v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

src/backend/tests/utils/shared-host-auth-resolver-folder.test.ts

@@ -0,0 +1,125 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+  hostOverride: null as number | null,
+  folderOverride: null as { folder: string; credentialId: number } | null,
+  ownerSecret: null as Record<string, unknown> | null,
+  usable: new Set<number>(),
+  folderLookups: [] as Array<{ folder: unknown; protocol: string }>,
+}));
+
+vi.mock("../../hosts/protocol-auth/registry.js", () => ({
+  isAuthOverrideProtocol: (protocol: string) => protocol === "ssh",
+}));
+
+vi.mock("../../hosts/usable-credential.js", () => ({
+  findUsableCredential: async (id: number) =>
+    state.usable.has(id) ? { id, username: `user-${id}` } : null,
+}));
+
+vi.mock("../../database/repositories/factory.js", () => ({
+  createCurrentHostResolutionRepository: () => ({
+    findHostOwnerId: async () => "owner",
+  }),
+  createCurrentRbacAccessRepository: () => ({
+    findActiveHostAccess: async () => null,
+  }),
+  createCurrentRoleRepository: () => ({ listUserRoleIds: async () => [] }),
+  createCurrentSharedHostAuthOverrideRepository: () => ({
+    findCredentialId: async () => state.hostOverride,
+  }),
+  createCurrentSharedFolderAuthOverrideRepository: () => ({
+    findClosest: async (_userId: string, folder: unknown, protocol: string) => {
+      state.folderLookups.push({ folder, protocol });
+      return state.folderOverride;
+    },
+  }),
+}));
+
+vi.mock("../../utils/shared-host-secrets-manager.js", () => ({
+  SharedHostSecretsManager: {
+    getInstance: () => ({
+      getSecretForUser: async () => state.ownerSecret,
+      snapshotForUser: async () => undefined,
+    }),
+  },
+}));
+
+const { resolveRecipientSharedHostAuthentication } =
+  await import("../../utils/shared-host-auth-resolver.js");
+
+const host = (extra: Record<string, unknown> = {}) =>
+  ({
+    id: 42,
+    userId: "owner",
+    folder: "Prod / Web",
+    authType: "credential",
+    credentialId: 99,
+    shareSshAuth: false,
+    ...extra,
+  }) as never;
+
+beforeEach(() => {
+  state.hostOverride = null;
+  state.folderOverride = null;
+  state.ownerSecret = null;
+  state.usable = new Set();
+  state.folderLookups = [];
+});
+
+describe("folder logins for shared hosts", () => {
+  it("uses the folder's login when the host has none of its own", async () => {
+    state.folderOverride = { folder: "Prod", credentialId: 7 };
+    state.usable.add(7);
+    const result = await resolveRecipientSharedHostAuthentication(
+      host(),
+      42,
+      "recipient",
+      "ssh",
+    );
+    expect(result).toMatchObject({
+      source: "personal-override",
+      credentialId: 7,
+      folder: "Prod",
+    });
+    expect(state.folderLookups).toEqual([
+      { folder: "Prod / Web", protocol: "ssh" },
+    ]);
+  });
+
+  it("lets the host's own login win over the folder's", async () => {
+    state.hostOverride = 5;
+    state.folderOverride = { folder: "Prod", credentialId: 7 };
+    state.usable.add(5).add(7);
+    const result = await resolveRecipientSharedHostAuthentication(
+      host(),
+      42,
+      "recipient",
+      "ssh",
+    );
+    expect(result).toMatchObject({ credentialId: 5 });
+    expect(result).not.toHaveProperty("folder");
+  });
+
+  it("skips a folder login the user can no longer use", async () => {
+    state.folderOverride = { folder: "Prod", credentialId: 7 };
+    state.ownerSecret = { authType: "password", password: "x" };
+    const result = await resolveRecipientSharedHostAuthentication(
+      host({ shareSshAuth: true }),
+      42,
+      "recipient",
+      "ssh",
+    );
+    expect(result).toMatchObject({ source: "owner-shared" });
+  });
+
+  it("asks for a login when nothing is set", async () => {
+    const result = await resolveRecipientSharedHostAuthentication(
+      host(),
+      42,
+      "recipient",
+      "ssh",
+    );
+    expect(result).toEqual({ source: "required" });
+  });
+});

src/backend/tests/utils/shared-host-secrets-manager.test.ts

@@ -17,8 +17,14 @@ const state = vi.hoisted(() => ({
 }));
 
 vi.mock("../../hosts/usable-credential.js", () => ({
-  findUsableCredential: async (credentialId: number) =>
-    state.credentials.get(credentialId) ?? null,
+  findUsableCredential: async (credentialId: number, userId: string) => {
+    const credential = state.credentials.get(credentialId);
+    if (!credential) return null;
+    const sharedWith = (credential.sharedWith as string[] | undefined) ?? [];
+    return credential.userId === userId || sharedWith.includes(userId)
+      ? credential
+      : null;
+  },
 }));
 
 vi.mock("../../database/repositories/factory.js", () => ({
@@ -29,8 +35,10 @@ vi.mock("../../database/repositories/factory.js", () => ({
     findHostById: async (hostId: number) => state.hosts.get(hostId) ?? null,
     findHostOwnerId: async (hostId: number) =>
       (state.hosts.get(hostId)?.userId as string) ?? null,
-    findCredentialByIdForUser: async (credentialId: number) =>
-      state.credentials.get(credentialId) ?? null,
+    findCredentialByIdForUser: async (credentialId: number, userId: string) =>
+      state.credentials.get(credentialId)?.userId === userId
+        ? state.credentials.get(credentialId)
+        : null,
   }),
   createCurrentSharedHostSecretsRepository: () => ({
     upsert: async (row: Record<string, unknown>) => {
@@ -260,6 +268,39 @@ describe("SharedHostSecretsManager", () => {
     });
   });
 
+  it("snapshots SSH auth from a credential shared with the host owner", async () => {
+    state.credentials.set(123, {
+      id: 123,
+      userId: "cred-owner",
+      sharedWith: ["owner"],
+      username: "cred-user",
+      authType: "password",
+      password: "cred-pass",
+      privateKey: null,
+      key: null,
+      keyPassword: null,
+      keyType: null,
+    });
+    state.hosts.set(
+      42,
+      baseHost({
+        authType: "credential",
+        credentialId: 123,
+        shareSshAuth: true,
+        password: null,
+      }),
+    );
+
+    await manager.snapshotForUser(7, 42, "target", "owner");
+
+    expect(state.secretRows.map((row) => row.protocol)).toEqual(["ssh"]);
+    expect(await manager.getSecretForUser(42, "target", "ssh")).toMatchObject({
+      username: "cred-user",
+      authType: "password",
+      password: "cred-pass",
+    });
+  });
+
   it("snapshots a credential-backed protocol login from the credential", async () => {
     state.credentials.set(55, {
       id: 55,

src/backend/tests/utils/ssh-key-utils.test.ts

@@ -11,6 +11,7 @@ import {
   getFriendlyKeyTypeName,
   validateKeyPair,
   isSecurityKeyFile,
+  clearUnlockedKeyCache,
 } from "../../utils/ssh-key-utils.js";
 
 const { parsePrivateKey } = sshpk;
@@ -226,6 +227,32 @@ describe("PKCS#8 runtime key normalization", () => {
   });
 });
 
+describe("encrypted OpenSSH keys", () => {
+  const key = sshpk.generatePrivateKey("ed25519");
+  const encrypted = key.toString("openssh", { passphrase: "pw" }).trim();
+
+  it("unlocks once and hands ssh2 a key that needs no passphrase", () => {
+    clearUnlockedKeyCache();
+    const first = preparePrivateKeyForSSH2(encrypted, "pw");
+    const parsed = ssh2.utils.parseKey(first);
+    expect(parsed).not.toBeInstanceOf(Error);
+    expect(parsePrivateKey(first.toString()).fingerprint().toString()).toBe(
+      key.fingerprint().toString(),
+    );
+    expect(preparePrivateKeyForSSH2(encrypted, "pw").toString()).toBe(
+      first.toString(),
+    );
+  });
+
+  it("leaves the key locked for a wrong or missing passphrase", () => {
+    clearUnlockedKeyCache();
+    expect(preparePrivateKeyForSSH2(encrypted, "wrong").toString()).toBe(
+      encrypted,
+    );
+    expect(preparePrivateKeyForSSH2(encrypted).toString()).toBe(encrypted);
+  });
+});
+
 describe("security key files", () => {
   const str = (v: string | Buffer) => {
     const b = Buffer.from(v);