v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

src/backend/tests/hosts/connect/transport-providers.test.ts

@@ -37,6 +37,29 @@ afterEach(() => {
 });
 
 describe("ssh transport providers", () => {
+  it("tells providers the owner, sync id and origin of the host", async () => {
+    const claims = vi.fn(() => false);
+    provideSshTransport("a", { claims, open: vi.fn() });
+    await openSshTransport(
+      {
+        ...host,
+        userId: "u1",
+        syncId: "s1",
+        connectionOrigin: "remote",
+      } as never,
+      {} as never,
+    ).catch(() => {});
+    expect(claims).toHaveBeenCalledWith(7, {
+      id: 7,
+      ip: "10.0.0.7",
+      port: 22,
+      userId: "u1",
+      syncId: "s1",
+      connectionOrigin: "remote",
+      localOnly: false,
+    });
+  });
+
   it("opens nothing when no provider claims the host", async () => {
     provideSshTransport("a", { claims: () => false, open: vi.fn() });
     expect(await openProvidedTransport(host)).toBeNull();

src/backend/tests/hosts/host-resolver.test.ts

@@ -6,6 +6,7 @@ const state = vi.hoisted(() => ({
   isAdminBypass: false,
   overrideCredentialId: null as number | null,
   credentials: new Map<string, Record<string, unknown>>(),
+  sharedCredentials: new Map<string, Record<string, unknown>>(),
   auditCalls: [] as Record<string, unknown>[],
   sharedSecret: null as Record<string, unknown> | null,
   activeHostAccessId: null as number | null,
@@ -37,6 +38,13 @@ vi.mock("../../database/repositories/factory.js", () => ({
   }),
 }));
 
+vi.mock("../../hosts/usable-credential.js", () => ({
+  findUsableCredential: async (credentialId: number, userId: string) =>
+    state.credentials.get(`${credentialId}:${userId}`) ??
+    state.sharedCredentials.get(`${credentialId}:${userId}`) ??
+    null,
+}));
+
 vi.mock("../../utils/audit-logger.js", () => ({
   logAudit: async (params: Record<string, unknown>) => {
     state.auditCalls.push(params);
@@ -125,6 +133,7 @@ beforeEach(() => {
   state.isAdminBypass = false;
   state.overrideCredentialId = null;
   state.credentials.clear();
+  state.sharedCredentials.clear();
   state.auditCalls = [];
   state.sharedSecret = null;
   state.activeHostAccessId = null;
@@ -376,6 +385,61 @@ describe("resolveHostById", () => {
     expect(host.username).toBe("shared-login");
   });
 
+  it("uses a credential shared with the recipient as their personal override", async () => {
+    state.overrideCredentialId = 7;
+    state.sharedCredentials.set("7:recipient", {
+      id: 7,
+      username: "shared-cred-user",
+      password: "shared-cred-pass",
+      privateKey: null,
+      key: null,
+      keyPassword: null,
+      keyType: null,
+    });
+
+    const host = (await resolveHostById(42, "recipient")) as Record<
+      string,
+      unknown
+    >;
+    expect(host.username).toBe("shared-cred-user");
+    expect(host.password).toBe("shared-cred-pass");
+  });
+
+  it("uses the host's credential when it is also shared with the recipient", async () => {
+    state.host = baseHost({
+      authType: "credential",
+      password: null,
+      credentialId: 1,
+    });
+    state.sharedCredentials.set("1:recipient", {
+      id: 1,
+      username: "deploy",
+      password: null,
+      privateKey: "OWNER-KEY-COPY",
+      key: null,
+      keyPassword: null,
+      keyType: "ssh-ed25519",
+    });
+
+    const host = (await resolveHostById(42, "recipient")) as Record<
+      string,
+      unknown
+    >;
+    expect(host.authType).toBe("key");
+    expect(host.key).toBe("OWNER-KEY-COPY");
+    expect(host.username).toBe("deploy");
+  });
+
+  it("denies a recipient when the host's credential is not shared with them", async () => {
+    state.host = baseHost({
+      authType: "credential",
+      password: null,
+      credentialId: 1,
+    });
+
+    expect(await resolveHostById(42, "recipient")).toBeNull();
+  });
+
   it("denies a non-owner when a secret-bearing host has no personal credential", async () => {
     expect(await resolveHostById(42, "recipient")).toBeNull();
   });

src/backend/tests/hosts/ssh-relay.test.ts

@@ -7,6 +7,7 @@ import { WebSocket, WebSocketServer } from "ws";
 
 const mocks = vi.hoisted(() => ({
   resolveHostById: vi.fn(),
+  resolveHostBySyncId: vi.fn(),
   openSshTransport: vi.fn(),
   handler: null as null | ((connection: unknown) => Promise<void>),
 }));
@@ -17,6 +18,7 @@ vi.mock("../../utils/logger.js", () => {
 });
 vi.mock("../../hosts/host-resolver.js", () => ({
   resolveHostById: mocks.resolveHostById,
+  resolveHostBySyncId: mocks.resolveHostBySyncId,
 }));
 vi.mock("../../hosts/connect/transport.js", () => ({
   openSshTransport: mocks.openSshTransport,
@@ -114,6 +116,23 @@ describe("ssh relay", () => {
     await vi.waitFor(() => expect(end).toHaveBeenCalled());
   });
 
+  it("finds the host by sync id for a linked desktop", async () => {
+    mocks.resolveHostBySyncId.mockResolvedValue({
+      id: 9,
+      ip: "127.0.0.1",
+      port: echoPort,
+    });
+    const { socket } = await open("?syncId=abc");
+    const received = new Promise<string>((resolve) =>
+      socket.once("message", (data) => resolve(data.toString())),
+    );
+    socket.send("ping");
+    expect(await received).toBe("ping");
+    expect(mocks.resolveHostBySyncId).toHaveBeenCalledWith("abc", "user-1");
+    expect(mocks.resolveHostById).not.toHaveBeenCalled();
+    socket.close();
+  });
+
   it("refuses a host the user can't connect to", async () => {
     mocks.resolveHostById.mockResolvedValue(null);
     const { closed } = await open("?hostId=5");