, protocol, credentialId });
+    },
+    clearCredential: async (
+      _userId: string,
+      folder: string,
+      protocol: string,
+    ) => {
+      state.folderWrites.push({ folder, protocol, credentialId: null });
+      return true;
+    },
+  }),
   createCurrentUserRepository: () => ({
     findById: async () => ({ id: "recipient", username: "recipient" }),
   }),
@@ -108,6 +133,7 @@ vi.mock("../../../database/repositories/factory.js", () => ({
 
 vi.mock("../../../utils/audit-logger.js", () => ({
   getRequestMeta: () => ({ ipAddress: "", userAgent: "" }),
+  getAuditUsername: async (userId: string) => userId,
   logAudit: vi.fn(async (entry: Record<string, unknown>) => {
     state.auditCalls.push(entry);
   }),
@@ -133,6 +159,8 @@ describe("shared host authentication override routes", () => {
     method: "get" | "put",
     body: Record<string, unknown> = {},
     protocol = "ssh",
+    path = "/host-access/:hostId/auth/:protocol",
+    query: Record<string, unknown> = {},
   ): Promise<{ status: number; body: unknown }> {
     const routeLayer = (
       router as unknown as {
@@ -151,15 +179,14 @@ describe("shared host authentication override routes", () => {
         }>;
       }
     ).stack.find(
-      (layer) =>
-        layer.route?.path === "/host-access/:hostId/auth/:protocol" &&
-        layer.route.methods[method],
+      (layer) => layer.route?.path === path && layer.route.methods[method],
     );
     if (!routeLayer?.route) throw new Error(`Missing ${method} route`);
 
     const handlers = routeLayer.route.stack.map((layer) => layer.handle);
     const req = {
       params: { hostId: "42", protocol },
+      query,
       body,
       headers: {},
       ip: "127.0.0.1",
@@ -206,12 +233,106 @@ describe("shared host authentication override routes", () => {
       isShared: true,
       isAdminBypass: false,
     };
-    state.credentialOwned = true;
+    state.credentialUsable = true;
     state.credentialId = 7;
     state.writes = [];
+    state.folderWrites = [];
     state.auditCalls = [];
   });
 
+  describe("folder logins", () => {
+    const FOLDER = "/folder-auth/:protocol";
+
+    it("reads the login for a folder", async () => {
+      const response = await invoke("get", {}, "ssh", FOLDER, {
+        folder: " Prod /  Web ",
+      });
+      expect(response).toEqual({
+        status: 200,
+        body: { folder: "Prod / Web", protocol: "ssh", credentialId: 7 },
+      });
+    });
+
+    it("sets and clears the login and audits both", async () => {
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "Prod", credentialId: 8 },
+            "ssh",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(200);
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "Prod", credentialId: null },
+            "ssh",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(200);
+      expect(state.folderWrites).toEqual([
+        { folder: "Prod", protocol: "ssh", credentialId: 8 },
+        { folder: "Prod", protocol: "ssh", credentialId: null },
+      ]);
+      expect(state.auditCalls.map((call) => call.action)).toEqual([
+        "set_shared_folder_auth_override",
+        "clear_shared_folder_auth_override",
+      ]);
+    });
+
+    it("rejects a bad folder, protocol or credential", async () => {
+      expect(
+        (await invoke("get", {}, "ssh", FOLDER, { folder: "" })).status,
+      ).toBe(400);
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "x".repeat(300), credentialId: 8 },
+            "ssh",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(400);
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "Prod", credentialId: 8 },
+            "smtp",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(400);
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "Prod", credentialId: -1 },
+            "ssh",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(400);
+      state.credentialUsable = false;
+      expect(
+        (
+          await invoke(
+            "put",
+            { folder: "Prod", credentialId: 99 },
+            "ssh",
+            FOLDER,
+          )
+        ).status,
+      ).toBe(404);
+      expect(state.folderWrites).toEqual([]);
+    });
+  });
+
   it("returns the current override for a role-derived shared recipient", async () => {
     const response = await invoke("get");
     expect(response).toEqual({
@@ -254,7 +375,7 @@ describe("shared host authentication override routes", () => {
     const invalidResponse = await invoke("put", { credentialId: 0 });
     expect(invalidResponse.status).toBe(400);
 
-    state.credentialOwned = false;
+    state.credentialUsable = false;
     const foreignResponse = await invoke("put", { credentialId: 99 });
     expect(foreignResponse.status).toBe(404);