v26.10.6 (#1739)

* feat: let the login page send the token back to the mobile app

* feat: add host-scripts entry to the plugin sdk

* feat: let plugins say how they show in the mobile app

* feat: frame host for running one plugin view outside the shell

* fix: build the SDK host modules in production mode

* chore: note the SDK host build fix in the changelog

* feat: list plugin engine ranges for the mobile app

* feat: host color and icon columns that sync

* chore: update translations and plugin pins

* fix: test

* fix: show source address when rejecting proxy auth

* fix: deleting your own account removes all of its data

* fix(deps): update body-parser to 2.4.0 (#1736)

* fix: body-parser 보안 패치 반영

* chore: 자동 검사를 막던 기존 JSON 서식 정리

---------

Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>

* fix(sdk): decode command output as GBK when it is not valid UTF-8 (#1735)

* fix: honor shared credentials on shared hosts (#1730)

* fix: honor shared credentials on shared hosts and in personal SSH auth

* fix: snapshot shared SSH auth from a credential shared with the host owner

* fix: size DataView list columns by the table's own width (#1713)

* fix: size DataView list columns by the table's own width

The list grid was built from every column, so columns hidden below md/lg
left empty tracks and the visible cells landed under the wrong headers.
Each width now gets a template of only its visible columns (CSS variables
+ container queries on the table, so a narrow panel counts, not the window),
the header uses the same gap as the rows, and rows use a minimum height so
wrapped cells no longer overlap.

* test: wait for the title bar offset effect before asserting

The bar shows once getTitleBarVisible resolves, but --termix-titlebar-height
is set in a later passive effect, so reading it right after findByText raced
(3-5 of 40 runs under load, on main too).

* chore: rerun CI against dev-26.10.6

* fix: unlock passphrase keys once per connect burst (#1737)

* feat: give ssh transports the host origin and sync id (#1717)

* fix: wake other clients after a sync push (Plugin-Sync#1)

* feat: look up local row ids by sync id for the sync plugin (Plugin-Sync#4)

* feat: rail items can show a status dot (Plugin-Sync#5)

* fix: add the desktop shared copy banner text (#1709)

* feat: sidebar preference for alternating rows (#1712)

* fix: striped rows text

* feat: shell can open a saved host's editor for plugins (Plugin-SSH-Terminal#36)

* fix: show the logo in the macos menu bar (#1728)

* fix: number shortcuts skip the home tab (#1724)

* fix: show plugins that could not be downloaded as failed (#1714)

* fix: pass the host id as text when opening its editor

* fix: retry a plugin bundle that was not ready yet (#1708)

* fix: let commonjs plugins fall back to core packages on the desktop

* fix: let non docker installs switch nginx to https (#1711)

* feat: remove a folder share from its hosts too (#1719)

* chore: changelog for merged pull requests

* fix: accept the release .sig when installing a plugin from a file

* feat: folder logins for shared hosts, read only plugin sync, full desktop builds

* fix: test

* fix: stop dev runner restart loops and narrow plugin watchers

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.6

---------

Co-authored-by: renovys <renovy@gmail.com>
Co-authored-by: renovys <180682734+renovys@users.noreply.github.com>
Co-authored-by: Sebastian Cao <cycsmail@gmail.com>
Co-authored-by: Jonathan Rehuel Lewerissa <jonathan.rehuel16@gmail.com>
Co-authored-by: Rhiz3K <33246262+Rhiz3K@users.noreply.github.com>

src/ui/auth/Auth.tsx

@@ -1,9 +1,11 @@
 /* eslint-disable react-refresh/only-export-components */
 import {
+  isEmbeddedAuthFrame,
   isInElectronWebView,
   isInMobileWebView,
   type EmbeddedFrameWindow,
 } from "@/lib/embedded-frame";
+import { handOffToApp, pendingAppReturn } from "@/lib/app-return";
 import { useState, useEffect, useCallback, useRef } from "react";
 import { Button } from "@/components/button";
 import { Input } from "@/components/input";
@@ -145,6 +147,13 @@ export function storeAuth(username: string) {
   );
 }
 
+/** A browser login the mobile app asked for goes back to the app. */
+async function handOffLogin(token?: string | null): Promise<boolean> {
+  if (!pendingAppReturn() || isEmbeddedAuthFrame()) return false;
+  const value = token || (await getCurrentToken());
+  return handOffToApp(value ? { token: value } : { error: "no_token" });
+}
+
 type AuthView = "login" | "register" | "reset" | "second-factor" | "external";
 type ResetStep = "email" | "code" | "newpass";
 
@@ -331,8 +340,9 @@ export function Auth({ onLogin }: AuthProps) {
     if (proxySigninHandledRef.current || isElectron()) return;
     proxySigninHandledRef.current = true;
     requestTrustedProxyLogin()
-      .then((result) => {
+      .then(async (result) => {
         if (!result.enabled || !result.success) return;
+        if (await handOffLogin()) return;
         storeAuth(result.username || "");
         onLogin(
           result.username || "",
@@ -625,24 +635,27 @@ export function Auth({ onLogin }: AuthProps) {
         }
         return;
       }
-      getUserInfo()
-        .then((meRes) => {
-          storeAuth(meRes.username || "");
-          clearDesktopManualLogout();
-          onLogin(
-            meRes.username || "",
-            meRes.userId || undefined,
-            !!meRes.is_admin,
-          );
-          window.history.replaceState(
-            {},
-            document.title,
-            window.location.pathname,
-          );
-        })
-        .catch(() => {
-          toast.error(t("errors.failedUserInfo"));
-        });
+      void handOffLogin(urlParams.get("token")).then((handedOff) => {
+        if (handedOff) return;
+        getUserInfo()
+          .then((meRes) => {
+            storeAuth(meRes.username || "");
+            clearDesktopManualLogout();
+            onLogin(
+              meRes.username || "",
+              meRes.userId || undefined,
+              !!meRes.is_admin,
+            );
+            window.history.replaceState(
+              {},
+              document.title,
+              window.location.pathname,
+            );
+          })
+          .catch(() => {
+            toast.error(t("errors.failedUserInfo"));
+          });
+      });
     }
   }, [onLogin, t]);
 
@@ -746,6 +759,7 @@ export function Auth({ onLogin }: AuthProps) {
       setWebviewAuthSuccess(true);
       return;
     }
+    if (await handOffLogin(res?.token)) return;
     const meRes = await getUserInfo();
     const name =
       meRes.username || res.username || options.fallbackUsername || "";