v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

src/backend/utils/shared-host-auth-override-service.ts

@@ -1,10 +1,10 @@
 import type { AuthOverrideProtocol } from "../../types/auth-protocols.js";
 import { isAuthOverrideProtocol } from "../hosts/protocol-auth/registry.js";
 import {
-  createCurrentCredentialRepository,
   createCurrentSharedHostAuthOverrideRepository,
   createCurrentUserRepository,
 } from "../database/repositories/factory.js";
+import { findUsableCredential } from "../hosts/usable-credential.js";
 import { logAudit } from "./audit-logger.js";
 import { PermissionManager } from "./permission-manager.js";
 
@@ -60,11 +60,7 @@ export class SharedHostAuthOverrideService {
     await this.requireSharedHostAccess(hostId, userId);
 
     if (credentialId !== null) {
-      const credential =
-        await createCurrentCredentialRepository().findByIdForUser(
-          userId,
-          credentialId,
-        );
+      const credential = await findUsableCredential(credentialId, userId);
       if (!credential) {
         throw new SharedHostAuthOverrideServiceError(
           "Credential not found",

src/backend/utils/shared-host-auth-resolver.ts

@@ -4,6 +4,7 @@ import {
   createCurrentHostResolutionRepository,
   createCurrentRbacAccessRepository,
   createCurrentRoleRepository,
+  createCurrentSharedFolderAuthOverrideRepository,
   createCurrentSharedHostAuthOverrideRepository,
 } from "../database/repositories/factory.js";
 import type {
@@ -12,6 +13,7 @@ import type {
 } from "../database/repositories/host-resolution-repository.js";
 import { getSshAuthProvider } from "../hosts/connect/auth-provider-registry.js";
 import { ensureCoreSshAuthProviders } from "../hosts/connect/core-providers.js";
+import { findUsableCredential } from "../hosts/usable-credential.js";
 import {
   SharedHostSecretsManager,
   type SharedSecretData,
@@ -22,6 +24,8 @@ export type RecipientSharedHostAuthResolution =
       source: "personal-override";
       credentialId: number;
       credential: HostResolutionCredentialRecord;
+      /** Set when the login comes from the folder, not the host itself. */
+      folder?: string;
     }
   | {
       source: "owner-shared";
@@ -53,8 +57,8 @@ function isOwnerAuthShared(
 
 /**
  * Applies the shared-host authentication precedence independently from any
- * transport: recipient override, shared owner auth, secretless auth, then
- * "required".
+ * transport: recipient override on the host, then on its folder, shared
+ * owner auth, secretless auth, then "required".
  */
 export async function resolveRecipientSharedHostAuthentication(
   host: HostResolutionHostRecord,
@@ -80,10 +84,7 @@ export async function resolveRecipientSharedHostAuthentication(
   }
 
   if (overrideCredentialId) {
-    const credential = await repository.findCredentialByIdForUser(
-      overrideCredentialId,
-      userId,
-    );
+    const credential = await findUsableCredential(overrideCredentialId, userId);
     if (credential) {
       return {
         source: "personal-override",
@@ -93,6 +94,31 @@ export async function resolveRecipientSharedHostAuthentication(
     }
   }
 
+  try {
+    const folderOverride =
+      await createCurrentSharedFolderAuthOverrideRepository().findClosest(
+        userId,
+        host.folder,
+        protocol,
+      );
+    if (folderOverride) {
+      const credential = await findUsableCredential(
+        folderOverride.credentialId,
+        userId,
+      );
+      if (credential) {
+        return {
+          source: "personal-override",
+          credentialId: folderOverride.credentialId,
+          credential,
+          folder: folderOverride.folder,
+        };
+      }
+    }
+  } catch {
+    // Same as a host override: an unreadable one counts as none.
+  }
+
   if (isOwnerAuthShared(host, protocol)) {
     if (protocol === "ssh" && host.authType === "agent") {
       return {
@@ -145,6 +171,17 @@ export async function resolveRecipientSharedHostAuthentication(
     }
   }
 
+  if (protocol === "ssh" && host.credentialId) {
+    const credential = await findUsableCredential(host.credentialId, userId);
+    if (credential) {
+      return {
+        source: "personal-override",
+        credentialId: host.credentialId,
+        credential,
+      };
+    }
+  }
+
   return requiresPersonalHostAuthentication(host, protocol)
     ? { source: "required" }
     : { source: "secretless" };

src/backend/utils/shared-host-secrets-manager.ts

@@ -381,12 +381,11 @@ class SharedHostSecretsManager {
     host: HostResolutionHostRecord,
     ownerId: string,
   ): Promise<ProtocolSnapshot[]> {
-    const repository = createCurrentHostResolutionRepository();
     const snapshots: ProtocolSnapshot[] = [];
 
     if (sshEnabled(host) && host.shareSshAuth) {
       if (host.credentialId) {
-        const credential = await repository.findCredentialByIdForUser(
+        const credential = await findUsableCredential(
           host.credentialId,
           ownerId,
         );

src/backend/utils/ssh-key-utils.ts

@@ -1,4 +1,4 @@
-import { createPrivateKey } from "node:crypto";
+import { createHash, createPrivateKey } from "node:crypto";
 import sshpk from "sshpk";
 import { getErrorMessage } from "./error-message.js";
 import ssh2Pkg from "ssh2";
@@ -264,12 +264,59 @@ export function isSecurityKeyFile(privateKeyData: string): boolean {
   }
 }
 
+// Unlocking an OpenSSH key runs bcrypt on the main thread (about a second per
+// try), and every connect used to do it 3 or more times. Keep the unlocked copy
+// in memory for a short while so a burst of connects pays for it once.
+const UNLOCKED_KEY_TTL_MS = 15 * 60 * 1000;
+const UNLOCKED_KEY_MAX = 64;
+const unlockedKeys = new Map<string, { text: string; expires: number }>();
+
+function unlockOpenSSHKey(cleanKey: string, passphrase?: string): string {
+  if (
+    !passphrase ||
+    !cleanKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----")
+  )
+    return cleanKey;
+  const id = createHash("sha256")
+    .update(cleanKey)
+    .update("\n")
+    .update(passphrase)
+    .digest("hex");
+  const now = Date.now();
+  const hit = unlockedKeys.get(id);
+  if (hit && hit.expires > now) return hit.text;
+  unlockedKeys.delete(id);
+  let text: string;
+  try {
+    text = parsePrivateKey(cleanKey, "openssh", { passphrase }).toString(
+      "openssh",
+    );
+  } catch {
+    // Wrong passphrase or a cipher sshpk lacks; the normal path reports it.
+    return cleanKey;
+  }
+  if (ssh2Utils.parseKey(text) instanceof Error) return cleanKey;
+  if (unlockedKeys.size >= UNLOCKED_KEY_MAX) {
+    const oldest = unlockedKeys.keys().next().value;
+    if (oldest !== undefined) unlockedKeys.delete(oldest);
+  }
+  unlockedKeys.set(id, { text, expires: now + UNLOCKED_KEY_TTL_MS });
+  return text;
+}
+
+export function clearUnlockedKeyCache(): void {
+  unlockedKeys.clear();
+}
+
 export function preparePrivateKeyForSSH2(
   privateKeyData: string,
   passphrase?: string,
 ): Buffer {
   if (isSecurityKeyFile(privateKeyData)) throw new Error(SECURITY_KEY_ERROR);
-  let cleanKey = normalizePrivateKeyText(privateKeyData);
+  let cleanKey = unlockOpenSSHKey(
+    normalizePrivateKeyText(privateKeyData),
+    passphrase,
+  );
   if (
     /^-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/.test(cleanKey) &&
     ssh2Utils.parseKey(cleanKey, passphrase) instanceof Error