v26.10.5 (#1710 )

* feat: add an auto or fixed columns picker to card grids * feat: add safe mode that only runs layout and theme plugins * docs: add simple layout to plugin table * fix: ask for local network access in the macOS app * feat: allow plugin registries on listed private hosts (#1705) * chore: add private registry hosts to the changelog * feat: use the proxy for plugin registry downloads * fix: allow changing connection origin on shared hosts * chore: update translations and plugin pins * chore: lint, format, and bump version to 26.10.5 --------- Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>
chore: add six new plugins to the readme table
2026-10-28 14:15:24 +00:00 · 2026-10-22 13:30:48 -05:00 · 2026-10-21 16:25:59 -05:00 · 2026-10-21 11:55:50 -05:00 · 2026-10-21 10:44:53 -05:00 · 2026-10-21 09:54:43 -05:00
375 changed files with 52622 additions and 24138 deletions
@@ -41,9 +41,15 @@ on:
        default: ""

 jobs:
+  # One image per plugin profile (docker/bundled-plugins.json). standard keeps
+  # the plain tags; minimal and full add a suffix.
  build:
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [standard, minimal, full]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
@@ -80,12 +86,17 @@ jobs:
          TAGS=()
          ALL_TAGS=()

+          SUFFIX=""
+          if [ "${{ matrix.profile }}" != "standard" ]; then
+            SUFFIX="-${{ matrix.profile }}"
+          fi
+
          if [ "$BUILD_TYPE" = "Production" ]; then
-            TAGS+=("$VERSION" "latest")
+            TAGS+=("$VERSION$SUFFIX" "latest$SUFFIX")
          elif [ "$BUILD_TYPE" = "Beta" ]; then
-            TAGS+=("beta" "$VERSION")
+            TAGS+=("beta$SUFFIX" "$VERSION$SUFFIX")
          else
-            TAGS+=("dev-$VERSION")
+            TAGS+=("dev-$VERSION$SUFFIX")
          fi

          for tag in "${TAGS[@]}"; do
@@ -124,6 +135,7 @@ jobs:
          tags: ${{ env.ALL_TAGS }}
          build-args: |
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
+            PLUGIN_PROFILE=${{ matrix.profile }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
@@ -115,7 +115,9 @@ jobs:
          Write-Host "Spectre libs present: $($found.FullName)"

      - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci
+          node scripts/install-windows-sharp.cjs

      # Bundled plugins are counted as downloads in the plugin store, so a
      # build only fetches them when the pins change.
@@ -161,9 +161,10 @@ jobs:
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
          echo "prev_ref=$PREV" >> "$GITHUB_OUTPUT"

-  # Translates new or changed strings with the Termix LLM server and commits
-  # them to the dev branch, so the beta or stable build includes them. If the
-  # server is down it warns and the release goes on with what is there.
+  # Translates new or changed strings with the Termix LLM server and pins the
+  # bundled plugins to their newest registry releases, then commits both to the
+  # dev branch so the beta or stable build includes them. If the server is down
+  # it warns and the release goes on with what is there.
  translate:
    needs: [prep]
    if: ${{ needs.prep.outputs.skip != 'true' && needs.prep.outputs.mode != 'Overwrite release' }}
@@ -191,19 +192,26 @@ jobs:
          languages: src/ui/locales/languages.json
          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}

-      - name: Commit translations
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      # Newest stable plugin release whose engine.termix allows this version.
+      - name: Pin bundled plugins
+        run: node scripts/pin-bundled-plugins.cjs --all --core-version "${{ needs.prep.outputs.version }}"
+
+      - name: Commit translations and plugin pins
        id: commit
        run: |
-          git add src/ui/locales
+          git add src/ui/locales docker/bundled-plugins.json
          if git diff --cached --quiet; then
            echo "No translation changes."
          elif [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
-            echo "DRY RUN: would commit these translation changes:"
+            echo "DRY RUN: would commit these translation and pin changes:"
            git --no-pager diff --cached --stat
          else
            git config user.name "LukeGus"
            git config user.email "bugattiguy527@gmail.com"
-            git commit -m "chore: update translations"
+            git commit -m "chore: update translations and plugin pins"
            git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
          fi
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
@@ -1,5 +1,30 @@
 # Changelog

+## 26.10.5
+
+### Added
+
+- Safe mode: start the server with TERMIX_SAFE_MODE=1 to run only layout and theme plugins, so a broken plugin can be turned off
+- TERMIX_PLUGIN_REGISTRY_PRIVATE_HOSTS lets plugin registries live on a private address, like a registry in your LAN
+- Plugin registry browsing and downloads use HTTP_PROXY and HTTPS_PROXY when they are set
+- Docker image sizes: the default image now ships the most used plugins, the minimal tag ships only the look plugins and the full tag ships every official plugin
+- Plugins an older image shipped and you had on are downloaded from the registry on the first start of a smaller image, so nothing goes missing
+
+### Changed
+
+- Card grids in the Plugins tab and in plugins can show Auto (as many as fit) or a set number of cards per row
+
+### Fixed
+
+- The macOS app asks for Local Network access, so it can reach servers on your LAN
+- The desktop app can change the connection origin of a host shared with you, instead of failing to save
+
+## 26.10.4
+
+### Fixed
+
+- Pin classic layout plugin (fixes proxmox install)
+
 ## 26.10.3

 ### Added
@@ -11,13 +36,54 @@
 - Restore the bundled copy of a plugin from the repair screen, which also pins the shipped version
 - Switching layouts closes the tabs only the old layout could show, like its Settings tab
 - A chosen layout whose plugin was uninstalled falls back to the default instead of the repair screen
+- Filter plugins by type, like layouts, themes or tabs, from a filter list beside the results
+- Browse shows plugins a page at a time
+- Plugins that need a newer Termix are hidden in Browse, with a toggle to show them
+- Hosts can be managed from a config file through a plugin. Managed hosts are read only for everyone, but pins and order still work
+- A plugin can block adding hosts by hand, so every host comes from one place
+- Plugins can set login rules: sign out after a time without activity, limit how long a session lasts, turn off remember me and require a second factor
+- A user who must have a second factor but has none can sign in only to set one up
+- Admins can redirect HTTP to HTTPS and send HSTS while HTTPS is on. Off by default so reverse proxies keep working
+- A plugin can answer all sync requests and use the replica store, change feed and linked server list, so sync no longer lives in the core app
+- The desktop app can hold several accounts, each with its own copy of a server's data. The app signs in as the active one and its auto session follows a switch
+- The linked server list holds one link per account, with room for more connection options per server
+- A plugin can carry SSH connections over its own stream, and core relays a host's connection over a socket for another Termix
+- Plugins can create a folder with a color and icon and remove it when it is empty
+- Another Termix server can manage this one with an API key, which can now ask for a one minute ticket to open plugin sockets as its user
+- FIDO2 security keys (ed25519-sk and ecdsa-sk) work through SSH Agent authentication when Termix runs in the desktop app. The key asks for a touch or PIN on your own machine
+- Pasting a security key file now explains how to use it instead of failing to decode it
+- Plugins can add a panel that sits beside a host tab, like a terminal. You can open, resize and move it
+- The desktop app can link to a server that requires a client certificate (mutual TLS). It uses a PFX or P12 file for sync and the certificate in your system store for the app window
+- Plugins can show a web page in a native view in the desktop app, for sites that do not load in an iframe
+- The desktop app draws its own title bar in the colors of your theme instead of the native white one

 ### Changed

+- Server and desktop sync moved out of the core app into a plugin, including the Sync screen, the link wizard and the first run step. Existing links and offline copies keep working
 - The icon rail, sidebar, tab bar, dock, Dashboard, Manage, Settings and command palette now come from a bundled layout. It can be swapped for another layout but not removed, and a fix to it no longer needs a Termix release
 - Your theme is saved to your account so your other devices use it too, unless you keep settings on this device only
 - The themes besides light and dark now come from a bundled themes plugin. It can be swapped but not removed, and Termix keeps a basic light and dark theme of its own
 - A theme that no longer exists shows as System instead of an unstyled page
+- Installs and updates from a registry check the Termix version a plugin needs, not only its plugin API
+- Host online and offline dots now come from the Host Status plugin. The check interval setting moved to its settings and keeps its value. Without the plugin hosts show no dot
+- Audit log forwarding and the CSV and NDJSON export now come from the Audit Tools plugin. The collector URL and token move to its settings on upgrade. The audit log viewer, retention and the audit log itself stay in Termix
+- Client tunnels on your own computer and opening a host in Windows Remote Desktop moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The local terminal, the local side of the file manager with its transfers, and opening a file in an external editor moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The recent activity list and the first run steps for the preset and for theme, accent, font and language now come from bundled plugins. Existing entries and choices are kept, and people who went through those steps are not asked again
+- Branding (app name, tagline and logo) is now saved by the bundled layout plugin. An existing setup keeps its branding, and the sign in screen still reads it from Termix
+- Without the plugin that stores recent activity, the list stays empty and nothing is recorded
+- Importing hosts from a JSON or SSH config file and exporting hosts now come from the Import and Export plugin. Exports are now written to the audit log. Without the plugin there is no import or export
+- Generating and checking SSH keys in the credential editor and deploying a key to a host now come from the Credential Tools plugin. Deploys are now written to the audit log. Without the plugin those buttons are hidden
+
+### Fixed
+
+- Linking the desktop app to a server no longer stalls on the server dashboard after sign in
+- Exporting your data no longer fails when a plugin table has a text key, like saved passkeys
+- The Windows on ARM desktop app starts again instead of failing with a local server error
+
+### Removed
+
+- The desktop app no longer has its own client tunnel and native Remote Desktop code

 ## 26.10.2

@@ -1,6 +1,6 @@
 cask "termix" do
-  version "26.10.2"
-  sha256 "9df1850b5f75a3c0a1b3876847d46b7b4ff993aa1e50da55f4c88819308ba223"
+  version "26.10.3"
+  sha256 "a0c9db16f144c1e2be6ce2f4ead9268a010d12e0d0608feb34976750661a2239"

  url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
  name "Termix"
@@ -57,42 +57,58 @@ What every install has, with or without plugins:

 Plugins add everything else. The official ones ship with Termix, and admins can install, update or remove plugins from the Plugins tab. Each plugin has its own repo.

-| Plugin                                                                      | What it does                                                                                                |
-| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.            |
-| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                              |
-| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                    |
-| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                            |
-| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                 |
-| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                       |
-| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.        |
-| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                               |
-| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.            |
-| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                             |
-| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                           |
-| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                   |
-| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider. |
-| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                               |
-| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                  |
-| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.         |
-| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.             |
-| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                       |
-| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                      |
-| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.         |
-| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                 |
-| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                   |
-| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.     |
-| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                         |
-| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                |
-| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.              |
-| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                      |
-| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                |
-| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                   |
-| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                      |
-| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                |
-| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                            |
-| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                         |
-| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                         |
+| Plugin                                                                      | What it does                                                                                                                    |
+| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.                                |
+| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                                                  |
+| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                                        |
+| [Audit Tools](https://github.com/Termix-SSH/Plugin-Audit-Tools)             | Send the audit log to your SIEM and export it as CSV or NDJSON.                                                                 |
+| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                                                |
+| [Classic Layout](https://github.com/Termix-SSH/Plugin-Classic-Layout)       | The classic Termix layout with an icon rail, sidebar, tab bar and dock.                                                         |
+| [Classic Themes](https://github.com/Termix-SSH/Plugin-Classic-Themes)       | Light, dark and seven more color themes for Termix.                                                                             |
+| [Cloud Providers](https://github.com/Termix-SSH/Plugin-Cloud-Providers)     | Add hosts from AWS, Azure, Google Cloud, DigitalOcean, Hetzner and other clouds, and keep them in sync.                         |
+| [Credential Tools](https://github.com/Termix-SSH/Plugin-Credential-Tools)   | Generate SSH keys, check them and copy a public key to a host.                                                                  |
+| [Databases](https://github.com/Termix-SSH/Plugin-Databases)                 | Browse and edit MySQL, MariaDB, PostgreSQL and SQLite databases on your hosts from one tab.                                     |
+| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                                     |
+| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                                           |
+| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.                            |
+| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                                                   |
+| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.                                |
+| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                                                 |
+| [Host Status](https://github.com/Termix-SSH/Plugin-Host-Status)             | Shows if each host is online with a dot in the host list, checked by connecting to its port.                                    |
+| [Hosts Config](https://github.com/Termix-SSH/Plugin-Hosts-Config)           | Keep hosts, folders and sharing in a YAML or JSON file. Termix loads them as read only hosts and reloads when the file changes. |
+| [Import and Export](https://github.com/Termix-SSH/Plugin-Import-Export)     | Import hosts from a JSON file or an SSH config file and export them to share or back up.                                        |
+| [Kubernetes](https://github.com/Termix-SSH/Plugin-Kubernetes)               | Manage Kubernetes clusters from your hosts over SSH, with logs, metrics, YAML and a shell.                                      |
+| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                                               |
+| [Login Security](https://github.com/Termix-SSH/Plugin-Login-Security)       | Sign people out when idle, limit session length, turn off remember me and require a second factor at login.                     |
+| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                                       |
+| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider.                     |
+| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                                                   |
+| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                                      |
+| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.                             |
+| [Reverse Proxy](https://github.com/Termix-SSH/Plugin-Reverse-Proxy)         | Reverse proxy for TCP, UDP, HTTP and HTTPS with free certificates and Termix login, managed per host.                           |
+| [Samba Shares](https://github.com/Termix-SSH/Plugin-Samba)                  | Create and manage Samba (SMB) file shares, users and permissions on your hosts from one tab.                                    |
+| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.                                 |
+| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                                           |
+| [Services](https://github.com/Termix-SSH/Plugin-Service-Manager)            | Manage services, timers and logs on your hosts over SSH.                                                                        |
+| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                                          |
+| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.                             |
+| [Simple Layout](https://github.com/Termix-SSH/Plugin-Simple-Layout)         | A simple Termix layout for small setups with a top bar, a Home screen and only the basics.                                      |
+| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                                     |
+| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                                       |
+| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.                         |
+| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                                             |
+| [Sync](https://github.com/Termix-SSH/Plugin-Sync)                           | Sync the desktop app with one or more servers, and manage other Termix servers as remote sites from a master.                   |
+| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                                    |
+| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.                                  |
+| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                                          |
+| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                                    |
+| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                                       |
+| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                                          |
+| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                                    |
+| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                                                |
+| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                                             |
+| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                                             |

 Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Turn on the community registry in Plugins, Registries to install plugins made by other people, or add your own registry. See [submitting a plugin](https://docs.termix.site/develop/community-registry) and [hosting your own registry](https://docs.termix.site/develop/registries#host-your-own-registry).

@@ -34,9 +34,20 @@ WORKDIR /app

 COPY . .

+RUN npm run build:backend:core
+
+# Stage 3b: Stage the bundled plugins for one profile (minimal, standard or
+# full, see docker/bundled-plugins.json). Only this stage and the final one
+# differ between profiles, so the other stages are built once.
+FROM deps AS plugins
+WORKDIR /app
+ARG PLUGIN_PROFILE=standard
+COPY scripts/build-plugins.cjs ./scripts/build-plugins.cjs
+COPY scripts/lib/bundled-plugins.cjs ./scripts/lib/bundled-plugins.cjs
+COPY docker/bundled-plugins.json ./docker/bundled-plugins.json
 # Bundled plugin downloads show in the plugin store, so keep them between builds.
 RUN --mount=type=cache,target=/app/node_modules/.cache/termix-bundled-plugins \
-    npm run build:backend
+    node scripts/build-plugins.cjs --profile "$PLUGIN_PROFILE"

 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
 FROM node:24-slim AS opkssh-downloader
@@ -117,9 +128,9 @@ COPY --chown=node:node --from=frontend-builder /app/dist /app/html

 COPY --chown=node:node --from=production-deps /app/node_modules /app/node_modules
 COPY --chown=node:node --from=backend-builder /app/dist/backend ./dist/backend
-# Plugins pinned in docker/bundled-plugins.json, resolved as dist/plugins by
-# getBundledPluginsDir().
-COPY --chown=node:node --from=backend-builder /app/dist/plugins ./dist/plugins
+# Plugins of the chosen profile pinned in docker/bundled-plugins.json, resolved
+# as dist/plugins by getBundledPluginsDir().
+COPY --chown=node:node --from=plugins /app/dist/plugins ./dist/plugins
 # Target of node_modules/@termix-ssh/plugin-sdk, which core and the plugins import.
 COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/dist ./packages/plugin-sdk/dist
@@ -3,50 +3,85 @@
    {
      "id": "acme-ssl",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.2/acme-ssl-1.0.2.tmxplug",
-      "sha256": "157d0f96dc42136ff64e618b6904db7862079cd31c1f1cf5f19846b1d127b00f"
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.1.0/acme-ssl-1.1.0.tmxplug",
+      "sha256": "fb75541fae110007b45ed69d58aa4b9b6f6a79b6b1b762c6e54b635aa7cb6e4a",
+      "tier": "full"
    },
    {
      "id": "ai",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.1.0/ai-1.1.0.tmxplug",
-      "sha256": "71dda6940d62c9eede7821bbac21e99443fbc08728a47759f215e2416f1d162f"
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.3.0/ai-1.3.0.tmxplug",
+      "sha256": "87ad17324cec6036dc224135fee342250c37413dccb2963f5f6b554d4ab8f5a6",
+      "tier": "full"
    },
    {
      "id": "alerts",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.2/alerts-1.0.2.tmxplug",
-      "sha256": "50768e77019276343a5d162c85d081659fb89d1cc3733ac45cd0db4436918faa",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.1.0/alerts-1.1.0.tmxplug",
+      "sha256": "a7ce9e20ce3c15f77c15479b4901563adf3c793e24a3aacd7226950491f0434c",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
      }
    },
+    {
+      "id": "audit-tools",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Audit-Tools/releases/download/v1.0.0/audit-tools-1.0.0.tmxplug",
+      "sha256": "131479c294d692b1c0ed4d6cec273730a3a67a28ecd44825ffd36bade9aa863b",
+      "tier": "full"
+    },
    {
      "id": "automations",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.2/automations-1.0.2.tmxplug",
-      "sha256": "674eb04276b4a0c77c794b30647f8680218a78de8d52b73e99ec900cc1b3fdb3"
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.2.0/automations-1.2.0.tmxplug",
+      "sha256": "2ec9c718d73a094be3b59121aea049f0237e5783f53d193c4ea24a524584aeea",
+      "tier": "full"
    },
    {
      "id": "classic-layout",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Classic-Layout/releases/download/v1.0.0/classic-layout-1.0.0.tmxplug",
-      "sha256": "3a51cc9a4c966478f2ebfd58dbbe025ff0ebe8bbdcd3ba73156151e555f62dec",
+      "url": "https://github.com/Termix-SSH/Plugin-Classic-Layout/releases/download/v1.0.2/classic-layout-1.0.2.tmxplug",
+      "sha256": "cf54f9b2e81c33b7e58cd3a21e203805f08ba37b3bc78412a08eb21b9fef8f14",
+      "tier": "minimal",
      "defaultLook": true
    },
    {
      "id": "classic-themes",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Classic-Themes/releases/download/v1.0.0/classic-themes-1.0.0.tmxplug",
-      "sha256": "17561e569811476ea4e1f7cdf8d9afbe33edf061bd09f6b05699b44968da41ad",
+      "sha256": "919283f95701d41727c826637a7d349bd6a646abd61f9ac9017149bd0bee782c",
+      "tier": "minimal",
      "defaultLook": true
    },
+    {
+      "id": "cloud-providers",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Cloud-Providers/releases/download/v1.1.0/cloud-providers-1.1.0.tmxplug",
+      "sha256": "7f61eafc3b99bdf1328fffa95791db1d27f8e1b683e5a5925603b5840057a9c7",
+      "tier": "full"
+    },
+    {
+      "id": "credential-tools",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Credential-Tools/releases/download/v1.0.0/credential-tools-1.0.0.tmxplug",
+      "sha256": "413eff710b5c832a2575a890bbab1c90d28ea55f10cd7a7b94b851d51dd77dce",
+      "tier": "standard"
+    },
+    {
+      "id": "databases",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Databases/releases/download/v1.1.0/databases-1.1.0.tmxplug",
+      "sha256": "4d9504cde705688a6f1f7706139d4e4c49b2276eccc67538fdee8251f29920b8",
+      "tier": "full"
+    },
    {
      "id": "docker",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.2/docker-1.0.2.tmxplug",
-      "sha256": "0e1c722682faac6a027fd9b01e6910eb53ce5acb13332c6c8d8868554f3701ab",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.2.1/docker-1.2.1.tmxplug",
+      "sha256": "b2ca797465d88cfb549a04c3f0161708669def22a5ca73cb107879847c2db8ff",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -55,8 +90,9 @@
    {
      "id": "file-manager",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.3/file-manager-1.0.3.tmxplug",
-      "sha256": "250e9779a6b1caf11721f1ee2baf76655ae6e52d963e894d8db84eb9677cf0b3",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.1.1/file-manager-1.1.1.tmxplug",
+      "sha256": "ebba0b7d14facb3354f22a00e059e9f5a69e233458cb24985bf4ed5e5f8d2abd",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -66,91 +102,167 @@
      "id": "fleets",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.2/fleets-1.0.2.tmxplug",
-      "sha256": "50dab38e1c6c95fdb4d0544ce50cdf84dae84789e64aa34ea9d04fdac3a38c59"
+      "sha256": "50dab38e1c6c95fdb4d0544ce50cdf84dae84789e64aa34ea9d04fdac3a38c59",
+      "tier": "full"
    },
    {
      "id": "homepage",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.2/homepage-1.0.2.tmxplug",
-      "sha256": "88cdea8ba8f458fcf124e7ab97e3d419896d8d22ffa9a372af34f1818872975b"
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.1.0/homepage-1.1.0.tmxplug",
+      "sha256": "5a9d5d2cc337fcee5590ea957e35ddeea5a71596aeb59410bf1420065b9b5b00",
+      "tier": "full"
    },
    {
      "id": "host-metrics",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.3/host-metrics-1.0.3.tmxplug",
-      "sha256": "8f6022568349fc4318d509781bdb9d5b40973c010a9e27f720eed6baf68b881e",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.2.0/host-metrics-1.2.0.tmxplug",
+      "sha256": "8522cd23b558c3209821cee6d177daeb80f439b8ff652c577c5e4955315cc7a3",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
      }
    },
+    {
+      "id": "host-status",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Status/releases/download/v1.0.0/host-status-1.0.0.tmxplug",
+      "sha256": "1ba62577dc7373a2a2787bab7efdb89b544a30a8003b1de91ce51f372fc4f170",
+      "tier": "standard"
+    },
+    {
+      "id": "hosts-config",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Hosts-Config/releases/download/v1.0.0/hosts-config-1.0.0.tmxplug",
+      "sha256": "60a2b2a6d9ba13bad12a511c93af70a30a10fbc560066b6419acf533d806a3ad",
+      "tier": "full"
+    },
+    {
+      "id": "import-export",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Import-Export/releases/download/v1.0.0/import-export-1.0.0.tmxplug",
+      "sha256": "6670b6c147e81eed0ddfd249f9a7c9564f1ab50e45f2771161d2e30c47f6fd58",
+      "tier": "standard"
+    },
+    {
+      "id": "kubernetes",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Kubernetes/releases/download/v1.0.1/kubernetes-1.0.1.tmxplug",
+      "sha256": "31d6b200579d326d07244712713ae291ff473270d44b478a884d07c863a394f0",
+      "tier": "full"
+    },
    {
      "id": "ldap",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.2/ldap-1.0.2.tmxplug",
-      "sha256": "9ef269ad281f1c68cea53e0d43ccb7a5d4f949f11b30b22eac3d01047b20eb03"
+      "sha256": "9ef269ad281f1c68cea53e0d43ccb7a5d4f949f11b30b22eac3d01047b20eb03",
+      "tier": "full"
+    },
+    {
+      "id": "login-security",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Login-Security/releases/download/v1.0.0/login-security-1.0.0.tmxplug",
+      "sha256": "b21dff5722e72a02022d563ef27130e8b56a53e273f1668fade4ec7d030374aa",
+      "tier": "full"
    },
    {
      "id": "network-topology",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.2/network-topology-1.0.2.tmxplug",
-      "sha256": "8d32340a0d0f9674b872da5d3d53e90f529b80dfe0d73ab294eed00e565fbb56"
+      "sha256": "8d32340a0d0f9674b872da5d3d53e90f529b80dfe0d73ab294eed00e565fbb56",
+      "tier": "full"
    },
    {
      "id": "opkssh",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.2/opkssh-1.0.2.tmxplug",
-      "sha256": "4bb8f1ac5d39bd18ac3d0fe82ddbf2f26ab4c01bd75e6f7a073d65c2e9aef219"
+      "sha256": "4bb8f1ac5d39bd18ac3d0fe82ddbf2f26ab4c01bd75e6f7a073d65c2e9aef219",
+      "tier": "full"
    },
    {
      "id": "proxmox",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.2/proxmox-1.0.2.tmxplug",
-      "sha256": "b92be2644b0c8121732103b922069a6cb3cf00caad4e6549f7a8cb471bda5e4e"
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.1.0/proxmox-1.1.0.tmxplug",
+      "sha256": "8937d239ad40033d69fba59085fe8896ee25c61951c21f66ff98531fd4c63cbf",
+      "tier": "full"
    },
    {
      "id": "remote-desktop",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.1.0/remote-desktop-1.1.0.tmxplug",
-      "sha256": "6f74f1d26f91a43b2d2203417d744211f366c335d5fff7bed34bfce33874dd01",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.2.1/remote-desktop-1.2.1.tmxplug",
+      "sha256": "ad244f31016f0ea5df5c303bf6f48af35c6c8e52b12098d381c8296626b73de7",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
      }
    },
+    {
+      "id": "reverse-proxy",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Reverse-Proxy/releases/download/v1.1.0/reverse-proxy-1.1.0.tmxplug",
+      "sha256": "c8a9851da7ca6291c1f47cf6ab235da5057455a86b4ed0dc1c1a3026afb30aa7",
+      "tier": "full"
+    },
+    {
+      "id": "samba",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Samba/releases/download/v1.0.0/samba-1.0.0.tmxplug",
+      "sha256": "6e131ccdca998a9d0802becdd439a88305b64fcd7f07335bec9c7ed6791c0f53",
+      "tier": "full"
+    },
    {
      "id": "secret-sources",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.2/secret-sources-1.0.2.tmxplug",
-      "sha256": "82e2b1e95b0837dd3e5fee277be4eea2d1ce68567b0e204941c48150f415d134"
+      "sha256": "82e2b1e95b0837dd3e5fee277be4eea2d1ce68567b0e204941c48150f415d134",
+      "tier": "full"
    },
    {
      "id": "serial",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.2/serial-1.0.2.tmxplug",
      "sha256": "6ede7e8726a7312429473f34a46f93ba6657c5b7ebc12bed18f80ec62c211715",
+      "tier": "standard",
      "onboarding": {
        "recommended": "desktop",
        "consent": false
      }
    },
+    {
+      "id": "service-manager",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Service-Manager/releases/download/v1.1.0/service-manager-1.1.0.tmxplug",
+      "sha256": "82b1c70abd97ed535f217535c667fe6c48e5e01e2bf8037a89b58b80d35206bf",
+      "tier": "full"
+    },
    {
      "id": "session-recording",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.2/session-recording-1.0.2.tmxplug",
-      "sha256": "55ace6897710ce9a63f24e3d736a9e533cac557be0f3d98974956c94cf417d1c"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.1.0/session-recording-1.1.0.tmxplug",
+      "sha256": "31cd78d67e061242f8776849a2fae5f84ab48c7c765d487b32c5e1693c54b46a",
+      "tier": "full"
    },
    {
      "id": "session-sharing",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.2/session-sharing-1.0.2.tmxplug",
-      "sha256": "6408e7949a9549ac5ec94b35205729099138e730df1598d50f4bb618d8d90804"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.1.0/session-sharing-1.1.0.tmxplug",
+      "sha256": "2988b39221d93b3dbc5e2a81e104e5dc01ce264afb1e66df3407492658ab9fdc",
+      "tier": "full"
+    },
+    {
+      "id": "simple-layout",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Simple-Layout/releases/download/v1.0.1/simple-layout-1.0.1.tmxplug",
+      "sha256": "838f08050335b44b62295b87006b50d1db1029699bfe6a35fa75808d4aea2cde",
+      "tier": "full"
    },
    {
      "id": "snippets",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.2/snippets-1.0.2.tmxplug",
-      "sha256": "cc1f5d74cf97f9a9c8f800fccf481c8a000e6fa516bc260ce24a7249d4f4c8e5",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.1.0/snippets-1.1.0.tmxplug",
+      "sha256": "e2d7d1ebe5bdf2986ffb4961ac6f6d32b392b02c30a64a333a7eeb2ce6a46bb3",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -159,8 +271,9 @@
    {
      "id": "ssh-terminal",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.3/ssh-terminal-1.0.3.tmxplug",
-      "sha256": "bc288bd843e37b64bcda7462d175039147b75dc6de8866769e4a938036a9d023",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.1.1/ssh-terminal-1.1.1.tmxplug",
+      "sha256": "5cfb381a2de10b7a6fab108d79645bb1e6e7316fb5e4150c4529a3e76a2193d8",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -169,8 +282,9 @@
    {
      "id": "sso",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.3/sso-1.0.3.tmxplug",
-      "sha256": "87b03c0789d981dbc806162d73dfcc2c624150375277efd2ae40ab9d7657d48e",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.4/sso-1.0.4.tmxplug",
+      "sha256": "2aad33177085fbc92fe06cd007facffbfc8f42f9c9fa688ad5f37d68f62093d9",
+      "tier": "standard",
      "onboarding": {
        "recommended": false,
        "consent": false,
@@ -181,19 +295,29 @@
      "id": "step-ca",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.2/step-ca-1.0.2.tmxplug",
-      "sha256": "685b644fe44c2d3fa007baee16e8ea8a7d5204f039ebc8aa65e8093ad93adf8a"
+      "sha256": "685b644fe44c2d3fa007baee16e8ea8a7d5204f039ebc8aa65e8093ad93adf8a",
+      "tier": "full"
+    },
+    {
+      "id": "sync",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Sync/releases/download/v1.0.1/sync-1.0.1.tmxplug",
+      "sha256": "66a301fd04fb8d2a3ece18dfb230069cf78e1138ee78941dc511dfbd8ee4f91e",
+      "tier": "standard"
    },
    {
      "id": "tailscale",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.2/tailscale-1.0.2.tmxplug",
-      "sha256": "5c7b00d6b6b0186d833302e39a9d31b92ea92d4542e9e2dab550b95837a59d97"
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.1.0/tailscale-1.1.0.tmxplug",
+      "sha256": "8784a77a1fc1b0011d8243d9520574300df31bc40c31f86339868f4c9b76d1bf",
+      "tier": "full"
    },
    {
      "id": "telemetry",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.2/telemetry-1.0.2.tmxplug",
      "sha256": "5ffdc58b05cd8b37fd0a207f99d2d3a256164130c950032501c499f869edb9ec",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": true
@@ -203,19 +327,22 @@
      "id": "termix-identity",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.2/termix-identity-1.0.2.tmxplug",
-      "sha256": "ac6c90a48b4f1e9cff6773a5fd267b2bf7319d2fc7e2aa2cd4004cec82f0f927"
+      "sha256": "ac6c90a48b4f1e9cff6773a5fd267b2bf7319d2fc7e2aa2cd4004cec82f0f927",
+      "tier": "full"
    },
    {
      "id": "tmux-monitor",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.3/tmux-monitor-1.0.3.tmxplug",
-      "sha256": "f152d64f433d3f1de7c3fdf172e752ea7e333909f0fdda77336a6b8dddb9f242"
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.1.0/tmux-monitor-1.1.0.tmxplug",
+      "sha256": "3cdc54a34e1ca30c4e3c217bbc612e40ef3cd3e4d5de704ea92d914b32d98006",
+      "tier": "full"
    },
    {
      "id": "totp",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.2/totp-1.0.2.tmxplug",
      "sha256": "94a0772660fa8e4dfd9afc15b68d5bc9fe02fe28a1acfd35e65a57c304d460c0",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -224,8 +351,9 @@
    {
      "id": "tunnels",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.3/tunnels-1.0.3.tmxplug",
-      "sha256": "d0de9e59ccc9e1a0f2817dd1ec9951021f2d7e89304894bb1e8cefd65aebff0b",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.2.1/tunnels-1.2.1.tmxplug",
+      "sha256": "2871a8d31854e1a31416c4afe5839099a4c489e34d9d31573659f73b2515f159",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -235,31 +363,36 @@
      "id": "vault",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.2/vault-1.0.2.tmxplug",
-      "sha256": "48ef402d030912a836489edf0fdfcaf7929cbd67c21f16a2079cb4925134cc28"
+      "sha256": "48ef402d030912a836489edf0fdfcaf7929cbd67c21f16a2079cb4925134cc28",
+      "tier": "full"
    },
    {
      "id": "wake-on-lan",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.2/wake-on-lan-1.0.2.tmxplug",
-      "sha256": "3e9cf9a133b4dd96ec5f2b9fbf2d6a3ff7e08f8dfbf1e86b8d45de0c2f024f42"
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.1.0/wake-on-lan-1.1.0.tmxplug",
+      "sha256": "1afb708c12631ededec40938aed3ab587bc9a519215fa5e93350b1f0a843d2a8",
+      "tier": "full"
    },
    {
      "id": "warpgate",
      "source": "tmxplug",
      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.2/warpgate-1.0.2.tmxplug",
-      "sha256": "5c2c1c9aef40dbbf98424d02303f2ee77e6e869334247881e8aa0fcd8c415b47"
+      "sha256": "5c2c1c9aef40dbbf98424d02303f2ee77e6e869334247881e8aa0fcd8c415b47",
+      "tier": "full"
    },
    {
      "id": "web-endpoint",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.2/web-endpoint-1.0.2.tmxplug",
-      "sha256": "0326edb1052d1debd083004c2dd1711d21a902cfacb55ce74d1a8856a5122477"
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.1.0/web-endpoint-1.1.0.tmxplug",
+      "sha256": "79e691abc456b17c8ce651017b47097a7ff71e94267e668341548a05b911a92c",
+      "tier": "full"
    },
    {
      "id": "webauthn",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.2/webauthn-1.0.2.tmxplug",
-      "sha256": "8269f6e407897332648c8526b65383c4db071ea782bf1e58aa7c7c00627f3f4b",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.1.0/webauthn-1.1.0.tmxplug",
+      "sha256": "83a61a530db0273f9fef2080d6aa027a82ef8374fb4e0f158a8559a2770299de",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -268,8 +401,9 @@
    {
      "id": "workspaces",
      "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.2/workspaces-1.0.2.tmxplug",
-      "sha256": "97519a01fbb2eb2eecf21d7b9ab9028c740457bcff9fc6b075fb6facbc5ccb6b",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.1.0/workspaces-1.1.0.tmxplug",
+      "sha256": "7189d767c3f7cddfb59366f6cceeca27a0b29e41da1dcc89d57a25317a0fe4bf",
+      "tier": "standard",
      "onboarding": {
        "recommended": true,
        "consent": false
@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;
@@ -0,0 +1,2 @@
+ALTER TABLE `sessions` ADD `restriction` text;--> statement-breakpoint
+ALTER TABLE `sessions` ADD `idle_timeout` int;
@@ -519,6 +519,20 @@
      "when": 1792357129912,
      "tag": "0073_user_look_preferences",
      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "5",
+      "when": 1792374489419,
+      "tag": "0074_mature_puff_adder",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "5",
+      "when": 1792430772041,
+      "tag": "0075_session_policy",
+      "breakpoints": true
    }
  ]
 }
@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;
@@ -0,0 +1,2 @@
+ALTER TABLE "sessions" ADD COLUMN "restriction" text;--> statement-breakpoint
+ALTER TABLE "sessions" ADD COLUMN "idle_timeout" integer;
@@ -519,6 +519,20 @@
      "when": 1792357128746,
      "tag": "0073_user_look_preferences",
      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1792374488837,
+      "tag": "0074_bouncy_sersi",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "7",
+      "when": 1792430770990,
+      "tag": "0075_session_policy",
+      "breakpoints": true
    }
  ]
 }
@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;
@@ -0,0 +1,2 @@
+ALTER TABLE `sessions` ADD `restriction` text(32);--> statement-breakpoint
+ALTER TABLE `sessions` ADD `idle_timeout` integer;
@@ -484,6 +484,20 @@
      "when": 1792357127581,
      "tag": "0068_user_look_preferences",
      "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "6",
+      "when": 1792374488196,
+      "tag": "0069_normal_ozymandias",
+      "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "6",
+      "when": 1792430769899,
+      "tag": "0070_session_policy",
+      "breakpoints": true
    }
  ]
 }
@@ -128,6 +128,10 @@
    "category": "public.app-category.developer-tools",
    "hardenedRuntime": true,
    "gatekeeperAssess": false,
+    "extendInfo": {
+      "NSLocalNetworkUsageDescription": "Termix connects to servers and hosts on your local network.",
+      "NSBonjourServices": ["_http._tcp", "_https._tcp", "_ssh._tcp"]
+    },
    "entitlements": "packaging/build/entitlements.mac.plist",
    "entitlementsInherit": "packaging/build/entitlements.mac.inherit.plist",
    "type": "distribution",
@@ -153,6 +157,8 @@
    "artifactName": "termix_macos_${arch}_mas.${ext}",
    "extendInfo": {
      "ITSAppUsesNonExemptEncryption": false,
+      "NSLocalNetworkUsageDescription": "Termix connects to servers and hosts on your local network.",
+      "NSBonjourServices": ["_http._tcp", "_https._tcp", "_ssh._tcp"],
      "NSAppleEventsUsageDescription": "Termix needs access to control other applications for terminal operations."
    }
  },
@@ -1,78 +0,0 @@
-const { randomUUID } = require("node:crypto");
-
-function createC2SAuthBridge(ipcMain, getWindow) {
-  const pending = new Map();
-  ipcMain.handle("answer-c2s-auth", (event, id, answer) => {
-    const item = pending.get(id);
-    if (!item || item.sender !== event.sender) return false;
-    if (answer !== null && (typeof answer !== "string" || answer.length > 8192))
-      return false;
-    item.finish(answer);
-    return true;
-  });
-  return function attach(ws, tunnelName) {
-    const active = new Set();
-    const close = () => {
-      for (const id of active) pending.get(id)?.finish(null);
-      ws.off("message", onMessage);
-      ws.off("close", close);
-      ws.off("error", close);
-    };
-    const onMessage = (raw, binary) => {
-      if (binary) return;
-      let message;
-      try {
-        message = JSON.parse(raw.toString());
-      } catch {
-        return;
-      }
-      if (message.type !== "auth-prompt") return;
-      const window = getWindow();
-      if (
-        !window ||
-        window.isDestroyed() ||
-        active.size ||
-        typeof message.requestId !== "string" ||
-        !["totp", "input", "browser"].includes(message.request?.kind) // plugin-id-ok: SSH prompt kind, not the plugin
-      ) {
-        ws.close();
-        return;
-      }
-      const sender = window.webContents;
-      const id = randomUUID();
-      const finish = (answer) => {
-        if (!pending.delete(id)) return;
-        active.delete(id);
-        clearTimeout(timer);
-        sender.off("destroyed", cancelled);
-        sender.off("did-start-loading", cancelled);
-        if (!sender.isDestroyed())
-          sender.send("c2s-auth-prompt", { id, closed: true });
-        if (ws.readyState === 1)
-          ws.send(
-            JSON.stringify({
-              type: "auth-response",
-              requestId: message.requestId,
-              answer,
-            }),
-          );
-        if (answer === null) ws.close();
-      };
-      const cancelled = () => finish(null);
-      const timer = setTimeout(cancelled, 60_000);
-      active.add(id);
-      pending.set(id, { sender, finish });
-      sender.once("destroyed", cancelled);
-      sender.once("did-start-loading", cancelled);
-      sender.send("c2s-auth-prompt", {
-        id,
-        tunnelName,
-        request: message.request,
-      });
-    };
-    ws.on("message", onMessage);
-    ws.once("close", close);
-    ws.once("error", close);
-  };
-}
-module.exports = { createC2SAuthBridge };
@@ -0,0 +1,165 @@
+const { isolatedUrl } = require("./isolated-window.cjs");
+
+function cleanBounds(bounds) {
+  const value = (n) => Math.max(0, Math.round(Number(n) || 0));
+  return {
+    x: value(bounds?.x),
+    y: value(bounds?.y),
+    width: value(bounds?.width),
+    height: value(bounds?.height),
+  };
+}
+
+/**
+ * Native web views drawn inside the main window, for pages that do not work
+ * in a sandboxed iframe. Each one is a WebContentsView in its own
+ * non-persistent session, with the same limits as an isolated window: no
+ * permissions, no downloads, http(s) and ws(s) only. The renderer owns the
+ * placement and sends the bounds of the element the view should cover.
+ */
+function createEmbeddedViews({ WebContentsView, session, getMainWindow }) {
+  const views = new Map();
+
+  function destroy(id) {
+    const entry = views.get(id);
+    if (!entry) return;
+    views.delete(id);
+    const main = getMainWindow();
+    if (main && !main.isDestroyed()) {
+      try {
+        main.contentView.removeChildView(entry.view);
+      } catch {
+        /* already detached */
+      }
+    }
+    if (!entry.view.webContents.isDestroyed()) entry.view.webContents.close();
+    void Promise.allSettled([
+      entry.session.clearStorageData(),
+      entry.session.clearCache(),
+      entry.session.closeAllConnections(),
+    ]);
+  }
+
+  function destroyAll() {
+    for (const id of [...views.keys()]) destroy(id);
+  }
+
+  function open(options = {}) {
+    const main = getMainWindow();
+    if (!main) throw new Error("No window to attach a view to");
+    const id = String(options.id || "");
+    if (!id) throw new Error("A view needs an id");
+    const url = isolatedUrl(options.url);
+    const existing = views.get(id);
+    if (existing) {
+      if (
+        existing.url === url.href &&
+        existing.ignoreCert === !!options.ignoreCert
+      ) {
+        setBounds(id, options.bounds);
+        setVisible(id, options.visible !== false);
+        return { success: true };
+      }
+      destroy(id);
+    }
+
+    const isolated = session.fromPartition(
+      `embedded-view-${id}-${Date.now()}`,
+      {
+        cache: false,
+      },
+    );
+    isolated.setPermissionRequestHandler((_c, _p, callback) => callback(false));
+    isolated.setPermissionCheckHandler(() => false);
+    isolated.on("will-download", (event) => event.preventDefault());
+    isolated.webRequest.onBeforeRequest((details, callback) => {
+      const protocol = new URL(details.url).protocol;
+      callback({
+        cancel: !["http:", "https:", "ws:", "wss:"].includes(protocol),
+      });
+    });
+
+    const view = new WebContentsView({
+      webPreferences: {
+        session: isolated,
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        webviewTag: false,
+        webSecurity: true,
+      },
+    });
+    const canNavigate = (target) => {
+      try {
+        return target === "about:blank" || !!isolatedUrl(target);
+      } catch {
+        return false;
+      }
+    };
+    for (const name of ["will-navigate", "will-redirect"]) {
+      view.webContents.on(name, (event, target) => {
+        if (!canNavigate(target)) event.preventDefault();
+      });
+    }
+    view.webContents.setWindowOpenHandler(({ url: target }) =>
+      canNavigate(target)
+        ? {
+            action: "allow",
+            overrideBrowserWindowOptions: {
+              webPreferences: { session: isolated, sandbox: true },
+            },
+          }
+        : { action: "deny" },
+    );
+
+    views.set(id, {
+      view,
+      session: isolated,
+      url: url.href,
+      origin: url.origin,
+      ignoreCert: !!options.ignoreCert,
+    });
+    main.contentView.addChildView(view);
+    setBounds(id, options.bounds);
+    setVisible(id, options.visible !== false);
+    view.webContents.loadURL(url.href).catch(() => {});
+    return { success: true };
+  }
+
+  function setBounds(id, bounds) {
+    const entry = views.get(id);
+    if (entry) entry.view.setBounds(cleanBounds(bounds));
+  }
+
+  function setVisible(id, visible) {
+    const entry = views.get(id);
+    if (entry) entry.view.setVisible(!!visible);
+  }
+
+  function handleCertificateError(event, contents, url, callback) {
+    for (const entry of views.values()) {
+      if (entry.view.webContents !== contents) continue;
+      event.preventDefault();
+      let allowed = false;
+      try {
+        allowed = entry.ignoreCert && new URL(url).origin === entry.origin;
+      } catch {
+        /* malformed URL is refused */
+      }
+      callback(allowed);
+      return true;
+    }
+    return false;
+  }
+
+  return {
+    open,
+    setBounds,
+    setVisible,
+    destroy,
+    destroyAll,
+    handleCertificateError,
+  };
+}
+
+module.exports = { createEmbeddedViews, cleanBounds };
@@ -1,70 +0,0 @@
-const path = require("path");
-
-// Saved by the file manager after the user picks an editor in a file dialog.
-const EXTERNAL_EDITOR_SETTING = "fileManager.externalEditorPath";
-
-// Extensions the OS would run rather than open in an editor. With no editor
-// configured the temp copy goes to shell.openPath, and its name comes from
-// the remote server.
-const LAUNCHABLE_EXTENSIONS = new Set([
-  // Windows
-  "application",
-  "appref-ms",
-  "bat",
-  "chm",
-  "cmd",
-  "com",
-  "cpl",
-  "exe",
-  "gadget",
-  "hta",
-  "inf",
-  "jar",
-  "js",
-  "jse",
-  "library-ms",
-  "lnk",
-  "msc",
-  "msi",
-  "msp",
-  "mst",
-  "pif",
-  "ps1",
-  "psd1",
-  "psm1",
-  "py",
-  "pyw",
-  "reg",
-  "scf",
-  "scr",
-  "search-ms",
-  "settingcontent-ms",
-  "url",
-  "vbe",
-  "vbs",
-  "ws",
-  "wsf",
-  "wsh",
-  "xll",
-  // macOS
-  "app",
-  "command",
-  "pkg",
-  "terminal",
-  "tool",
-  "workflow",
-  // Linux
-  "appimage",
-  "desktop",
-  "run",
-  "sh",
-]);
-
-function isLaunchableFileName(fileName) {
-  // Windows drops trailing dots and spaces, so "a.exe. " is saved as a.exe.
-  const name = path.basename(String(fileName || "")).replace(/[. ]+$/, "");
-  const extension = path.extname(name).slice(1).toLowerCase();
-  return LAUNCHABLE_EXTENSIONS.has(extension);
-}
-
-module.exports = { EXTERNAL_EDITOR_SETTING, isLaunchableFileName };
@@ -34,6 +34,8 @@ function setLinkedServer(config) {
    basicAuth:
      config.basicAuth && config.basicAuth.username ? config.basicAuth : null,
    allowInvalidCertificate: !!config.allowInvalidCertificate,
+    clientCert:
+      config.clientCert && config.clientCert.pfx ? config.clientCert : null,
  };
 }

@@ -45,6 +47,16 @@ function isLinkedOrigin(url) {
  return !!linked && getOrigin(url) === linked.origin;
 }

+// The PFX of the link's client certificate, for TLS this process makes itself
+// to the linked origin. Null for any other origin.
+function clientCertOptionsFor(url) {
+  if (!isLinkedOrigin(url) || !linked.clientCert) return {};
+  return {
+    pfx: Buffer.from(linked.clientCert.pfx, "base64"),
+    passphrase: linked.clientCert.passphrase || "",
+  };
+}
+
 function basicAuthValue(basicAuth) {
  return `Basic ${Buffer.from(
    `${basicAuth.username}:${basicAuth.password || ""}`,
@@ -99,6 +111,7 @@ module.exports = {
  setLinkedServer,
  getLinkedServer,
  isLinkedOrigin,
+  clientCertOptionsFor,
  applyLinkHeaders,
  linkedRequestHeaders,
  answerLogin,
@@ -1,71 +0,0 @@
-const fs = require("node:fs");
-const path = require("node:path");
-
-function isUsableShell(file, exists) {
-  return !!file && (!path.isAbsolute(file) || exists(file));
-}
-
-function resolveLocalShell(
-  platform,
-  requestedShell,
-  env = process.env,
-  exists = fs.existsSync,
-) {
-  if (platform === "win32") {
-    if (requestedShell === "wsl") {
-      return { file: "wsl.exe", args: [] };
-    }
-    return {
-      file: env.TERMIX_LOCAL_SHELL || "powershell.exe",
-      args: ["-NoLogo"],
-    };
-  }
-
-  // A SHELL left pointing at an uninstalled shell makes the spawn fail.
-  const fallbacks =
-    platform === "darwin"
-      ? ["/bin/zsh", "/bin/bash", "/bin/sh"]
-      : ["/bin/bash", "/bin/sh"];
-  const file =
-    [env.TERMIX_LOCAL_SHELL, env.SHELL, ...fallbacks].find((candidate) =>
-      isUsableShell(candidate, exists),
-    ) || fallbacks[0];
-  return { file, args: ["-l"] };
-}
-
-/**
- * node-pty starts every shell through its spawn-helper binary, and a packaged
- * copy that lost its execute bit fails with "posix_spawnp failed". Returns
- * how many helpers were fixed.
- */
-function repairSpawnHelpers(ptyDir, fsImpl = fs) {
-  // A universal macOS build ships app-arm64.asar and app-x64.asar.
-  const dir = ptyDir.replace(
-    /\b(app(?:-[a-z0-9]+)?)\.asar(?!\.unpacked)/,
-    "$1.asar.unpacked",
-  );
-  const candidates = [
-    path.join(dir, "build", "Release", "spawn-helper"),
-    path.join(
-      dir,
-      "prebuilds",
-      `${process.platform}-${process.arch}`,
-      "spawn-helper",
-    ),
-  ];
-  let fixed = 0;
-  for (const helper of candidates) {
-    try {
-      const mode = fsImpl.statSync(helper).mode;
-      if ((mode & 0o111) === 0) {
-        fsImpl.chmodSync(helper, mode | 0o755);
-        fixed += 1;
-      }
-    } catch {
-      // Missing or read-only; nothing to fix here.
-    }
-  }
-  return fixed;
-}
-
-module.exports = { resolveLocalShell, repairSpawnHelpers };
@@ -1,85 +0,0 @@
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { spawn } = require("child_process");
-
-function singleLine(value, maxLength = 255) {
-  return String(value ?? "")
-    .replace(/[\r\n\0]/g, "")
-    .trim()
-    .slice(0, maxLength);
-}
-
-function validateNativeRdpOptions(options) {
-  const host = singleLine(options?.host);
-  const port = Number(options?.port ?? 3389);
-  if (!host || host.length > 253 || /[\\/]/.test(host)) {
-    throw new Error("Invalid RDP host");
-  }
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error("Invalid RDP port");
-  }
-  return {
-    host,
-    port,
-    username: singleLine(options?.username),
-    domain: singleLine(options?.domain),
-  };
-}
-
-function buildRdpFile(options) {
-  const { host, port, username, domain } = validateNativeRdpOptions(options);
-  const address = host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`;
-  const qualifiedUsername = username
-    ? domain
-      ? `${domain}\\${username}`
-      : username
-    : "";
-  return [
-    `full address:s:${address}`,
-    "prompt for credentials:i:1",
-    "administrative session:i:0",
-    ...(qualifiedUsername ? [`username:s:${qualifiedUsername}`] : []),
-    "",
-  ].join("\r\n");
-}
-
-async function launchNativeRdp(options, platform = process.platform) {
-  if (platform !== "win32") {
-    return {
-      success: false,
-      error: "Windows Remote Desktop is only available on Windows",
-    };
-  }
-
-  const rdpContent = buildRdpFile(options);
-  const tempDir = await fs.promises.mkdtemp(
-    path.join(os.tmpdir(), "termix-rdp-"),
-  );
-  const rdpPath = path.join(tempDir, "connection.rdp");
-  await fs.promises.writeFile(rdpPath, rdpContent, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
-
-  return new Promise((resolve) => {
-    const child = spawn("mstsc.exe", [rdpPath], {
-      detached: true,
-      windowsHide: true,
-      stdio: "ignore",
-    });
-    const cleanup = () =>
-      fs.promises.rm(tempDir, { recursive: true, force: true }).catch(() => {});
-    child.once("error", (error) => {
-      cleanup();
-      resolve({ success: false, error: error.message });
-    });
-    child.once("spawn", () => {
-      child.unref();
-      setTimeout(cleanup, 30_000).unref();
-      resolve({ success: true });
-    });
-  });
-}
-
-module.exports = { buildRdpFile, launchNativeRdp, validateNativeRdpOptions };
@@ -32,6 +32,19 @@ contextBridge.exposeInMainWorld("electronAPI", {
    webFrame.setZoomFactor(Math.min(2, Math.max(0.5, value)));
  },
  getPlatform: () => ipcRenderer.invoke("get-platform"),
+
+  // Whether the app-drawn title bar shows in this window, and when it changes
+  // (full screen hides it).
+  getTitleBarVisible: () => ipcRenderer.invoke("get-title-bar-visible"),
+  onTitleBarVisibleChange: (callback) => {
+    const listener = (_event, visible) => callback(visible);
+    ipcRenderer.on("title-bar-visible-changed", listener);
+    return () =>
+      ipcRenderer.removeListener("title-bar-visible-changed", listener);
+  },
+  // Keeps the window controls the system draws in the colors of the theme.
+  setTitleBarOverlay: (colors) =>
+    ipcRenderer.invoke("set-title-bar-overlay", colors),
  getEmbeddedServerStatus: () =>
    ipcRenderer.invoke("get-embedded-server-status"),

@@ -58,36 +71,6 @@ contextBridge.exposeInMainWorld("electronAPI", {

  getSetting: (key) => ipcRenderer.invoke("get-setting", key),
  setSetting: (key, value) => ipcRenderer.invoke("set-setting", key, value),
-  answerC2SAuth: (id, answer) =>
-    ipcRenderer.invoke("answer-c2s-auth", id, answer),
-  onC2SAuthPrompt: (callback) => {
-    const listener = (_event, prompt) => callback(prompt);
-    ipcRenderer.on("c2s-auth-prompt", listener);
-    return () => ipcRenderer.removeListener("c2s-auth-prompt", listener);
-  },
-  getC2STunnelConfig: () => ipcRenderer.invoke("get-c2s-tunnel-config"),
-  saveC2STunnelConfig: (config) =>
-    ipcRenderer.invoke("save-c2s-tunnel-config", config),
-  checkLocalPortAvailable: (host, port) =>
-    ipcRenderer.invoke("check-local-port-available", host, port),
-  getC2STunnelPresetDefaultName: () =>
-    ipcRenderer.invoke("get-c2s-tunnel-preset-default-name"),
-  startC2STunnel: (tunnel, index, authToken) =>
-    ipcRenderer.invoke("start-c2s-tunnel", tunnel, index, authToken),
-  testC2STunnel: (tunnel, index, authToken) =>
-    ipcRenderer.invoke("test-c2s-tunnel", tunnel, index, authToken),
-  stopC2STunnel: (tunnelName) =>
-    ipcRenderer.invoke("stop-c2s-tunnel", tunnelName),
-  getC2STunnelStatuses: () => ipcRenderer.invoke("get-c2s-tunnel-statuses"),
-  onC2STunnelStatuses: (callback) => {
-    const listener = (_event, statuses) => callback(statuses);
-    ipcRenderer.on("c2s-tunnel-statuses", listener);
-    return () => ipcRenderer.removeListener("c2s-tunnel-statuses", listener);
-  },
-  startC2SAutoStartTunnels: () =>
-    ipcRenderer.invoke("start-c2s-autostart-tunnels"),
-  setC2SRelayPath: (relayPath) =>
-    ipcRenderer.invoke("set-c2s-relay-path", relayPath),

  onCloseActiveTab: (callback) => {
    const listener = () => callback();
@@ -100,32 +83,8 @@ contextBridge.exposeInMainWorld("electronAPI", {
  externalBrowserLogin: (authUrl, callbackPort) =>
    ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),

-  openExternalEditor: (fileData) =>
-    ipcRenderer.invoke("open-external-editor", fileData),
-  closeExternalEditor: (editId) =>
-    ipcRenderer.invoke("close-external-editor", editId),
-  onExternalEditorSaved: (callback) => {
-    const listener = (_event, payload) => callback(payload);
-    ipcRenderer.on("external-editor-saved", listener);
-    return () => ipcRenderer.removeListener("external-editor-saved", listener);
-  },
-
  showSaveDialog: (options) => ipcRenderer.invoke("show-save-dialog", options),
  showOpenDialog: (options) => ipcRenderer.invoke("show-open-dialog", options),
-  getLocalHomeDirectory: () => ipcRenderer.invoke("get-local-home-directory"),
-  listLocalDirectory: (dirPath) =>
-    ipcRenderer.invoke("list-local-directory", dirPath),
-  statLocalPaths: (paths) => ipcRenderer.invoke("stat-local-paths", paths),
-  collectLocalFiles: (paths) =>
-    ipcRenderer.invoke("collect-local-files", paths),
-  createLocalFolder: (parentPath, folderName) =>
-    ipcRenderer.invoke("create-local-folder", parentPath, folderName),
-  renameLocalPath: (entryPath, newName) =>
-    ipcRenderer.invoke("rename-local-path", entryPath, newName),
-  trashLocalPath: (entryPath) =>
-    ipcRenderer.invoke("trash-local-path", entryPath),
-  chmodLocalPath: (entryPath, permissions) =>
-    ipcRenderer.invoke("chmod-local-path", entryPath, permissions),
  createTempFile: (fileData) =>
    ipcRenderer.invoke("create-temp-file", fileData),
  createTempFolder: (folderData) =>
@@ -134,61 +93,14 @@ contextBridge.exposeInMainWorld("electronAPI", {
    ipcRenderer.invoke("start-drag-to-desktop", dragData),
  cleanupTempFile: (tempId) => ipcRenderer.invoke("cleanup-temp-file", tempId),

-  startLocalTerminal: (dimensions) =>
-    ipcRenderer.invoke("local-terminal-start", dimensions),
-  writeLocalTerminal: (sessionId, data) =>
-    ipcRenderer.invoke("local-terminal-write", sessionId, data),
-  readyLocalTerminal: (sessionId) =>
-    ipcRenderer.invoke("local-terminal-ready", sessionId),
-  resizeLocalTerminal: (sessionId, cols, rows) =>
-    ipcRenderer.invoke("local-terminal-resize", sessionId, cols, rows),
-  closeLocalTerminal: (sessionId) =>
-    ipcRenderer.invoke("local-terminal-close", sessionId),
-  onLocalTerminalData: (sessionId, callback) => {
-    const channel = `local-terminal:data:${sessionId}`;
-    const listener = (_event, data) => callback(data);
-    ipcRenderer.on(channel, listener);
-    return () => ipcRenderer.removeListener(channel, listener);
-  },
-  onLocalTerminalExit: (sessionId, callback) => {
-    const channel = `local-terminal:exit:${sessionId}`;
-    const listener = (_event, exitCode) => callback(exitCode);
-    ipcRenderer.on(channel, listener);
-    return () => ipcRenderer.removeListener(channel, listener);
-  },
-
-  // Dual-pane file manager: local disk browsing and streamed transfers.
-  localFs: {
-    home: () => ipcRenderer.invoke("local-fs:home"),
-    list: (dirPath) => ipcRenderer.invoke("local-fs:list", dirPath),
-    mkdir: (parentPath, name) =>
-      ipcRenderer.invoke("local-fs:mkdir", parentPath, name),
-    createFile: (parentPath, name) =>
-      ipcRenderer.invoke("local-fs:create-file", parentPath, name),
-    rename: (oldPath, newName) =>
-      ipcRenderer.invoke("local-fs:rename", oldPath, newName),
-    trash: (paths) => ipcRenderer.invoke("local-fs:trash", paths),
-    ensureDir: (dirPath, rootPath) =>
-      ipcRenderer.invoke("local-fs:ensure-dir", dirPath, rootPath),
-    exists: (paths) => ipcRenderer.invoke("local-fs:exists", paths),
-    walk: (paths) => ipcRenderer.invoke("local-fs:walk", paths),
-    reveal: (targetPath) => ipcRenderer.invoke("local-fs:reveal", targetPath),
-    open: (targetPath) => ipcRenderer.invoke("local-fs:open", targetPath),
-  },
-  localTransfer: {
-    setApiPath: (apiPath) =>
-      ipcRenderer.invoke("local-transfer:set-api", apiPath),
-    upload: (options) => ipcRenderer.invoke("local-transfer:upload", options),
-    download: (options) =>
-      ipcRenderer.invoke("local-transfer:download", options),
-    cancel: (transferId) =>
-      ipcRenderer.invoke("local-transfer:cancel", transferId),
-    onProgress: (callback) => {
-      const listener = (_event, payload) => callback(payload);
-      ipcRenderer.on("local-transfer:progress", listener);
-      return () =>
-        ipcRenderer.removeListener("local-transfer:progress", listener);
-    },
+  // Native web views placed over an element of the page (WebContentsView).
+  embeddedView: {
+    open: (options) => ipcRenderer.invoke("embedded-view-open", options),
+    setBounds: (id, bounds) =>
+      ipcRenderer.invoke("embedded-view-bounds", id, bounds),
+    setVisible: (id, visible) =>
+      ipcRenderer.invoke("embedded-view-visible", id, visible),
+    close: (id) => ipcRenderer.invoke("embedded-view-close", id),
  },

  invoke: invokeAllowed,
@@ -1,22 +0,0 @@
-const fs = require("node:fs");
-
-function renameLocalPath(source, target) {
-  if (source === target) return;
-  try {
-    fs.lstatSync(target);
-    const error = new Error("A file or folder with that name already exists");
-    error.code = "EEXIST";
-    throw error;
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  if (fs.lstatSync(source).isDirectory()) {
-    fs.renameSync(source, target);
-    return;
-  }
-  // link is exclusive: a destination created concurrently is never replaced.
-  fs.linkSync(source, target);
-  fs.unlinkSync(source);
-}
-
-module.exports = { renameLocalPath };
@@ -298,7 +298,7 @@
    {
      "name": "HTTP_PROXY",
      "group": "proxy",
-      "description": "Proxy for outbound HTTP requests, like registry downloads and webhooks."
+      "description": "Proxy for outbound HTTP requests, like plugin registry downloads and webhooks."
    },
    {
      "name": "HTTPS_PROXY",
@@ -332,17 +332,6 @@
      "default": "10000",
      "description": "Most audit entries kept. The oldest go first."
    },
-    {
-      "name": "AUDIT_LOG_FORWARD_URL",
-      "group": "logging",
-      "description": "Also POST every audit entry as JSON to this URL. Overrides the admin setting."
-    },
-    {
-      "name": "AUDIT_LOG_FORWARD_TOKEN",
-      "group": "logging",
-      "secret": true,
-      "description": "Bearer token sent with forwarded audit entries."
-    },
    {
      "name": "SESSION_RECORDING_RETENTION_DAYS",
      "group": "logging",
@@ -364,6 +353,11 @@
      "group": "plugins",
      "description": "Where plugin download counts are read from. Defaults to stats.json next to the registry index."
    },
+    {
+      "name": "TERMIX_PLUGIN_REGISTRY_PRIVATE_HOSTS",
+      "group": "plugins",
+      "description": "Comma-separated host names or IP addresses that plugin registry downloads may reach on a private address, like a registry in your LAN. List bare hosts: entries with a scheme, port or path are ignored. Matched by name only, on any port, so only list names your own DNS answers for. With HTTPS_PROXY set, add them to NO_PROXY too."
+    },
    {
      "name": "TERMIX_REQUIRE_SIGNED_PLUGINS",
      "group": "plugins",
@@ -376,6 +370,12 @@
      "default": "false",
      "description": "Start everyone in the layout repair view instead of the chosen layout. Use it when a layout plugin breaks the app."
    },
+    {
+      "name": "TERMIX_SAFE_MODE",
+      "group": "plugins",
+      "default": "false",
+      "description": "Start only layout and theme plugins. Every other plugin stays off until a restart without it, so you can turn off a plugin that breaks the server or the app."
+    },
    {
      "name": "TERMIX_BUNDLED_PLUGINS_DIR",
      "group": "plugins",
@@ -433,6 +433,12 @@
      "internal": true,
      "description": "Set by the desktop app when it runs its own backend."
    },
+    {
+      "name": "ELECTRON_USER_DATA",
+      "group": "desktop",
+      "internal": true,
+      "description": "Set by the desktop app to its user data folder."
+    },
    {
      "name": "EMBEDDED_BACKEND_PORT",
      "group": "desktop",
@@ -1,12 +1,12 @@
 {
  "name": "termix",
-  "version": "26.10.3",
+  "version": "26.10.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "termix",
-      "version": "26.10.3",
+      "version": "26.10.5",
      "hasInstallScript": true,
      "workspaces": [
        "packages/*"
@@ -15058,7 +15058,7 @@
    },
    "packages/plugin-sdk": {
      "name": "@termix-ssh/plugin-sdk",
-      "version": "1.0.12",
+      "version": "1.0.13",
      "license": "Apache-2.0",
      "dependencies": {
        "@deadendjs/swagger-jsdoc": "^8.1.2",
@@ -4,7 +4,7 @@
  "workspaces": [
    "packages/*"
  ],
-  "version": "26.10.3",
+  "version": "26.10.5",
  "description": "Self-hosted, plugin-based server management.",
  "author": "Karmaa",
  "main": "electron/main.cjs",
@@ -15,10 +15,10 @@
  "scripts": {
    "format": "prettier --write .",
    "format:check": "prettier --check .",
-    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-node-pty.cjs && node scripts/patch-ssh2-agent.cjs",
+    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-node-pty.cjs && node scripts/patch-ssh2-agent.cjs && node scripts/patch-ssh2-sk.cjs",
    "prepare": "husky || true",
    "prebuild": "node scripts/write-electron-build-info.cjs",
-    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/check-sdk-guide.cjs && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
+    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/check-button-colors.cjs && node scripts/check-sdk-guide.cjs && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
    "lint:fix": "eslint --fix .",
    "type-check": "npm run build:sdk && tsc -b --force",
    "test": "vitest run",
@@ -31,7 +31,8 @@
    "dev:docker": "node scripts/dev.mjs docker",
    "dev:frontend": "vite",
    "build": "npm run build:sdk && vite build && node scripts/stamp-sw-build-info.cjs && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\" && npm run build:plugins",
-    "build:backend": "npm run build:sdk && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\" && npm run build:plugins",
+    "build:backend:core": "npm run build:sdk && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\"",
+    "build:backend": "npm run build:backend:core && npm run build:plugins",
    "generate:openapi": "npm run build:sdk && node scripts/generate-openapi.mjs",
    "electron:rebuild": "electron-rebuild -f -o better-sqlite3,@serialport/bindings-cpp,node-pty",
    "build:win-portable": "npm run build && npm run electron:rebuild && electron-builder --win --dir",
@@ -1,5 +1,96 @@
 # Changelog

+## 1.0.20
+
+Plugin API 1.12.0.
+
+### Added
+
+- `columns` and `onColumns` on `ViewToggle` show a cards per row picker: Auto fits as many as the pane has room for, or pick 1 to 6
+- `size` and `minCardWidth` on `DataView`, so a card grid follows that pick, and the `GridSize` type
+- `usePluginPanelView` also keeps `columns`, the cards per row pick, with `setColumns`
+
+## 1.0.19
+
+Plugin API 1.11.0.
+
+### Added
+
+- `app.registerCompanionLayout` and `useCompanions`, so a plugin can let each host turn the panel bar on or off, move it and choose which panels show and in what order
+
+## 1.0.18
+
+Plugin API 1.10.0.
+
+### Added
+
+- `clientCert` on the sync link, link patch and remote target, and the `client_cert` remote error kind, so a sync plugin can link to a server that needs mutual TLS
+
+## 1.0.17
+
+Plugin API 1.9.0.
+
+### Added
+
+- `app.registerCompanion` and `app.toggleCompanion`, so a plugin can add a panel beside any host tab. The user opens, resizes and moves it, and the tab keeps running
+- `NativeView` in `@termix-ssh/plugin-sdk/ui`, which shows a web page in a native view in the desktop app, for sites that do not work in an iframe
+
+## 1.0.16
+
+Plugin API 1.8.0.
+
+### Added
+
+- `ctx.sync.provide` and the `sync:provide` capability, so a plugin can answer every /sync request
+- `ctx.ssh.transports.provide` and the `ssh:transport` capability, so a plugin can carry SSH connections over its own stream
+- `ctx.hosts.folders.ensure` and `removeEmpty`
+
+### Removed
+
+- The sync screens and calls in `@termix-ssh/plugin-sdk/ui`: `LinkServerDialog`, `ProxySettingsFields`, `useSyncStatus`, `refreshSyncStatus`, `setSyncStatus`, `getSyncConflicts`, `getSyncErrors`, `retrySyncErrors`, `settleSyncConflict`, `syncNow`, `unlinkServer`, `updateSyncSettings` and their types. They moved into the sync plugin
+
+## 1.0.15
+
+Plugin API 1.7.0.
+
+### Added
+
+- `ctx.auth.policy.provide` and the `auth:policy` capability, so a plugin can set an idle timeout, cap session length, turn off remember me and require a second factor
+- `ctx.auth.listSecondFactors` lists the second factors from every running plugin
+- `AuthEnrollmentSections` takes `factorsOnly`
+- `getHttpsSettings` and `updateHttpsSettings` in `@termix-ssh/plugin-sdk/ui`
+
+### Fixed
+
+- Plugin frontend tests against a locally linked SDK failed with a second copy of React
+
+## 1.0.14
+
+Plugin API 1.6.0.
+
+### Added
+
+- `ctx.hosts.locks.provide` and the `hosts:lock` capability, so a plugin can manage hosts that stay read only for everyone else and block adding hosts by hand
+- `ctx.hosts.setShares` to replace every grant on a host in one call
+- `ctx.credentials.list` returns the acting user's credentials by name, without secrets
+- `ctx.hosts.create` and `update` take `password`, `key`, `keyPassword`, `keyType`, `sudoPassword`, `protocolAuth` and `pluginEnable`
+
+## 1.0.13
+
+Plugin API 1.5.0.
+
+### Added
+
+- `runtime: "desktop"` in the manifest for a plugin that only loads on the desktop app
+- `desktop:local` and `ctx.desktop.local`: file system, local shell and machine info on the desktop app's own backend
+- `ctx.audit.subscribe`, `ctx.audit.list` and `ctx.audit.exportBatches` under `audit:read`
+- `ctx.hosts.importMany`, `importSshConfig`, `exportMany` and `registerImportNormalizer`, with the `hosts:export` capability
+- `ctx.credentials.publicKey` and `resolveKeyRefs`, `ctx.ssh.exec`, and `@termix-ssh/plugin-sdk/ssh-keys`
+- `ctx.hosts.status.provide` and `ctx.hosts.activity.provide` so a plugin can own host status and recent activity, with `ctx.network.tcpProbe`, `ctx.ssh.probe`, `ctx.hosts.probeTargets` and `ctx.hosts.sessionActive`
+- `registerHostStatusIndicator` and `registerHostEditorToolbarItem`, and `order` for host badges
+- Onboarding steps can sit in a `start` section, take a `position` and `replaces` a core step
+- A plugin can provide the app name, tagline and logo through the `<id>.brandingProvider` registry key
+
 ## 1.0.12

 Plugin API 1.4.0.
@@ -1,6 +1,6 @@
 # Termix plugin guide

-SDK 1.0.12 | Plugin API 1.4.0
+SDK 1.0.20 | Plugin API 1.12.0

 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
@@ -164,7 +164,7 @@ Unknown fields are refused at every level, so a typo fails validation. The schem
 | `icon`                                 | A [Lucide](https://lucide.dev/icons/) icon name, like `Hand`.                                                       |
 | `features`                             | Up to 20 short lines shown on the plugin's page.                                                                    |
 | `docs`                                 | An https link to your docs.                                                                                         |
-| `engine.termix`                        | Termix versions you work with, like `>=26.10.0`.                                                                    |
+| `engine.termix`                        | Termix versions you work with, like `>=26.10.0`. Older Termix builds don't list a release they can't run.           |
 | `engine.api`                           | Plugin API range, like `^1.2`. A major bump of the API is breaking.                                                 |
 | `capabilities`                         | What your code may do. See the reference at the end.                                                                |
 | `dependencies`, `optionalDependencies` | Other plugins, `{ "snippets": "^1.0.0" }`. You must keep working without optional ones.                             |
@@ -202,36 +202,40 @@ Bundled as ESM for Node 22+ into `dist/backend.js`. Backend imports of your own

 ### What ctx has

-| Member                 | Capability                       | What it does                                                   |
-| ---------------------- | -------------------------------- | -------------------------------------------------------------- |
-| `pluginId`, `manifest` | none                             | Your id and manifest                                           |
-| `log`                  | none                             | Log lines tagged with your plugin                              |
-| `db`                   | `db:own`                         | Your own tables                                                |
-| `kv`                   | `kv:own`                         | Small key value state                                          |
-| `files.dataDir()`      | `files:own`                      | A folder of your own                                           |
-| `settings`             | none                             | Your settings                                                  |
-| `secrets`              | `secrets:own`                    | Encrypted values per user, `seal`/`unseal` for your own tables |
-| `http`, `ws`           | `network:serve`                  | Routes and sockets                                             |
-| `rbac`                 | none                             | Check the actor's permissions                                  |
-| `hosts`                | `hosts:read`, `hosts:write`      | List, read, create, update and share hosts as the actor        |
-| `ssh`                  | `ssh:connect`, `credentials:use` | Connect to hosts through Termix's SSH pipeline                 |
-| `credentials`          | varies                           | The actor's saved keys, and protocol logins                    |
-| `services`             | per service                      | Call other plugins and offer your own                          |
-| `events`               | `events:core` for core topics    | Emit and listen for events                                     |
-| `notify`               | `notify:send`                    | Send alerts to the Alerts inbox                                |
-| `fetch`                | `network:outbound`               | Outbound HTTP with SSRF protection                             |
-| `process`              | `process:spawn`                  | Run programs on the server                                     |
-| `schedule`             | none                             | Timers that stop on disable and never overlap                  |
-| `audit.record`         | none                             | Write your own audit line                                      |
-| `sync`                 | none                             | Sync your tables to a linked desktop                           |
-| `auth`                 | `auth:provide`                   | Login methods, second factors, SSH auth types                  |
-| `auth.issueUserToken`  | `users:impersonate`              | A short-lived session for calling Termix's API as a user       |
-| `users.getLocale`      | `users:read`                     | A user's UI language                                           |
-| `system`               | `system:tls`                     | The server's HTTPS certificate                                 |
-| `plugins.list()`       | `plugins:read`                   | Which plugins are installed                                    |
-| `asUser(userId, fn)`   | always audited                   | Run background work as a user                                  |
-| `currentActor()`       | none                             | The user the current call runs for                             |
-| `disposables.add(fn)`  | none                             | Extra cleanup on disable                                       |
+| Member                 | Capability                       | What it does                                                    |
+| ---------------------- | -------------------------------- | --------------------------------------------------------------- |
+| `pluginId`, `manifest` | none                             | Your id and manifest                                            |
+| `log`                  | none                             | Log lines tagged with your plugin                               |
+| `db`                   | `db:own`                         | Your own tables                                                 |
+| `kv`                   | `kv:own`                         | Small key value state                                           |
+| `files.dataDir()`      | `files:own`                      | A folder of your own                                            |
+| `settings`             | none                             | Your settings                                                   |
+| `secrets`              | `secrets:own`                    | Encrypted values per user, `seal`/`unseal` for your own tables  |
+| `http`, `ws`           | `network:serve`                  | Routes and sockets                                              |
+| `rbac`                 | none                             | Check the actor's permissions                                   |
+| `hosts`                | `hosts:read`, `hosts:write`      | List, read, create, update and share hosts as the actor         |
+| `ssh`                  | `ssh:connect`, `credentials:use` | Connect to hosts through Termix's SSH pipeline                  |
+| `credentials`          | varies                           | The actor's saved keys, and protocol logins                     |
+| `services`             | per service                      | Call other plugins and offer your own                           |
+| `events`               | `events:core` for core topics    | Emit and listen for events                                      |
+| `notify`               | `notify:send`                    | Send alerts to the Alerts inbox                                 |
+| `fetch`                | `network:outbound`               | Outbound HTTP with SSRF protection                              |
+| `process`              | `process:spawn`                  | Run programs on the server                                      |
+| `schedule`             | none                             | Timers that stop on disable and never overlap                   |
+| `audit.record`         | none                             | Write your own audit line                                       |
+| `sync`                 | none                             | Sync your tables to a linked desktop                            |
+| `auth`                 | `auth:provide`                   | Login methods, second factors, SSH auth types                   |
+| `auth.issueUserToken`  | `users:impersonate`              | A short-lived session for calling Termix's API as a user        |
+| `auth.policy`          | `auth:policy`                    | Login rules: idle timeout, session length, second factors       |
+| `sync.provide`         | `sync:provide`                   | Answers all /sync requests: server sync, linked desktops        |
+| `ssh.transports`       | `ssh:transport`                  | Carries a host's SSH connection over your own stream            |
+| `hosts.folders`        | `hosts:write`                    | Create a folder row with a color and icon, remove it when empty |
+| `users.getLocale`      | `users:read`                     | A user's UI language                                            |
+| `system`               | `system:tls`                     | The server's HTTPS certificate                                  |
+| `plugins.list()`       | `plugins:read`                   | Which plugins are installed                                     |
+| `asUser(userId, fn)`   | always audited                   | Run background work as a user                                   |
+| `currentActor()`       | none                             | The user the current call runs for                              |
+| `disposables.add(fn)`  | none                             | Extra cleanup on disable                                        |

 ### The actor

@@ -300,6 +304,14 @@ router.post("/notes", async (req, res) => {
 - `ctx.rbac.require("manage")` on a single route, `await ctx.rbac.has("manage")` in code. A full id like
  `hosts.edit` checks a core permission.
 - Host access: `ctx.hosts.checkAccess(hostId, "connect" | "view" | "edit" | "manage")`.
+- Transports: with `ssh:transport`, `ctx.ssh.transports.provide({ claims(hostId), open({ id, ip, port }) })`
+  returns a stream the SSH client uses instead of a direct, proxy or jump host connection. Core also serves
+  `/plugin-ws/core/ssh-relay?hostId=` for callers with connect access, so one Termix can relay to another.
+- Managed hosts: with `hosts:lock`, `ctx.hosts.locks.provide({ isLocked, note, allowManualCreate })` makes
+  the hosts you manage read only for the UI, the API and other plugins (pins and order still work), and
+  `allowManualCreate: () => false` blocks adding hosts by hand. Your own `ctx.hosts` writes still go
+  through. `ctx.hosts.setShares(hostId, grants)` replaces a host's whole grant list, and
+  `ctx.credentials.list()` finds the acting user's credentials by name.

 ### Errors

@@ -325,6 +337,24 @@ try {
 commands. `@termix-ssh/plugin-sdk/host-commands` has helpers to detect the OS and run package manager and
 sudo commands. Hosts from `ctx.hosts` never carry secrets. Pass the host or its id to `ctx.ssh`.

+### The desktop app
+
+Set `"runtime": "desktop"` in the manifest for a plugin that only makes sense on a desktop app. It never
+loads on a server, ignores server sync and may declare `desktop:local`. Any plugin can declare
+`desktop:local` and check `ctx.desktop.local.available()` at runtime.
+
+`ctx.desktop.local` works on the desktop app's own backend only:
+
+- `info()`: home folder, platform, user data folder, backend port and the linked server (url and token) or null
+- `fs`: `list`, `mkdir`, `createFile`, `rename`, `ensureDir`, `exists`, `walk`, `trash`, `reveal`, `open`,
+  `openRead` and `openDownload`. Downloads stay inside the folder the user picked, links in it are refused and
+  an existing file is never replaced by accident
+- `pty.spawn()`: a local shell, stopped when the plugin stops
+- `pluginFetch(origin, subPath, init)`: calls this plugin's own routes on the desktop's backend ("local") or the linked server ("remote") as the acting user. Bodies can be streams, so a plugin can move big files without the renderer
+
+Use `ctx.audit.subscribe`, `list` and `exportBatches` (`audit:read`) to read the audit trail. Subscribers
+are called after a line is accepted and never delay the action that wrote it.
+
 ### Events, timers, alerts, services

 ```ts
@@ -465,18 +495,22 @@ your plugin's error boundary and Suspense.
 | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
 | `registerRailItem`                                                                 | A sidebar rail button                                             |
 | `registerTab`, `registerPanel`                                                     | A tab type or sidebar panel (id in `contributes.tabs` / `panels`) |
+| `registerCompanion`, `toggleCompanion`                                             | A panel beside any host tab, bound to its host and handle         |
+| `registerCompanionLayout`                                                          | Per host on/off, side, order and hidden panels for a tab type     |
 | `registerDashboardCard`                                                            | A dashboard card (`contributes.dashboardCards`)                   |
 | `registerHostAction`                                                               | A host button, palette entry or default connect                   |
 | `registerHostEditorSection`                                                        | Your own host editor section (host settings get one for free)     |
 | `registerHostProtocol`                                                             | A connection protocol next to SSH                                 |
 | `registerHostBadge`, `registerHostContextMenuItem`                                 | Badges and menu items on host rows                                |
+| `registerHostStatusIndicator`                                                      | The status dot or stripe on a host row (a layout draws it)        |
+| `registerHostEditorToolbarItem`                                                    | A control in the host editor toolbar (a layout draws it)          |
 | `registerPaletteEntry`, `registerPaletteGroup`                                     | Command palette entries                                           |
 | `registerKeybindingAction`, `registerKeybindingDefault`                            | Bindable actions                                                  |
 | `registerSettingsComponent`                                                        | A component for a `custom` settings field                         |
 | `registerAction`, `invokeAction`                                                   | Actions across plugins                                            |
 | `registerSlotContribution`, `declareActionSlot`                                    | Fill or own a UI slot                                             |
 | `registerComponent`, `registerExtension`                                           | Offer a component by id, add to an extension point                |
-| `registerOnboardingStep`                                                           | A first run setup step                                            |
+| `registerOnboardingStep`                                                           | A first run setup step (`section`, `position`, `replaces`)        |
 | `registerLoginMethod`, `registerSecondFactorUI`, `registerSshAuthEditor`           | Sign in UI                                                        |
 | `registerLayout`                                                                   | A whole-app layout (`contributes.layouts`, API 1.4)               |
 | `api`                                                                              | Axios client for your `/plugin-api/<id>/` routes, auth included   |
@@ -484,6 +518,16 @@ your plugin's error boundary and Suspense.
 | `docs`, `tabs`, `confirm`, `listHosts`, `getHost`, `t`, `hasPermission`, `desktop` | Helpers                                                           |
 | `onSettingsChanged`, `onDispose`                                                   | Hooks                                                             |

+Badges, status indicators and toolbar items take `{ id, when(host), component, order? }`; lower `order`
+comes first. An onboarding step sits in a section (`start`, `setup`, `explore`, `security`) or at an exact
+`position` from 1 to 99. `replaces: ["preset"]` lists older step keys the step took over, so people who saw
+those are not shown it again.
+
+Branding: a plugin that owns the app name, tagline and logo provides
+`ctx.registry.provide("<id>.brandingProvider", async () => ({ appName, tagline, logo }))` in its backend.
+Core reads it for `GET /users/branding` (the login page, the browser tab and the sync server name) and falls
+back to "Termix" with no logo when no plugin provides one. `logo` is a PNG data URL or null.
+
 Hooks from `@termix-ssh/plugin-sdk/frontend`: `useTranslation`, `usePermission`, `useSettings`, `useHost`,
 `useHosts`, `usePluginApi`, `useCurrentUser`, `useTheme`, `useToast`, `useDocsUrl`, `useTabs`,
 `useSlotContributions`, `useSshAuthTypes`, `useExtensions`, `useShell`.
@@ -563,8 +607,6 @@ export function activate(app: TermixApp) {
  `classic-layout.hostTree` and `classic-layout.dashboard` for other plugins to place with `PluginComponent`.
  It reads the shell with `useShellController()` from `@termix-ssh/plugin-sdk/ui`, which exposes more than
  `useShell()` and may change with Termix. A third party layout should start from `useShell()`.
- Example Top Bar Layout (https://github.com/Termix-SSH/Plugin-Example-Topbar-Layout) is a small third party
-  style layout built only on `useShell()`, `TabStage` and `@termix-ssh/plugin-sdk/ui`, with a phone version.

 A theme is CSS only. Declare it in `contributes.themes` (`id`, `label`, `mode` light or dark, `css` path,
 optional `swatch` colors for the picker) with the `ui:theme` capability. The id becomes a class on `<html>`,
@@ -582,9 +624,7 @@ A plugin that only holds themes needs no code. Leave out `src/`: `termix-plugin
 - Themes show in the picker in the order core lists its own, then the plugin's order.
 - A theme someone saved that no longer exists shows as System. It comes back when the plugin does.
 - Accent color, UI font, font size and density are not part of a theme. Core applies them on top.
- Bundled Classic Themes (https://github.com/Termix-SSH/Plugin-Classic-Themes) is a full example, and
-  Example Theme (https://github.com/Termix-SSH/Plugin-Example-Theme) a small one with one light and one dark
-  theme.
+- Bundled Classic Themes (https://github.com/Termix-SSH/Plugin-Classic-Themes) is a full example.

 ## Looking native

@@ -592,6 +632,9 @@ Build UI from `@termix-ssh/plugin-sdk/ui` so it matches Termix and follows the t
 exports with props is `ui.api.txt` in the Termix repo
 (https://github.com/Termix-SSH/Termix/blob/main/packages/plugin-sdk/ui.api.txt).

+- Web pages that break in an iframe: `NativeView` (props `url`, `ignoreCert`, `hidden`, `fallback`) shows the
+  page in a native view in the desktop app. It fills its element, hides while a dialog or menu is open and renders
+  `fallback` in a browser.
 - Square: panels, cards and containers have no rounded corners. Small controls may stay rounded.
 - Flat: borders, not shadows. Use theme tokens like `border-border`, `bg-background`,
  `text-muted-foreground`, `text-destructive`. One accent, `text-accent-brand`. Don't add colors.
@@ -600,6 +643,9 @@ exports with props is `ui.api.txt` in the Termix repo
  `PanePrompt` for small prompts.
 - Every tab or panel sits in `PanelShell`. Lists use `PanelList` and `ListRow`, add with `AddButton`,
  forms end with `FormFooter`, empty lists show `EmptyState`.
+- Card grids use `DataView` with `ViewToggle`. Pass `columns` and `onColumns` to `ViewToggle` and the same
+  value as `size` to `DataView`, so users can pick Auto (as many as fit) or a fixed number of cards per
+  row. `usePluginPanelView` keeps the choice as `columns`. Older Termix versions ignore both props.
 - Forms: `TextField`, `NumberField`, `SelectField`, `SwitchRow`, `SecretField`, `SettingRow` and friends.
 - Host sessions use `ConnectionGate` for the whole connect flow (host keys, TOTP, passphrases, errors).
 - Mobile: check `useIsMobile()` and give small screens a layout that works. The desktop app always uses the
@@ -668,6 +714,21 @@ closely. Declare ids in `contributes.auth` and register them with `ctx.auth.regi
 `registerSecondFactor` or `registerSshAuthProvider`. Connection protocols go in `contributes.protocols`
 and `app.registerHostProtocol`. Read https://docs.termix.site/develop/auth before starting one.

+Login rules need `auth:policy`. `ctx.auth.policy.provide({ evaluate, allowRememberDevice })` is asked at
+every login with the user, the method, the device and every second factor (`ctx.auth.listSecondFactors()`
+lists them too). `evaluate` returns `allowRememberDevice`, `maxSessionSeconds`, `idleTimeoutSeconds` and
+`secondFactor` (`"always"` or `"new-device"`). The strictest answer from all plugins wins, and a throw
+refuses the login. A user who must have a second factor but has none gets a session that can only set one
+up, and `/users/me` reports `restriction: "second-factor-setup"`.
+
+Sync is answered by one plugin. `sync:provide` is high risk: `ctx.sync.provide({ handle })` takes over every
+request under `/sync` (an Express style handler, 404 when nothing provides it), and `ctx.sync.host` hands
+over the neutral parts core keeps: the replica store (`replica`), the change feed and push applier
+(`feed`), the linked server list (`links`, one per local user), desktop accounts (`accounts`), sessions
+(`sessions`), host lookups, plugin mirroring and the proxy settings the desktop app needs. A test passes its
+own `syncHost` to `createMockCtx`. An API key can ask `POST /users/ws-ticket/api-key` for a one minute
+ticket that opens plugin sockets as its user, which is how one server opens sessions through another.
+
 ## Testing

 ```ts
@@ -832,60 +893,70 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie

 ## SDK entry points

-| Import                                                               | What it is                                                            |
-| -------------------------------------------------------------------- | --------------------------------------------------------------------- |
-| `@termix-ssh/plugin-sdk/backend`                                     | `PluginContext` and the backend types                                 |
-| `@termix-ssh/plugin-sdk/frontend`                                    | `TermixApp`, `TabProps` and the hooks                                 |
-| `@termix-ssh/plugin-sdk/ui`                                          | The UI kit, served by Termix at runtime                               |
-| `@termix-ssh/plugin-sdk/db`                                          | `defineTable` and column builders                                     |
-| `@termix-ssh/plugin-sdk/manifest`                                    | `PluginManifest` type and manifest checks                             |
-| `@termix-ssh/plugin-sdk/capabilities`                                | The capability catalog                                                |
-| `@termix-ssh/plugin-sdk/settings`                                    | Settings field validation                                             |
-| `@termix-ssh/plugin-sdk/testing`                                     | `createMockCtx`, `createTestDb`, `renderWithApp`, `createFakeContext` |
-| `@termix-ssh/plugin-sdk/vitest-preset`                               | `pluginVitestConfig`                                                  |
-| `@termix-ssh/plugin-sdk/host-commands`                               | OS detection, package manager and sudo helpers over ssh2              |
-| `@termix-ssh/plugin-sdk/ssh-certs`                                   | `applyCertificateAuth()` for certificate based SSH auth               |
-| `@termix-ssh/plugin-sdk/desktop`                                     | The desktop app bridge, typed. Check it exists before use             |
-| `@termix-ssh/plugin-sdk/openapi`                                     | `buildOpenApi()`                                                      |
-| `@termix-ssh/plugin-sdk/changelog`                                   | Changelog parsing and checks                                          |
-| `@termix-ssh/plugin-sdk/docs`                                        | Docs link and env var helpers                                         |
-| `@termix-ssh/plugin-sdk/ddl`, `@termix-ssh/plugin-sdk/table-builder` | Table to SQL and Drizzle mapping. You rarely need these               |
+| Import                                                               | What it is                                                                                     |
+| -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `@termix-ssh/plugin-sdk/backend`                                     | `PluginContext` and the backend types                                                          |
+| `@termix-ssh/plugin-sdk/frontend`                                    | `TermixApp`, `TabProps` and the hooks                                                          |
+| `@termix-ssh/plugin-sdk/ui`                                          | The UI kit, served by Termix at runtime                                                        |
+| `@termix-ssh/plugin-sdk/db`                                          | `defineTable` and column builders                                                              |
+| `@termix-ssh/plugin-sdk/manifest`                                    | `PluginManifest` type and manifest checks                                                      |
+| `@termix-ssh/plugin-sdk/capabilities`                                | The capability catalog                                                                         |
+| `@termix-ssh/plugin-sdk/settings`                                    | Settings field validation                                                                      |
+| `@termix-ssh/plugin-sdk/testing`                                     | `createMockCtx`, `createTestDb`, `renderWithApp`, `createFakeContext`                          |
+| `@termix-ssh/plugin-sdk/vitest-preset`                               | `pluginVitestConfig`                                                                           |
+| `@termix-ssh/plugin-sdk/host-commands`                               | OS detection, package manager and sudo helpers over ssh2                                       |
+| `@termix-ssh/plugin-sdk/ssh-certs`                                   | `applyCertificateAuth()` for certificate based SSH auth                                        |
+| `@termix-ssh/plugin-sdk/ssh-keys`                                    | `generateSshKeyPair()`, `detectSshKeyType()`, `publicKeyFromPrivate()`, `validateSshKeyPair()` |
+| `@termix-ssh/plugin-sdk/desktop`                                     | The desktop app bridge, typed. Check it exists before use                                      |
+| `@termix-ssh/plugin-sdk/openapi`                                     | `buildOpenApi()`                                                                               |
+| `@termix-ssh/plugin-sdk/changelog`                                   | Changelog parsing and checks                                                                   |
+| `@termix-ssh/plugin-sdk/docs`                                        | Docs link and env var helpers                                                                  |
+| `@termix-ssh/plugin-sdk/ddl`, `@termix-ssh/plugin-sdk/table-builder` | Table to SQL and Drizzle mapping. You rarely need these                                        |

 ## Capabilities

-| Capability           | Risk     | What it allows                                          |
-| -------------------- | -------- | ------------------------------------------------------- |
-| `credentials:read`   | critical | Read stored secrets for hosts the user can reach        |
-| `system:tls`         | critical | Replace the HTTPS certificate, answer CA domain checks  |
-| `ssh:connect`        | high     | Run any command on hosts, with the user's access        |
-| `process:spawn`      | high     | Run programs on the Termix server                       |
-| `users:write`        | high     | Add users and change their roles                        |
-| `users:impersonate`  | high     | Act as another user, or get a session for them, audited |
-| `db:core-refs`       | high     | Query core users, roles and hosts tables (read only)    |
-| `auth:provide`       | high     | Add login methods, second factors, SSH auth types       |
-| `device:serial`      | high     | Open serial and USB ports on the server                 |
-| `notify:hub`         | high     | Receive every alert (the alerts hub only)               |
-| `ui:layout`          | high     | Replace the whole app layout                            |
-| `hosts:write`        | medium   | Add and edit hosts                                      |
-| `credentials:use`    | medium   | Connect with saved credentials without seeing them      |
-| `credentials:write`  | medium   | Save new credentials                                    |
-| `network:outbound`   | medium   | Outbound HTTP through `ctx.fetch`                       |
-| `network:serve`      | medium   | HTTP routes and sockets                                 |
-| `network:broadcast`  | medium   | Local network broadcasts, like Wake-on-LAN              |
-| `users:read`         | medium   | Usernames, roles and UI language                        |
-| `events:core`        | medium   | Listen to core events                                   |
-| `notify:send`        | medium   | Send alerts                                             |
-| `audit:read`         | medium   | Read the audit log                                      |
-| `desktop:window`     | medium   | Open windows in the desktop app                         |
-| `hosts:read`         | low      | Read hosts the user can see                             |
-| `db:own`             | low      | Your own tables                                         |
-| `kv:own`             | low      | Small key value state                                   |
-| `files:own`          | low      | Your own folder on disk                                 |
-| `secrets:own`        | low      | Your own encrypted secrets                              |
-| `settings:read-core` | low      | Read Termix server settings                             |
-| `plugins:read`       | low      | See installed plugins                                   |
-| `ui:surface`         | low      | Add tabs, panels and settings                           |
-| `ui:theme`           | low      | Add color themes, CSS only                              |
+| Capability               | Risk     | What it allows                                                |
+| ------------------------ | -------- | ------------------------------------------------------------- |
+| `credentials:read`       | critical | Read stored secrets for hosts the user can reach              |
+| `system:tls`             | critical | Replace the HTTPS certificate, answer CA domain checks        |
+| `ssh:connect`            | high     | Run any command on hosts, with the user's access              |
+| `process:spawn`          | high     | Run programs on the Termix server                             |
+| `users:write`            | high     | Add users and change their roles                              |
+| `users:impersonate`      | high     | Act as another user, or get a session for them, audited       |
+| `db:core-refs`           | high     | Query core users, roles and hosts tables (read only)          |
+| `auth:provide`           | high     | Add login methods, second factors, SSH auth types             |
+| `auth:policy`            | high     | Set login rules: idle timeout, session length, 2FA            |
+| `sync:provide`           | high     | Run sync: answer every /sync request                          |
+| `device:serial`          | high     | Open serial and USB ports on the server                       |
+| `desktop:local`          | high     | Use the user's own computer, desktop app only                 |
+| `hosts:export`           | high     | Export hosts with their saved logins                          |
+| `notify:hub`             | high     | Receive every alert (the alerts hub only)                     |
+| `ui:layout`              | high     | Replace the whole app layout                                  |
+| `hosts:write`            | medium   | Add and edit hosts                                            |
+| `hosts:status-provide`   | medium   | Be the source of host status dots                             |
+| `hosts:activity-provide` | medium   | Be the source of the recent activity list                     |
+| `ssh:transport`          | high     | Carry SSH connections for hosts it claims over its own stream |
+| `hosts:lock`             | medium   | Make hosts it manages read only for everyone else             |
+| `network:probe`          | medium   | Check that a host answers on a TCP port                       |
+| `credentials:use`        | medium   | Connect with saved credentials without seeing them            |
+| `credentials:write`      | medium   | Save new credentials                                          |
+| `network:outbound`       | medium   | Outbound HTTP through `ctx.fetch`                             |
+| `network:serve`          | medium   | HTTP routes and sockets                                       |
+| `network:broadcast`      | medium   | Local network broadcasts, like Wake-on-LAN                    |
+| `users:read`             | medium   | Usernames, roles and UI language                              |
+| `events:core`            | medium   | Listen to core events                                         |
+| `notify:send`            | medium   | Send alerts                                                   |
+| `audit:read`             | medium   | Read the audit log                                            |
+| `desktop:window`         | medium   | Open windows in the desktop app                               |
+| `hosts:read`             | low      | Read hosts the user can see                                   |
+| `db:own`                 | low      | Your own tables                                               |
+| `kv:own`                 | low      | Small key value state                                         |
+| `files:own`              | low      | Your own folder on disk                                       |
+| `secrets:own`            | low      | Your own encrypted secrets                                    |
+| `settings:read-core`     | low      | Read Termix server settings                                   |
+| `plugins:read`           | low      | See installed plugins                                         |
+| `ui:surface`             | low      | Add tabs, panels and settings                                 |
+| `ui:theme`               | low      | Add color themes, CSS only                                    |

 An update that adds a capability waits for an admin to approve it.

@@ -1,6 +1,6 @@
 {
  "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.12",
+  "version": "1.0.20",
  "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
  "license": "Apache-2.0",
  "repository": {
@@ -85,6 +85,10 @@
      "types": "./dist/ssh-certs.d.ts",
      "default": "./dist/ssh-certs.js"
    },
+    "./ssh-keys": {
+      "types": "./dist/ssh-keys.d.ts",
+      "default": "./dist/ssh-keys.js"
+    },
    "./tsconfig.plugin.json": "./tsconfig.plugin.json",
    "./schema/manifest.schema.json": "./schema/manifest.schema.json",
    "./ui": {
@@ -151,9 +151,13 @@
          "process:spawn",
          "users:write",
          "auth:provide",
+          "auth:policy",
+          "sync:provide",
+          "ssh:transport",
          "system:tls",
          "device:serial",
          "hosts:write",
+          "hosts:export",
          "credentials:use",
          "credentials:write",
          "network:outbound",
@@ -163,7 +167,12 @@
          "events:core",
          "notify:send",
          "audit:read",
+          "network:probe",
+          "hosts:status-provide",
+          "hosts:activity-provide",
+          "hosts:lock",
          "desktop:window",
+          "desktop:local",
          "users:impersonate",
          "db:core-refs",
          "hosts:read",
@@ -1261,6 +1270,11 @@
      "enum": ["mirror", "local", "server"],
      "description": "How a desktop linked to a server treats this plugin: mirror follows the server, local is decided on each desktop, server never runs on a linked desktop. Defaults to mirror."
    },
+    "runtime": {
+      "type": "string",
+      "enum": ["desktop"],
+      "description": "desktop: the plugin only loads on a desktop app's own embedded backend, never on a server. It implies desktop local and may declare desktop:local."
+    },
    "nativeDependencies": {
      "type": "array",
      "minItems": 1,
@@ -47,21 +47,30 @@ export const CAPABILITY_CATALOG: readonly CapabilityInfo[] = [
  entry("users:impersonate", "high"),
  entry("db:core-refs", "high"),
  entry("auth:provide", "high"),
+  entry("auth:policy", "high"),
+  entry("sync:provide", "high"),
+  entry("ssh:transport", "high"),
  entry("device:serial", "high"),
  entry("notify:hub", "high"),
  entry("ui:layout", "high"),

  entry("hosts:write", "medium"),
+  entry("hosts:export", "high"),
  entry("credentials:use", "medium"),
  entry("credentials:write", "medium"),
  entry("network:outbound", "medium"),
  entry("network:serve", "medium"),
  entry("network:broadcast", "medium"),
+  entry("network:probe", "medium"),
+  entry("hosts:status-provide", "medium"),
+  entry("hosts:activity-provide", "medium"),
+  entry("hosts:lock", "medium"),
  entry("users:read", "medium"),
  entry("events:core", "medium"),
  entry("notify:send", "medium"),
  entry("audit:read", "medium"),
  entry("desktop:window", "medium"),
+  entry("desktop:local", "high"),

  entry("hosts:read", "low"),
  entry("db:own", "low"),
@@ -256,6 +256,7 @@ export const LEGACY_TABLE_OWNERS: Readonly<Record<string, string>> = {
  homepage_items: "homepage",
  homepage_layouts: "homepage",
  dashboard_service_links: "homepage",
+  recent_activity: "homepage",
  secret_sources: "secret-sources",
  opkssh_tokens: "opkssh",
  vault_profiles: "vault",
@@ -3,8 +3,6 @@
 * only inside the Termix desktop app; check isElectron before calling it.
 */

-import type { PluginSshPromptRequest } from "./backend.js";
-
 export interface ServerConfig {
  serverUrl?: string;
  allowInvalidCertificate?: boolean;
@@ -33,31 +31,21 @@ export interface DialogResult {
  [key: string]: unknown;
 }

-export interface LocalDirectoryResult {
-  success: boolean;
-  path: string;
-  parent?: string;
-  entries: LocalFileEntry[];
-  error?: string;
-}
-
-export interface LocalCollectedFile {
-  path: string;
-  name: string;
-  relativePath: string;
-  size: number;
-  created?: string;
-  modified: string;
-}
-
-export type LocalPathMutationResult =
-  | ({ success: true } & Partial<LocalFileEntry>)
-  | { success: false; error?: string };
-
 export interface ElectronAPI {
  getAppVersion: () => Promise<string>;
  setZoomFactor?: (factor: number) => void;
  getPlatform: () => Promise<string>;
+  /** Whether the app-drawn title bar shows in this window. */
+  getTitleBarVisible?: () => Promise<boolean>;
+  /** Calls back when the title bar shows or hides; returns an unsubscribe. */
+  onTitleBarVisibleChange?: (
+    callback: (visible: boolean) => void,
+  ) => () => void;
+  /** Keeps the window controls the system draws in the colors of the theme. */
+  setTitleBarOverlay?: (colors: {
+    color?: string;
+    symbolColor?: string;
+  }) => Promise<void>;
  getSetting?: (key: string) => Promise<string | null | undefined>;
  setSetting?: (key: string, value: string) => Promise<void>;

@@ -67,60 +55,6 @@ export interface ElectronAPI {
    serverUrl: string,
    allowInvalidCertificate?: boolean,
  ) => Promise<ConnectionTestResult>;
-  answerC2SAuth: (id: string, answer: string | null) => Promise<boolean>;
-  onC2SAuthPrompt: (
-    callback: (prompt: {
-      id: string;
-      closed?: boolean;
-      tunnelName?: string;
-      request?: PluginSshPromptRequest;
-    }) => void,
-  ) => () => void;
-  getC2STunnelConfig: () => Promise<unknown[]>;
-  saveC2STunnelConfig: (
-    config: unknown[],
-  ) => Promise<{ success: boolean; error?: string }>;
-  checkLocalPortAvailable: (
-    host: string,
-    port: number,
-  ) => Promise<{ available: boolean; error?: string }>;
-  getC2STunnelPresetDefaultName: () => Promise<string>;
-  startC2STunnel: (
-    tunnel: unknown,
-    index: number,
-    authToken?: string,
-  ) => Promise<{
-    success: boolean;
-    tunnelName?: string;
-    error?: string;
-    code?: string;
-  }>;
-  testC2STunnel: (
-    tunnel: unknown,
-    index: number,
-    authToken?: string,
-  ) => Promise<{
-    success: boolean;
-    message?: string;
-    error?: string;
-    code?: string;
-  }>;
-  stopC2STunnel: (
-    tunnelName: string,
-  ) => Promise<{ success: boolean; error?: string }>;
-  getC2STunnelStatuses: () => Promise<Record<string, unknown>>;
-  onC2STunnelStatuses?: (
-    callback: (statuses: Record<string, unknown>) => void,
-  ) => () => void;
-  startC2SAutoStartTunnels: () => Promise<{
-    success: boolean;
-    started: number;
-    errors: string[];
-  }>;
-  /** Where the linked server relays client tunnel streams, a /plugin-ws/ path. */
-  setC2SRelayPath?: (
-    relayPath: string,
-  ) => Promise<{ success: boolean; error?: string }>;
  onCloseActiveTab?: (callback: () => void) => () => void;
  clearSessionCookies: () => Promise<void>;
  getSessionCookie: (
@@ -136,62 +70,6 @@ export interface ElectronAPI {

  showSaveDialog: (options: DialogOptions) => Promise<DialogResult>;
  showOpenDialog: (options: DialogOptions) => Promise<DialogResult>;
-  getLocalHomeDirectory?: () => Promise<string>;
-  listLocalDirectory?: (path?: string) => Promise<LocalDirectoryResult>;
-  statLocalPaths?: (
-    paths: string[],
-  ) => Promise<
-    Array<
-      | (LocalFileEntry & { success: true })
-      | { success: false; path: string; error?: string }
-    >
-  >;
-  collectLocalFiles?: (paths: string[]) => Promise<{
-    success: boolean;
-    files: LocalCollectedFile[];
-    truncated?: boolean;
-    error?: string;
-  }>;
-  createLocalFolder?: (
-    parentPath: string,
-    folderName: string,
-  ) => Promise<LocalPathMutationResult>;
-  renameLocalPath?: (
-    path: string,
-    newName: string,
-  ) => Promise<LocalPathMutationResult>;
-  trashLocalPath?: (path: string) => Promise<LocalPathMutationResult>;
-  chmodLocalPath?: (
-    path: string,
-    permissions: string,
-  ) => Promise<LocalPathMutationResult>;
-
-  openExternalEditor: (fileData: {
-    fileName: string;
-    content: string;
-    encoding?: "utf8" | "base64";
-    editorPath?: string | null;
-  }) => Promise<{
-    success: boolean;
-    editId?: string;
-    path?: string;
-    error?: string;
-  }>;
-
-  closeExternalEditor: (editId: string) => Promise<{
-    success: boolean;
-    error?: string;
-  }>;
-
-  onExternalEditorSaved?: (
-    callback: (payload: {
-      editId: string;
-      content: string;
-      encoding: "utf8";
-      path: string;
-    }) => void,
-  ) => () => void;
-
  onUpdateAvailable: (callback: () => void) => void;
  onUpdateDownloaded: (callback: () => void) => void;

@@ -238,159 +116,6 @@ export interface ElectronAPI {
    success: boolean;
    error?: string;
  }>;
-
-  startLocalTerminal(dimensions: {
-    cols: number;
-    rows: number;
-    shell?: "default" | "wsl";
-  }): Promise<{ sessionId: string; shell: string }>;
-  readyLocalTerminal(sessionId: string): Promise<boolean>;
-  writeLocalTerminal(sessionId: string, data: string): Promise<boolean>;
-  resizeLocalTerminal(
-    sessionId: string,
-    cols: number,
-    rows: number,
-  ): Promise<boolean>;
-  closeLocalTerminal(sessionId: string): Promise<boolean>;
-  onLocalTerminalData(
-    sessionId: string,
-    callback: (data: string) => void,
-  ): () => void;
-  onLocalTerminalExit(
-    sessionId: string,
-    callback: (exitCode: number) => void,
-  ): () => void;
-
-  /** Local disk browsing for the dual-pane file manager (desktop only). */
-  localFs?: {
-    home: () => Promise<LocalFsResult<LocalFsHomeInfo>>;
-    list: (dirPath: string) => Promise<LocalFsResult<LocalDirectoryListing>>;
-    mkdir: (
-      parentPath: string,
-      name: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    createFile: (
-      parentPath: string,
-      name: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    rename: (
-      oldPath: string,
-      newName: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    trash: (paths: string[]) => Promise<LocalFsResult<LocalTrashResult>>;
-    ensureDir: (
-      dirPath: string,
-      rootPath?: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    exists: (paths: string[]) => Promise<LocalFsResult<{ existing: string[] }>>;
-    walk: (paths: string[]) => Promise<LocalFsResult<LocalWalkResult>>;
-    reveal: (targetPath: string) => Promise<LocalFsResult<unknown>>;
-    open: (targetPath: string) => Promise<LocalFsResult<unknown>>;
-  };
-
-  /** Streamed local<->remote transfers driven by the main process. */
-  localTransfer?: {
-    /** The /plugin-api/<id> path that serves the streaming routes. */
-    setApiPath?: (apiPath: string) => Promise<LocalFsResult<object>>;
-    upload: (
-      options: LocalUploadRequest,
-    ) => Promise<LocalFsResult<{ bytes: number }>>;
-    download: (
-      options: LocalDownloadRequest,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    cancel: (
-      transferId: string,
-    ) => Promise<LocalFsResult<{ cancelled: boolean }>>;
-    onProgress: (
-      callback: (payload: LocalTransferProgress) => void,
-    ) => () => void;
-  };
-}
-
-export type LocalFsResult<T> =
-  ({ success: true } & T) | { success: false; error: string; code?: string };
-
-export interface LocalFsHomeInfo {
-  home: string;
-  separator: string;
-  platform: string;
-}
-
-export interface LocalFileEntry {
-  name: string;
-  path: string;
-  type: "file" | "directory" | "link" | "other";
-  created?: string;
-  modified?: string;
-  permissions?: string;
-  owner?: string;
-  group?: string;
-  size: number;
-  modifiedTimestamp?: number;
-  linkTarget?: string;
-  hidden: boolean;
-}
-
-export interface LocalDirectoryListing {
-  path: string;
-  parent: string | null;
-  entries: LocalFileEntry[];
-}
-
-export interface LocalTrashResult {
-  trashed: number;
-  failed: Array<{ path: string; error: string }>;
-}
-
-export interface LocalWalkFile {
-  localPath: string;
-  /** Path relative to the drop root; "/"-separated and includes the root's own name. */
-  relativePath: string;
-  size: number;
-}
-
-export interface LocalWalkResult {
-  files: LocalWalkFile[];
-  emptyDirs: string[];
-  totalBytes: number;
-}
-
-/**
- * Which Termix backend a transfer talks to. The main process resolves the
- * actual URL and credentials for the origin; the renderer never supplies them.
- */
-export type LocalTransferOrigin = "local" | "remote";
-
-export interface LocalUploadRequest {
-  transferId: string;
-  origin: LocalTransferOrigin;
-  fields: Record<string, string>;
-  localPath: string;
-  fileName: string;
-  deviceId?: string;
-  /** The renderer's token for the embedded backend (origin "local"); sent as a Bearer header. */
-  authToken?: string;
-}
-
-export interface LocalDownloadRequest {
-  transferId: string;
-  origin: LocalTransferOrigin;
-  body: Record<string, unknown>;
-  destPath: string;
-  /** Selected download folder; destPath must resolve strictly inside it (code EINVAL otherwise). */
-  rootPath: string;
-  expectedSize?: number;
-  /** Replace an existing file at destPath; otherwise the transfer is refused with code EEXIST. */
-  overwrite?: boolean;
-  deviceId?: string;
-  /** The renderer's token for the embedded backend (origin "local"); sent as a Bearer header. */
-  authToken?: string;
-}
-
-export interface LocalTransferProgress {
-  transferId: string;
-  transferred: number;
-  total?: number;
 }

 declare global {
@@ -653,8 +653,16 @@ export interface HostBadgeContribution {
  id: string;
  when: (host: PluginHostRecord) => boolean;
  component: ComponentType<{ host: PluginHostRecord }>;
+  /** Lower comes first. Ties sort by id. */
+  order?: number;
 }

+/** The dot or stripe that shows a host's status on its row. */
+export type HostStatusIndicatorContribution = HostBadgeContribution;
+
+/** A control in the host editor's toolbar. */
+export type HostEditorToolbarItemContribution = HostBadgeContribution;
+
 export interface HostContextMenuItemContribution {
  id: string;
  titleKey: string;
@@ -806,6 +814,66 @@ export interface SettingsComponentProps {
  running: boolean;
 }

+/** What a companion starts with. Read from the plugin's own settings. */
+export interface CompanionDefaults {
+  /** Open by itself the first time a matching tab shows. */
+  open?: boolean;
+  side?: "left" | "right" | "bottom";
+  /** Pixels of width, or height at the bottom. */
+  size?: number;
+  /** Show the edge button that opens and closes it. Default true. */
+  edgeButton?: boolean;
+}
+
+/** A panel a tab type can show beside it, for a picker. */
+export interface CompanionInfo {
+  /** The id registerCompanionLayout's hidden and order lists use. */
+  id: string;
+  titleKey: string;
+  icon?: IconComponent;
+}
+
+/** How a host wants the panel bar beside a tab. */
+export interface CompanionLayout {
+  /** False removes the bar and its panels. */
+  enabled?: boolean;
+  /** Where a panel opens until the user moves it. */
+  side?: "left" | "right" | "bottom";
+  /** Companion ids in bar order. */
+  order?: string[];
+  /** Companion ids left out. */
+  hidden?: string[];
+}
+
+export interface CompanionProps {
+  /** The tab it sits beside. */
+  tab: PluginTabRecord;
+  host?: PluginHostRecord;
+  /** The host in the shape the connection APIs take. */
+  sshHost?: Record<string, unknown>;
+  /** The tab's surface handle (see TabHandle), read at call time. */
+  getHandle: () => TabHandle | null;
+  side: "left" | "right" | "bottom";
+  /** False while the tab is in the background or the panel is closed. */
+  isVisible: boolean;
+  close: () => void;
+  setSide: (side: "left" | "right" | "bottom") => void;
+}
+
+export interface CompanionOptions {
+  icon?: IconComponent;
+  titleKey?: string;
+  order?: number;
+  /** Tab types it applies to. Any tab with a host when empty. */
+  tabTypes?: string[];
+  when?: (tab: PluginTabRecord, host?: PluginHostRecord) => boolean;
+  /**
+   * A hook returning the starting state. It runs in the plugin's scope, so it
+   * can read the plugin's settings.
+   */
+  useDefaults?: () => CompanionDefaults;
+}
+
 export type ActionHandler = (...args: never[]) => unknown;

 export interface ActionSlotDefinition {
@@ -838,10 +906,11 @@ export type OnboardingMode = "full" | "partial" | "rerun";
 * Where a plugin step sits in onboarding. "setup" comes right after the
 * appearance steps, for things that need doing before the feature works
 * (like pointing at a guacd server). "explore" (the default) comes after
- * that, "security" after the account security step. Onboarding is for
+ * that, "security" after the account security step. "start" comes before
+ * the appearance steps, for choices that shape how the rest looks. Onboarding is for
 * choices, not for explaining features.
 */
-export type OnboardingSection = "setup" | "explore" | "security";
+export type OnboardingSection = "start" | "setup" | "explore" | "security";

 export interface OnboardingStepProps {
  /**
@@ -884,6 +953,16 @@ export interface OnboardingStepContribution {
  permission?: string;
  section?: OnboardingSection;
  order?: number;
+  /**
+   * Exact place in the flow, 1 to 99, instead of a section. Core steps sit at
+   * 10 (plugins), 20, 25, 30 (preset), 40 (appearance) and 90 (security).
+   */
+  position?: number;
+  /**
+   * Older step keys this step took over, like "preset". People who already
+   * saw one of them are not shown this step again.
+   */
+  replaces?: string[];
  when?: (context: {
    isAdmin: boolean;
    isDesktop: boolean;
@@ -1049,12 +1128,40 @@ export interface TermixApp extends TermixAppInfo {
    component: ComponentType<TabProps>,
    options?: TabOptions,
  ) => Disposer;
+  /**
+   * A panel that sits beside any host tab the options match (a terminal, a
+   * desktop, ...), bound to that tab's host. The user opens, resizes and moves
+   * it; the tab keeps running underneath.
+   */
+  registerCompanion: (
+    id: string,
+    component: ComponentType<CompanionProps>,
+    options?: CompanionOptions,
+  ) => Disposer;
+  /**
+   * Lets a plugin decide, per host, how the panel bar looks on one tab type.
+   * Read from the host payload, so it must not call hooks.
+   */
+  registerCompanionLayout: (
+    tabType: string,
+    resolve: (host: PluginHostRecord | undefined) => CompanionLayout,
+  ) => Disposer;
+  /** Opens a companion on a tab, or closes it when it is showing. */
+  toggleCompanion: (tab: PluginTabRecord, id?: string) => void;
  registerHostEditorSection: (
    section: HostEditorSectionContribution,
  ) => Disposer;
  registerHostAction: (action: HostActionContribution) => Disposer;
  registerHostProtocol: (protocol: HostProtocolContribution) => Disposer;
  registerHostBadge: (badge: HostBadgeContribution) => Disposer;
+  /** Draws a host row's status. A layout renders every registered one. */
+  registerHostStatusIndicator: (
+    indicator: HostStatusIndicatorContribution,
+  ) => Disposer;
+  /** Adds a control to the host editor's toolbar. */
+  registerHostEditorToolbarItem: (
+    item: HostEditorToolbarItemContribution,
+  ) => Disposer;
  registerHostContextMenuItem: (
    item: HostContextMenuItemContribution,
  ) => Disposer;
@@ -1268,6 +1375,7 @@ export interface PluginHostBridge {
  hostProtocols: (host: PluginHostRecord) => string[];
  useHostStatus: (hostId: number | undefined) => HostStatusInfo | null;
  useHostActions: () => HostActionContribution[];
+  useCompanions: (tabType: string) => CompanionInfo[];
  useActivityTypes: () => string[];
  activityTarget: (type: string) => ActivityTargetInfo | undefined;
  useExtensions: (pointId: string) => ExtensionContribution[];
@@ -1603,28 +1711,49 @@ export function usePluginUiPreferences<
  return bridge.usePluginUiPreferences(bridge.usePluginId()) as never;
 }

+type PanelGridSize = "auto" | "1" | "2" | "3" | "4" | "5" | "6";
+const PANEL_GRID_SIZES: readonly string[] = [
+  "auto",
+  "1",
+  "2",
+  "3",
+  "4",
+  "5",
+  "6",
+];
+
 /**
- * Grid or list and row density for one of this plugin's views, kept in its
- * Appearance area as `<prefix>viewMode` and `<prefix>density`. Declare those
- * keys in contributes.uiPresets so each preset level can pick a default.
+ * Grid or list, row density and cards per row for one of this plugin's
+ * views, kept in its Appearance area as `<prefix>viewMode`, `<prefix>density`
+ * and `<prefix>columns`. Declare those keys in contributes.uiPresets so each
+ * preset level can pick a default. Hand columns to ViewToggle and DataView.
 */
 export function usePluginPanelView(prefix = ""): {
  view: "grid" | "list";
  density: "comfortable" | "compact";
  compact: boolean;
+  columns: PanelGridSize;
  setView: (view: "grid" | "list") => void;
  setDensity: (density: "comfortable" | "compact") => void;
+  setColumns: (columns: PanelGridSize) => void;
 } {
  const { values, set } = usePluginUiPreferences();
  const view = values[`${prefix}viewMode`] === "list" ? "list" : "grid";
  const density =
    values[`${prefix}density`] === "compact" ? "compact" : "comfortable";
+  const saved = values[`${prefix}columns`];
+  const columns =
+    typeof saved === "string" && PANEL_GRID_SIZES.includes(saved)
+      ? (saved as PanelGridSize)
+      : "auto";
  return {
    view,
    density,
    compact: density === "compact",
+    columns,
    setView: (next) => set(`${prefix}viewMode`, next),
    setDensity: (next) => set(`${prefix}density`, next),
+    setColumns: (next) => set(`${prefix}columns`, next),
  };
 }

@@ -1677,6 +1806,14 @@ export function useHostActions(): HostActionContribution[] {
  return requireHost().useHostActions();
 }

+/**
+ * Every panel that can open beside a tab of this type, for a settings screen
+ * that lets the user hide or reorder them. Reactive.
+ */
+export function useCompanions(tabType: string): CompanionInfo[] {
+  return requireHost().useCompanions(tabType);
+}
+
 /**
 * Recent-activity types every registered tab claims (registerTab's
 * activityTypes), core's and plugins'. For a filter that lists what a user
@@ -37,7 +37,7 @@ export {
 * "^1.2" needs 1.2 or later). engine.termix is checked against the core
 * version by the server.
 */
-export const PLUGIN_API_VERSION = "1.4.0";
+export const PLUGIN_API_VERSION = "1.12.0";

 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(
@@ -688,6 +688,21 @@ export interface PluginManifest {
  nativeDependencies?: string[];
  /** How a linked desktop treats this plugin. Defaults to "mirror". */
  desktop?: PluginDesktopMode;
+  /**
+   * "desktop": the plugin only loads on a desktop app's own embedded backend,
+   * never on a server. It implies desktop "local" and may declare desktop:local.
+   */
+  runtime?: PluginRuntime;
+}
+
+export type PluginRuntime = "desktop";
+export const PLUGIN_RUNTIMES: readonly PluginRuntime[] = ["desktop"];
+
+/** The desktop mode a manifest resolves to. */
+export function resolvePluginDesktopMode(
+  m: Pick<PluginManifest, "desktop" | "runtime">,
+): PluginDesktopMode {
+  return m.desktop ?? (m.runtime === "desktop" ? "local" : "mirror");
 }

 export const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
@@ -727,6 +742,7 @@ const ALLOWED_TOP_LEVEL = new Set([
  "platforms",
  "nativeDependencies",
  "desktop",
+  "runtime",
 ]);

 const ALLOWED_CONTRIBUTES = new Set([
@@ -904,6 +920,21 @@ export function validateManifest(manifest: unknown): string[] {
      `Field "desktop" must be one of: ${PLUGIN_DESKTOP_MODES.join(", ")}`,
    );
  }
+  if (
+    m.runtime !== undefined &&
+    !PLUGIN_RUNTIMES.includes(m.runtime as PluginRuntime)
+  ) {
+    errors.push(
+      `Field "runtime" must be one of: ${PLUGIN_RUNTIMES.join(", ")}`,
+    );
+  }
+  if (
+    m.runtime === "desktop" &&
+    m.desktop !== undefined &&
+    m.desktop !== "local"
+  ) {
+    errors.push(`A "desktop" runtime plugin must use desktop "local"`);
+  }
  validateDependencyMap(m.dependencies, "dependencies", errors);
  validateDependencyMap(m.optionalDependencies, "optionalDependencies", errors);
  validateProvides(m.provides, errors);
@@ -0,0 +1,122 @@
+/**
+ * SSH key helpers for plugins that make, check or deploy keys: generate a key
+ * pair, tell what a key is, derive a public key and check a pair belongs
+ * together. Pure functions over ssh2, which the host supplies. Core keeps its
+ * own copy for the connect pipeline.
+ */
+
+import ssh2 from "ssh2";
+
+export type SshKeyKind = "ssh-ed25519" | "ssh-rsa" | "ecdsa-sha2-nistp256";
+
+export interface GeneratedSshKeyPair {
+  privateKey: string;
+  publicKey: string;
+  keyType: SshKeyKind;
+}
+
+export interface GenerateSshKeyPairOptions {
+  /** RSA only. 2048 to 8192, default 4096. */
+  bits?: number;
+  passphrase?: string;
+  comment?: string;
+}
+
+/** Makes a new key pair; the public half is one authorized_keys line. */
+export function generateSshKeyPair(
+  type: SshKeyKind,
+  options: GenerateSshKeyPairOptions = {},
+): GeneratedSshKeyPair {
+  const algorithm =
+    type === "ssh-rsa" ? "rsa" : type === "ssh-ed25519" ? "ed25519" : "ecdsa";
+  if (
+    type !== "ssh-rsa" &&
+    type !== "ssh-ed25519" &&
+    type !== "ecdsa-sha2-nistp256"
+  ) {
+    throw new Error(`Unsupported key type: ${String(type)}`);
+  }
+  const generateOptions: Record<string, unknown> = {
+    comment: options.comment ?? "",
+  };
+  if (options.passphrase) {
+    generateOptions.passphrase = options.passphrase;
+    generateOptions.cipher = "aes256-ctr";
+  }
+  if (type === "ssh-rsa") {
+    const bits = options.bits ?? 4096;
+    if (!Number.isInteger(bits) || bits < 2048 || bits > 8192) {
+      throw new Error("RSA keys need 2048 to 8192 bits");
+    }
+    generateOptions.bits = bits;
+  }
+  if (type === "ecdsa-sha2-nistp256") generateOptions.bits = 256;
+
+  const pair = ssh2.utils.generateKeyPairSync(
+    algorithm as "rsa",
+    generateOptions as never,
+  );
+  return {
+    privateKey: pair.private,
+    publicKey: pair.public.trim(),
+    keyType: type,
+  };
+}
+
+function parse(key: string, passphrase?: string) {
+  const parsed = ssh2.utils.parseKey(key.trim(), passphrase || undefined);
+  const first = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!first || first instanceof Error) {
+    throw first instanceof Error ? first : new Error("Not a readable SSH key");
+  }
+  return first;
+}
+
+/** The key's algorithm, like "ssh-ed25519", or null when it cannot be read. */
+export function detectSshKeyType(
+  key: string,
+  passphrase?: string,
+): string | null {
+  try {
+    return parse(key, passphrase).type;
+  } catch {
+    return null;
+  }
+}
+
+/** The authorized_keys line for a private key, or null. */
+export function publicKeyFromPrivate(
+  privateKey: string,
+  passphrase?: string,
+): string | null {
+  try {
+    const parsed = parse(privateKey, passphrase);
+    return `${parsed.type} ${parsed.getPublicSSH().toString("base64")}`;
+  } catch {
+    return null;
+  }
+}
+
+/** Whether a public key line belongs to the private key. */
+export function validateSshKeyPair(
+  privateKey: string,
+  publicKey: string,
+  passphrase?: string,
+): { isValid: boolean; error?: string } {
+  try {
+    const priv = parse(privateKey, passphrase);
+    const pub = parse(publicKey);
+    const same = priv.getPublicSSH().equals(pub.getPublicSSH());
+    return same
+      ? { isValid: true }
+      : {
+          isValid: false,
+          error: "The public key does not match the private key",
+        };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
@@ -14,7 +14,10 @@ import {
  PluginCapabilityError,
 } from "./backend.js";
 import type {
+  PluginAuditEntry,
+  PluginAuditFilters,
  PluginContext,
+  PluginDesktopLocal,
  PluginDisposables,
  PluginLogger,
 } from "./backend.js";
@@ -65,12 +68,19 @@ import type {
  PluginSshKeyCredential,
  PluginSshKeyCredentialInput,
 } from "./backend.js";
-import type { SyncEntityRegistration } from "./backend.js";
+import type { PluginSyncHost, SyncEntityRegistration } from "./backend.js";
 import type { PluginDatabase } from "./backend.js";
 import type {
  PluginExternalClientRequest,
  PluginProtocolTarget,
+  PluginHostProbeTarget,
  PluginHostStatusEntry,
+  PluginActivityProvider,
+  PluginHostLockProvider,
+  PluginAuthPolicyProvider,
+  PluginCredentialSummary,
+  PluginHostShareGrant,
+  PluginHostStatusProvider,
  PluginNotification,
  PluginNotificationChannel,
  PluginNotifyHub,
@@ -94,6 +104,8 @@ export interface FakeScheduledJob {

 export interface FakeContextOptions {
  pluginId?: string;
+  /** What ctx.sync.host answers, for a sync provider's tests. */
+  syncHost?: Partial<PluginSyncHost>;
  manifest?: Partial<PluginManifest>;
  /** Acting user returned by currentActor and used by asUser. */
  actor?: string;
@@ -101,6 +113,8 @@ export interface FakeContextOptions {
  settings?: Record<string, unknown>;
  /** Seed for the core settings ctx.settings.readCore can reach. */
  coreSettings?: Record<string, string>;
+  /** What ctx.files.dataDir() answers. Defaults to /tmp/<pluginId>. */
+  dataDir?: string;
  /** What ctx.ssh.connect and withConnection hand back as the client. */
  sshClient?: unknown;
  /** A real database behind ctx.db, usually createTestDb().database. */
@@ -132,10 +146,22 @@ export interface FakeContextOptions {
  protocolTargets?: Record<string, PluginProtocolTarget>;
  /** What ctx.credentials.listSshKeys answers. */
  sshKeyCredentials?: PluginSshKeyCredential[];
+  /** What ctx.credentials.list answers. */
+  credentialSummaries?: PluginCredentialSummary[];
  /** What ctx.desktop.available() answers. Defaults to false. */
  desktopAvailable?: boolean;
+  /** What ctx.desktop.local is. Calls throw when this is not given. */
+  desktopLocal?: PluginDesktopLocal;
+  /** The stored audit lines ctx.audit.list and exportBatches serve. */
+  auditEntries?: PluginAuditEntry[];
  /** What ctx.hosts.status.get and check answer, by host id. */
  hostStatuses?: Record<number, PluginHostStatusEntry>;
+  /** What ctx.hosts.probeTargets answers. */
+  probeTargets?: PluginHostProbeTarget[];
+  /** Host ids ctx.hosts.sessionActive answers true for. */
+  activeSessions?: number[];
+  /** What ctx.network.tcpProbe and ctx.ssh.probe answer. Defaults to false. */
+  reachable?: (target: string | number, port?: number) => boolean;
  /** The acting user's channels, what ctx.notify.channels answers. */
  notificationChannels?: PluginNotificationChannel[];
  /**
@@ -172,6 +198,8 @@ export interface FakeContextOptions {
  baseUrl?: string;
  /** What ctx.auth.countLinkedUsers answers, by provider. Defaults to 0. */
  linkedUsers?: Record<string, number>;
+  /** Second factors from other plugins that ctx.auth.listSecondFactors adds. */
+  secondFactors?: { id: string; pluginId: string }[];
  /** Failures before ctx.auth.loginRateLimit locks a key. Defaults to 5. */
  loginAttemptLimit?: number;
  /** What ctx.users.getLocale answers, by user id. A missing user answers null. */
@@ -251,6 +279,8 @@ export interface FakeAuthRegistrations {
  loginFailures: Map<string, number>;
  /** Every ctx.auth.issueUserToken call, in order. */
  userTokens: Array<{ userId: string; purpose: string; ttlSeconds?: number }>;
+  /** Providers passed to ctx.auth.policy.provide that are still registered. */
+  policies: PluginAuthPolicyProvider[];
 }

 export interface FakePluginContext {
@@ -263,6 +293,12 @@ export interface FakePluginContext {
  ) => Promise<Record<string, string>>;
  /** Everything the plugin registered through ctx.disposables. */
  disposals: Array<() => void | Promise<void>>;
+  /** Providers registered through ctx.hosts.status.provide. */
+  hostStatusProviders: PluginHostStatusProvider[];
+  /** Every provider passed to ctx.hosts.activity.provide that is still registered. */
+  activityProviders: PluginActivityProvider[];
+  /** Every provider passed to ctx.hosts.locks.provide that is still registered. */
+  hostLockProviders: PluginHostLockProvider[];
  /** Topics emitted through ctx.events.emit, in order. */
  emitted: Array<{ topic: string; payload: unknown }>;
  /** Backing store behind ctx.kv. */
@@ -295,6 +331,8 @@ export interface FakePluginContext {
    permissionLevel: string;
    durationHours?: number;
  }>;
+  /** Every ctx.hosts.setShares call, in order. */
+  hostShareSets: Array<{ hostId: number; grants: PluginHostShareGrant[] }>;
  /** Everything registered through ctx.auth. */
  auth: FakeAuthRegistrations;
  /** Every ctx.desktop.openIsolatedWindow call, in order. */
@@ -338,6 +376,8 @@ export interface FakePluginContext {
    challenges: Map<string, string>;
    renewers: number;
  };
+  /** Calls every ctx.audit.subscribe handler, like a line core just accepted. */
+  emitAudit: (entry: PluginAuditEntry) => void;
  /** Every ctx.audit.record entry, in order. */
  audits: Array<{ action: string; success: boolean; [key: string]: unknown }>;
  /** Every ctx.hosts.recordActivity call, in order. */
@@ -464,7 +504,14 @@ function applyHostInput(
  const {
    tags,
    pluginSettings: _settings,
+    pluginEnable: _pluginEnable,
    forceKeyboardInteractive: _fki,
+    password: _password,
+    key: _key,
+    keyPassword: _keyPassword,
+    keyType: _keyType,
+    sudoPassword: _sudoPassword,
+    protocolAuth: _protocolAuth,
    ...rest
  } = input;
  const next: PluginHostRecord = { ...record };
@@ -491,6 +538,9 @@ export function createFakeContext(
  const pluginId = options.pluginId ?? "test-plugin";
  const disposals: Array<() => void | Promise<void>> = [];
  const emitted: Array<{ topic: string; payload: unknown }> = [];
+  const hostStatusProviders: PluginHostStatusProvider[] = [];
+  const activityProviders: PluginActivityProvider[] = [];
+  const hostLockProviders: PluginHostLockProvider[] = [];
  const kv = new Map<string, unknown>();
  const tables: PluginTableDefinition[] = [];
  const syncEntities: SyncEntityRegistration[] = [];
@@ -508,6 +558,7 @@ export function createFakeContext(
  }>();
  const sshConnections: FakePluginContext["sshConnections"] = [];
  const hostShares: FakePluginContext["hostShares"] = [];
+  const hostShareSets: FakePluginContext["hostShareSets"] = [];
  const desktopWindows: FakePluginContext["desktopWindows"] = [];
  const externalClientLaunches: FakePluginContext["externalClientLaunches"] =
    [];
@@ -531,6 +582,7 @@ export function createFakeContext(
  };
  const secretStore = new Map<string, string>();
  const audits: FakePluginContext["audits"] = [];
+  const auditSubscribers = new Set<(entry: PluginAuditEntry) => void>();
  const activities: FakePluginContext["activities"] = [];
  const trackedSessions: number[] = [];
  const interactions: FakePluginContext["interactions"] = [];
@@ -579,6 +631,7 @@ export function createFakeContext(
    revokedSessions: [],
    loginFailures: new Map(),
    userTokens: [],
+    policies: [],
  };
  const sshClient = options.sshClient ?? {};
  let actor = options.actor;
@@ -665,7 +718,7 @@ export function createFakeContext(
    files: {
      // A fake path; a test that needs a real folder uses the OS temp dir
      // itself, not this double.
-      dataDir: async () => `/tmp/${pluginId}`,
+      dataDir: async () => options.dataDir ?? `/tmp/${pluginId}`,
    },

    db: options.db
@@ -705,6 +758,12 @@ export function createFakeContext(
      registerEntity: (entity) => {
        syncEntities.push(entity);
      },
+      provide: () => () => {},
+      get host() {
+        if (!options.syncHost)
+          throw new Error("Pass syncHost to use ctx.sync.host");
+        return options.syncHost as PluginSyncHost;
+      },
    },

    registry: {
@@ -902,6 +961,27 @@ export function createFakeContext(
    disposables,

    hosts: {
+      importMany: async (rows) => {
+        const created = rows.map(() => nextHostId++);
+        return {
+          success: created.length,
+          updated: 0,
+          skipped: 0,
+          failed: 0,
+          errors: [],
+          createdHostIds: created,
+        };
+      },
+      importSshConfig: async () => ({
+        success: 0,
+        updated: 0,
+        skipped: 0,
+        failed: 0,
+        errors: [],
+        createdHostIds: [],
+      }),
+      exportMany: async () => ({ hosts: [] }),
+      registerImportNormalizer: () => () => {},
      list: async () => [...hostsById.values()],
      get: async (hostId) => hostsById.get(hostId) ?? null,
      checkAccess: async (hostId): Promise<PluginHostAccess> => {
@@ -956,6 +1036,10 @@ export function createFakeContext(
        hostShares.push({ hostId, targets, permissionLevel, durationHours });
        return { hostId, shared: true };
      },
+      setShares: async (hostId, grants) => {
+        hostShareSets.push({ hostId, grants: [...grants] });
+        return { hostId, shared: true };
+      },
      listUsers: async () => options.shareableUsers ?? [],
      listRoles: async () => options.shareableRoles ?? [],
      trackSession: (hostId) => {
@@ -971,7 +1055,42 @@ export function createFakeContext(
      recordActivity: async (hostId, type, hostName) => {
        activities.push({ hostId, type, hostName });
      },
+      probeTargets: async (filter) =>
+        (options.probeTargets ?? []).filter(
+          (target) => !filter?.hostIds || filter.hostIds.includes(target.id),
+        ),
+      sessionActive: (hostId) =>
+        options.activeSessions?.includes(hostId) ?? false,
+      activity: {
+        provide: (provider) => {
+          activityProviders.push(provider);
+          return () => {
+            const at = activityProviders.indexOf(provider);
+            if (at >= 0) activityProviders.splice(at, 1);
+          };
+        },
+      },
+      folders: {
+        ensure: async () => {},
+        removeEmpty: async () => true,
+      },
+      locks: {
+        provide: (provider) => {
+          hostLockProviders.push(provider);
+          return () => {
+            const at = hostLockProviders.indexOf(provider);
+            if (at >= 0) hostLockProviders.splice(at, 1);
+          };
+        },
+      },
      status: {
+        provide: (provider) => {
+          hostStatusProviders.push(provider);
+          return () => {
+            const at = hostStatusProviders.indexOf(provider);
+            if (at >= 0) hostStatusProviders.splice(at, 1);
+          };
+        },
        get: async (hostId) => hostStatuses.get(hostId) ?? null,
        check: async (hostId) => hostStatuses.get(hostId) ?? null,
        reportLogin: (hostId, outcome) => {
@@ -996,12 +1115,46 @@ export function createFakeContext(
    },

    audit: {
+      subscribe: (handler) => {
+        auditSubscribers.add(handler);
+        return () => {
+          auditSubscribers.delete(handler);
+        };
+      },
+      list: async (listOptions) => {
+        const matching = filterAuditEntries(
+          options.auditEntries ?? [],
+          listOptions?.filters,
+        ).reverse();
+        const offset = listOptions?.offset ?? 0;
+        return {
+          entries: matching.slice(offset, offset + (listOptions?.limit ?? 50)),
+          total: matching.length,
+        };
+      },
+      exportBatches: async function* (filters, batchSize) {
+        const matching = filterAuditEntries(
+          options.auditEntries ?? [],
+          filters,
+        );
+        const size = batchSize ?? 500;
+        for (let at = 0; at < matching.length; at += size) {
+          yield matching.slice(at, at + size);
+        }
+      },
      record: async (entry) => {
        audits.push({ ...entry });
      },
    },

+    network: {
+      tcpProbe: async (host, port) => options.reachable?.(host, port) ?? false,
+    },
+
    ssh: {
+      transports: { provide: () => () => {} },
+      probe: async (hostId, probeOptions) =>
+        options.reachable?.(hostId, probeOptions?.port) ?? false,
      connect: async (host, connectOptions) => {
        sshConnections.push({ host, options: connectOptions });
        return {
@@ -1013,6 +1166,16 @@ export function createFakeContext(
          dispose: () => {},
        };
      },
+      exec: async (host) => {
+        sshConnections.push({ host });
+        return {
+          stdout: "",
+          stderr: "",
+          code: 0,
+          truncated: false,
+          timedOut: false,
+        };
+      },
      withConnection: async (host, connectOptions, fn) => {
        sshConnections.push({ host, pool: connectOptions.pool });
        return fn(sshClient as never);
@@ -1153,6 +1316,22 @@ export function createFakeContext(
          expiresAt: new Date(Date.now() + ttl * 1000).toISOString(),
        };
      },
+      policy: {
+        provide: (provider) => {
+          auth.policies.push(provider);
+          return () => {
+            const at = auth.policies.indexOf(provider);
+            if (at >= 0) auth.policies.splice(at, 1);
+          };
+        },
+      },
+      listSecondFactors: () => [
+        ...auth.secondFactors.map((factor) => ({
+          id: factor.id,
+          pluginId,
+        })),
+        ...(options.secondFactors ?? []),
+      ],
    },

    users: {
@@ -1169,9 +1348,11 @@ export function createFakeContext(
        return { success: true };
      },
      available: () => options.desktopAvailable ?? false,
+      local: options.desktopLocal ?? unavailableDesktopLocal(),
    },

    credentials: {
+      list: async () => [...(options.credentialSummaries ?? [])],
      listSshKeys: async () => [
        ...(options.sshKeyCredentials ?? []),
        ...createdSshKeys.map((key) => ({
@@ -1195,6 +1376,13 @@ export function createFakeContext(
        credentialReads.push({ hostId, protocol });
        return options.protocolTargets?.[`${hostId}:${protocol}`] ?? null;
      },
+      publicKey: async (credentialId) =>
+        (options.sshKeyCredentials ?? []).find((k) => k.id === credentialId)
+          ?.publicKey ?? null,
+      resolveKeyRefs: async (key, passphrase) => ({
+        key,
+        passphrase: passphrase ?? undefined,
+      }),
      registerSecretResolver: (scheme, resolve) => {
        auth.secretResolvers.set(scheme, resolve);
        disposals.push(() => {
@@ -1345,6 +1533,9 @@ export function createFakeContext(
      return errors;
    },
    disposals,
+    hostStatusProviders,
+    activityProviders,
+    hostLockProviders,
    emitted,
    kv,
    tables,
@@ -1355,6 +1546,7 @@ export function createFakeContext(
    coreSettings,
    sshConnections,
    hostShares,
+    hostShareSets,
    auth,
    desktopWindows,
    externalClientLaunches,
@@ -1368,6 +1560,9 @@ export function createFakeContext(
    tls,
    secretStore,
    audits,
+    emitAudit: (entry) => {
+      for (const handler of auditSubscribers) handler(entry);
+    },
    activities,
    trackedSessions,
    interactions,
@@ -1400,6 +1595,8 @@ export function createFakeContext(

 export interface MockContextOptions {
  pluginId?: string;
+  /** What ctx.sync.host answers, for a sync provider's tests. */
+  syncHost?: Partial<PluginSyncHost>;
  manifest?: Partial<PluginManifest>;
  /** Capabilities the plugin is granted. Anything else throws. */
  capabilities?: string[];
@@ -1409,6 +1606,8 @@ export interface MockContextOptions {
  settings?: Record<string, unknown>;
  /** Seed for the core settings readCore can reach. */
  coreSettings?: Record<string, string>;
+  /** What ctx.files.dataDir() answers. */
+  dataDir?: string;
  /** Acting user returned by currentActor and used by asUser. */
  actor?: string;
  /** What ctx.ssh.connect and withConnection hand back as the client. */
@@ -1432,10 +1631,22 @@ export interface MockContextOptions {
  protocolTargets?: Record<string, PluginProtocolTarget>;
  /** What ctx.credentials.listSshKeys serves. */
  sshKeyCredentials?: PluginSshKeyCredential[];
+  /** What ctx.credentials.list serves. */
+  credentialSummaries?: PluginCredentialSummary[];
  /** What ctx.desktop.available() answers. */
  desktopAvailable?: boolean;
+  /** What ctx.desktop.local is. See FakeContextOptions. */
+  desktopLocal?: PluginDesktopLocal;
+  /** See FakeContextOptions. */
+  auditEntries?: PluginAuditEntry[];
  /** What ctx.hosts.status answers. See FakeContextOptions. */
  hostStatuses?: Record<number, PluginHostStatusEntry>;
+  /** What ctx.hosts.probeTargets answers. */
+  probeTargets?: PluginHostProbeTarget[];
+  /** Host ids ctx.hosts.sessionActive answers true for. */
+  activeSessions?: number[];
+  /** What ctx.network.tcpProbe and ctx.ssh.probe answer. */
+  reachable?: (target: string | number, port?: number) => boolean;
  /** The acting user's channels, what ctx.notify.channels answers. */
  notificationChannels?: PluginNotificationChannel[];
  /**
@@ -1460,6 +1671,8 @@ export interface MockContextOptions {
  /** See FakeContextOptions. */
  loginAttemptLimit?: number;
  /** See FakeContextOptions. */
+  secondFactors?: FakeContextOptions["secondFactors"];
+  /** See FakeContextOptions. */
  locales?: Record<string, string>;
 }

@@ -1481,6 +1694,63 @@ export interface MockPluginContext extends FakePluginContext {
 * (users:impersonate on issueUserToken), and users:read on ctx.users. Reading a plugin's own settings is deliberately
 * ungated. As the SDK grows a member, add its gate here in the same shape.
 */
+function filterAuditEntries(
+  entries: PluginAuditEntry[],
+  filters: PluginAuditFilters | undefined,
+): PluginAuditEntry[] {
+  return entries.filter(
+    (entry) =>
+      (filters?.userId === undefined || entry.userId === filters.userId) &&
+      (filters?.action === undefined || entry.action === filters.action) &&
+      (filters?.resourceType === undefined ||
+        entry.resourceType === filters.resourceType) &&
+      (filters?.success === undefined || entry.success === filters.success) &&
+      (filters?.startDate === undefined ||
+        entry.timestamp >= filters.startDate) &&
+      (filters?.endDate === undefined || entry.timestamp <= filters.endDate),
+  );
+}
+
+function gateDesktopLocal(
+  target: PluginDesktopLocal,
+  check: () => void,
+): PluginDesktopLocal {
+  const wrap = (value: unknown): unknown => {
+    if (typeof value === "function") {
+      return (...args: unknown[]) => {
+        check();
+        return (value as (...a: unknown[]) => unknown)(...args);
+      };
+    }
+    if (value && typeof value === "object") {
+      return new Proxy(value as object, {
+        get: (obj, key) => wrap((obj as Record<string | symbol, unknown>)[key]),
+      });
+    }
+    return value;
+  };
+  return new Proxy(target, {
+    get: (obj, key) =>
+      key === "available"
+        ? obj.available
+        : wrap((obj as unknown as Record<string | symbol, unknown>)[key]),
+  });
+}
+
+function unavailableDesktopLocal(): PluginDesktopLocal {
+  const fail = (): never => {
+    throw new Error("ctx.desktop.local needs the desktopLocal test option");
+  };
+  const deep = (): unknown =>
+    new Proxy(() => fail(), { get: () => deep(), apply: () => fail() });
+  return {
+    available: () => false,
+    info: fail,
+    fs: deep(),
+    pty: deep(),
+  } as unknown as PluginDesktopLocal;
+}
+
 export function createMockCtx(
  options: MockContextOptions = {},
 ): MockPluginContext {
@@ -1489,9 +1759,11 @@ export function createMockCtx(

  const base = createFakeContext({
    pluginId: options.pluginId,
+    syncHost: options.syncHost,
    actor: options.actor,
    settings: options.settings,
    coreSettings: options.coreSettings,
+    dataDir: options.dataDir,
    sshClient: options.sshClient,
    db: options.db,
    router: options.router,
@@ -1503,8 +1775,14 @@ export function createMockCtx(
    services: options.services,
    protocolTargets: options.protocolTargets,
    sshKeyCredentials: options.sshKeyCredentials,
+    credentialSummaries: options.credentialSummaries,
    desktopAvailable: options.desktopAvailable,
+    desktopLocal: options.desktopLocal,
+    auditEntries: options.auditEntries,
    hostStatuses: options.hostStatuses,
+    probeTargets: options.probeTargets,
+    activeSessions: options.activeSessions,
+    reachable: options.reachable,
    notificationChannels: options.notificationChannels,
    fetch: options.fetch,
    process: options.process,
@@ -1515,6 +1793,7 @@ export function createMockCtx(
    baseUrl: options.baseUrl,
    linkedUsers: options.linkedUsers,
    loginAttemptLimit: options.loginAttemptLimit,
+    secondFactors: options.secondFactors,
    locales: options.locales,
    manifest: {
      capabilities: options.capabilities ?? [],
@@ -1650,6 +1929,23 @@ export function createMockCtx(
    },

    hosts: {
+      importMany: async (rows, importOptions) => {
+        require("hosts:write");
+        if (importOptions?.credentials?.length) require("credentials:write");
+        return ctx.hosts.importMany(rows, importOptions);
+      },
+      importSshConfig: async (content, importOptions) => {
+        require("hosts:write");
+        return ctx.hosts.importSshConfig(content, importOptions);
+      },
+      exportMany: async (exportOptions) => {
+        require("hosts:export");
+        return ctx.hosts.exportMany(exportOptions);
+      },
+      registerImportNormalizer: (normalizer) => {
+        require("hosts:write");
+        return ctx.hosts.registerImportNormalizer(normalizer);
+      },
      list: async () => {
        require("hosts:read");
        return ctx.hosts.list();
@@ -1682,6 +1978,10 @@ export function createMockCtx(
        require("hosts:write");
        return ctx.hosts.share(hostId, targets, permissionLevel, durationHours);
      },
+      setShares: async (hostId, grants) => {
+        require("hosts:write");
+        return ctx.hosts.setShares(hostId, grants);
+      },
      listUsers: async () => {
        require("hosts:write");
        return ctx.hosts.listUsers();
@@ -1698,7 +1998,42 @@ export function createMockCtx(
        require("hosts:read");
        return ctx.hosts.recordActivity(hostId, type, hostName);
      },
+      probeTargets: async (filter) => {
+        require("hosts:read");
+        return ctx.hosts.probeTargets(filter);
+      },
+      sessionActive: (hostId) => {
+        require("hosts:read");
+        return ctx.hosts.sessionActive(hostId);
+      },
+      activity: {
+        provide: (provider) => {
+          require("hosts:activity-provide");
+          return ctx.hosts.activity.provide(provider);
+        },
+      },
+      folders: {
+        ensure: async (name, style) => {
+          require("hosts:write");
+          return ctx.hosts.folders.ensure(name, style);
+        },
+        removeEmpty: async (name) => {
+          require("hosts:write");
+          return ctx.hosts.folders.removeEmpty(name);
+        },
+      },
+      locks: {
+        provide: (provider) => {
+          require("hosts:lock");
+          return ctx.hosts.locks.provide(provider);
+        },
+      },
      status: {
+        provide: (provider) => {
+          require("hosts:read");
+          require("hosts:status-provide");
+          return ctx.hosts.status.provide(provider);
+        },
        get: async (hostId) => {
          require("hosts:read");
          return ctx.hosts.status.get(hostId);
@@ -1720,11 +2055,26 @@ export function createMockCtx(

    ssh: {
      ...ctx.ssh,
+      transports: {
+        provide: (provider) => {
+          require("ssh:transport");
+          return ctx.ssh.transports.provide(provider);
+        },
+      },
+      probe: async (hostId, probeOptions) => {
+        require("ssh:connect");
+        return ctx.ssh.probe(hostId, probeOptions);
+      },
      connect: async (host, connectOptions) => {
        require("ssh:connect");
        require("credentials:use");
        return ctx.ssh.connect(host, connectOptions);
      },
+      exec: async (host, command, execOptions) => {
+        require("ssh:connect");
+        require("credentials:use");
+        return ctx.ssh.exec(host, command, execOptions);
+      },
      withConnection: async (host, connectOptions, fn) => {
        require("ssh:connect");
        require("credentials:use");
@@ -1811,6 +2161,13 @@ export function createMockCtx(
        require("users:impersonate");
        return ctx.auth.issueUserToken(userId, tokenOptions);
      },
+      policy: {
+        provide: (provider) => {
+          require("auth:policy");
+          return ctx.auth.policy.provide(provider);
+        },
+      },
+      listSecondFactors: () => ctx.auth.listSecondFactors(),
    },

    users: {
@@ -1820,6 +2177,22 @@ export function createMockCtx(
      },
    },

+    audit: {
+      record: (entry) => ctx.audit.record(entry),
+      subscribe: (handler) => {
+        require("audit:read");
+        return ctx.audit.subscribe(handler);
+      },
+      list: async (listOptions) => {
+        require("audit:read");
+        return ctx.audit.list(listOptions);
+      },
+      exportBatches: (filters, batchSize) => {
+        require("audit:read");
+        return ctx.audit.exportBatches(filters, batchSize);
+      },
+    },
+
    desktop: {
      openIsolatedWindow: async (request) => {
        require("desktop:window");
@@ -1830,9 +2203,16 @@ export function createMockCtx(
        return ctx.desktop.launchExternalClient(request);
      },
      available: () => ctx.desktop.available(),
+      local: gateDesktopLocal(ctx.desktop.local, () =>
+        require("desktop:local"),
+      ),
    },

    credentials: {
+      list: async () => {
+        require("credentials:use");
+        return ctx.credentials.list();
+      },
      listSshKeys: async () => {
        require("credentials:use");
        return ctx.credentials.listSshKeys();
@@ -1851,6 +2231,14 @@ export function createMockCtx(
        }
        return ctx.credentials.resolveHostProtocol(hostId, protocol);
      },
+      publicKey: async (credentialId) => {
+        require("credentials:use");
+        return ctx.credentials.publicKey(credentialId);
+      },
+      resolveKeyRefs: async (key, passphrase) => {
+        require("credentials:read");
+        return ctx.credentials.resolveKeyRefs(key, passphrase);
+      },
      registerSecretResolver: (scheme, resolve) => {
        require("auth:provide");
        ctx.credentials.registerSecretResolver(scheme, resolve);
@@ -1877,6 +2265,13 @@ export function createMockCtx(
      return ctx.fetch(url, init);
    },

+    network: {
+      tcpProbe: async (host, port, probeOptions) => {
+        require("network:probe");
+        return ctx.network.tcpProbe(host, port, probeOptions);
+      },
+    },
+
    process: {
      run: async (file, args, runOptions) => {
        require("process:spawn");
@@ -139,6 +139,7 @@ const offline = () =>
  }),
  hostProtocols: () => ["ssh"],
  useHostActions: () => [],
+  useCompanions: () => [],
  useActivityTypes: () => [],
  activityTarget: () => undefined,
  useExtensions: () => [],
@@ -9,6 +9,7 @@
 * Two projects: tests/backend runs in node, tests/frontend in jsdom.
 */

+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -121,6 +122,28 @@ export function pluginVitestConfig(
  // Vite must be allowed to read it, and React must come from the plugin.
  const sdkDir = fs.realpathSync(fileURLToPath(new URL("..", import.meta.url)));
  const server = { fs: { allow: [pluginDir, sdkDir] } };
+  // dedupe alone is not enough: react-dom or the testing library loaded from
+  // the linked SDK's own node_modules pull in a second React, and hooks then
+  // see no renderer.
+  if (!sdkDir.startsWith(pluginDir)) {
+    const pluginRequire = createRequire(path.join(pluginDir, "package.json"));
+    for (const name of [
+      "react",
+      "react-dom",
+      "@testing-library/react",
+      "react-i18next",
+      "i18next",
+    ]) {
+      if (alias[name]) continue;
+      try {
+        alias[name] = path.dirname(
+          pluginRequire.resolve(`${name}/package.json`),
+        );
+      } catch {
+        // Not installed in the plugin: leave it to normal resolution.
+      }
+    }
+  }
  const resolve = {
    alias,
    dedupe: ["react", "react-dom", "react-i18next", "i18next"],
@@ -22,7 +22,7 @@ AlertTitle (value): ({ className, ...props }: DetailedHTMLProps<HTMLAttributes<H
 ApiKey (type): ApiKey
 AuditLog (type): AuditLog
 AuditLogFilters (type): AuditLogFilters
-AuthEnrollmentSections (value): () => Element
+AuthEnrollmentSections (value): ({ factorsOnly, }?: { factorsOnly?: boolean; }) => Element
 AuthOverrideProtocol (type): string
 BackButton (value): ({ onClick, label, className, }: { onClick: () => void; label?: string; className?: string; }) => Element
 Badge (value): ({ className, variant, asChild, ...props }: ClassAttributes<HTMLSpanElement> & HTMLAttributes<HTMLSpanElement> & VariantProps<(props?: ConfigVariants<{ variant: { default: string; secondary: string; destructive: string; outline: string; }; }> & ClassProp) => string> & { asChild?: boolean; }) => Element
@@ -80,7 +80,7 @@ DEFAULT_FOLDER_COLOR (value): "#f59145"
 DEFAULT_FOLDER_ICON (value): "folder"
 DashboardCardId (type): DashboardCardId
 DataColumn (type): DataColumn<T>
-DataView (value): <T>({ items, view, density, getKey, renderCard, columns, listColumns, onRowClick, isRowActive, empty, className, }: { items: T[]; view: PanelViewMode; density?: PanelDensity; getKey: (item: T) => string; renderCard: (item: T) => ReactNode; columns: GridColumns; listColumns: DataColumn<T>[]; onRowClick?: (item: T) => void; isRowActive?: (item: T) => boolean; empty: ReactNode; className?: string; }) => Element
+DataView (value): <T>({ items, view, density, getKey, renderCard, columns, size, minCardWidth, listColumns, onRowClick, isRowActive, empty, className, }: { items: T[]; view: PanelViewMode; density?: PanelDensity; getKey: (item: T) => string; renderCard: (item: T) => ReactNode; columns: GridColumns; size?: GridSize; minCardWidth?: number; listColumns: DataColumn<T>[]; onRowClick?: (item: T) => void; isRowActive?: (item: T) => boolean; empty: ReactNode; className?: string; }) => Element
 DefaultOverrides (type): DefaultOverrides
 DefaultsOnly (value): ({ settingKey, children, }: { settingKey: string; children: ReactNode; }) => Element
 DesktopUpdateMode (type): DesktopUpdateMode
@@ -115,13 +115,11 @@ DropdownMenuSubTrigger (value): ({ className, inset, children, ...props }: Dropd
 DropdownMenuTrigger (value): ({ ...props }: DropdownMenuTriggerProps & RefAttributes<HTMLButtonElement>) => Element
 EditingWidth (type): EditingWidth
 EmptyState (value): ({ icon: Icon, title, hint, action, className, }: { icon?: LucideIcon; title: string; hint?: string; action?: ReactNode; className?: string; }) => Element
-ExportPayload (type): ExportPayload
 FOLDER_COLORS (value): string[]
 FONT_SIZES (value): { id: FontSizeId; label: string; }[]
 Facts (value): ({ className, children, }: { className?: string; children: ReactNode; }) => Element
 FakeSwitch (value): ({ defaultChecked, disabled, checked, onChange, }: { defaultChecked?: boolean; disabled?: boolean; checked?: boolean; onChange?: (v: boolean) => void; }) => Element
 Field (value): ({ label, hint, error, aside, htmlFor, className, children, }: { label: string; hint?: ReactNode; error?: string; aside?: ReactNode; htmlFor?: string; className?: string; children: ReactNode; }) => Element
-FieldGroup (type): FieldGroup
 FieldPair (value): ({ children }: { children: ReactNode; }) => Element
 FolderAccessRule (type): FolderAccessRule
 FolderIconEl (value): ({ icon, className, style, }: { icon?: string; className?: string; style?: CSSProperties; }) => Element
@@ -133,6 +131,7 @@ GridCardCatalogEntry (type): GridCardCatalogEntry
 GridColSpan (type): GridColSpan
 GridColumns (type): GridColumns
 GridLayout (type): GridLayout
+GridSize (type): GridSize
 GridSlot (type): GridSlot
 GroupHeading (value): ({ title, count, action, className, }: { title: string; count?: number; action?: ReactNode; className?: string; }) => Element
 HexColorPicker (value): ({ value, onChange, }: { value: string; onChange: (hex: string) => void; }) => Element
@@ -153,7 +152,9 @@ HostFeatureFieldsProps (type): HostFeatureFieldsProps
 HostFolder (type): HostFolder
 HostGroupKey (type): HostGroupKey
 HostKeyVerificationDialog (value): ({ isOpen, scenario, ip, port, hostname, fingerprint, oldFingerprint, onAccept, onReject, backgroundColor, }: HostKeyVerificationDialogProps) => Element
+HostLock (type): HostLock
 HostOnly (value): ({ children }: { children: ReactNode; }) => Element
+HostPolicy (type): HostPolicy
 HostProtocolAuthInput (type): HostProtocolAuthInput
 HostProtocolDef (type): HostProtocolDef
 HostProtocols (type): HostProtocols
@@ -161,6 +162,7 @@ HostRowFields (type): HostRowFields
 HostSidebarFilterState (type): HostSidebarFilterState
 HostSidebarPreferences (type): HostSidebarPreferences
 HostTrayTrigger (type): HostTrayTrigger
+HttpsSettings (type): HttpsSettings
 IconPicker (value): ({ value, color, onChange, }: { value: string; color?: string; onChange: (icon: string) => void; }) => Element
 InlineView (value): ({ open, onOpenChange, title, icon, status, actions, toolbar, footer, width, onBeforeClose, scroll, bare, className, children, }: { open: boolean; onOpenChange: (open: boolean) => void; title: ReactNode; icon?: ReactNode; status?: ReactNode; actions?: ReactNode; toolbar?: ReactNode; footer?: ReactNode; width?: EditingWidth; onBeforeClose?: () => boolean | Promise<boolean>; scroll?: boolean; bare?: boolean; className?: string; children: ReactNode; }) => ReactPortal
 Input (value): ({ className, type, ...props }: DetailedHTMLProps<InputHTMLAttributes<HTMLInputElement>, HTMLInputElement>) => Element
@@ -175,7 +177,6 @@ LANGUAGES (value): readonly { code: string; label: string; }[]
 Label (value): ({ className, ...props }: LabelProps & RefAttributes<HTMLLabelElement>) => Element
 LineChart (value): ({ series, timestamps, domain, yFormatter, height, className, }: LineChartProps) => Element
 LineChartSeries (type): LineChartSeries
-LinkServerDialog (value): ({ open, onOpenChange, onLinked, relogin, }: LinkServerDialogProps) => Element
 LinkedAccountInfo (type): LinkedAccountInfo
 ListBadge (value): ({ tone, className, children, }: { tone?: "destructive" | "muted" | "brand" | "warning" | "success"; className?: string; children: ReactNode; }) => Element
 ListRow (value): ({ title, icon, badges, meta, stripe, tone, color, selected, active, dimmed, leading, trailing, actions, onClick, className, children, ...rest }: { title: ReactNode; icon?: ReactNode; badges?: ReactNode; meta?: ReactNode; stripe?: number; tone?: ListRowTone; color?: string; selected?: boolean; active?: boolean; dimmed?: boolean; leading?: ReactNode; trailing?: ReactNode; actions?: ReactNode; onClick?: () => void; className?: string; children?: ReactNode; } & Omit<HTMLAttributes<HTMLDivElement>, "title" | "children" | "onClick">) => Element
@@ -196,10 +197,13 @@ ManagerSearch (value): ({ value, onChange, placeholder, count, extra, }: { value
 Meter (value): ({ percent, className, }: { percent: number; className?: string; }) => Element
 MetricCard (value): ({ title, icon, action, children, bodyClassName, scroll, scrollMax, }: { title: string; icon: ReactNode; action?: ReactNode; children: ReactNode; bodyClassName?: string; scroll?: boolean; scrollMax?: number; }) => Element
 MiniStat (value): ({ caption, value, valueClassName, className, }: { caption: ReactNode; value: ReactNode; valueClassName?: string; className?: string; }) => Element
+NativeView (value): ({ url, ignoreCert, hidden, fallback, className, style, }: NativeViewProps) => Element
+NativeViewProps (type): NativeViewProps
 NumberField (value): ({ label, value, onChange, placeholder, hint, error, min, max, disabled, className, }: { label: string; value: number; onChange: (value: number) => void; placeholder?: string; hint?: ReactNode; error?: string; min?: number; max?: number; disabled?: boolean; className?: string; }) => Element
 OPEN_PLUGINS_EVENT (value): "termix:open-plugins"
 OpenTabRecord (type): OpenTabRecord
 PANEL (value): { readonly body: "p-2.5"; readonly gap: "gap-2"; readonly band: "px-3 py-2"; readonly cardHead: "px-3 py-2.5"; readonly header: "h-12.5"; }
+PRESETS (value): Record<"simple" | "balanced" | "advanced", UiAreaPreferences>
 PROMPT_BUTTON (value): "inline-flex h-7 items-center justify-center gap-1.5 border border-border px-3 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50"
 PROMPT_DESTRUCTIVE_BUTTON (value): "inline-flex h-7 items-center justify-center gap-1.5 bg-destructive px-3 text-xs font-medium text-white transition-colors hover:bg-destructive/90 focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50"
 PROMPT_PRIMARY_BUTTON (value): "inline-flex h-7 items-center justify-center gap-1.5 border border-accent-brand/40 px-3 text-xs font-medium text-accent-brand transition-colors hover:bg-accent-brand/10 focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50"
@@ -225,7 +229,6 @@ PopoverAnchor (value): ({ ...props }: PopoverAnchorProps & RefAttributes<HTMLDiv
 PopoverContent (value): ({ className, align, sideOffset, ...props }: PopoverContentProps & RefAttributes<HTMLDivElement>) => Element
 PopoverTrigger (value): ({ ...props }: PopoverTriggerProps & RefAttributes<HTMLButtonElement>) => Element
 ProxyNode (type): ProxyNode
-ProxySettingsFields (value): ({ customHeaders, basicAuth, onChange, }: ProxySettingsFieldsProps) => Element
 RadialGauge (value): ({ value, label, caption, size, strokeWidth, className, colorClassName, }: RadialGaugeProps) => Element
 RadialGaugeProps (type): RadialGaugeProps
 RailGroup (type): RailGroup
@@ -286,12 +289,6 @@ SurfaceKind (type): SurfaceKind
 SurfaceScope (value): ({ kind, onEditingChange, onClose, className, children, }: { kind?: SurfaceKind; onClose?: () => void; onEditingChange?: (editing: EditingWidth) => void; className?: string; children: ReactNode; }) => Element
 Switch (value): ({ className, ...props }: SwitchProps & RefAttributes<HTMLButtonElement>) => Element
 SwitchRow (value): ({ label, description, badge, checked, onChange, disabled, defaultKey, rowId, }: { label: string; description?: ReactNode; badge?: string; checked: boolean; onChange: (value: boolean) => void; disabled?: boolean; defaultKey?: string; rowId?: string; }) => Element
-SyncBasicAuth (type): SyncBasicAuth
-SyncConflictItem (type): SyncConflictItem
-SyncEntityInfo (type): SyncEntityInfo
-SyncErrorItem (type): SyncErrorItem
-SyncProxyHeader (type): SyncProxyHeader
-SyncStatus (type): SyncStatus
 TOTPDialog (value): ({ isOpen, prompt, mode, waiting, onSubmit, onCancel, backgroundColor, }: TOTPDialogProps) => Element
 Tab (type): Tab
 TabShellCallbacks (type): TabShellCallbacks
@@ -325,7 +322,7 @@ UserRole (type): UserRole
 UserSecondFactorSummary (type): UserSecondFactorSummary
 VersionBadge (value): ({ status, releaseUrl, className, }: VersionBadgeProps) => Element
 VersionInfo (type): VersionInfo
-ViewToggle (value): ({ view, onView, density, onDensity, }: { view: PanelViewMode; onView: (next: PanelViewMode) => void; density?: PanelDensity; onDensity?: (next: PanelDensity) => void; }) => Element
+ViewToggle (value): ({ view, onView, density, onDensity, columns, onColumns, }: { view: PanelViewMode; onView: (next: PanelViewMode) => void; density?: PanelDensity; onDensity?: (next: PanelDensity) => void; columns?: GridSize; onColumns?: (next: GridSize) => void; }) => Element
 WebSocketConnectionTarget (type): WebSocketConnectionTarget
 WidgetTitle (value): ({ title, icon, fallback }: WidgetTitleProps) => Element
 actionOrder (value): (action: HostActionDef) => number
@@ -344,13 +341,11 @@ adminUpdateUserCredential (value): (targetUserId: string, credentialId: number,
 adminUpdateUserHost (value): (targetUserId: string, hostId: number, hostData: HostData) => Promise<Host>
 applyAccentColor (value): (colorValue: string) => void
 applyFontSize (value): (id: FontSizeId) => void
-applyPresetSideEffects (value): (preset: "advanced" | "simple" | "balanced") => Promise<void>
+applyPresetSideEffects (value): (preset: "simple" | "balanced" | "advanced") => Promise<void>
 applyUiFont (value): (id: UiFontId) => void
 assignRoleToUser (value): (userId: string, roleId: number) => Promise<{ success: boolean; }>
 beginSplitDrag (value): (source: SplitDragSource, x: number, y: number) => void
-buildExportPayload (value): (raw: ExportPayload, selected: Set<string>, groups: Set<FieldGroup>, withCredentials: boolean, pluginSecrets?: PluginSecretKeys) => ExportPayload
 buildOriginWsUrl (value): ({ origin, localPort, localPath, remotePath, includeJwt, }: { origin: ConnectionOrigin; localPort: number; localPath: string; remotePath: string; includeJwt?: boolean; }) => Promise<WebSocketConnectionTarget>
-bulkImportSSHHosts (value): (hosts: HostData[], overwrite?: boolean, credentials?: Record<string, unknown>[]) => Promise<{ message: string; success: number; updated: number; skipped: number; failed: number; errors: string[]; }>
 bulkUpdateSSHHosts (value): (hostIds: number[], updates: Record<string, unknown>) => Promise<{ updated: number; failed: number; errors: string[]; }>
 canConfigureUpdates (value): (state: DesktopUpdateState) => state is DesktopUpdateState
 canJoinSplit (value): (tab: Tab) => boolean
@@ -379,22 +374,17 @@ deleteOpenTab (value): (instanceId: string) => Promise<void>
 deleteRole (value): (roleId: number) => Promise<{ success: boolean; }>
 deleteSSHHost (value): (hostId: number) => Promise<Record<string, unknown>>
 deleteUser (value): (username: string, successorUserId?: string) => Promise<Record<string, unknown>>
-deployCredentialToHost (value): (credentialId: number, targetHostId: number) => Promise<Record<string, unknown>>
 desktopUpdates (value): () => DesktopUpdatesBridge
 docsUrl (value): (page?: "dashboard" | "users" | "sessions" | "roles" | "branding" | "database" | "manage" | "settings" | "plugins" | "install" | "cli" | "develop" | "home" | "updating" | "betas" | "envVars" | "https" | "reverseProxy" | "desktopSync" | "interface" | "hosts" | "portKnocking" | "hostDefaults" | "credentials" | "sharing" | "account" | "accountSecurity" | "accountData" | "apiKeys" | "commandPalette" | "interfaceSettings" | "appearance" | "keybindings" | "adminGeneral" | "adminDatabase" | "adminSsl" | "auditLog" | "importExport" | "pluginCatalog" | "communityRegistry" | "pluginRegistries" | "hostRegistry") => string
 duplicateCredential (value): (credentialId: number, data: Record<string, unknown>) => Promise<Record<string, unknown>>
 enabledHostProtocols (value): (host: { pluginSettings?: Record<string, Record<string, unknown>>; }, list?: HostProtocolDef[]) => HostProtocolDef[]
 endSplitDrag (value): (commit: boolean) => void
-exportAllSSHHosts (value): { (): Promise<{ hosts: Host[]; }>; (options: { share: true; }): Promise<{ version: string; exportedAt: string; credentials: Record<string, unknown>[]; hosts: Host[]; }>; }
 filterPaletteItems (value): (items: PaletteItemDef[], query: string, showWhenEmpty?: boolean) => PaletteItemDef[]
 findCoreHostDefault (value): (key: string) => CoreHostDefault
 findMatchingKeybinding (value): (e: KeyboardEvent, bindings: CustomKeybinding[]) => CustomKeybinding
-generateKeyPair (value): (keyType: "ssh-ed25519" | "ssh-rsa" | "ecdsa-sha2-nistp256", keySize?: number, passphrase?: string) => Promise<GeneratedKeyPair>
-generatePublicKeyFromPrivate (value): (privateKey: string, keyPassword?: string) => Promise<GeneratedPublicKey>
 getActiveSessions (value): () => Promise<ActiveSessionInfo[]>
 getAdaptiveResourceBudget (value): (kind: AdaptiveTaskKind) => AdaptiveResourceBudget
 getApiKeys (value): () => Promise<{ apiKeys: ApiKey[]; }>
-getAuditForwarding (value): () => Promise<AuditForwardingSettings>
 getAuditLogActions (value): () => Promise<{ actions: string[]; }>
 getAuditLogs (value): (filters?: AuditLogFilters) => Promise<AuditLogResponse>
 getBasePath (value): () => string
@@ -419,8 +409,10 @@ getHostAuthOverride (value): (hostId: number, protocol: string, sharedCopySyncId
 getHostDefaultsLevel (value): (target: HostDefaultsTarget) => Promise<HostDefaultsLevelData>
 getHostEditorSection (value): (id: string) => HostEditorSectionDef
 getHostPassword (value): (hostId: number, field?: "key" | "password" | "sudoPassword" | "keyPassword") => Promise<string>
+getHostPolicy (value): () => Promise<HostPolicy>
 getHostSidebarPreferences (value): () => Promise<HostSidebarPreferences>
 getHostTags (value): () => Promise<string[]>
+getHttpsSettings (value): () => Promise<HttpsSettings>
 getLiveHostStatus (value): (hostId: number) => StatusValue
 getLogLevel (value): () => Promise<{ level: string; }>
 getNotificationPrivateEndpoints (value): () => Promise<string[]>
@@ -446,8 +438,6 @@ getSessionTimeoutMinutes (value): () => Promise<number>
 getSessions (value): () => Promise<{ sessions: { id: string; userId: string; username?: string; deviceType: string; deviceInfo: string; createdAt: string; expiresAt: string; lastActiveAt: string; isRevoked?: boolean; isCurrentSession?: boolean; }[]; }>
 getStatusCheckSettings (value): () => Promise<{ statusCheckInterval: number; }>
 getStatusClasses (value): (status: boolean | "online" | "offline" | "unknown", scheme: StatusColorScheme, variant: "dot" | "stripe" | "badge", loading?: boolean) => string
-getSyncConflicts (value): () => Promise<SyncConflictItem[]>
-getSyncErrors (value): () => Promise<SyncErrorItem[]>
 getTabType (value): (id: string) => TabTypeDef
 getTlsStatus (value): () => Promise<TlsStatus>
 getUpdateChannel (value): () => Promise<UpdateChannelState>
@@ -463,11 +453,11 @@ groupRailItems (value): (items: RailItemDef[]) => { group: RailGroup; items: Rai
 hasVisibleFields (value): (fields: PluginSettingsField[]) => boolean
 hostActionsFor (value): (all: HostActionDef[], host: Host, kind?: "open" | "connect") => HostActionDef[]
 hostBadgesFor (value): (all: HostBadgeDef[], host: Host) => HostBadgeDef[]
-hostKey (value): (host: Record<string, unknown>) => string
+hostEditorToolbarItemsFor (value): (all: HostBadgeDef[], host: Host) => HostBadgeDef[]
 hostMenuItemsFor (value): (all: HostContextMenuItemDef[], host: Host) => HostContextMenuItemDef[]
 hostProtocolFlags (value): (host: { enableSsh?: boolean; pluginSettings?: Record<string, Record<string, unknown>>; }, list?: HostProtocolDef[]) => HostProtocols
+hostStatusIndicatorsFor (value): (all: HostBadgeDef[], host: Host) => HostBadgeDef[]
 hydrateLocalSharedHostAuth (value): <T>(host: T) => Promise<T>
-importSSHConfigHosts (value): (content: string, overwrite?: boolean) => Promise<{ message: string; success: number; updated: number; skipped: number; failed: number; errors: string[]; }>
 invalidateHostsAndStatusCaches (value): () => void
 invalidateServerStatusCache (value): () => void
 isCoreRailView (value): (id: string) => boolean
@@ -492,7 +482,6 @@ makeUserAdmin (value): (userId: string) => Promise<Record<string, unknown>>
 mapCredentials (value): (res: unknown) => Credential[]
 markAdaptiveResourceUsed (value): (kind: AdaptiveTaskKind, action: string, now?: number) => void
 markTabSurfaceUsed (value): (type: TabType) => void
-maskSecrets (value): (payload: ExportPayload, pluginSecrets?: PluginSecretKeys) => ExportPayload
 moveRailItem (value): (items: RailItemDef[], id: string, beforeId: string) => string[]
 moveSplitDrag (value): (x: number, y: number) => void
 normalizeLanguageCode (value): (language?: string) => string
@@ -503,7 +492,6 @@ parseCustomKeybindings (value): (raw?: string) => CustomKeybinding[]
 parseServerTime (value): (ts: string) => Date
 pluginKey (value): { (pluginId: string, key: string): string; (pluginId: string, key: string): string; }
 pluginName (value): (t: Translator, plugin: { id: string; name: string; }) => string
-pluginSecretKeys (value): (summaries: { id: string; contributes?: { settings?: { host?: { fields?: { key: string; secretKeys?: string[]; }[]; }; }; }; }[]) => PluginSecretKeys
 pluginWsUrl (value): (pluginId: string, path: string, options?: { origin?: ConnectionOrigin; }) => Promise<WebSocketConnectionTarget>
 preloadTabSurface (value): (type: TabType) => void
 previewHostDefaultsLevel (value): (target: HostDefaultsTarget, change: HostDefaultsChange) => Promise<{ changedHosts: number; }>
@@ -514,7 +502,6 @@ quickConnectTargets (value): (all: HostActionDef[], host: Host) => HostActionDef
 railItemLabel (value): (id: string, t: (key: string) => string) => string
 readFromClipboard (value): () => Promise<string>
 recordHostActionPreference (value): (hostId: string, action: TabType) => void
-refreshSyncStatus (value): () => void
 registerLayout (value): (item: RegisteredLayout) => () => void
 registerTabCloseGuard (value): (tabId: string, guard: Guard) => () => void
 releaseUrlFrom (value): (info: VersionInfo) => string
@@ -537,7 +524,6 @@ resolveConnectionOrigin (value): (host: OriginResolvableHost, options?: { defaul
 resolveHostDefaults (value): (where: { hostId?: number; folder?: string; parentHostId?: number; }, adminTargetUserId?: string) => Promise<Record<string, ResolvedHostDefault>>
 resolveHostTabType (value): (host: Host, preferredType?: TabType) => TabType
 resolveRemoteHostId (value): (syncId: string) => Promise<number>
-retrySyncErrors (value): () => Promise<SyncStatus>
 revokeAllUserSessions (value): (userId: string) => Promise<{ success: boolean; message: string; }>
 revokeCredentialAccess (value): (credentialId: number, accessId: number) => Promise<void>
 revokeFolderAccess (value): (ruleId: number) => Promise<void>
@@ -561,27 +547,22 @@ setDeveloperMode (value): (enabled: boolean) => Promise<void>
 setHostAuthOverride (value): (hostId: number, protocol: string, credentialId: number, sharedCopySyncId?: string) => Promise<{ success: boolean; protocol: string; credentialId: number; }>
 setNotificationPrivateEndpoints (value): (hosts: string[]) => Promise<string[]>
 setPluginOptions (value): (pluginId: string, options: { autoUpdate?: boolean; pinned?: boolean; channel?: PluginChannel; }) => Promise<{ autoUpdate: boolean; pinnedVersion: string; channel: PluginChannel; }>
-setSyncStatus (value): (next: SyncStatus) => void
 setUpdateChannel (value): (channel: UpdateChannel) => Promise<UpdateChannelState>
-settleSyncConflict (value): (id: number, keep: "mine" | "server") => Promise<void>
 shareCredential (value): (credentialId: number, targets: ShareTarget[], permissionLevel: CredentialPermissionLevel, durationHours?: number) => Promise<{ success: boolean; expiresAt: string; }>
 shareFolder (value): (folder: string, shareData: { targets: ShareTarget[]; permissionLevel: SharePermissionLevel; durationHours?: number; }) => Promise<{ success: boolean; expiresAt: string; hostsShared: number; hostsTotal: number; hostResults: { hostId: number; shared: boolean; reason?: string; }[]; }>
 shareHost (value): (hostId: number, shareData: { targets: ShareTarget[]; permissionLevel: SharePermissionLevel; durationHours?: number; }, syncId?: string) => Promise<{ success: boolean; expiresAt: string; results: { type: "role" | "user"; id: string | number; accessId: number; created: boolean; }[]; }>
 shell (value): TabShellCallbacks
 splitDefaultKey (value): (fullKey: string) => [string, string]
 sshHostToHost (value): (h: SSHHostWithStatus) => Host
-syncNow (value): () => Promise<SyncStatus>
 tabIcon (value): (type: TabType) => Element
 tabJumpHotkeyKeys (value): () => string[]
 takePendingManageRequest (value): () => ManageRequest
 unlinkExternalFromPasswordAccount (value): (userId: string) => Promise<{ success: boolean; message: string; }>
-unlinkServer (value): (keepData: boolean) => Promise<SyncStatus>
-updateAuditForwarding (value): (url: string, token?: string) => Promise<{ url: string; hasToken: boolean; }>
-updateBranding (value): (update: BrandingSettingsUpdate) => Promise<BrandingSettings>
 updateCredential (value): (credentialId: number, credentialData: Record<string, unknown>) => Promise<Record<string, unknown>>
 updateExternalAutoProvision (value): (enabled: boolean) => Promise<Record<string, unknown>>
 updateFolderMetadata (value): (name: string, color?: string, icon?: string, credentialId?: number, localOnly?: boolean) => Promise<void>
 updateHostAccess (value): (hostId: number, accessId: number, update: { permissionLevel?: SharePermissionLevel; durationHours?: number; }, syncId?: string) => Promise<{ success: boolean; expiresAt: string; }>
+updateHttpsSettings (value): (forceHttps: boolean) => Promise<HttpsSettings>
 updateLogLevel (value): (level: string) => Promise<void>
 updatePasswordLoginAllowed (value): (allowed: boolean) => Promise<{ allowed: boolean; }>
 updatePasswordResetAllowed (value): (allowed: boolean) => Promise<{ allowed: boolean; }>
@@ -594,7 +575,6 @@ updateSSHHost (value): (hostId: number, hostData: HostData) => Promise<Host>
 updateSecondFactorAfterExternalLogin (value): (enabled: boolean) => Promise<Record<string, unknown>>
 updateSessionTimeout (value): (timeoutHours: number) => Promise<void>
 updateStatusCheckSettings (value): (settings: { statusCheckInterval: number; }) => Promise<void>
-updateSyncSettings (value): (settings: { disabledTypes?: string[]; customHeaders?: SyncProxyHeader[]; basicAuth?: SyncBasicAuth; allowInvalidCertificate?: boolean; }) => Promise<SyncStatus>
 uploadTlsCertificate (value): (payload: { certificate: string; privateKey: string; }) => Promise<TlsStatus & { success: boolean; reloadMessage?: string; }>
 usageBarColor (value): (percent: number) => string
 usageColor (value): (percent: number) => string
@@ -607,14 +587,17 @@ useChooseTheme (value): () => (themeId: string) => void
 useConfirm (value): () => (options: ConfirmOptions) => Promise<boolean>
 useConnectionGate (value): () => ConnectionGateController
 useConnectionLog (value): () => ConnectionLogContextType
+useDesktopLinked (value): () => boolean
 useDesktopUpdate (value): () => DesktopUpdateState
 useEditorDefaultKeys (value): () => Map<string, EditorDefaultKey>
 useHostActions (value): () => HostActionDef[]
 useHostBadges (value): () => HostBadgeDef[]
 useHostContextMenuItems (value): () => HostContextMenuItemDef[]
 useHostEditorSections (value): () => HostEditorSectionDef[]
+useHostEditorToolbarItems (value): () => HostBadgeDef[]
 useHostProtocols (value): () => HostProtocolDef[]
 useHostStatus (value): (hostId: number, statusCheckEnabled?: boolean) => StatusValue
+useHostStatusIndicators (value): () => HostBadgeDef[]
 useInstalledPlugins (value): () => PluginSummary[]
 useIsDefaultsEditor (value): () => boolean
 useIsMobile (value): () => boolean
@@ -639,7 +622,6 @@ useSshAuthEditors (value): () => SshAuthEditorDef[]
 useSshAuthProviders (value): () => { providers: SshAuthTypeOption[]; loaded: boolean; find: (type: string) => SshAuthTypeOption; }
 useStatusColorScheme (value): () => StatusColorScheme
 useSurfaceKind (value): () => SurfaceKind
-useSyncStatus (value): () => any
 useTabHandlesVersion (value): () => number
 useTabs (value): () => TabContextType
 useTabsSafe (value): () => TabContextType
@@ -3,6 +3,8 @@
 *
 * getBundledPluginsDir() in src/backend/plugins/paths.ts resolves
 * dist/backend/backend/plugins -> dist/plugins, which is where this writes.
+ * --profile minimal|standard|full (or TERMIX_PLUGIN_PROFILE, default standard)
+ * picks which tiers of the file are staged.
 * Each .tmxplug is downloaded (or read from a path), checked against its
 * pinned sha256 and unpacked.
 *
@@ -25,13 +27,16 @@ const {
  localSdkBuildCommand,
  copyLocalBuild,
  buildBundledIndex,
+  resolveProfile,
+  pluginsForProfile,
 } = require("./lib/bundled-plugins.cjs");

 const root = path.resolve(__dirname, "..");
 const destination = path.join(root, "dist", "plugins");

 async function main() {
-  const plugins = loadBundledPlugins(root);
+  const profile = resolveProfile();
+  const plugins = pluginsForProfile(loadBundledPlugins(root), profile);
  const flag = process.argv.indexOf("--local");
  const localArg =
    flag !== -1 ? process.argv[flag + 1] : process.env.TERMIX_LOCAL_PLUGINS;
@@ -74,7 +79,7 @@ async function main() {
  );

  console.log(
-    `Bundled ${plugins.length + extra.length} plugin(s): ${[...pinned, ...extra].join(", ")}`,
+    `Bundled ${plugins.length + extra.length} plugin(s) (${profile}): ${[...pinned, ...extra].join(", ")}`,
  );
 }

@@ -16,6 +16,8 @@ import {
  localSdkBuildCommand,
  rebuildLocalPlugins,
  copyLocalBuild,
+  resolveProfile,
+  pluginsForProfile,
 } from "./lib/bundled-plugins.cjs";

 const cleanups: Array<() => void> = [];
@@ -263,10 +265,52 @@ describe("pinsFromIndex", () => {
      source: "tmxplug",
      url: "https://example.test/beta-1.1.0.tmxplug",
      sha256: "b".repeat(64),
+      tier: "full",
    });
    expect(parseBundledPlugins({ plugins: pins }).problems).toEqual([]);
  });

+  it("keeps the tier of an existing pin", () => {
+    const pins = pinsFromIndex(index, null, [
+      { id: "alpha", tier: "standard" },
+    ]);
+    expect(pins[0].tier).toBe("standard");
+    expect(pins[1].tier).toBe("full");
+  });
+
+  it("skips releases whose engine.termix excludes the core version", () => {
+    const withEngine = {
+      plugins: [
+        {
+          id: "gamma",
+          versions: [
+            {
+              version: "2.0.0",
+              url: "https://example.test/gamma-2.0.0.tmxplug",
+              sha256: "d".repeat(64),
+              engine: { api: "^1", termix: ">=26.10.6" },
+            },
+            {
+              version: "1.0.0",
+              url: "https://example.test/gamma-1.0.0.tmxplug",
+              sha256: "e".repeat(64),
+              engine: { api: "^1", termix: ">=26.10.0" },
+            },
+          ],
+        },
+      ],
+    };
+    expect(pinsFromIndex(withEngine, null, [], "26.10.5")[0].url).toBe(
+      "https://example.test/gamma-1.0.0.tmxplug",
+    );
+    expect(pinsFromIndex(withEngine, null, [], "26.10.6")[0].url).toBe(
+      "https://example.test/gamma-2.0.0.tmxplug",
+    );
+    expect(pinsFromIndex(withEngine, null)[0].url).toBe(
+      "https://example.test/gamma-2.0.0.tmxplug",
+    );
+  });
+
  it("keeps the onboarding defaults of an existing pin", () => {
    const current = [
      { id: "beta", onboarding: { recommended: true, consent: false } },
@@ -276,6 +320,33 @@ describe("pinsFromIndex", () => {
    expect(pins[0]).not.toHaveProperty("onboarding");
  });

+  it("pins a release kept in gated", () => {
+    const pins = pinsFromIndex(
+      {
+        plugins: [
+          {
+            id: "look",
+            versions: [],
+            gated: [
+              {
+                version: "1.1.0-beta.1",
+                url: "https://example.test/look-1.1.0-beta.1.tmxplug",
+                sha256: "d".repeat(64),
+              },
+              {
+                version: "1.0.0",
+                url: "https://example.test/look-1.0.0.tmxplug",
+                sha256: "e".repeat(64),
+              },
+            ],
+          },
+        ],
+      },
+      null,
+    );
+    expect(pins[0].url).toBe("https://example.test/look-1.0.0.tmxplug");
+  });
+
  it("pins only the ids asked for", () => {
    expect(pinsFromIndex(index, ["beta"]).map((pin) => pin.id)).toEqual([
      "beta",
@@ -484,3 +555,61 @@ describe("default look", () => {
    expect(fs.existsSync(path.join(out, "themes", "paper.css"))).toBe(true);
  });
 });
+
+describe("plugin profiles", () => {
+  const entry = (id: string, tier?: string) => ({
+    id,
+    source: "tmxplug",
+    url: `https://x/${id}.tmxplug`,
+    sha256: SHA,
+    ...(tier ? { tier } : {}),
+  });
+  const { plugins } = parseBundledPlugins({
+    plugins: [
+      entry("look", "minimal"),
+      entry("term", "standard"),
+      entry("extra", "full"),
+      entry("untiered"),
+    ],
+  });
+  const ids = (profile: string) =>
+    pluginsForProfile(plugins, profile).map((p: { id: string }) => p.id);
+
+  it("ships each tier and every smaller one", () => {
+    expect(ids("minimal")).toEqual(["look"]);
+    expect(ids("standard")).toEqual(["look", "term"]);
+    expect(ids("full")).toEqual(["look", "term", "extra", "untiered"]);
+  });
+
+  it("rejects an unknown tier", () => {
+    const { problems } = parseBundledPlugins({ plugins: [entry("x", "huge")] });
+    expect(problems[0]).toMatch(/tier must be one of/);
+  });
+
+  it("reads the profile from the flag, then the environment", () => {
+    expect(resolveProfile(["node", "x"], {})).toBe("standard");
+    expect(
+      resolveProfile(["node", "x"], { TERMIX_PLUGIN_PROFILE: "full" }),
+    ).toBe("full");
+    expect(
+      resolveProfile(["node", "x", "--profile", "minimal"], {
+        TERMIX_PLUGIN_PROFILE: "full",
+      }),
+    ).toBe("minimal");
+    expect(() =>
+      resolveProfile(["node", "x", "--profile", "tiny"], {}),
+    ).toThrow(/unknown plugin profile/);
+  });
+
+  it("keeps the real file valid with a default look in the minimal tier", () => {
+    const real = loadBundledPlugins(path.resolve(__dirname, ".."));
+    const minimal = pluginsForProfile(real, "minimal");
+    expect(minimal.length).toBeGreaterThan(0);
+    expect(minimal.every((p: { defaultLook: boolean }) => p.defaultLook)).toBe(
+      true,
+    );
+    expect(pluginsForProfile(real, "standard").length).toBeLessThan(
+      real.length,
+    );
+  });
+});
@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+/**
+ * Buttons are never white.
+ *
+ * Every Button variant is the brand orange with a different background
+ * opacity (or red for destructive, or transparent for ghost). Fails when a
+ * variant in src/ui/components/button.tsx uses a neutral fill, or when a
+ * <Button> anywhere in core or the local plugin checkouts sets a neutral fill
+ * in its className.
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const NEUTRAL =
+  /(?:^|[\s"'`])(?:dark:)?(?:bg-(?:primary|white|foreground|background|secondary|card|popover|muted|accent|input|neutral-\d+|zinc-\d+|gray-\d+|slate-\d+|stone-\d+)(?![\w-])|text-primary-foreground)/;
+
+/** The opening tag text of each <Button ...> in a source file. */
+function buttonTags(source) {
+  const tags = [];
+  const re = /<Button(?=[\s/>])/g;
+  let match;
+  while ((match = re.exec(source))) {
+    let depth = 0;
+    let quote = "";
+    let i = match.index + match[0].length;
+    for (; i < source.length; i++) {
+      const c = source[i];
+      if (quote) {
+        if (c === "\\") i++;
+        else if (c === quote) quote = "";
+      } else if (c === '"' || c === "'" || c === "`") quote = c;
+      else if (c === "{") depth++;
+      else if (c === "}") depth--;
+      else if (c === ">" && depth === 0) break;
+    }
+    tags.push(source.slice(match.index, i + 1));
+  }
+  return tags;
+}
+
+/** Variant strings from the cva block of button.tsx. */
+function variantLines(source) {
+  const start = source.indexOf("variant: {");
+  const end = source.indexOf("size: {");
+  if (start < 0 || end < 0) return [];
+  return source
+    .slice(start, end)
+    .split("\n")
+    .filter((line) => /["`]/.test(line) && !line.includes("variant: {"));
+}
+
+function walk(dir, out) {
+  if (!fs.existsSync(dir)) return;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (["node_modules", "dist", "tests", "__fixtures__"].includes(entry.name))
+      continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(full, out);
+    else if (entry.name.endsWith(".tsx")) out.push(full);
+  }
+}
+
+/** Problems found under the given roots. */
+function scan(roots, buttonFile) {
+  const problems = [];
+  if (buttonFile && fs.existsSync(buttonFile)) {
+    for (const line of variantLines(fs.readFileSync(buttonFile, "utf8"))) {
+      if (NEUTRAL.test(line)) {
+        problems.push(
+          `${buttonFile}: neutral fill in a variant: ${line.trim()}`,
+        );
+      }
+    }
+  }
+  const files = [];
+  for (const root of roots) walk(root, files);
+  for (const file of files) {
+    for (const tag of buttonTags(fs.readFileSync(file, "utf8"))) {
+      if (NEUTRAL.test(tag)) {
+        problems.push(
+          `${file}: <Button> with a neutral fill: ${tag.slice(0, 120)}`,
+        );
+      }
+    }
+  }
+  return problems;
+}
+
+module.exports = { scan, buttonTags, variantLines };
+
+if (require.main === module) {
+  const core = path.resolve(__dirname, "..");
+  const plugins = path.resolve(core, "..", "Plugins");
+  const roots = [path.join(core, "src", "ui")];
+  if (fs.existsSync(plugins)) {
+    for (const entry of fs.readdirSync(plugins)) {
+      roots.push(path.join(plugins, entry, "src"));
+    }
+  }
+  const problems = scan(
+    roots,
+    path.join(core, "src", "ui", "components", "button.tsx"),
+  );
+  if (problems.length) {
+    console.error("Buttons must be the brand orange, never white or neutral:");
+    for (const p of problems) console.error("  " + p);
+    process.exit(1);
+  }
+  console.log("ok  button colors");
+}
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const { scan, buttonTags } = require("./check-button-colors.cjs") as {
+  scan: (roots: string[], buttonFile?: string) => string[];
+  buttonTags: (source: string) => string[];
+};
+
+let root: string | null = null;
+
+afterEach(() => {
+  if (root) fs.rmSync(root, { recursive: true, force: true });
+  root = null;
+});
+
+function fixture(files: Record<string, string>): string {
+  root = fs.mkdtempSync(path.join(os.tmpdir(), "button-colors-"));
+  for (const [file, content] of Object.entries(files)) {
+    const full = path.join(root, file);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+  }
+  return root;
+}
+
+describe("buttonTags", () => {
+  it("reads a tag with arrow functions inside", () => {
+    const tags = buttonTags(
+      `<Button onClick={() => go(a > b)} className="x">Go</Button>`,
+    );
+    expect(tags).toHaveLength(1);
+    expect(tags[0]).toContain('className="x"');
+  });
+});
+
+describe("check-button-colors", () => {
+  it("accepts orange buttons and hover fills", () => {
+    const dir = fixture({
+      "a.tsx": `<Button className="bg-accent-brand/15 text-accent-brand hover:bg-muted" />`,
+    });
+    expect(scan([dir])).toEqual([]);
+  });
+
+  it("rejects a white or neutral fill on a Button", () => {
+    for (const cls of [
+      "bg-primary",
+      "bg-white",
+      "bg-foreground text-background",
+      "dark:bg-secondary",
+      "bg-muted",
+      "text-primary-foreground",
+    ]) {
+      const dir = fixture({ "a.tsx": `<Button className="${cls}">x</Button>` });
+      expect(scan([dir]), cls).toHaveLength(1);
+    }
+  });
+
+  it("rejects a neutral fill in a variant", () => {
+    const dir = fixture({
+      "button.tsx": `variant: {\n  default: "bg-primary text-primary-foreground",\n  ghost: "hover:bg-muted",\n},\nsize: {`,
+    });
+    expect(scan([], path.join(dir, "button.tsx"))).toHaveLength(1);
+  });
+
+  it("passes on the real button", () => {
+    const button = path.resolve(
+      __dirname,
+      "..",
+      "src",
+      "ui",
+      "components",
+      "button.tsx",
+    );
+    expect(scan([], button)).toEqual([]);
+  });
+});
@@ -32,14 +32,18 @@ const OFFICIAL_IDS = [
  "acme-ssl",
  "ai",
  "alerts",
+  "audit-tools",
  "automations",
  "classic-layout",
  "classic-themes",
+  "credential-tools",
  "docker",
  "file-manager",
  "fleets",
  "homepage",
  "host-metrics",
+  "host-status",
+  "import-export",
  "ldap",
  "network-topology",
  "opkssh",
@@ -136,13 +136,11 @@ const ALLOWED = [
  "DropdownMenuTrigger",
  "EditingWidth",
  "EmptyState",
-  "ExportPayload",
  "FOLDER_COLORS",
  "FONT_SIZES",
  "Facts",
  "FakeSwitch",
  "Field",
-  "FieldGroup",
  "FieldPair",
  "FolderAccessRule",
  "FolderIconEl",
@@ -153,6 +151,7 @@ const ALLOWED = [
  "GridCardCatalogEntry",
  "GridColSpan",
  "GridColumns",
+  "GridSize",
  "GridLayout",
  "GridSlot",
  "GroupHeading",
@@ -170,6 +169,9 @@ const ALLOWED = [
  "HostDefaultsTarget",
  "HostDensity",
  "HostFeatureFields",
+  "HostLock",
+  "HostPolicy",
+  "HttpsSettings",
  "HostFeatureFieldsProps",
  "HostFolder",
  "HostGroupKey",
@@ -196,7 +198,6 @@ const ALLOWED = [
  "Label",
  "LineChart",
  "LineChartSeries",
-  "LinkServerDialog",
  "LinkedAccountInfo",
  "ListBadge",
  "ListRow",
@@ -217,6 +218,8 @@ const ALLOWED = [
  "Meter",
  "MetricCard",
  "MiniStat",
+  "NativeView",
+  "NativeViewProps",
  "NumberField",
  "OPEN_PLUGINS_EVENT",
  "OpenTabRecord",
@@ -235,6 +238,7 @@ const ALLOWED = [
  "PasswordInput",
  "PermissionCatalogEntry",
  "PluginComponent",
+  "PRESETS",
  "PluginIcon",
  "PluginSettingsErrors",
  "PluginSettingsField",
@@ -246,7 +250,6 @@ const ALLOWED = [
  "PopoverContent",
  "PopoverTrigger",
  "ProxyNode",
-  "ProxySettingsFields",
  "RadialGauge",
  "RadialGaugeProps",
  "RailGroup",
@@ -307,12 +310,6 @@ const ALLOWED = [
  "SurfaceScope",
  "Switch",
  "SwitchRow",
-  "SyncBasicAuth",
-  "SyncConflictItem",
-  "SyncEntityInfo",
-  "SyncErrorItem",
-  "SyncProxyHeader",
-  "SyncStatus",
  "TOTPDialog",
  "Tab",
  "TabShellCallbacks",
@@ -369,9 +366,7 @@ const ALLOWED = [
  "applyUiFont",
  "assignRoleToUser",
  "beginSplitDrag",
-  "buildExportPayload",
  "buildOriginWsUrl",
-  "bulkImportSSHHosts",
  "bulkUpdateSSHHosts",
  "canConfigureUpdates",
  "canJoinSplit",
@@ -400,22 +395,17 @@ const ALLOWED = [
  "deleteRole",
  "deleteSSHHost",
  "deleteUser",
-  "deployCredentialToHost",
  "desktopUpdates",
  "docsUrl",
  "duplicateCredential",
  "enabledHostProtocols",
  "endSplitDrag",
-  "exportAllSSHHosts",
  "filterPaletteItems",
  "findCoreHostDefault",
  "findMatchingKeybinding",
-  "generateKeyPair",
-  "generatePublicKeyFromPrivate",
  "getActiveSessions",
  "getAdaptiveResourceBudget",
  "getApiKeys",
-  "getAuditForwarding",
  "getAuditLogActions",
  "getAuditLogs",
  "getBasePath",
@@ -440,9 +430,11 @@ const ALLOWED = [
  "getHostDefaultsLevel",
  "getHostEditorSection",
  "getHostPassword",
+  "getHostPolicy",
  "getHostSidebarPreferences",
  "getHostTags",
  "getLiveHostStatus",
+  "getHttpsSettings",
  "getLogLevel",
  "getNotificationPrivateEndpoints",
  "getPanel",
@@ -467,8 +459,6 @@ const ALLOWED = [
  "getSessions",
  "getStatusCheckSettings",
  "getStatusClasses",
-  "getSyncConflicts",
-  "getSyncErrors",
  "getTabType",
  "getTlsStatus",
  "getUpdateChannel",
@@ -484,11 +474,11 @@ const ALLOWED = [
  "hasVisibleFields",
  "hostActionsFor",
  "hostBadgesFor",
-  "hostKey",
+  "hostEditorToolbarItemsFor",
  "hostMenuItemsFor",
  "hostProtocolFlags",
+  "hostStatusIndicatorsFor",
  "hydrateLocalSharedHostAuth",
-  "importSSHConfigHosts",
  "invalidateHostsAndStatusCaches",
  "invalidateServerStatusCache",
  "isCoreRailView",
@@ -513,7 +503,6 @@ const ALLOWED = [
  "mapCredentials",
  "markAdaptiveResourceUsed",
  "markTabSurfaceUsed",
-  "maskSecrets",
  "moveRailItem",
  "moveSplitDrag",
  "normalizeLanguageCode",
@@ -524,7 +513,6 @@ const ALLOWED = [
  "parseServerTime",
  "pluginKey",
  "pluginName",
-  "pluginSecretKeys",
  "pluginWsUrl",
  "preloadTabSurface",
  "previewHostDefaultsLevel",
@@ -535,7 +523,6 @@ const ALLOWED = [
  "railItemLabel",
  "readFromClipboard",
  "recordHostActionPreference",
-  "refreshSyncStatus",
  "registerLayout",
  "registerTabCloseGuard",
  "releaseUrlFrom",
@@ -558,7 +545,6 @@ const ALLOWED = [
  "resolveHostDefaults",
  "resolveHostTabType",
  "resolveRemoteHostId",
-  "retrySyncErrors",
  "revokeAllUserSessions",
  "revokeCredentialAccess",
  "revokeFolderAccess",
@@ -582,23 +568,17 @@ const ALLOWED = [
  "setHostAuthOverride",
  "setNotificationPrivateEndpoints",
  "setPluginOptions",
-  "setSyncStatus",
  "setUpdateChannel",
-  "settleSyncConflict",
  "shareCredential",
  "shareFolder",
  "shareHost",
  "shell",
  "splitDefaultKey",
  "sshHostToHost",
-  "syncNow",
  "tabIcon",
  "tabJumpHotkeyKeys",
  "takePendingManageRequest",
  "unlinkExternalFromPasswordAccount",
-  "unlinkServer",
-  "updateAuditForwarding",
-  "updateBranding",
  "updateCredential",
  "updateExternalAutoProvision",
  "updateFolderMetadata",
@@ -614,8 +594,8 @@ const ALLOWED = [
  "updateSSHHost",
  "updateSecondFactorAfterExternalLogin",
  "updateSessionTimeout",
+  "updateHttpsSettings",
  "updateStatusCheckSettings",
-  "updateSyncSettings",
  "uploadTlsCertificate",
  "usageBarColor",
  "usageColor",
@@ -628,11 +608,14 @@ const ALLOWED = [
  "useConfirm",
  "useConnectionGate",
  "useConnectionLog",
+  "useDesktopLinked",
  "useDesktopUpdate",
  "useEditorDefaultKeys",
  "useHostActions",
  "useHostBadges",
  "useHostContextMenuItems",
+  "useHostEditorToolbarItems",
+  "useHostStatusIndicators",
  "useHostEditorSections",
  "useHostProtocols",
  "useHostStatus",
@@ -660,7 +643,6 @@ const ALLOWED = [
  "useSshAuthProviders",
  "useStatusColorScheme",
  "useSurfaceKind",
-  "useSyncStatus",
  "useTabHandlesVersion",
  "useTabs",
  "useTabsSafe",
@@ -48,7 +48,11 @@ function start() {
      writeFileSync: vi.fn(),
    },
    fork: () => child,
-    app: { isPackaged: true, getVersion: () => "2.9.0" },
+    app: {
+      isPackaged: true,
+      getVersion: () => "2.9.0",
+      getPath: () => "/user-data",
+    },
    process: { env: { LOG_LEVEL: "error" } },
    isDev: false,
    appRoot: "/app",
@@ -1,40 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-
-const require = createRequire(import.meta.url);
-const { isLaunchableFileName } = require("../electron/external-editor.cjs") as {
-  isLaunchableFileName: (fileName: unknown) => boolean;
-};
-
-describe("Electron external editor", () => {
-  it("refuses remote file names the OS would run instead of open", () => {
-    for (const name of [
-      "payload.exe",
-      "run.BAT",
-      "script.ps1",
-      "a.exe. ",
-      "a.cmd...",
-      "../../evil.vbs",
-      "start.command",
-      "launch.desktop",
-      "install.sh",
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(true);
-    }
-  });
-
-  it("opens ordinary text files", () => {
-    for (const name of [
-      "nginx.conf",
-      "README.md",
-      "Dockerfile",
-      ".bashrc",
-      "config.json",
-      "index.ts",
-      "",
-      undefined,
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(false);
-    }
-  });
-});
@@ -39,12 +39,24 @@ describe("Electron security boundary", () => {
    }
  });

-  it("launches only the editor saved from a file dialog", () => {
-    expect(main).not.toContain("fileData?.editorPath");
-    expect(main).toContain("readSetting(EXTERNAL_EDITOR_SETTING)");
+  it("saves an external editor only if it was chosen in a file dialog", () => {
    expect(main).toContain("dialogChosenPaths.has(value)");
  });

+  it("keeps local files, the local terminal and the external editor out of Electron", () => {
+    for (const channel of [
+      "open-external-editor",
+      "close-external-editor",
+      "local-terminal-start",
+      "local-fs:",
+      "local-transfer:",
+      "list-local-directory",
+    ]) {
+      expect(main).not.toContain(channel);
+      expect(preload).not.toContain(channel);
+    }
+  });
+
  it("scopes proxy headers and basic auth to the linked origin", () => {
    expect(main).toContain('"sync-proxy-config"');
    expect(main).toContain("linkedServer.applyLinkHeaders(");
@@ -0,0 +1,28 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { execFileSync } = require("node:child_process");
+
+function findPackage(start) {
+  let directory = path.dirname(start);
+  while (directory !== path.dirname(directory)) {
+    const manifest = path.join(directory, "package.json");
+    if (fs.existsSync(manifest)) return JSON.parse(fs.readFileSync(manifest));
+    directory = path.dirname(directory);
+  }
+  throw new Error("Could not locate the installed sharp package manifest");
+}
+
+// The build runs on x64 but ships arm64 and ia32 too, so npm ci alone
+// only installs the x64 binary.
+const sharpPackage = findPackage(require.resolve("sharp"));
+const packages = [
+  "@img/sharp-win32-arm64",
+  "@img/sharp-win32-ia32",
+  "@img/sharp-win32-x64",
+].map((name) => `${name}@${sharpPackage.optionalDependencies[name]}`);
+
+// A .cmd file only starts through a shell on current Node.
+execFileSync("npm.cmd", ["install", "--force", "--no-save", ...packages], {
+  stdio: "inherit",
+  shell: true,
+});
@@ -16,6 +16,11 @@
 * environment variables is set, for a server configured before first boot.
 * Plugins without it start unchecked.
 *
+ * "tier" says which image profile ships the plugin: "minimal" (only what the
+ * app cannot start without, the default look), "standard" (the default image)
+ * or "full" (everything else). A profile includes its own tier and every
+ * smaller one. A plugin with no tier counts as "full".
+ *
 * "defaultLook": true marks the plugin whose layout (and that layout's
 * theme) a fresh install shows. Core finds the default look this way, so it
 * never names a plugin. Such a plugin always starts enabled and cannot be
@@ -25,11 +30,14 @@
 const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
+const semver = require("semver");

 const ID = /^[a-z0-9][a-z0-9-]*$/;
 const ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
 const ONBOARDING_KEYS = new Set(["recommended", "consent", "enabledByEnv"]);
 const SHA256 = /^[0-9a-f]{64}$/;
+const PROFILES = ["minimal", "standard", "full"];
+const DEFAULT_PROFILE = "standard";

 function parseOnboarding(value, id, problems) {
  if (value === undefined) return null;
@@ -121,6 +129,9 @@ function parseBundledPlugins(raw) {
      ) {
        problems.push(`${entry.id} defaultLook must be a boolean`);
      }
+      if (entry.tier !== undefined && !PROFILES.includes(entry.tier)) {
+        problems.push(`${entry.id} tier must be one of ${PROFILES.join(", ")}`);
+      }
      if (problems.length > before) continue;
      plugins.push({
        id: entry.id,
@@ -130,6 +141,7 @@ function parseBundledPlugins(raw) {
        sha256: entry.sha256,
        onboarding,
        defaultLook: entry.defaultLook === true,
+        tier: entry.tier ?? "full",
      });
    } else {
      problems.push(`${entry.id} has an unknown source "${entry.source}"`);
@@ -240,26 +252,64 @@ function buildBundledIndex(plugins, stagedIds) {
  return { version: 1, plugins: out };
 }

+/** The profile to build: --profile, then TERMIX_PLUGIN_PROFILE, then standard. */
+function resolveProfile(argv = process.argv, env = process.env) {
+  const flag = argv.indexOf("--profile");
+  const value =
+    (flag !== -1 ? argv[flag + 1] : env.TERMIX_PLUGIN_PROFILE) ||
+    DEFAULT_PROFILE;
+  if (!PROFILES.includes(value)) {
+    throw new Error(
+      `unknown plugin profile "${value}", use ${PROFILES.join(", ")}`,
+    );
+  }
+  return value;
+}
+
+/** The plugins a profile ships: its own tier and every smaller one. */
+function pluginsForProfile(plugins, profile) {
+  const rank = PROFILES.indexOf(profile);
+  return plugins.filter((plugin) => PROFILES.indexOf(plugin.tier) <= rank);
+}
+
 /**
 * Pins the newest registry version of each wanted plugin. `ids` is the list
 * to pin, or null for every plugin in the index. `current` is the existing
- * pin list, so fields the registry does not know (onboarding) carry over.
+ * pin list, so fields the registry does not know (onboarding, tier) carry over;
+ * a plugin new to the list starts in the full tier. coreVersion, when given,
+ * skips releases whose engine.termix range does not include it, so the image
+ * never ships a plugin its own core cannot run.
 */
-function pinsFromIndex(index, ids, current = []) {
+function pinsFromIndex(index, ids, current = [], coreVersion = null) {
  const plugins = Array.isArray(index?.plugins) ? index.plugins : [];
  const byId = new Map(plugins.map((plugin) => [plugin.id, plugin]));
  const currentById = new Map(current.map((entry) => [entry.id, entry]));
  const wanted = ids ?? plugins.map((plugin) => plugin.id);
  return [...wanted].sort().map((id) => {
-    const latest = byId.get(id)?.versions?.[0];
+    const listed = byId.get(id);
+    // gated holds releases that need a newer Termix than old builds check for.
+    const latest = [...(listed?.versions ?? []), ...(listed?.gated ?? [])]
+      .filter((entry) => semver.valid(entry.version))
+      .filter((entry) => !semver.prerelease(entry.version))
+      .filter(
+        (entry) =>
+          !coreVersion ||
+          !entry.engine?.termix ||
+          semver.satisfies(coreVersion, entry.engine.termix, {
+            includePrerelease: true,
+          }),
+      )
+      .sort((a, b) => semver.rcompare(a.version, b.version))[0];
    if (!latest) throw new Error(`${id} is not in the registry index`);
    const onboarding = currentById.get(id)?.onboarding;
    const defaultLook = currentById.get(id)?.defaultLook === true;
+    const tier = currentById.get(id)?.tier ?? "full";
    return {
      id,
      source: "tmxplug",
      url: latest.url,
      sha256: latest.sha256,
+      tier,
      ...(onboarding ? { onboarding } : {}),
      ...(defaultLook ? { defaultLook } : {}),
    };
@@ -403,6 +453,9 @@ function copyLocalBuild(repo, destination) {
 }

 module.exports = {
+  PROFILES,
+  resolveProfile,
+  pluginsForProfile,
  findLocalPluginBuilds,
  isLocalBuildStale,
  localSdkBuildCommand,
@@ -0,0 +1,149 @@
+const fs = require("node:fs");
+
+const SK_ED = "sk-ssh-ed25519@openssh.com";
+const SK_EC = "sk-ecdsa-sha2-nistp256@openssh.com";
+
+function replaceOnce(source, from, to, label) {
+  const first = source.indexOf(from);
+  if (first === -1 || source.indexOf(from, first + 1) !== -1) {
+    throw new Error(`ssh2 changed (${label}); review the security key patch`);
+  }
+  return source.replace(from, () => to);
+}
+
+function patchKeyParserSource(source) {
+  if (source.includes("// termix-sk")) return source;
+  let out = replaceOnce(
+    source,
+    `    case 'ecdsa-sha2-nistp521':
+      return true;
+    case 'ssh-ed25519':
+      if (eddsaSupported)
+        return true;`,
+    `    case 'ecdsa-sha2-nistp521':
+      return true;
+    case '${SK_EC}': // termix-sk
+      return true;
+    case '${SK_ED}':
+    case 'ssh-ed25519':
+      if (eddsaSupported)
+        return true;`,
+    "key types",
+  );
+  out = replaceOnce(
+    out,
+    `    default:
+      return new Error(\`Unsupported OpenSSH public key type: \${baseType}\`);
+  }
+
+  return new OpenSSH_Public(`,
+    `    case '${SK_ED}':
+    case '${SK_EC}': {
+      // Public blob only; the security key signs, so there is no private half.
+      const rest = data.subarray(data._pos || 0);
+      const typeLen = Buffer.byteLength(baseType);
+      pubSSH = Buffer.allocUnsafe(4 + typeLen + rest.length);
+      writeUInt32BE(pubSSH, typeLen, 0);
+      pubSSH.utf8Write(baseType, 4, typeLen);
+      pubSSH.set(rest, 4 + typeLen);
+      algo = baseType === '${SK_ED}' ? null : 'sha256';
+      break;
+    }
+    default:
+      return new Error(\`Unsupported OpenSSH public key type: \${baseType}\`);
+  }
+
+  return new OpenSSH_Public(`,
+    "parseDER",
+  );
+  return out;
+}
+
+function patchAgentSource(source) {
+  if (source.includes("skTrailer")) return source;
+  return replaceOnce(
+    source,
+    `              binaryParser.init(signature, 0);
+              binaryParser.readString(true);
+              signature = binaryParser.readString();
+              binaryParser.clear();`,
+    `              binaryParser.init(signature, 0);
+              binaryParser.readString(true);
+              signature = binaryParser.readString();
+              // Security key signatures end with flags and a counter.
+              const skTrailer = signature === undefined
+                ? undefined
+                : binaryParser.readRaw();
+              binaryParser.clear();
+              if (skTrailer && skTrailer.length)
+                signature.skTrailer = Buffer.from(skTrailer);`,
+    "agent sign response",
+  );
+}
+
+function patchProtocolSource(source) {
+  if (source.includes("skTrailer")) return source;
+  const start = source.indexOf("  authPK(username, pubKey, keyAlgo, cbSign) {");
+  const end = source.indexOf("  authHostbased(", start);
+  if (start === -1 || end === -1) {
+    throw new Error("ssh2 changed (authPK); review the security key patch");
+  }
+  let region = source.slice(start, end);
+  region = replaceOnce(
+    region,
+    `      signature = convertSignature(signature, keyType);`,
+    `      const skTrailer = signature && signature.skTrailer;
+      signature = convertSignature(signature, keyType);`,
+    "authPK sign",
+  );
+  region = replaceOnce(
+    region,
+    `          + 4 + algoLen + 4 + sigLen
+      );`,
+    `          + 4 + algoLen + 4 + sigLen + (skTrailer ? skTrailer.length : 0)
+      );`,
+    "authPK alloc",
+  );
+  region = replaceOnce(
+    region,
+    `      writeUInt32BE(packet, 4 + algoLen + 4 + sigLen, p += pubKeyLen);`,
+    `      writeUInt32BE(
+        packet,
+        4 + algoLen + 4 + sigLen + (skTrailer ? skTrailer.length : 0),
+        p += pubKeyLen
+      );`,
+    "authPK length",
+  );
+  region = replaceOnce(
+    region,
+    `      packet.set(signature, p += 4);`,
+    `      packet.set(signature, p += 4);
+      if (skTrailer)
+        packet.set(skTrailer, p + sigLen);`,
+    "authPK copy",
+  );
+  return source.slice(0, start) + region + source.slice(end);
+}
+
+if (require.main === module) {
+  const targets = [
+    ["ssh2/lib/protocol/keyParser.js", patchKeyParserSource],
+    ["ssh2/lib/agent.js", patchAgentSource],
+    ["ssh2/lib/protocol/Protocol.js", patchProtocolSource],
+  ];
+  for (const [id, patch] of targets) {
+    const target = require.resolve(id);
+    const source = fs.readFileSync(target, "utf8");
+    const result = patch(source);
+    if (result !== source) fs.writeFileSync(target, result);
+  }
+  console.log(
+    "[patch-ssh2-sk] Security key public keys and signatures enabled",
+  );
+}
+
+module.exports = {
+  patchKeyParserSource,
+  patchAgentSource,
+  patchProtocolSource,
+};
@@ -4,7 +4,10 @@
 * re-released.
 *
 *   node scripts/pin-bundled-plugins.cjs          refresh the plugins already listed
- *   node scripts/pin-bundled-plugins.cjs --all    list every plugin in the index
+ *   node scripts/pin-bundled-plugins.cjs --all    also add plugins new to the index (tier full)
+ *   --core-version X                              skip releases whose engine.termix excludes X
+ *
+ * The release workflow runs it with --all and the version being released.
 */

 const fs = require("node:fs");
@@ -22,6 +25,8 @@ const configPath = path.join(root, "docker", "bundled-plugins.json");

 async function main() {
  const all = process.argv.includes("--all");
+  const flag = process.argv.indexOf("--core-version");
+  const coreVersion = flag !== -1 ? process.argv[flag + 1] : null;
  const response = await fetch(INDEX_URL);
  if (!response.ok) {
    throw new Error(`registry index download failed with ${response.status}`);
@@ -30,7 +35,7 @@ async function main() {

  const current = loadBundledPlugins(root);
  const ids = all ? null : current.map((plugin) => plugin.id);
-  const plugins = pinsFromIndex(index, ids, current);
+  const plugins = pinsFromIndex(index, ids, current, coreVersion);
  fs.writeFileSync(configPath, `${JSON.stringify({ plugins }, null, 2)}\n`);
  console.log(
    `Pinned ${plugins.length} plugin(s) in docker/bundled-plugins.json`,
@@ -137,9 +137,19 @@ function verifyArtifact(artifact) {
    console.log(`Verified macOS sharp packaging: ${path.basename(artifact)}`);
  } finally {
    if (mountedAt) {
-      spawnSync("hdiutil", ["detach", mountedAt], { stdio: "ignore" });
+      for (let attempt = 0; attempt < 5; attempt++) {
+        const args =
+          attempt < 3 ? ["detach", mountedAt] : ["detach", "-force", mountedAt];
+        if (spawnSync("hdiutil", args, { stdio: "ignore" }).status === 0) break;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000);
+      }
    }
-    fs.rmSync(temporaryRoot, { recursive: true, force: true });
+    fs.rmSync(temporaryRoot, {
+      recursive: true,
+      force: true,
+      maxRetries: 5,
+      retryDelay: 1000,
+    });
  }
 }

@@ -26,6 +26,12 @@ import {
  isSecondFactorAfterExternalLoginEnabled,
 } from "./core-auth.js";
 import { findOrProvisionExternalUser } from "./provisioning.js";
+import {
+  SECOND_FACTOR_SETUP,
+  evaluateAuthPolicy,
+  hasAuthPolicies,
+  rememberDeviceAllowed,
+} from "./policy.js";
 import {
  getLoginMethod,
  getSecondFactor,
@@ -122,12 +128,15 @@ export async function evaluateSecondFactors(
 * governs external methods (SSO, LDAP) alone.
 */
 function shouldRunSecondFactors(methodId: string): boolean {
-  ensureCoreLoginProviders();
-  const method = getLoginMethod(methodId);
-  if (!method?.external) return true;
+  if (!isExternalMethod(methodId)) return true;
  return isSecondFactorAfterExternalLoginEnabled();
 }

+function isExternalMethod(methodId: string): boolean {
+  ensureCoreLoginProviders();
+  return !!getLoginMethod(methodId)?.external;
+}
+
 export const TRUST_DEVICE_COOKIE = "termix_trust_device";
 const TRUST_TOKEN_PATTERN = /^[a-f0-9]{64}$/;
 const TRUST_TOKEN_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
@@ -294,9 +303,40 @@ export async function runLogin(
    `${context.methodId}_role_shared_credentials`,
  );

-  const factors = shouldRunSecondFactors(context.methodId)
-    ? await evaluateSecondFactors(user.id)
-    : { required: [], blocked: [] };
+  // A login policy may want a factor where core would skip it, so it always
+  // sees the full picture.
+  const runFactors = shouldRunSecondFactors(context.methodId);
+  const factors =
+    runFactors || hasAuthPolicies()
+      ? await evaluateSecondFactors(user.id)
+      : { required: [], blocked: [] };
+  const trusted =
+    factors.required.length > 0 || hasAuthPolicies()
+      ? await isTrustedDevice(req, user.id)
+      : false;
+  const policy = await evaluateAuthPolicy({
+    userId: user.id,
+    methodId: context.methodId,
+    external: isExternalMethod(context.methodId),
+    deviceType,
+    trustedDevice: trusted,
+    mfaSatisfied: !!identity.mfaSatisfied,
+    secondFactors: listSecondFactors().map((factor) => ({
+      id: factor.id,
+      pluginId: factor.pluginId,
+      enrolled: factors.required.some(
+        (required) =>
+          required.id === factor.id && required.pluginId === factor.pluginId,
+      ),
+    })),
+  });
+  if (!runFactors && !policy.secondFactor) {
+    factors.required = [];
+    factors.blocked = [];
+  }
+  const rememberMe = context.rememberMe && policy.allowRememberDevice;
+  const skipByDevice =
+    trusted && policy.allowRememberDevice && policy.secondFactor !== "always";
  if (factors.blocked.length > 0) {
    authLogger.warn("Login refused: an enrolled second factor is unavailable", {
      operation: "second_factor_unavailable",
@@ -324,11 +364,7 @@ export async function runLogin(

  const ssoClaims = { externalSession: identity.externalSession ?? null };

-  if (
-    factors.required.length > 0 &&
-    !identity.mfaSatisfied &&
-    !(await isTrustedDevice(req, user.id))
-  ) {
+  if (factors.required.length > 0 && !identity.mfaSatisfied && !skipByDevice) {
    const tempToken = await AuthManager.getInstance().generateJWTToken(
      user.id,
      { pendingTOTP: true, expiresIn: "10m" },
@@ -337,14 +373,17 @@ export async function runLogin(
    pendingLogins.set(pendingKey(tempToken), {
      userId: user.id,
      methodId: context.methodId,
-      rememberMe: context.rememberMe,
+      rememberMe,
+      allowRememberDevice: policy.allowRememberDevice,
+      maxSessionSeconds: policy.maxSessionSeconds,
+      idleTimeoutSeconds: policy.idleTimeoutSeconds,
      ...ssoClaims,
      createdAt: Date.now(),
    });
    return {
      kind: "second-factor",
      tempToken,
-      rememberMe: context.rememberMe,
+      rememberMe,
      factors: factors.required.map((factor) => ({
        id: factor.id,
        pluginId: factor.pluginId,
@@ -353,11 +392,22 @@ export async function runLogin(
    };
  }

+  // Required but nothing set up yet: a session that can only set one up.
+  const needsSetup =
+    !!policy.secondFactor &&
+    factors.required.length === 0 &&
+    !identity.mfaSatisfied &&
+    !skipByDevice;
+
  const session = await issueSession(req, user, {
    methodId: context.methodId,
-    rememberMe: context.rememberMe,
+    rememberMe,
    rateLimitUsername: context.rateLimitUsername ?? identity.rateLimitUsername,
-    longLivedForApps: identity.kind === "external",
+    longLivedForApps:
+      identity.kind === "external" && policy.allowRememberDevice,
+    maxAgeSeconds: policy.maxSessionSeconds,
+    idleTimeoutSeconds: policy.idleTimeoutSeconds,
+    restriction: needsSetup ? SECOND_FACTOR_SETUP : null,
    ...ssoClaims,
  });
  return { kind: "session", ...session };
@@ -510,10 +560,15 @@ export async function verifySecondFactorAndRespond(
  }
  loginRateLimiter.resetTOTPAttempts(user.id);

+  // A pending entry lost to a restart falls back to the current policy.
+  const allowRemember = lookup.pending
+    ? lookup.pending.allowRememberDevice !== false
+    : rememberDeviceAllowed();
  const rememberMe =
-    typeof req.body?.rememberMe === "boolean"
+    allowRemember &&
+    (typeof req.body?.rememberMe === "boolean"
      ? req.body.rememberMe
-      : (lookup.pending?.rememberMe ?? false);
+      : (lookup.pending?.rememberMe ?? false));

  let trustToken: string | null = null;
  if (rememberMe) {
@@ -545,6 +600,8 @@ export async function verifySecondFactorAndRespond(
    methodId: pending?.methodId ?? "password",
    rememberMe,
    externalSession: pending?.externalSession ?? null,
+    maxAgeSeconds: pending?.maxSessionSeconds ?? null,
+    idleTimeoutSeconds: pending?.idleTimeoutSeconds ?? null,
  });

  if (trustToken && isNativeAppRequest(req)) {
@@ -0,0 +1,125 @@
+/**
+ * Login policy from plugins through ctx.auth.policy.provide: idle timeout,
+ * session length, remember me and a required second factor. Core asks every
+ * provider and the strictest answer wins. A provider that throws at login
+ * refuses the login, since skipping a security rule is worse than a failed
+ * sign in. The idle timeout is stored on the session at login. Desktop
+ * loopback, sync link and plugin minted sessions are device credentials, not
+ * logins, so the policy never reaches them.
+ */
+
+import type {
+  PluginAuthPolicyDecision,
+  PluginAuthPolicyInput,
+  PluginAuthPolicyProvider,
+} from "@termix-ssh/plugin-sdk/backend";
+import { authLogger } from "../utils/logger.js";
+import { LoginMethodError } from "./types.js";
+
+/** sessions.restriction of a session that may only set up a second factor. */
+export const SECOND_FACTOR_SETUP = "second-factor-setup";
+
+interface Entry {
+  pluginId: string;
+  provider: PluginAuthPolicyProvider;
+}
+
+const providers = new Map<symbol, Entry>();
+
+export function provideAuthPolicy(
+  pluginId: string,
+  provider: PluginAuthPolicyProvider,
+): () => void {
+  const key = Symbol(pluginId);
+  providers.set(key, { pluginId, provider });
+  return () => {
+    providers.delete(key);
+  };
+}
+
+/** Test seam. */
+export function clearAuthPolicies(): void {
+  providers.clear();
+}
+
+export function hasAuthPolicies(): boolean {
+  return providers.size > 0;
+}
+
+export interface AuthPolicy {
+  allowRememberDevice: boolean;
+  maxSessionSeconds: number | null;
+  idleTimeoutSeconds: number | null;
+  secondFactor: "always" | "new-device" | null;
+}
+
+const NO_POLICY: AuthPolicy = {
+  allowRememberDevice: true,
+  maxSessionSeconds: null,
+  idleTimeoutSeconds: null,
+  secondFactor: null,
+};
+
+function shortest(current: number | null, next: unknown): number | null {
+  if (typeof next !== "number" || !(next > 0)) return current;
+  const value = Math.floor(next);
+  return current === null ? value : Math.min(current, value);
+}
+
+function merge(policy: AuthPolicy, next: PluginAuthPolicyDecision): AuthPolicy {
+  let secondFactor = policy.secondFactor;
+  if (next.secondFactor === "always") secondFactor = "always";
+  else if (next.secondFactor === "new-device" && secondFactor !== "always") {
+    secondFactor = "new-device";
+  }
+  return {
+    allowRememberDevice:
+      policy.allowRememberDevice && next.allowRememberDevice !== false,
+    maxSessionSeconds: shortest(
+      policy.maxSessionSeconds,
+      next.maxSessionSeconds,
+    ),
+    idleTimeoutSeconds: shortest(
+      policy.idleTimeoutSeconds,
+      next.idleTimeoutSeconds,
+    ),
+    secondFactor,
+  };
+}
+
+export async function evaluateAuthPolicy(
+  input: PluginAuthPolicyInput,
+): Promise<AuthPolicy> {
+  let policy = NO_POLICY;
+  for (const entry of providers.values()) {
+    let decision: PluginAuthPolicyDecision;
+    try {
+      decision = (await entry.provider.evaluate(input)) ?? {};
+    } catch (error) {
+      authLogger.warn("Login policy failed, refusing the login", {
+        operation: "auth_policy",
+        pluginId: entry.pluginId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      throw new LoginMethodError(
+        "Sign in is not available right now. Contact an admin.",
+        503,
+        "auth_policy_unavailable",
+      );
+    }
+    policy = merge(policy, decision);
+  }
+  return policy;
+}
+
+/** Whether the login page should offer remember me. */
+export function rememberDeviceAllowed(): boolean {
+  for (const entry of providers.values()) {
+    try {
+      if (entry.provider.allowRememberDevice?.() === false) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
@@ -68,6 +68,11 @@ export interface IssueSessionOptions {
  externalSession?: ExternalSessionRef | null;
  /** SSO logins keep desktop and mobile apps signed in for 30 days. */
  longLivedForApps?: boolean;
+  /** Login policy cap on the session length. */
+  maxAgeSeconds?: number | null;
+  /** See SECOND_FACTOR_SETUP. */
+  restriction?: string | null;
+  idleTimeoutSeconds?: number | null;
 }

 export interface IssuedSession {
@@ -93,6 +98,9 @@ export async function issueSession(
    deviceType: deviceInfo.type,
    deviceInfo: deviceInfo.deviceInfo,
    externalSession: options.externalSession ?? null,
+    maxAgeSeconds: options.maxAgeSeconds ?? null,
+    restriction: options.restriction ?? null,
+    idleTimeoutSeconds: options.idleTimeoutSeconds ?? null,
  });

  if (options.rateLimitUsername) {
@@ -123,11 +131,14 @@ export async function issueSession(
    method: options.methodId,
  });

-  const maxAge =
+  let maxAge =
    options.longLivedForApps &&
    (deviceInfo.type === "desktop" || deviceInfo.type === "mobile")
      ? THIRTY_DAYS_MS
      : await sessionCookieMaxAge(options.rememberMe);
+  if (options.maxAgeSeconds) {
+    maxAge = Math.min(maxAge, options.maxAgeSeconds * 1000);
+  }

  return {
    token,
@@ -142,6 +153,7 @@ export async function issueSession(
      totp_enabled: await createCurrentUserAuthRepository().hasSecondFactor(
        user.id,
      ),
+      ...(options.restriction ? { restriction: options.restriction } : {}),
      ...(isNativeAppRequest(req) ? { token } : {}),
    },
  };
@@ -35,5 +35,9 @@ export interface PendingLogin {
  methodId: string;
  rememberMe: boolean;
  externalSession?: ExternalSessionRef | null;
+  /** Login policy that applied when the login paused. */
+  allowRememberDevice?: boolean;
+  maxSessionSeconds?: number | null;
+  idleTimeoutSeconds?: number | null;
  createdAt: number;
 }
@@ -27,8 +27,7 @@ import hostSidebarPreferencesRoutes from "./routes/host-sidebar-preferences.js";
 import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-preferences.js";
 import uiPreferencesRoutes from "./routes/ui-preferences.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
-import syncRoutes from "../sync/server/routes.js";
-import syncLinkRoutes from "../sync/client/routes.js";
+import { syncForwarder } from "../sync/provider.js";
 import { syncChangeWatcher } from "../sync/server/change-watcher.js";
 import dashboardRoutes from "./routes/dashboard-routes.js";
 import {
@@ -36,6 +35,7 @@ import {
  mountPluginLegacyPaths,
 } from "./routes/plugin-api-routes.js";
 import { attachPluginWebSockets } from "../plugins/ws.js";
+import { registerSshRelay } from "../hosts/ssh-relay.js";
 import pluginRoutes from "./routes/plugins.js";
 import { createPluginAssetsRouter } from "../plugins/assets.js";
 import { getPluginRuntime } from "../plugins/index.js";
@@ -73,6 +73,7 @@ import {
 } from "../plugins/user-data.js";
 import { configureDirectHttps, getTlsConfig } from "../tls/tls-service.js";
 import { acmeChallengeHandler } from "../tls/acme-challenges.js";
+import { httpsPolicyMiddleware } from "../tls/https-policy.js";
 import {
  createCurrentCredentialRepository,
  createCurrentHostRepository,
@@ -105,6 +106,7 @@ const __dirname = path.dirname(__filename);
 const app = express();

 app.set("trust proxy", "loopback");
+app.use(httpsPolicyMiddleware);

 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
@@ -1623,8 +1625,7 @@ app.use("/host-sidebar/preferences", hostSidebarPreferencesRoutes);
 app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
 app.use("/ui-preferences", uiPreferencesRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
-app.use("/sync", syncRoutes);
-app.use("/sync", syncLinkRoutes);
+app.use("/sync", syncForwarder);
 app.use("/dashboard", dashboardRoutes);
 app.use("/plugins", pluginRoutes);
 app.use(
@@ -1898,6 +1899,7 @@ const httpServer = http.createServer(app);
 // Plugin sockets ride this server at /plugin-ws/<id>/<path>. Anything else is
 // left alone, so core's own upgrade handling is unaffected.
 attachPluginWebSockets(httpServer);
+registerSshRelay();

 httpServer.on("error", (err: NodeJS.ErrnoException) => {
  if (err.code === "EADDRINUSE") {
@@ -370,17 +370,6 @@ async function initializeCompleteDatabase(): Promise<void> {
        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
    );

-    CREATE TABLE IF NOT EXISTS recent_activity (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id TEXT NOT NULL,
-        type TEXT NOT NULL,
-        host_id INTEGER NOT NULL,
-        host_name TEXT,
-        timestamp TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
-        FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE
-    );
-
    CREATE TABLE IF NOT EXISTS host_access (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        host_id INTEGER NOT NULL,
@@ -1032,6 +1021,8 @@ const migrateSchema = () => {
  }
  enforceUniqueUsernames();
  addColumnIfNotExists("sessions", "external_session_ref", "TEXT");
+  addColumnIfNotExists("sessions", "restriction", "TEXT");
+  addColumnIfNotExists("sessions", "idle_timeout", "INTEGER");

  addColumnIfNotExists("ssh_data", "name", "TEXT");
  addColumnIfNotExists("ssh_data", "folder", "TEXT");
@@ -98,12 +98,7 @@ export const PERFORMANCE_INDEXES: PerformanceIndex[] = [
    columns: "user_id",
  },

-  // Per-user history and file manager surfaces.
-  {
-    name: "idx_recent_activity_user_ts",
-    table: "recent_activity",
-    columns: "user_id, timestamp",
-  },
+  // Per-user open tabs.
  {
    name: "idx_user_open_tabs_user_id",
    table: "user_open_tabs",
@@ -59,6 +59,10 @@ export const sessions = mysqlTable(
    lastActiveAt: text("last_active_at")
      .notNull()
      .default(sql`(CURRENT_TIMESTAMP)`),
+    // Set while the session may only set up a second factor.
+    restriction: text("restriction"),
+    // Seconds without a request before the session ends, from the login policy.
+    idleTimeout: int("idle_timeout"),
  },
  // Listing a user's devices, and the startup sweep of expired rows.
  (table) => [
@@ -414,28 +418,6 @@ export const hostDefaults = mysqlTable(
  ],
 );

-export const recentActivity = mysqlTable(
-  "recent_activity",
-  {
-    id: int("id").autoincrement().primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    type: text("type").notNull(),
-    hostId: int("host_id")
-      .notNull()
-      .references(() => hosts.id, { onDelete: "cascade" }),
-    hostName: text("host_name"),
-    timestamp: varchar("timestamp", { length: 255 })
-      .notNull()
-      .default(sql`(CURRENT_TIMESTAMP)`),
-  },
-  // Always read newest-first for one user, so timestamp follows user_id.
-  (table) => [
-    index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
-  ],
-);
-
 export const hostAccess = mysqlTable(
  "host_access",
  {
@@ -59,6 +59,10 @@ export const sessions = pgTable(
    lastActiveAt: text("last_active_at")
      .notNull()
      .default(sql`CURRENT_TIMESTAMP`),
+    // Set while the session may only set up a second factor.
+    restriction: text("restriction"),
+    // Seconds without a request before the session ends, from the login policy.
+    idleTimeout: integer("idle_timeout"),
  },
  // Listing a user's devices, and the startup sweep of expired rows.
  (table) => [
@@ -414,28 +418,6 @@ export const hostDefaults = pgTable(
  ],
 );

-export const recentActivity = pgTable(
-  "recent_activity",
-  {
-    id: serial("id").primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    type: text("type").notNull(),
-    hostId: integer("host_id")
-      .notNull()
-      .references(() => hosts.id, { onDelete: "cascade" }),
-    hostName: text("host_name"),
-    timestamp: varchar("timestamp", { length: 255 })
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  // Always read newest-first for one user, so timestamp follows user_id.
-  (table) => [
-    index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
-  ],
-);
-
 export const hostAccess = pgTable(
  "host_access",
  {
@@ -47,6 +47,10 @@ export const sessions = sqliteTable(
    lastActiveAt: text("last_active_at")
      .notNull()
      .default(sql`CURRENT_TIMESTAMP`),
+    // Set while the session may only set up a second factor.
+    restriction: text("restriction", { length: 32 }),
+    // Seconds without a request before the session ends, from the login policy.
+    idleTimeout: integer("idle_timeout"),
  },
  // Listing a user's devices, and the startup sweep of expired rows.
  (table) => [
@@ -404,28 +408,6 @@ export const hostDefaults = sqliteTable(
  ],
 );

-export const recentActivity = sqliteTable(
-  "recent_activity",
-  {
-    id: integer("id").primaryKey({ autoIncrement: true }),
-    userId: text("user_id")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    type: text("type").notNull(),
-    hostId: integer("host_id")
-      .notNull()
-      .references(() => hosts.id, { onDelete: "cascade" }),
-    hostName: text("host_name"),
-    timestamp: text("timestamp")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  // Always read newest-first for one user, so timestamp follows user_id.
-  (table) => [
-    index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
-  ],
-);
-
 export const hostAccess = sqliteTable(
  "host_access",
  {
@@ -23,7 +23,6 @@ import { PluginPermissionGrantRepository } from "./plugin-permission-grant-repos
 import { UserAuthRepository } from "./user-auth-repository.js";
 import { RbacAccessRepository } from "./rbac-access-repository.js";
 import { RbacPermissionRepository } from "./rbac-permission-repository.js";
-import { RecentActivityRepository } from "./recent-activity-repository.js";
 import { RoleRepository } from "./role-repository.js";
 import { SessionRepository } from "./session-repository.js";
 import { CredentialAccessRepository } from "./credential-access-repository.js";
@@ -269,13 +268,6 @@ export function createCurrentRbacAccessRepository(): RbacAccessRepository {
  );
 }

-export function createCurrentRecentActivityRepository(): RecentActivityRepository {
-  return new RecentActivityRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("recent_activity_repository_write"),
-  );
-}
-
 export function createCurrentRoleRepository(): RoleRepository {
  return new RoleRepository(
    createCurrentRepositoryContext(),
@@ -236,6 +236,29 @@ export class HostFolderRepository {
      .where(and(eq(hosts.userId, userId), folderMatch(hosts.folder)));
  }

+  /** Drops the folder rows (and subfolders) only when no host is left in them. */
+  async deleteEmptyFolderRecords(
+    userId: string,
+    folderName: string,
+  ): Promise<boolean> {
+    if ((await this.listHostsInFolder(userId, folderName)).length > 0) {
+      return false;
+    }
+    await deleteReturning(
+      this.context,
+      sshFolders,
+      and(
+        eq(sshFolders.userId, userId),
+        or(
+          eq(sshFolders.name, folderName),
+          like(sshFolders.name, `${folderName} / %`),
+        ),
+      ),
+    );
+    await this.afterWrite();
+    return true;
+  }
+
  async deleteHostsAndFolderRecords(
    userId: string,
    folderName: string,
@@ -1,107 +0,0 @@
-import { desc, eq, inArray } from "drizzle-orm";
-import { recentActivity } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import { insertReturning } from "./returning.js";
-
-export type RecentActivityRecord = typeof recentActivity.$inferSelect;
-export type NewRecentActivityRecord = typeof recentActivity.$inferInsert;
-
-export class RecentActivityRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  async listByUserId(
-    userId: string,
-    limit: number,
-  ): Promise<RecentActivityRecord[]> {
-    return this.context.drizzle
-      .select()
-      .from(recentActivity)
-      .where(eq(recentActivity.userId, userId))
-      .orderBy(desc(recentActivity.timestamp))
-      .limit(limit);
-  }
-
-  async create(
-    activity: NewRecentActivityRecord,
-  ): Promise<RecentActivityRecord> {
-    const rows = await insertReturning(this.context, recentActivity, activity);
-
-    await this.afterWrite();
-    return rows[0];
-  }
-
-  async trimUserActivity(userId: string, keepCount: number): Promise<number> {
-    const rows = await this.context.drizzle
-      .select({ id: recentActivity.id })
-      .from(recentActivity)
-      .where(eq(recentActivity.userId, userId))
-      .orderBy(desc(recentActivity.timestamp));
-
-    const idsToDelete = rows
-      .slice(keepCount)
-      .map((row) => row.id)
-      .filter((id) => typeof id === "number");
-
-    if (idsToDelete.length === 0) {
-      return 0;
-    }
-
-    const result = await this.context.drizzle
-      .delete(recentActivity)
-      .where(inArray(recentActivity.id, idsToDelete));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  async deleteByUserId(userId: string): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(recentActivity)
-      .where(eq(recentActivity.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  async deleteByHostId(hostId: number): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(recentActivity)
-      .where(eq(recentActivity.hostId, hostId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  async deleteByHostIds(hostIds: number[]): Promise<number> {
-    if (hostIds.length === 0) {
-      return 0;
-    }
-
-    const result = await this.context.drizzle
-      .delete(recentActivity)
-      .where(inArray(recentActivity.hostId, hostIds));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}
@@ -69,6 +69,14 @@ export class SessionRepository {
    return true;
  }

+  async clearRestrictionForUser(userId: string): Promise<void> {
+    await this.context.drizzle
+      .update(sessions)
+      .set({ restriction: null })
+      .where(eq(sessions.userId, userId));
+    await this.afterWrite();
+  }
+
  async updateToken(
    id: string,
    jwtToken: string,
@@ -5,12 +5,6 @@ import {
  createCurrentUserRepository,
 } from "../repositories/factory.js";
 import { apiLogger } from "../../utils/logger.js";
-import { exportFilename, toCsv, toNdjson } from "../../utils/audit-export.js";
-import {
-  logAudit,
-  getAuditUsername,
-  getRequestMeta,
-} from "../../utils/audit-logger.js";

 async function isAdminUser(userId: string | undefined): Promise<boolean> {
  if (!userId) return false;
@@ -138,125 +132,4 @@ export function registerAuditLogRoutes(
        .json({ error: "Failed to fetch audit log actions" });
    }
  });
-
-  /**
-   * @openapi
-   * /audit-logs/export:
-   *   get:
-   *     summary: Export audit logs
-   *     description: Streams the full filtered result set as CSV or NDJSON. Accepts the same filters as GET /audit-logs. Admin only. The export is itself audited.
-   *     tags:
-   *       - Audit
-   *     parameters:
-   *       - in: query
-   *         name: format
-   *         schema: { type: string, enum: [csv, ndjson], default: csv }
-   *       - in: query
-   *         name: userId
-   *         schema: { type: string }
-   *       - in: query
-   *         name: action
-   *         schema: { type: string }
-   *       - in: query
-   *         name: resourceType
-   *         schema: { type: string }
-   *       - in: query
-   *         name: success
-   *         schema: { type: string, enum: [true, false] }
-   *       - in: query
-   *         name: startDate
-   *         schema: { type: string, format: date-time }
-   *       - in: query
-   *         name: endDate
-   *         schema: { type: string, format: date-time }
-   *     responses:
-   *       200:
-   *         description: Audit log file.
-   *       403:
-   *         description: Not authorized.
-   *       500:
-   *         description: Failed to export audit logs.
-   */
-  router.get("/audit-logs/export", authenticateJWT, async (req, res) => {
-    const authReq = req as AuthenticatedRequest;
-    try {
-      if (!(await isAdminUser(authReq.userId))) {
-        return res.status(403).json({ error: "Not authorized" });
-      }
-
-      const format = req.query.format === "ndjson" ? "ndjson" : "csv";
-      const { userId, action, resourceType, success, startDate, endDate } =
-        req.query as Record<string, string | undefined>;
-      const filters = {
-        userId,
-        action,
-        resourceType,
-        success:
-          success !== undefined && success !== ""
-            ? success === "true"
-            : undefined,
-        startDate,
-        endDate,
-      };
-
-      res.setHeader(
-        "Content-Type",
-        format === "csv" ? "text/csv; charset=utf-8" : "application/x-ndjson",
-      );
-      res.setHeader(
-        "Content-Disposition",
-        `attachment; filename="${exportFilename(format, new Date())}"`,
-      );
-
-      // Streamed in batches: an export is unbounded by definition, and the
-      // whole point is to move data out before retention drops it.
-      const BATCH = 500;
-      let offset = 0;
-      let exported = 0;
-
-      for (;;) {
-        const rows = await createCurrentAuditLogRepository().listForExport({
-          filters,
-          limit: BATCH,
-          offset,
-        });
-        if (rows.length === 0) break;
-
-        if (format === "csv") {
-          // Header only on the first batch.
-          const chunk = toCsv(rows);
-          res.write(
-            offset === 0 ? chunk : chunk.slice(chunk.indexOf("\n") + 1),
-          );
-        } else {
-          res.write(toNdjson(rows));
-        }
-
-        exported += rows.length;
-        offset += rows.length;
-        if (rows.length < BATCH) break;
-      }
-
-      res.end();
-
-      // Reading the whole trail is itself worth recording.
-      const { ipAddress, userAgent } = getRequestMeta(req);
-      void logAudit({
-        userId: authReq.userId!,
-        username: await getAuditUsername(authReq.userId!),
-        action: "export_audit_logs",
-        resourceType: "audit_log",
-        details: JSON.stringify({ format, exported, filters }),
-        ipAddress,
-        userAgent,
-        success: true,
-      });
-    } catch (err) {
-      apiLogger.error("Failed to export audit logs", err);
-      if (!res.headersSent) {
-        return res.status(500).json({ error: "Failed to export audit logs" });
-      }
-      res.end();
-    }
-  });
 }
@@ -25,6 +25,7 @@ import {
 } from "../../auth/registry.js";
 import { isTrustedProxyAuthEnabled } from "../../utils/trusted-proxy-auth.js";
 import { LoginMethodError, type VerifiedIdentity } from "../../auth/types.js";
+import { rememberDeviceAllowed } from "../../auth/policy.js";

 export interface PublicLoginMethod {
  id: string;
@@ -243,7 +244,7 @@ export function registerAuthRoutes(router: Router): void {
   * /users/auth/methods:
   *   get:
   *     summary: List login methods
-   *     description: Public. The login methods with at least one enabled instance, for the login screen. Carries ids and labels only.
+   *     description: Public. The login methods with at least one enabled instance, for the login screen. Carries ids and labels only, plus rememberDevice, false when the login policy turned remember me off.
   *     tags:
   *       - Auth
   *     responses:
@@ -252,7 +253,10 @@ export function registerAuthRoutes(router: Router): void {
   */
  router.get("/auth/methods", async (_req, res) => {
    try {
-      res.json({ methods: await listPublicLoginMethods() });
+      res.json({
+        methods: await listPublicLoginMethods(),
+        rememberDevice: rememberDeviceAllowed(),
+      });
    } catch (error) {
      authLogger.error("Failed to list login methods", error);
      res.status(500).json({ error: "Failed to list login methods" });
@@ -1,98 +1,9 @@
-import type { Request, RequestHandler, Response, Router } from "express";
+import type { Request, Response, Router } from "express";
 import { databaseLogger } from "../../utils/logger.js";
 import { createCurrentSettingsRepository } from "../repositories/factory.js";
-import {
-  BRANDING_KEYS,
-  parseBrandingAppName,
-  parseBrandingLogoDataUrl,
-  parseBrandingTagline,
-  resolveBrandingSettings,
-} from "./branding-settings.js";
+import { resolveBrandingSettings } from "./branding-settings.js";

-const PATCHABLE_FIELDS = ["appName", "tagline", "logo"] as const;
-type PatchableField = (typeof PATCHABLE_FIELDS)[number];
-
-function invalidField(res: Response, field: string): void {
-  res.status(400).json({
-    error: `Invalid value for ${field}`,
-    code: "BRANDING_SETTINGS_INVALID",
-    field,
-  });
-}
-
-/**
- * Validates a PATCH body and returns the settings-table writes/deletes it
- * implies, or null after the response has already been failed with a 400.
- * `logo: null` clears the custom logo (falls back to the bundled default).
- */
-async function buildBrandingWrites(
-  body: unknown,
-  res: Response,
-): Promise<{
-  writes: Array<{ key: string; value: string }>;
-  deletes: string[];
-} | null> {
-  if (typeof body !== "object" || body === null || Array.isArray(body)) {
-    res.status(400).json({
-      error: "Invalid request body",
-      code: "BRANDING_SETTINGS_INVALID",
-    });
-    return null;
-  }
-
-  for (const field of Object.keys(body)) {
-    if (!(PATCHABLE_FIELDS as readonly string[]).includes(field)) {
-      res.status(400).json({
-        error: `Unknown setting field: ${field}`,
-        code: "BRANDING_SETTINGS_UNKNOWN_FIELD",
-        field,
-      });
-      return null;
-    }
-  }
-
-  const input = body as Partial<Record<PatchableField, unknown>>;
-  const writes: Array<{ key: string; value: string }> = [];
-  const deletes: string[] = [];
-
-  if (input.appName !== undefined) {
-    const appName = parseBrandingAppName(input.appName);
-    if (appName === null) {
-      invalidField(res, "appName");
-      return null;
-    }
-    writes.push({ key: BRANDING_KEYS.appName, value: appName });
-  }
-
-  if (input.tagline !== undefined) {
-    const tagline = parseBrandingTagline(input.tagline);
-    if (tagline === null) {
-      invalidField(res, "tagline");
-      return null;
-    }
-    writes.push({ key: BRANDING_KEYS.tagline, value: tagline });
-  }
-
-  if (input.logo !== undefined) {
-    if (input.logo === null) {
-      deletes.push(BRANDING_KEYS.logo);
-    } else {
-      const logo = await parseBrandingLogoDataUrl(input.logo);
-      if (logo === null) {
-        invalidField(res, "logo");
-        return null;
-      }
-      writes.push({ key: BRANDING_KEYS.logo, value: logo });
-    }
-  }
-
-  return { writes, deletes };
-}
-
-export function registerBrandingRoutes(
-  router: Router,
-  requireAdmin: RequestHandler,
-): void {
+export function registerBrandingRoutes(router: Router): void {
  /**
   * @openapi
   * /users/branding:
@@ -118,48 +29,4 @@ export function registerBrandingRoutes(
      res.status(500).json({ error: "Failed to load branding settings" });
    }
  });
-
-  /**
-   * @openapi
-   * /users/branding:
-   *   patch:
-   *     summary: Update white-label branding (admin only)
-   *     description: Persists a partial update to appName, tagline and/or logo (a PNG/JPEG/WEBP data URL; pass null to clear the logo). Invalid values are rejected with a 400.
-   *     tags:
-   *       - Users
-   *     responses:
-   *       200:
-   *         description: Updated effective branding settings.
-   *       400:
-   *         description: Invalid or unknown setting field.
-   *       401:
-   *         description: Not authenticated.
-   *       403:
-   *         description: Admin access required.
-   *       500:
-   *         description: Failed to save branding settings.
-   */
-  router.patch(
-    "/branding",
-    requireAdmin,
-    async (req: Request, res: Response) => {
-      const result = await buildBrandingWrites(req.body, res);
-      if (result === null) return;
-
-      try {
-        const settings = createCurrentSettingsRepository();
-        if (result.writes.length > 0) {
-          await settings.setMany(result.writes);
-        }
-        for (const key of result.deletes) {
-          await settings.delete(key);
-        }
-        const resolved = await resolveBrandingSettings(settings);
-        res.json(resolved);
-      } catch (err) {
-        databaseLogger.error("Failed to save branding settings", err);
-        res.status(500).json({ error: "Failed to save branding settings" });
-      }
-    },
-  );
 }
@@ -1,5 +1,4 @@
-import sharp from "sharp";
-import { databaseLogger } from "../../utils/logger.js";
+import { consumeByName } from "../../plugins/registry.js";

 /**
 * White-label branding: admin-configurable app name, logo and tagline shown
@@ -20,25 +19,33 @@ export const BRANDING_KEYS = {
 } as const;

 export const BRANDING_DEFAULT_APP_NAME = "Termix";
-const APP_NAME_MAX_LENGTH = 60;
-const TAGLINE_MAX_LENGTH = 160;
-
-/**
- * Cap applies to the decoded image bytes, not the base64 text. The settings
- * table is fully cached in memory per backend process (see
- * settings-cache.ts), so an oversized logo would be permanently resident RAM
- * on every instance, not just a one-time upload cost.
- */
-export const BRANDING_LOGO_MAX_BYTES = 750 * 1024;
-const BRANDING_LOGO_MAX_INPUT_PIXELS = 20_000_000;

 interface SettingSource {
  get(key: string): Promise<string | null>;
 }

+export const BRANDING_PROVIDER_NAME = "brandingProvider";
+
+/** A plugin supplies branding by providing "<its id>.brandingProvider". */
+export type BrandingProvider = () =>
+  Promise<BrandingSettings> | BrandingSettings;
+
 export async function resolveBrandingSettings(
  settings: SettingSource,
 ): Promise<BrandingSettings> {
+  const provider = consumeByName<BrandingProvider>(BRANDING_PROVIDER_NAME);
+  if (provider) {
+    try {
+      const provided = await provider();
+      return {
+        appName: provided.appName?.trim() || BRANDING_DEFAULT_APP_NAME,
+        tagline: provided.tagline ?? "",
+        logo: provided.logo || null,
+      };
+    } catch {
+      // A broken provider falls back to the stored settings.
+    }
+  }
  const [appName, tagline, logo] = await Promise.all([
    settings.get(BRANDING_KEYS.appName),
    settings.get(BRANDING_KEYS.tagline),
@@ -53,74 +60,3 @@ export async function resolveBrandingSettings(
 }

 /** Trimmed, 1-60 chars. Falls back to the default when cleared. */
-export function parseBrandingAppName(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  if (trimmed.length === 0) return BRANDING_DEFAULT_APP_NAME;
-  if (trimmed.length > APP_NAME_MAX_LENGTH) return null;
-  return trimmed;
-}
-
-/** Trimmed, 0-160 chars. An empty string means "use the built-in default". */
-export function parseBrandingTagline(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  if (trimmed.length > TAGLINE_MAX_LENGTH) return null;
-  return trimmed;
-}
-
-/**
- * Validates and re-encodes an uploaded logo. Only raster formats are
- * accepted (no SVG), sidestepping SVG-script XSS entirely rather than trying
- * to sanitize markup. The image is always re-encoded to PNG through sharp:
- * this both proves the payload is a genuine image (not a disguised file
- * behind a spoofed data-URL prefix) and strips any embedded metadata.
- *
- * Returns null on any validation failure; the caller is expected to reject
- * the request with a 400 without echoing back details of what was rejected.
- */
-export async function parseBrandingLogoDataUrl(
-  value: unknown,
-): Promise<string | null> {
-  if (typeof value !== "string") return null;
-  const match = value.match(
-    /^data:image\/(png|jpe?g|webp);base64,([a-zA-Z0-9+/]+=*)$/,
-  );
-  if (!match) return null;
-
-  const [, , base64] = match;
-  let buffer: Buffer;
-  try {
-    buffer = Buffer.from(base64, "base64");
-  } catch {
-    return null;
-  }
-  if (buffer.length === 0 || buffer.length > BRANDING_LOGO_MAX_BYTES * 4) {
-    // Reject wildly oversized input before decoding it with sharp; the final
-    // size check happens below on the re-encoded PNG.
-    return null;
-  }
-
-  try {
-    const source = sharp(buffer, {
-      failOn: "error",
-      limitInputPixels: BRANDING_LOGO_MAX_INPUT_PIXELS,
-    });
-    const metadata = await source.metadata();
-    if (
-      !metadata.format ||
-      !["png", "jpeg", "webp"].includes(metadata.format)
-    ) {
-      return null;
-    }
-    const normalized = await source.rotate().png().toBuffer();
-    if (normalized.length > BRANDING_LOGO_MAX_BYTES) return null;
-    return `data:image/png;base64,${normalized.toString("base64")}`;
-  } catch (err) {
-    databaseLogger.warn("Rejected invalid branding logo upload", {
-      operation: "branding_logo_invalid",
-      error: err instanceof Error ? err.message : String(err),
-    });
-    return null;
-  }
-}
@@ -1,436 +0,0 @@
-import { getErrorMessage } from "../../utils/error-message.js";
-import type {
-  AuthenticatedRequest,
-  CredentialBackend,
-} from "../../../types/index.js";
-import type { Request, RequestHandler, Response, Router } from "express";
-import type { Client as SshClient } from "ssh2";
-import { createCurrentHostResolutionRepository } from "../repositories/factory.js";
-import { connectHost } from "../../hosts/connect/connect-host.js";
-import type { SshConnectHost } from "../../hosts/connect/types.js";
-import { resolveHostById } from "../../hosts/host-resolver.js";
-import { isSecretReference } from "../../hosts/external-secrets.js";
-import { resolveKeyReferences } from "../../hosts/stored-ssh-key.js";
-import { parseSSHKey } from "../../utils/ssh-key-utils.js";
-
-function describeDeployError(err: unknown): string {
-  const message = getErrorMessage(err, "Connection failed");
-  if (message.includes("All configured authentication methods failed")) {
-    return "Authentication failed. Please check your credentials and ensure the SSH service is running.";
-  }
-  if (message.includes("ENOTFOUND") || message.includes("ENOENT")) {
-    return "Could not resolve hostname or connect to server.";
-  }
-  if (message.includes("ECONNREFUSED")) {
-    return "Connection refused. The server may not be running or the port may be incorrect.";
-  }
-  if (message.includes("ETIMEDOUT")) {
-    return "Connection timed out. Check your network connection and server availability.";
-  }
-  if (
-    message.includes("authentication failed") ||
-    message.includes("Permission denied")
-  ) {
-    return "Authentication failed. Please check your username and password/key.";
-  }
-  if (message === "SSH connection timeout") return "Connection timeout";
-  return message;
-}
-
-async function deploySSHKeyToHost(
-  host: SshConnectHost,
-  userId: string,
-  credData: CredentialBackend,
-): Promise<{ success: boolean; message?: string; error?: string }> {
-  const publicKey = credData.publicKey as string;
-
-  let conn: SshClient;
-  try {
-    ({ client: conn } = await connectHost(host, {
-      userId,
-      purpose: "credential-deploy",
-      timeoutMs: 120000,
-    }));
-  } catch (error) {
-    return { success: false, error: describeDeployError(error) };
-  }
-
-  return new Promise((resolve) => {
-    void (async () => {
-      try {
-        await new Promise<void>((resolveCmd, rejectCmd) => {
-          const cmdTimeout = setTimeout(() => {
-            rejectCmd(new Error("mkdir command timeout"));
-          }, 10000);
-
-          conn.exec(
-            "test -d ~/.ssh || mkdir -p ~/.ssh; chmod 700 ~/.ssh",
-            (err, stream) => {
-              if (err) {
-                clearTimeout(cmdTimeout);
-                return rejectCmd(err);
-              }
-
-              stream.on("close", (code) => {
-                clearTimeout(cmdTimeout);
-                if (code === 0) {
-                  resolveCmd();
-                } else {
-                  rejectCmd(
-                    new Error(`mkdir command failed with code ${code}`),
-                  );
-                }
-              });
-
-              stream.on("data", () => {
-                // Ignore output
-              });
-            },
-          );
-        });
-
-        const keyExists = await new Promise<boolean>(
-          (resolveCheck, rejectCheck) => {
-            const checkTimeout = setTimeout(() => {
-              rejectCheck(new Error("Key check timeout"));
-            }, 5000);
-
-            let actualPublicKey = publicKey;
-            try {
-              const parsed = JSON.parse(publicKey);
-              if (parsed.data) {
-                actualPublicKey = parsed.data;
-              }
-            } catch {
-              // Ignore parse errors
-            }
-
-            const keyParts = actualPublicKey.trim().split(" ");
-            if (keyParts.length < 2) {
-              clearTimeout(checkTimeout);
-              return rejectCheck(
-                new Error(
-                  "Invalid public key format - must contain at least 2 parts",
-                ),
-              );
-            }
-
-            const keyPattern = keyParts[1];
-            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(keyPattern)) {
-              clearTimeout(checkTimeout);
-              return rejectCheck(new Error("Invalid public key data"));
-            }
-
-            conn.exec(
-              `if [ -f ~/.ssh/authorized_keys ]; then grep -F "${keyPattern}" ~/.ssh/authorized_keys >/dev/null 2>&1; echo $?; else echo 1; fi`,
-              (err, stream) => {
-                if (err) {
-                  clearTimeout(checkTimeout);
-                  return rejectCheck(err);
-                }
-
-                let output = "";
-                stream.on("data", (data) => {
-                  output += data.toString();
-                });
-
-                stream.on("close", () => {
-                  clearTimeout(checkTimeout);
-                  const exists = output.trim() === "0";
-                  resolveCheck(exists);
-                });
-              },
-            );
-          },
-        );
-
-        if (keyExists) {
-          conn.end();
-          resolve({ success: true, message: "SSH key already deployed" });
-          return;
-        }
-
-        await new Promise<void>((resolveAdd, rejectAdd) => {
-          const addTimeout = setTimeout(() => {
-            rejectAdd(new Error("Key add timeout"));
-          }, 30000);
-
-          let actualPublicKey = publicKey;
-          try {
-            const parsed = JSON.parse(publicKey);
-            if (parsed.data) {
-              actualPublicKey = parsed.data;
-            }
-          } catch {
-            // Ignore parse errors
-          }
-
-          const escapedKey = actualPublicKey
-            .replace(/\\/g, "\\\\")
-            .replace(/'/g, "'\\''");
-          const escapedName = credData.name
-            .replace(/\\/g, "\\\\")
-            .replace(/'/g, "'\\''");
-
-          conn.exec(
-            `printf '%s\n' '${escapedKey} ${escapedName}@Termix' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
-            (err, stream) => {
-              if (err) {
-                clearTimeout(addTimeout);
-                return rejectAdd(err);
-              }
-
-              stream.on("data", () => {
-                // Consume output
-              });
-
-              stream.on("close", (code) => {
-                clearTimeout(addTimeout);
-                if (code === 0) {
-                  resolveAdd();
-                } else {
-                  rejectAdd(
-                    new Error(`Key deployment failed with code ${code}`),
-                  );
-                }
-              });
-            },
-          );
-        });
-
-        const verifySuccess = await new Promise<boolean>(
-          (resolveVerify, rejectVerify) => {
-            const verifyTimeout = setTimeout(() => {
-              rejectVerify(new Error("Key verification timeout"));
-            }, 5000);
-
-            let actualPublicKey = publicKey;
-            try {
-              const parsed = JSON.parse(publicKey);
-              if (parsed.data) {
-                actualPublicKey = parsed.data;
-              }
-            } catch {
-              // Ignore parse errors
-            }
-
-            const keyParts = actualPublicKey.trim().split(" ");
-            if (keyParts.length < 2) {
-              clearTimeout(verifyTimeout);
-              return rejectVerify(
-                new Error(
-                  "Invalid public key format - must contain at least 2 parts",
-                ),
-              );
-            }
-
-            const keyPattern = keyParts[1];
-            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(keyPattern)) {
-              clearTimeout(verifyTimeout);
-              return rejectVerify(new Error("Invalid public key data"));
-            }
-            conn.exec(
-              `grep -F "${keyPattern}" ~/.ssh/authorized_keys >/dev/null 2>&1; echo $?`,
-              (err, stream) => {
-                if (err) {
-                  clearTimeout(verifyTimeout);
-                  return rejectVerify(err);
-                }
-
-                let output = "";
-                stream.on("data", (data) => {
-                  output += data.toString();
-                });
-
-                stream.on("close", () => {
-                  clearTimeout(verifyTimeout);
-                  const verified = output.trim() === "0";
-                  resolveVerify(verified);
-                });
-              },
-            );
-          },
-        );
-
-        conn.end();
-
-        if (verifySuccess) {
-          resolve({ success: true, message: "SSH key deployed successfully" });
-        } else {
-          resolve({
-            success: false,
-            error: "Key deployment verification failed",
-          });
-        }
-      } catch (error) {
-        conn.end();
-        resolve({
-          success: false,
-          error: getErrorMessage(error, "Deployment failed"),
-        });
-      }
-    })();
-  });
-}
-
-export function registerCredentialDeployRoutes(
-  router: Router,
-  authenticateJWT: RequestHandler,
-  requireCredentialViewPermission: RequestHandler,
-  requireHostEditPermission: RequestHandler,
-  requireDataAccess: RequestHandler,
-): void {
-  /**
-   * @openapi
-   * /credentials/{id}/deploy-to-host:
-   *   post:
-   *     summary: Deploy SSH key to a host
-   *     description: Deploys an SSH public key to a target host's authorized_keys file.
-   *     tags:
-   *       - Credentials
-   *     parameters:
-   *       - in: path
-   *         name: id
-   *         required: true
-   *         schema:
-   *           type: integer
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               targetHostId:
-   *                 type: integer
-   *     responses:
-   *       200:
-   *         description: SSH key deployed successfully.
-   *       400:
-   *         description: Credential ID and target host ID are required.
-   *       401:
-   *         description: Authentication required.
-   *       404:
-   *         description: Credential or target host not found.
-   *       500:
-   *         description: Failed to deploy SSH key.
-   */
-  router.post(
-    "/:id/deploy-to-host",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireHostEditPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      const id = Array.isArray(req.params.id)
-        ? req.params.id[0]
-        : req.params.id;
-      const credentialId = parseInt(id);
-      const { targetHostId } = req.body;
-
-      if (!credentialId || !targetHostId) {
-        return res.status(400).json({
-          success: false,
-          error: "Credential ID and target host ID are required",
-        });
-      }
-
-      try {
-        const userId = (req as AuthenticatedRequest).userId;
-        if (!userId) {
-          return res.status(401).json({
-            success: false,
-            error: "Authentication required",
-          });
-        }
-
-        const repository = createCurrentHostResolutionRepository();
-        const credential = await repository.findCredentialByIdForUser(
-          credentialId,
-          userId,
-        );
-
-        if (!credential) {
-          return res.status(404).json({
-            success: false,
-            error: "Credential not found",
-          });
-        }
-
-        const credData = credential as unknown as CredentialBackend;
-
-        if (credData.authType !== "key") {
-          return res.status(400).json({
-            success: false,
-            error: "Only SSH key-based credentials can be deployed",
-          });
-        }
-
-        let publicKey = credData.publicKey;
-        const storedKey = credData.privateKey || credData.key;
-        if (!publicKey && isSecretReference(storedKey)) {
-          // A key kept in a secret source has no stored public key; derive
-          // it from the resolved key.
-          const resolved = await resolveKeyReferences(
-            userId,
-            storedKey,
-            (credData as { keyPassword?: string | null }).keyPassword,
-          );
-          publicKey =
-            parseSSHKey(resolved.key, resolved.passphrase).publicKey ||
-            undefined;
-        }
-        if (!publicKey) {
-          return res.status(400).json({
-            success: false,
-            error: "Public key is required for deployment",
-          });
-        }
-        // Writing authorized_keys is an owner action, so ownership is checked
-        // before the shared resolver fills in the credentials.
-        const hostData = await repository.findHostByIdForUser(
-          targetHostId,
-          userId,
-        );
-
-        if (!hostData) {
-          return res.status(404).json({
-            success: false,
-            error: "Target host not found",
-          });
-        }
-
-        const resolvedHost = await resolveHostById(targetHostId, userId);
-        if (!resolvedHost) {
-          return res.status(400).json({
-            success: false,
-            error: "Host credential not found",
-          });
-        }
-
-        const deployResult = await deploySSHKeyToHost(
-          resolvedHost as unknown as SshConnectHost,
-          userId,
-          credData,
-        );
-
-        if (deployResult.success) {
-          res.json({
-            success: true,
-            message: deployResult.message || "SSH key deployed successfully",
-          });
-        } else {
-          res.status(500).json({
-            success: false,
-            error: deployResult.error || "Deployment failed",
-          });
-        }
-      } catch (error) {
-        res.status(500).json({
-          success: false,
-          error: getErrorMessage(error, "Failed to deploy SSH key"),
-        });
-      }
-    },
-  );
-}
@@ -1,519 +0,0 @@
-import { getErrorMessage } from "../../utils/error-message.js";
-import type { Request, RequestHandler, Response, Router } from "express";
-import crypto from "crypto";
-import ssh2Pkg from "ssh2";
-import { authLogger } from "../../utils/logger.js";
-import {
-  parsePublicKey,
-  parseSSHKey,
-  validateKeyPair,
-} from "../../utils/ssh-key-utils.js";
-import { resolveKeyReferences } from "../../hosts/stored-ssh-key.js";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-
-const { utils: ssh2Utils } = ssh2Pkg;
-
-function generateSSHKeyPair(
-  keyType: string,
-  keySize?: number,
-  passphrase?: string,
-): {
-  success: boolean;
-  privateKey?: string;
-  publicKey?: string;
-  error?: string;
-} {
-  try {
-    let ssh2Type = keyType;
-    const options: {
-      bits?: number;
-      passphrase?: string;
-      cipher?: string;
-    } = {};
-
-    if (keyType === "ssh-rsa") {
-      ssh2Type = "rsa";
-      options.bits = keySize || 2048;
-    } else if (keyType === "ssh-ed25519") {
-      ssh2Type = "ed25519";
-    } else if (keyType === "ecdsa-sha2-nistp256") {
-      ssh2Type = "ecdsa";
-      options.bits = 256;
-    }
-
-    if (passphrase && passphrase.trim()) {
-      options.passphrase = passphrase;
-      options.cipher = "aes128-cbc";
-    }
-
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const keyPair = ssh2Utils.generateKeyPairSync(ssh2Type as any, options);
-
-    return {
-      success: true,
-      privateKey: keyPair.private,
-      publicKey: keyPair.public,
-    };
-  } catch (error) {
-    return {
-      success: false,
-      error: getErrorMessage(error, "SSH key generation failed"),
-    };
-  }
-}
-
-export function registerCredentialKeyRoutes(
-  router: Router,
-  authenticateJWT: RequestHandler,
-  requireCredentialViewPermission: RequestHandler,
-  requireDataAccess: RequestHandler,
-): void {
-  /**
-   * @openapi
-   * /credentials/detect-key-type:
-   *   post:
-   *     summary: Detect SSH key type
-   *     description: Detects the type of an SSH private key.
-   *     tags:
-   *       - Credentials
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               privateKey:
-   *                 type: string
-   *               keyPassword:
-   *                 type: string
-   *     responses:
-   *       200:
-   *         description: Key type detection result.
-   *       400:
-   *         description: Private key is required.
-   *       500:
-   *         description: Failed to detect key type.
-   */
-  router.post(
-    "/detect-key-type",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      if (!req.body?.privateKey || typeof req.body.privateKey !== "string") {
-        return res.status(400).json({ error: "Private key is required" });
-      }
-
-      try {
-        const { key: privateKey, passphrase: keyPassword } =
-          await resolveKeyReferences(
-            (req as AuthenticatedRequest).userId,
-            req.body.privateKey,
-            req.body.keyPassword,
-          );
-        const keyInfo = parseSSHKey(privateKey, keyPassword);
-
-        const response = {
-          success: keyInfo.success,
-          keyType: keyInfo.keyType,
-          detectedKeyType: keyInfo.keyType,
-          hasPublicKey: !!keyInfo.publicKey,
-          error: keyInfo.error || null,
-        };
-
-        res.json(response);
-      } catch (error) {
-        authLogger.error("Failed to detect key type", error);
-        res.status(500).json({
-          error: getErrorMessage(error, "Failed to detect key type"),
-        });
-      }
-    },
-  );
-
-  /**
-   * @openapi
-   * /credentials/detect-public-key-type:
-   *   post:
-   *     summary: Detect SSH public key type
-   *     description: Detects the type of an SSH public key.
-   *     tags:
-   *       - Credentials
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               publicKey:
-   *                 type: string
-   *     responses:
-   *       200:
-   *         description: Key type detection result.
-   *       400:
-   *         description: Public key is required.
-   *       500:
-   *         description: Failed to detect public key type.
-   */
-  router.post(
-    "/detect-public-key-type",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      const { publicKey } = req.body;
-
-      if (!publicKey || typeof publicKey !== "string") {
-        return res.status(400).json({ error: "Public key is required" });
-      }
-
-      try {
-        const keyInfo = parsePublicKey(publicKey);
-
-        const response = {
-          success: keyInfo.success,
-          keyType: keyInfo.keyType,
-          detectedKeyType: keyInfo.keyType,
-          error: keyInfo.error || null,
-        };
-
-        res.json(response);
-      } catch (error) {
-        authLogger.error("Failed to detect public key type", error);
-        res.status(500).json({
-          error: getErrorMessage(error, "Failed to detect public key type"),
-        });
-      }
-    },
-  );
-
-  /**
-   * @openapi
-   * /credentials/validate-key-pair:
-   *   post:
-   *     summary: Validate SSH key pair
-   *     description: Validates if a given SSH private key and public key match.
-   *     tags:
-   *       - Credentials
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               privateKey:
-   *                 type: string
-   *               publicKey:
-   *                 type: string
-   *               keyPassword:
-   *                 type: string
-   *     responses:
-   *       200:
-   *         description: Key pair validation result.
-   *       400:
-   *         description: Private key and public key are required.
-   *       500:
-   *         description: Failed to validate key pair.
-   */
-  router.post(
-    "/validate-key-pair",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      const { privateKey, publicKey, keyPassword } = req.body;
-
-      if (!privateKey || typeof privateKey !== "string") {
-        return res.status(400).json({ error: "Private key is required" });
-      }
-
-      if (!publicKey || typeof publicKey !== "string") {
-        return res.status(400).json({ error: "Public key is required" });
-      }
-
-      try {
-        const validationResult = validateKeyPair(
-          privateKey,
-          publicKey,
-          keyPassword,
-        );
-
-        const response = {
-          isValid: validationResult.isValid,
-          privateKeyType: validationResult.privateKeyType,
-          publicKeyType: validationResult.publicKeyType,
-          generatedPublicKey: validationResult.generatedPublicKey,
-          error: validationResult.error || null,
-        };
-
-        res.json(response);
-      } catch (error) {
-        authLogger.error("Failed to validate key pair", error);
-        res.status(500).json({
-          error: getErrorMessage(error, "Failed to validate key pair"),
-        });
-      }
-    },
-  );
-
-  /**
-   * @openapi
-   * /credentials/generate-key-pair:
-   *   post:
-   *     summary: Generate new SSH key pair
-   *     description: Generates a new SSH key pair.
-   *     tags:
-   *       - Credentials
-   *     requestBody:
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               keyType:
-   *                 type: string
-   *               keySize:
-   *                 type: integer
-   *               passphrase:
-   *                 type: string
-   *     responses:
-   *       200:
-   *         description: The new key pair.
-   *       500:
-   *         description: Failed to generate SSH key pair.
-   */
-  router.post(
-    "/generate-key-pair",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      const { keyType = "ssh-ed25519", keySize = 2048, passphrase } = req.body;
-
-      try {
-        const result = generateSSHKeyPair(keyType, keySize, passphrase);
-
-        if (result.success && result.privateKey && result.publicKey) {
-          const response = {
-            success: true,
-            privateKey: result.privateKey,
-            publicKey: result.publicKey,
-            keyType: keyType,
-            format: "ssh",
-            algorithm: keyType,
-            keySize: keyType === "ssh-rsa" ? keySize : undefined,
-            curve: keyType === "ecdsa-sha2-nistp256" ? "nistp256" : undefined,
-          };
-
-          res.json(response);
-        } else {
-          res.status(500).json({
-            success: false,
-            error: result.error || "Failed to generate SSH key pair",
-          });
-        }
-      } catch (error) {
-        authLogger.error("Failed to generate key pair", error);
-        res.status(500).json({
-          success: false,
-          error: getErrorMessage(error, "Failed to generate key pair"),
-        });
-      }
-    },
-  );
-
-  /**
-   * @openapi
-   * /credentials/generate-public-key:
-   *   post:
-   *     summary: Generate public key from private key
-   *     description: Generates a public key from a given private key.
-   *     tags:
-   *       - Credentials
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             properties:
-   *               privateKey:
-   *                 type: string
-   *               keyPassword:
-   *                 type: string
-   *     responses:
-   *       200:
-   *         description: The generated public key.
-   *       400:
-   *         description: Private key is required.
-   *       500:
-   *         description: Failed to generate public key.
-   */
-  router.post(
-    "/generate-public-key",
-    authenticateJWT,
-    requireCredentialViewPermission,
-    requireDataAccess,
-    async (req: Request, res: Response) => {
-      if (!req.body?.privateKey || typeof req.body.privateKey !== "string") {
-        return res.status(400).json({ error: "Private key is required" });
-      }
-
-      try {
-        const { key: privateKey, passphrase: keyPassword } =
-          await resolveKeyReferences(
-            (req as AuthenticatedRequest).userId,
-            req.body.privateKey,
-            req.body.keyPassword,
-          );
-        let privateKeyObj;
-        const parseAttempts = [];
-
-        try {
-          privateKeyObj = crypto.createPrivateKey({
-            key: privateKey,
-            passphrase: keyPassword,
-          });
-        } catch (error) {
-          parseAttempts.push(`Method 1 (with passphrase): ${error.message}`);
-        }
-
-        if (!privateKeyObj) {
-          try {
-            privateKeyObj = crypto.createPrivateKey(privateKey);
-          } catch (error) {
-            parseAttempts.push(
-              `Method 2 (without passphrase): ${error.message}`,
-            );
-          }
-        }
-
-        if (!privateKeyObj) {
-          try {
-            privateKeyObj = crypto.createPrivateKey({
-              key: privateKey,
-              format: "pem",
-              type: "pkcs8",
-            });
-          } catch (error) {
-            parseAttempts.push(`Method 3 (PKCS#8): ${error.message}`);
-          }
-        }
-
-        if (
-          !privateKeyObj &&
-          privateKey.includes("-----BEGIN RSA PRIVATE KEY-----")
-        ) {
-          try {
-            privateKeyObj = crypto.createPrivateKey({
-              key: privateKey,
-              format: "pem",
-              type: "pkcs1",
-            });
-          } catch (error) {
-            parseAttempts.push(`Method 4 (PKCS#1): ${error.message}`);
-          }
-        }
-
-        if (
-          !privateKeyObj &&
-          privateKey.includes("-----BEGIN EC PRIVATE KEY-----")
-        ) {
-          try {
-            privateKeyObj = crypto.createPrivateKey({
-              key: privateKey,
-              format: "pem",
-              type: "sec1",
-            });
-          } catch (error) {
-            parseAttempts.push(`Method 5 (SEC1): ${error.message}`);
-          }
-        }
-
-        if (!privateKeyObj) {
-          try {
-            const keyInfo = parseSSHKey(privateKey, keyPassword);
-
-            if (keyInfo.success && keyInfo.publicKey) {
-              const publicKeyString = String(keyInfo.publicKey);
-              return res.json({
-                success: true,
-                publicKey: publicKeyString,
-                keyType: keyInfo.keyType,
-              });
-            } else {
-              parseAttempts.push(
-                `SSH2 fallback: ${keyInfo.error || "No public key generated"}`,
-              );
-            }
-          } catch (error) {
-            parseAttempts.push(`SSH2 fallback exception: ${error.message}`);
-          }
-        }
-
-        if (!privateKeyObj) {
-          return res.status(400).json({
-            success: false,
-            error: "Unable to parse private key. Tried multiple formats.",
-            details: parseAttempts,
-          });
-        }
-
-        const publicKeyObj = crypto.createPublicKey(privateKeyObj);
-        const publicKeyPem = publicKeyObj.export({
-          type: "spki",
-          format: "pem",
-        });
-
-        const publicKeyString =
-          typeof publicKeyPem === "string"
-            ? publicKeyPem
-            : (publicKeyPem as Buffer).toString("utf8");
-
-        let keyType = "unknown";
-        const asymmetricKeyType = privateKeyObj.asymmetricKeyType;
-
-        if (asymmetricKeyType === "rsa") {
-          keyType = "ssh-rsa";
-        } else if (asymmetricKeyType === "ed25519") {
-          keyType = "ssh-ed25519";
-        } else if (asymmetricKeyType === "ec") {
-          keyType = "ecdsa-sha2-nistp256";
-        }
-
-        let finalPublicKey = publicKeyString;
-        let formatType = "pem";
-
-        try {
-          const ssh2PrivateKey = ssh2Utils.parseKey(privateKey, keyPassword);
-          if (!(ssh2PrivateKey instanceof Error)) {
-            const publicKeyBuffer = ssh2PrivateKey.getPublicSSH();
-            const base64Data = publicKeyBuffer.toString("base64");
-            finalPublicKey = `${keyType} ${base64Data}`;
-            formatType = "ssh";
-          }
-        } catch {
-          // Ignore validation errors
-        }
-
-        const response = {
-          success: true,
-          publicKey: finalPublicKey,
-          keyType: keyType,
-          format: formatType,
-        };
-
-        res.json(response);
-      } catch (error) {
-        authLogger.error("Failed to generate public key", error);
-        res.status(500).json({
-          success: false,
-          error: getErrorMessage(error, "Failed to generate public key"),
-        });
-      }
-    },
-  );
-}
@@ -8,8 +8,6 @@ import { authLogger } from "../../utils/logger.js";
 import { PermissionManager } from "../../utils/permission-manager.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import { parseKeyForStorage } from "../../hosts/stored-ssh-key.js";
-import { registerCredentialKeyRoutes } from "./credential-key-routes.js";
-import { registerCredentialDeployRoutes } from "./credential-deploy-routes.js";
 import { registerCredentialBulkRoutes } from "./credential-bulk-routes.js";
 import {
  logAudit,
@@ -1211,19 +1209,4 @@ router.put(
  },
 );

-registerCredentialKeyRoutes(
-  router,
-  authenticateJWT,
-  permissionManager.requirePermission("credentials.view"),
-  requireDataAccess,
-);
-
-registerCredentialDeployRoutes(
-  router,
-  authenticateJWT,
-  permissionManager.requirePermission("credentials.view"),
-  permissionManager.requirePermission("hosts.edit"),
-  requireDataAccess,
-);
-
 export default router;
@@ -3,8 +3,7 @@ import express, { type Request, type Response } from "express";
 import { dashboardLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import { DataCrypto } from "../../utils/data-crypto.js";
-import { createCurrentRecentActivityRepository } from "../repositories/factory.js";
-import { recordRecentActivity } from "../../services/recent-activity.js";
+import { recentActivity } from "../../plugins/activity-provider.js";

 const router = express.Router();

@@ -99,11 +98,7 @@ router.get(

      const limit = Number(req.query.limit) || 20;

-      const activities =
-        await createCurrentRecentActivityRepository().listByUserId(
-          userId,
-          limit,
-        );
+      const activities = await recentActivity.list(userId, limit);

      res.json(activities);
    } catch (err) {
@@ -169,7 +164,7 @@ router.post(
        });
      }

-      const result = await recordRecentActivity(userId, {
+      const result = await recentActivity.record(userId, {
        type,
        hostId,
        hostName,
@@ -185,6 +180,11 @@ router.post(
          message: "Activity already logged recently (rate limited)",
        });
      }
+      if (result.status === "unavailable") {
+        return res
+          .status(404)
+          .json({ error: "Recent activity is not available" });
+      }
      if (result.status === "denied") {
        return res
          .status(404)
@@ -222,7 +222,7 @@ router.delete(
    try {
      const userId = (req as AuthenticatedRequest).userId;

-      await createCurrentRecentActivityRepository().deleteByUserId(userId);
+      await recentActivity.deleteByUserId(userId);

      dashboardLogger.success("Recent activity cleared", {
        operation: "reset_recent_activity",
@@ -1,4 +1,5 @@
 import { authLogger } from "../../utils/logger.js";
+import { recentActivity } from "../../plugins/activity-provider.js";
 import {
  createCurrentApiKeyRepository,
  createCurrentAuditLogRepository,
@@ -9,7 +10,6 @@ import {
  createCurrentCredentialSidebarPreferenceRepository,
  createCurrentUiPreferenceRepository,
  createCurrentOpenTabRepository,
-  createCurrentRecentActivityRepository,
  createCurrentRbacAccessRepository,
  createCurrentRoleRepository,
  createCurrentSessionRepository,
@@ -64,7 +64,7 @@ export async function deleteUserAndRelatedData(

    await createCurrentSshCredentialUsageRepository().deleteByUserId(userId);

-    await createCurrentRecentActivityRepository().deleteByUserId(userId);
+    await recentActivity.deleteByUserId(userId);

    await createCurrentHostFolderRepository().deleteByUserId(userId);

@@ -61,15 +61,23 @@ export function isNativeTokenExportRequest(req: Request): boolean {
 * during testing, or a household sharing one install) -- a user in that
 * state deserves to get into the app they installed, not a confusing,
 * unexplained dead end. So this always returns a single, deterministic
- * user: the admin account if one exists, else the earliest-registered
- * account. It never returns null.
+ * user: the account the user switched to if it still exists, else the admin
+ * account if one exists, else the earliest-registered account. It never
+ * returns null when there are users.
 */
 export function resolveDesktopAutoSessionUser(
  allUsers: UserRecord[],
+  preferredId?: string | null,
 ): UserRecord | null {
  if (allUsers.length === 0) return null;
  if (allUsers.length === 1) return allUsers[0];

+  // An account the user switched to on purpose, while it still exists.
+  const preferred = preferredId
+    ? allUsers.find((user) => user.id === preferredId)
+    : undefined;
+  if (preferred) return preferred;
+
  const admin = allUsers.find((user) => user.isAdmin);
  if (admin) return admin;

@@ -1,172 +1,23 @@
-import {
-  prepareHostImports,
-  remapImportedJumpHosts,
-} from "./host-import-order.js";
-import { sshOptionsForWrite } from "../../hosts/ssh-options.js";
-import {
-  applyDefaultsAfterHostWrites,
-  applyHostDefaultsToWrite,
-} from "../../hosts/defaults/index.js";
 import {
  changeHostOverrides,
  type OverrideChange,
 } from "../../hosts/defaults/overrides.js";
 import { recompute } from "../../hosts/defaults/recompute.js";
 import { splitDefaultKey } from "../../../types/host-defaults.js";
-import {
-  keepUsableProtocolCredentials,
-  readProtocolAuthPayload,
-  writeProtocolAuth,
-} from "../../hosts/protocol-auth/protocol-auth.js";
-import { getErrorMessage } from "../../utils/error-message.js";
+
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import type { Request, RequestHandler, Response, Router } from "express";
 import { sshLogger } from "../../utils/logger.js";
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
-import { pluginEvents, TOPICS } from "../../plugins/events.js";
-import {
-  createCurrentCredentialRepository,
-  createCurrentHostRepository,
-  createCurrentHostResolutionRepository,
-  createCurrentHostDefaultsRepository,
-} from "../repositories/factory.js";
+import { createCurrentHostRepository } from "../repositories/factory.js";
 import { validateParentHostId } from "./host-parent-validation.js";
-import {
-  listSshAuthProviders,
-  listSshAuthTypeOwners,
-} from "../../hosts/connect/auth-provider-registry.js";
-import {
-  applyPluginHostImportSettings,
-  setHostPluginEnabled,
-} from "./host-plugin-settings.js";
-import {
-  isNonEmptyString,
-  isValidPort,
-  normalizeImportedHost,
-} from "./host-normalizers.js";
+import { assertHostsUnlocked, sendHostLocked } from "../../hosts/locks.js";

-type SSHConfigHost = {
-  name: string;
-  hostname?: string;
-  user?: string;
-  port?: number;
-  identityFile?: string;
-  proxyJump?: string;
-};
-
-type ShareCredential = {
-  alias?: unknown;
-  name?: unknown;
-  description?: unknown;
-  folder?: unknown;
-  tags?: unknown;
-  authType?: unknown;
-  username?: unknown;
-  keyType?: unknown;
-};
-
-function textValue(value: unknown): string | null {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-
-function tagString(value: unknown): string {
-  if (Array.isArray(value)) {
-    return value
-      .map((tag) => textValue(tag))
-      .filter((tag): tag is string => !!tag)
-      .join(",");
-  }
-  return textValue(value) || "";
-}
-
-function normalizeCredentialAuthType(value: unknown): "password" | "key" {
-  return value === "key" ? "key" : "password";
-}
-
-export function parseSSHConfig(content: string): SSHConfigHost[] {
-  const results: SSHConfigHost[] = [];
-  let current: SSHConfigHost | null = null;
-
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-
-    const match = /^(\S+?)(?:\s*=\s*|\s+)(.+)$/.exec(line);
-    if (!match) continue;
-
-    const key = match[1].toLowerCase();
-    const value = match[2];
-
-    if (key === "host") {
-      if (current && current.hostname) results.push(current);
-      // Skip wildcard patterns
-      if (value === "*" || value.includes("*") || value.includes("?")) {
-        current = null;
-      } else {
-        current = { name: value };
-      }
-      continue;
-    }
-
-    if (!current) continue;
-
-    switch (key) {
-      case "hostname":
-        current.hostname = value;
-        break;
-      case "user":
-        current.user = value;
-        break;
-      case "port": {
-        const p = Number.parseInt(value, 10);
-        if (p > 0 && p <= 65535) current.port = p;
-        break;
-      }
-      case "identityfile":
-        if (!current.identityFile) current.identityFile = value;
-        break;
-      case "proxyjump":
-        current.proxyJump = value;
-        break;
-    }
-  }
-
-  if (current && current.hostname) results.push(current);
-
-  return results;
-}
-
-/**
- * Tells status checks and other pollers about hosts an import wrote, the way
- * a single host create or update does.
- */
-export function notifyImportedHosts(
-  userId: string,
-  hostIds: number[],
-  createdHostIds: number[],
-): void {
-  for (const hostId of createdHostIds) {
-    pluginEvents.emit(TOPICS.hostCreated, { hostId, userId });
-  }
-  for (const hostId of hostIds) {
-    pluginEvents.emit(TOPICS.hostUpdated, { hostId, userId });
-  }
-}
-
-export function importedHostUsername(
-  connectionType: string,
-  authType: unknown,
-  username: unknown,
-): string | null {
-  if (isNonEmptyString(username)) return username;
-  if (connectionType !== "ssh" || authType === "credential") return "";
-  return null;
-}
+import { setHostPluginEnabled } from "./host-plugin-settings.js";

 export function registerHostBulkRoutes(
  router: Router,
  authenticateJWT: RequestHandler,
-  requireCreatePermission: RequestHandler,
  requireEditPermission: RequestHandler,
  requireDataAccess: RequestHandler,
 ): void {
@@ -291,6 +142,15 @@ export function registerHostBulkRoutes(
        );

        const ownedIds = ownedHosts.map((h) => h.id);
+        // Pins stay the user's own on a managed host.
+        if (Object.keys(updates).some((key) => key !== "pin")) {
+          try {
+            assertHostsUnlocked(ownedIds);
+          } catch (error) {
+            if (sendHostLocked(res, error)) return;
+            throw error;
+          }
+        }
        const unauthorizedIds = hostIds.filter(
          (id: number) => !ownedIds.includes(id),
        );
@@ -467,674 +327,6 @@ export function registerHostBulkRoutes(
      }
    },
  );
-
-  router.post(
-    "/bulk-import",
-    authenticateJWT,
-    requireCreatePermission,
-    requireEditPermission,
-    requireDataAccess,
-    DatabaseSaveTrigger.batched(async (req: Request, res: Response) => {
-      const userId = (req as AuthenticatedRequest).userId;
-      const {
-        hosts: hostsToImport,
-        overwrite,
-        credentials: credentialsToImport,
-      } = req.body;
-
-      if (!Array.isArray(hostsToImport) || hostsToImport.length === 0) {
-        return res
-          .status(400)
-          .json({ error: "Hosts array is required and must not be empty" });
-      }
-
-      if (hostsToImport.length > 100) {
-        return res
-          .status(400)
-          .json({ error: "Maximum 100 hosts allowed per import" });
-      }
-
-      let orderedHosts: ReturnType<typeof prepareHostImports>;
-      try {
-        orderedHosts = prepareHostImports(hostsToImport);
-      } catch (error) {
-        return res.status(400).json({ error: getErrorMessage(error) });
-      }
-      const importedIds = new Map<unknown, number>();
-
-      const results = {
-        success: 0,
-        updated: 0,
-        skipped: 0,
-        failed: 0,
-        errors: [] as string[],
-      };
-
-      const credentialAliasMap = new Map<string, number>();
-      const addCredentialAlias = (alias: unknown, id: number) => {
-        const key = textValue(alias);
-        if (key) credentialAliasMap.set(key.toLowerCase(), id);
-      };
-
-      try {
-        const credentialRepository = createCurrentCredentialRepository();
-        const existingCredentials =
-          await credentialRepository.listDecryptedByUserId(userId);
-
-        for (const credential of existingCredentials) {
-          addCredentialAlias(credential.name, credential.id as number);
-        }
-
-        if (Array.isArray(credentialsToImport)) {
-          for (const rawCredential of credentialsToImport as ShareCredential[]) {
-            const alias = textValue(rawCredential.alias);
-            const name = textValue(rawCredential.name) || alias;
-            if (!alias || !name) continue;
-
-            const existingId = credentialAliasMap.get(name.toLowerCase());
-            if (existingId) {
-              addCredentialAlias(alias, existingId);
-              continue;
-            }
-
-            const now = new Date().toISOString();
-            const created = await credentialRepository.createEncryptedForUser(
-              userId,
-              {
-                userId,
-                name,
-                description:
-                  textValue(rawCredential.description) ||
-                  "Imported placeholder. Add the secret before connecting.",
-                folder: textValue(rawCredential.folder),
-                tags: tagString(rawCredential.tags),
-                authType: normalizeCredentialAuthType(rawCredential.authType),
-                username: textValue(rawCredential.username),
-                password: null,
-                key: null,
-                privateKey: null,
-                publicKey: null,
-                keyPassword: null,
-                keyType: textValue(rawCredential.keyType),
-                detectedKeyType: null,
-                usageCount: 0,
-                lastUsed: null,
-                createdAt: now,
-                updatedAt: now,
-              },
-            );
-
-            const createdCredential = created as Record<string, unknown>;
-            addCredentialAlias(alias, createdCredential.id as number);
-            addCredentialAlias(name, createdCredential.id as number);
-          }
-        }
-      } catch (error) {
-        results.errors.push(
-          `Credential placeholders: ${getErrorMessage(error, "failed to prepare credential aliases")}`,
-        );
-      }
-
-      // Loaded for both modes: overwrite updates a match, skip leaves it alone.
-      let existingHostMap: Map<string, { id: number }> | undefined;
-      const hostRepository = createCurrentHostRepository();
-      try {
-        const allHosts =
-          await createCurrentHostResolutionRepository().findHostsByUserId(
-            userId,
-          );
-        existingHostMap = new Map();
-        for (const h of allHosts) {
-          const key = `${h.ip}:${h.port}:${h.username}`;
-          existingHostMap.set(key, { id: h.id as number });
-        }
-      } catch {
-        existingHostMap = undefined;
-      }
-
-      const knownAuthTypes = listKnownAuthTypes();
-      const writtenHostIds: number[] = [];
-      const createdHostIds: number[] = [];
-      for (const { host: hostData, index: i, exportId } of orderedHosts) {
-        try {
-          const effectiveConnectionType = hostData.connectionType || "ssh";
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType === "credential" &&
-            !hostData.credentialId &&
-            hostData.credentialAlias
-          ) {
-            hostData.credentialId = credentialAliasMap.get(
-              hostData.credentialAlias.toLowerCase(),
-            );
-          }
-
-          if (!isNonEmptyString(hostData.ip) || !isValidPort(hostData.port)) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: Missing required fields (ip, port)`,
-            );
-            continue;
-          }
-
-          const username = importedHostUsername(
-            effectiveConnectionType,
-            hostData.authType,
-            hostData.username,
-          );
-          if (username === null) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: Username required for SSH connections`,
-            );
-            continue;
-          }
-
-          const lookupKey = `${hostData.ip}:${hostData.port}:${hostData.username}`;
-          const existing = existingHostMap?.get(lookupKey);
-          if (existing && !overwrite) {
-            // Hosts that jump through this one still resolve to the kept host.
-            if (exportId !== undefined) importedIds.set(exportId, existing.id);
-            results.skipped++;
-            continue;
-          }
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType &&
-            !knownAuthTypes.has(hostData.authType)
-          ) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: Invalid authType. Must be one of ${[...knownAuthTypes].join(", ")}`,
-            );
-            continue;
-          }
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType === "password" &&
-            !isNonEmptyString(hostData.password)
-          ) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: Password required for password authentication`,
-            );
-            continue;
-          }
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType === "key" &&
-            !isNonEmptyString(hostData.key)
-          ) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: Key required for key authentication`,
-            );
-            continue;
-          }
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType === "credential" &&
-            !hostData.credentialId
-          ) {
-            results.failed++;
-            results.errors.push(
-              `Host ${i + 1}: credentialId required for credential authentication`,
-            );
-            continue;
-          }
-
-          if (
-            effectiveConnectionType === "ssh" &&
-            hostData.authType === "credential" &&
-            hostData.credentialId
-          ) {
-            const credentialRepository = createCurrentCredentialRepository();
-            const cred = await credentialRepository.findByIdForUser(
-              userId,
-              hostData.credentialId,
-            );
-
-            if (!cred) {
-              const fallback = await credentialRepository.listByUserId(userId);
-
-              if (fallback.length > 0) {
-                hostData.credentialId = fallback[0].id;
-              } else if (isNonEmptyString(hostData.key)) {
-                hostData.authType = "key";
-                hostData.credentialId = undefined;
-              } else if (isNonEmptyString(hostData.password)) {
-                hostData.authType = "password";
-                hostData.credentialId = undefined;
-              } else {
-                results.failed++;
-                results.errors.push(
-                  `Host ${i + 1}: credentialId ${hostData.credentialId} not found and no fallback credential available`,
-                );
-                continue;
-              }
-            }
-          }
-
-          const jumpHosts = remapImportedJumpHosts(
-            hostData.jumpHosts,
-            importedIds,
-          );
-          const sshDataObj: Record<string, unknown> = {
-            userId: userId,
-            connectionType: effectiveConnectionType,
-            name: hostData.name || `${username}@${hostData.ip}`,
-            folder: hostData.folder || "Default",
-            tags: Array.isArray(hostData.tags) ? hostData.tags.join(",") : "",
-            ip: hostData.ip,
-            port: hostData.port,
-            username,
-            pin: hostData.pin || false,
-            sudoPassword: hostData.sudoPassword || null,
-            jumpHosts: jumpHosts ? JSON.stringify(jumpHosts) : null,
-            ...importedStatusCheck(hostData as Record<string, unknown>),
-            // A 2.8 export carries these inside terminalConfig.
-            sshOptions:
-              sshOptionsForWrite({
-                sshOptions: hostData.sshOptions,
-                terminalConfig: hostData.terminalConfig,
-              }) ?? null,
-            forceKeyboardInteractive: hostData.forceKeyboardInteractive
-              ? "true"
-              : "false",
-            notes: hostData.notes || null,
-            useSocks5: hostData.useSocks5 ? 1 : 0,
-            socks5Host: hostData.socks5Host || null,
-            socks5Port: hostData.socks5Port || null,
-            socks5Username: hostData.socks5Username || null,
-            socks5Password: hostData.socks5Password || null,
-            socks5ProxyChain: hostData.socks5ProxyChain
-              ? JSON.stringify(hostData.socks5ProxyChain)
-              : null,
-            portKnockSequence: hostData.portKnockSequence
-              ? JSON.stringify(hostData.portKnockSequence)
-              : null,
-            overrideCredentialUsername: hostData.overrideCredentialUsername
-              ? 1
-              : 0,
-            enableSsh: hostData.enableSsh ?? effectiveConnectionType === "ssh",
-            updatedAt: new Date().toISOString(),
-          };
-
-          if (effectiveConnectionType !== "ssh") {
-            sshDataObj.password = hostData.password || null;
-            sshDataObj.authType = "password";
-            sshDataObj.credentialId = null;
-            sshDataObj.key = null;
-            sshDataObj.keyPassword = null;
-            sshDataObj.keyType = null;
-          } else {
-            sshDataObj.password =
-              hostData.authType === "password" ? hostData.password : null;
-            sshDataObj.authType = hostData.authType || "password";
-            sshDataObj.credentialId =
-              hostData.authType === "credential" ? hostData.credentialId : null;
-            sshDataObj.key = hostData.authType === "key" ? hostData.key : null;
-            sshDataObj.keyPassword =
-              hostData.authType === "key" ? hostData.keyPassword || null : null;
-            sshDataObj.keyType =
-              hostData.authType === "key" ? hostData.keyType || "auto" : null;
-          }
-
-          await withHostDefaults(
-            userId,
-            existing?.id ?? null,
-            sshDataObj,
-            hostData as Record<string, unknown>,
-          );
-
-          let savedHostId: number;
-          if (existing) {
-            const saved = await hostRepository.updateEncryptedForUser(
-              userId,
-              existing.id,
-              sshDataObj,
-            );
-            if (!saved) throw new Error("Host no longer exists");
-            if (exportId !== undefined) importedIds.set(exportId, existing.id);
-            savedHostId = existing.id;
-            results.updated++;
-          } else {
-            sshDataObj.createdAt = new Date().toISOString();
-            const saved = await hostRepository.createEncryptedForUser(
-              userId,
-              sshDataObj,
-            );
-            if (exportId !== undefined) importedIds.set(exportId, saved.id);
-            savedHostId = saved.id;
-            createdHostIds.push(saved.id);
-            results.success++;
-          }
-
-          const protocolAuth = readProtocolAuthPayload(
-            hostData as Record<string, unknown>,
-          );
-          if (protocolAuth) {
-            await writeProtocolAuth(
-              userId,
-              savedHostId,
-              await keepUsableProtocolCredentials(protocolAuth, userId),
-              { isOwner: true },
-            );
-          }
-
-          // Every enabled plugin that declares host-scope settings and
-          // registered a hostImportNormalizer validates and writes its own
-          // fields here, so this loop does not need to know which plugins
-          // exist. See host-plugin-settings.ts.
-          await applyPluginHostImportSettings(
-            savedHostId,
-            hostData as Record<string, unknown>,
-          );
-          writtenHostIds.push(savedHostId);
-        } catch (error) {
-          results.failed++;
-          results.errors.push(`Host ${i + 1}: ${getErrorMessage(error)}`);
-        }
-      }
-
-      await applyDefaultsAfterHostWrites(writtenHostIds);
-      notifyImportedHosts(userId, writtenHostIds, createdHostIds);
-
-      res.json({
-        message: `Import completed: ${results.success} created, ${results.updated} updated, ${results.skipped} skipped, ${results.failed} failed`,
-        success: results.success,
-        updated: results.updated,
-        skipped: results.skipped,
-        failed: results.failed,
-        errors: results.errors,
-      });
-    }),
-  );
-
-  /**
-   * @openapi
-   * /host/ssh-config-import:
-   *   post:
-   *     summary: Import hosts from an OpenSSH config file
-   *     description: Parses an OpenSSH ~/.ssh/config file and imports the defined hosts.
-   *     tags:
-   *       - SSH
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             required:
-   *               - content
-   *             properties:
-   *               content:
-   *                 type: string
-   *                 description: Raw text content of the SSH config file.
-   *               overwrite:
-   *                 type: boolean
-   *     responses:
-   *       200:
-   *         description: Import completed.
-   *       400:
-   *         description: Invalid request body.
-   */
-  router.post(
-    "/ssh-config-import",
-    authenticateJWT,
-    requireCreatePermission,
-    requireEditPermission,
-    requireDataAccess,
-    DatabaseSaveTrigger.batched(async (req: Request, res: Response) => {
-      const userId = (req as AuthenticatedRequest).userId;
-      const { content, overwrite } = req.body;
-
-      if (!isNonEmptyString(content)) {
-        return res.status(400).json({
-          error: "content is required and must be a non-empty string",
-        });
-      }
-
-      let parsed: SSHConfigHost[];
-      try {
-        parsed = parseSSHConfig(content);
-      } catch {
-        return res
-          .status(400)
-          .json({ error: "Failed to parse SSH config file" });
-      }
-
-      if (parsed.length === 0) {
-        return res.status(400).json({
-          error: "No valid Host entries found in the SSH config file",
-        });
-      }
-
-      if (parsed.length > 100) {
-        return res
-          .status(400)
-          .json({ error: "Maximum 100 hosts allowed per import" });
-      }
-
-      const hostsToImport = parsed.map((h) => ({
-        name: h.name,
-        ip: h.hostname,
-        port: h.port ?? 22,
-        username: h.user,
-        authType: h.identityFile ? "key" : undefined,
-        connectionType: "ssh",
-        enableSsh: true,
-        ...(h.proxyJump
-          ? {
-              jumpHosts: [{ host: h.proxyJump, port: 22 }],
-            }
-          : {}),
-      }));
-
-      const results = {
-        success: 0,
-        updated: 0,
-        skipped: 0,
-        failed: 0,
-        errors: [] as string[],
-      };
-
-      let existingHostMap: Map<string, { id: number }> | undefined;
-      const hostRepository = createCurrentHostRepository();
-      try {
-        const allHosts =
-          await createCurrentHostResolutionRepository().findHostsByUserId(
-            userId,
-          );
-        existingHostMap = new Map();
-        for (const h of allHosts) {
-          const key = `${h.ip}:${h.port}:${h.username}`;
-          existingHostMap.set(key, { id: h.id as number });
-        }
-      } catch {
-        existingHostMap = undefined;
-      }
-
-      const writtenHostIds: number[] = [];
-      const createdHostIds: number[] = [];
-      for (let i = 0; i < hostsToImport.length; i++) {
-        const hostData = normalizeImportedHost(
-          hostsToImport[i] as Record<string, unknown>,
-        );
-
-        try {
-          if (!isNonEmptyString(hostData.ip) || !isValidPort(hostData.port)) {
-            results.failed++;
-            results.errors.push(
-              `Host "${parsed[i].name}": Missing required fields (HostName, Port)`,
-            );
-            continue;
-          }
-
-          const lookupKey = `${hostData.ip}:${hostData.port}:${hostData.username}`;
-          const existing = existingHostMap?.get(lookupKey);
-          if (existing && !overwrite) {
-            results.skipped++;
-            continue;
-          }
-
-          const sshDataObj: Record<string, unknown> = {
-            userId,
-            connectionType: "ssh",
-            name: hostData.name || hostData.ip,
-            folder: "Default",
-            tags: "",
-            ip: hostData.ip,
-            port: hostData.port,
-            username: hostData.username || null,
-            authType: hostData.authType || "none",
-            password: null,
-            key: null,
-            keyPassword: null,
-            keyType: null,
-            credentialId: null,
-            pin: false,
-            sudoPassword: null,
-            jumpHosts: hostData.jumpHosts
-              ? JSON.stringify(hostData.jumpHosts)
-              : null,
-            statusCheckEnabled: true,
-            statusCheckInterval: null,
-            sshOptions: null,
-            forceKeyboardInteractive: "false",
-            notes: null,
-            useSocks5: 0,
-            socks5Host: null,
-            socks5Port: null,
-            socks5Username: null,
-            socks5Password: null,
-            socks5ProxyChain: null,
-            portKnockSequence: null,
-            overrideCredentialUsername: 0,
-            enableSsh: true,
-            updatedAt: new Date().toISOString(),
-          };
-
-          await withHostDefaults(
-            userId,
-            existing?.id ?? null,
-            sshDataObj,
-            hostData as unknown as Record<string, unknown>,
-          );
-
-          if (existing) {
-            await hostRepository.updateEncryptedForUser(
-              userId,
-              existing.id,
-              sshDataObj,
-            );
-            writtenHostIds.push(existing.id);
-            results.updated++;
-          } else {
-            sshDataObj.createdAt = new Date().toISOString();
-            const saved = await hostRepository.createEncryptedForUser(
-              userId,
-              sshDataObj,
-            );
-            writtenHostIds.push(saved.id);
-            createdHostIds.push(saved.id);
-            results.success++;
-          }
-        } catch (error) {
-          results.failed++;
-          results.errors.push(
-            `Host "${parsed[i].name}": ${getErrorMessage(error)}`,
-          );
-        }
-      }
-
-      await applyDefaultsAfterHostWrites(writtenHostIds);
-      notifyImportedHosts(userId, writtenHostIds, createdHostIds);
-
-      res.json({
-        message: `Import completed: ${results.success} created, ${results.updated} updated, ${results.skipped} skipped, ${results.failed} failed`,
-        success: results.success,
-        updated: results.updated,
-        skipped: results.skipped,
-        failed: results.failed,
-        errors: results.errors,
-      });
-    }),
-  );
-}
-
-/**
- * Status check fields from an import row. Exports from before 2.9.0 carried
- * them inside statsConfig.
- */
-function importedStatusCheck(raw: Record<string, unknown>): {
-  statusCheckEnabled: boolean;
-  statusCheckInterval: number | null;
-} {
-  const legacy =
-    raw.statsConfig && typeof raw.statsConfig === "object"
-      ? (raw.statsConfig as Record<string, unknown>)
-      : {};
-  const enabled = raw.statusCheckEnabled ?? legacy.statusCheckEnabled;
-  const useGlobal = legacy.useGlobalStatusInterval !== false;
-  const interval =
-    raw.statusCheckInterval ?? (useGlobal ? null : legacy.statusCheckInterval);
-  const seconds = Number(interval);
-  return {
-    statusCheckEnabled: enabled !== false && legacy.disableTcpPing !== true,
-    statusCheckInterval:
-      interval != null && Number.isInteger(seconds) && seconds >= 5
-        ? seconds
-        : null,
-  };
-}
-
-const BUILTIN_SSH_AUTH_TYPES = [
-  "password",
-  "key",
-  "credential",
-  "agent",
-  "none",
-];
-
-/** Core's own types plus every type a plugin registers or declares. */
-function listKnownAuthTypes(): Set<string> {
-  return new Set([
-    ...BUILTIN_SSH_AUTH_TYPES,
-    ...listSshAuthProviders().map((provider) => provider.type),
-    ...listSshAuthTypeOwners().map((owner) => owner.type),
-  ]);
-}
-
-/** Fills an imported host's inherited keys and records what it sets itself. */
-async function withHostDefaults(
-  userId: string,
-  hostId: number | null,
-  columns: Record<string, unknown>,
-  body: Record<string, unknown>,
-): Promise<void> {
-  const stored =
-    hostId === null
-      ? null
-      : ((
-          await createCurrentHostDefaultsRepository().listHosts({
-            hostIds: [hostId],
-          })
-        )[0] ?? null);
-  columns.defaultOverrides = JSON.stringify(
-    await applyHostDefaultsToWrite({
-      ownerId: userId,
-      hostId,
-      columns,
-      body,
-      stored,
-    }),
-  );
 }

 /** A resetDefaults body as an override change, or null when there is none. */
@@ -32,6 +32,7 @@ import {
 } from "../../hosts/defaults/service.js";
 import { changeHostOverrides } from "../../hosts/defaults/overrides.js";
 import { readDefaultsReset } from "./host-bulk-routes.js";
+import { assertHostsUnlocked, sendHostLocked } from "../../hosts/locks.js";

 type HostDefaultsRoutesDeps = {
  authenticateJWT: RequestHandler;
@@ -678,6 +679,7 @@ export function registerHostDefaultsRoutes(
      const reset = readDefaultsReset(req.body);
      if (!reset) return res.status(400).json({ error: "Nothing to reset" });
      try {
+        assertHostsUnlocked([hostId]);
        const access = await PermissionManager.getInstance().canAccessHost(
          userId,
          hostId,
@@ -700,6 +702,7 @@ export function registerHostDefaultsRoutes(
        await changeHostOverrides([hostId], reset);
        res.json({ message: "Host reset to its defaults" });
      } catch (error) {
+        if (sendHostLocked(res, error)) return;
        databaseLogger.error("Failed to reset host defaults", error);
        res.status(500).json({ error: "Failed to reset host defaults" });
      }
@@ -2,11 +2,11 @@ import type { Request, RequestHandler, Response, Router } from "express";
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import { databaseLogger, sshLogger } from "../../utils/logger.js";
 import { pluginEvents, TOPICS } from "../../plugins/events.js";
+import { recentActivity } from "../../plugins/activity-provider.js";
 import {
  createCurrentCredentialRepository,
  createCurrentHostFolderRepository,
  createCurrentFolderAccessRepository,
-  createCurrentRecentActivityRepository,
  createCurrentRbacAccessRepository,
  createCurrentSshCredentialUsageRepository,
 } from "../repositories/factory.js";
@@ -16,6 +16,31 @@ import {
  folderCredentialIds,
  setFolderCredentialDefault,
 } from "../../hosts/defaults/service.js";
+import {
+  assertHostsUnlocked,
+  hasHostLocks,
+  sendHostLocked,
+} from "../../hosts/locks.js";
+
+/** Refuses a folder change that would touch a locked host. */
+async function folderHostsUnlocked(
+  userId: string,
+  folderName: string,
+  res: Response,
+): Promise<boolean> {
+  if (!hasHostLocks()) return true;
+  const inFolder = await createCurrentHostFolderRepository().listHostsInFolder(
+    userId,
+    folderName,
+  );
+  try {
+    assertHostsUnlocked(inFolder.map((host) => host.id));
+    return true;
+  } catch (error) {
+    if (sendHostLocked(res, error)) return false;
+    throw error;
+  }
+}

 type HostFolderRoutesDeps = {
  authenticateJWT: RequestHandler;
@@ -86,6 +111,7 @@ export function registerHostFolderRoutes(
      }

      try {
+        if (!(await folderHostsUnlocked(userId, oldName, res))) return;
        const { updatedHosts, updatedCredentials } =
          await createCurrentHostFolderRepository().renameFolder(
            userId,
@@ -417,6 +443,7 @@ export function registerHostFolderRoutes(
      });

      try {
+        if (!(await folderHostsUnlocked(userId, folderName, res))) return;
        const hostFolderRepository = createCurrentHostFolderRepository();
        const hostsToDelete = await hostFolderRepository.listHostsInFolder(
          userId,
@@ -432,9 +459,7 @@ export function registerHostFolderRoutes(
            hostIds,
          );

-          await createCurrentRecentActivityRepository().deleteByHostIds(
-            hostIds,
-          );
+          await recentActivity.deleteByHostIds(hostIds);

          await createCurrentRbacAccessRepository().deleteHostAccessForHosts(
            hostIds,
@@ -5,6 +5,7 @@ import {
 } from "../../hosts/ssh-options.js";
 import { listHostProtocols } from "../../hosts/protocol-auth/registry.js";
 import { sanitizeProtocolAuthForRecipient } from "../../hosts/protocol-auth/summary.js";
+import { hostLock } from "../../hosts/locks.js";

 export function isNonEmptyString(value: unknown): value is string {
  return typeof value === "string" && value.trim().length > 0;
@@ -337,6 +338,7 @@ const CONNECT_LEVEL_FIELDS = new Set([
  "sshPort",
  "protocolAuth",
  "jumpHosts",
+  "lock",
  "createdAt",
  "updatedAt",
 ]);
@@ -439,8 +441,10 @@ export function transformHostResponse(
  host: Record<string, unknown>,
 ): Record<string, unknown> {
  const shared = parseSharedSource(host.sharedSource);
+  const lock = typeof host.id === "number" ? hostLock(host.id) : null;
  return {
    ...host,
+    ...(lock ? { lock } : {}),
    sharedSource: undefined,
    localOnly: !!host.localOnly,
    sharedCopy: !!shared,
@@ -3,13 +3,10 @@ import type { Request, RequestHandler, Response, Router } from "express";
 import { PermissionManager } from "../../utils/permission-manager.js";
 import { DataCrypto } from "../../utils/data-crypto.js";
 import { sshLogger } from "../../utils/logger.js";
-import { createCurrentSettingsRepository } from "../repositories/factory.js";
 import {
-  DEFAULT_STATUS_INTERVAL,
-  GLOBAL_STATUS_INTERVAL_KEY,
-  hostStatusService,
+  hostStatus,
  type HostStatusEntry,
-} from "../../hosts/status/host-status-service.js";
+} from "../../plugins/host-status-provider.js";

 interface HostStatusRoutesDeps {
  authenticateJWT: RequestHandler;
@@ -71,7 +68,7 @@ export function registerHostStatusRoutes(
        return sessionExpired(res);

      const requested = parseStatusHostIds(req.query.hostIds);
-      const statuses = await hostStatusService.statusesFor(userId, requested);
+      const statuses = await hostStatus.statusesFor(userId, requested);

      // One batched permission check: this is polled every few seconds, and a
      // per-host check made it linear in host count against the database.
@@ -110,15 +107,7 @@ export function registerHostStatusRoutes(
    authenticateJWT,
    requireAdmin,
    async (_req: Request, res: Response) => {
-      const value = Number(
-        await createCurrentSettingsRepository().get(GLOBAL_STATUS_INTERVAL_KEY),
-      );
-      res.json({
-        statusCheckInterval:
-          Number.isInteger(value) && value >= 5
-            ? value
-            : DEFAULT_STATUS_INTERVAL,
-      });
+      res.json({ statusCheckInterval: await hostStatus.getIntervalSeconds() });
    },
  );

@@ -161,11 +150,7 @@ export function registerHostStatusRoutes(
          .json({ error: "Status check interval must be 5 to 3600 seconds" });
      }
      try {
-        await createCurrentSettingsRepository().set(
-          GLOBAL_STATUS_INTERVAL_KEY,
-          String(seconds),
-        );
-        hostStatusService.retimeAll();
+        await hostStatus.setIntervalSeconds(seconds);
        res.json({ statusCheckInterval: seconds });
      } catch (error) {
        sshLogger.error("Failed to save status check settings", error, {
@@ -198,7 +183,7 @@ export function registerHostStatusRoutes(
      if (DataCrypto.getUserDataKey(userId) === null) {
        return sessionExpired(res);
      }
-      await hostStatusService.refresh(userId);
+      await hostStatus.refresh(userId);
      res.json({ message: "Status checks restarted" });
    },
  );
@@ -247,9 +232,8 @@ export function registerHostStatusRoutes(
        return res.status(404).json({ error: "Status not available" });
      }

-      await hostStatusService.statusesFor(userId, null);
-      const entry =
-        hostStatusService.get(id) ?? (await hostStatusService.check(id));
+      await hostStatus.statusesFor(userId, null);
+      const entry = hostStatus.get(id) ?? (await hostStatus.check(id));
      if (!entry) {
        return res.status(404).json({ error: "Status not available" });
      }
@@ -7,25 +7,21 @@ import type { AuthenticatedRequest } from "../../../types/index.js";
 import express, { type Request, type Response } from "express";
 import multer from "multer";
 import { sshLogger, databaseLogger } from "../../utils/logger.js";
+import { resolveHostCredentials } from "../../hosts/resolve-host-credentials.js";
 import { pluginEvents, TOPICS } from "../../plugins/events.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import { PermissionManager } from "../../utils/permission-manager.js";
 import { DataCrypto } from "../../utils/data-crypto.js";
 import { parseKeyForStorage } from "../../hosts/stored-ssh-key.js";
-import {
-  pickResolvedPassword,
-  pickResolvedUsername,
-} from "../../hosts/credential-username.js";
+import { pickResolvedPassword } from "../../hosts/credential-username.js";
 import { emitInternalEvent } from "../../hosts/internal-events.js";
 import { deleteOwnedHost } from "../../hosts/delete-host.js";
 import {
-  createCurrentCredentialRepository,
  createCurrentRbacAccessRepository,
  createCurrentRoleRepository,
  createCurrentHostResolutionRepository,
  createCurrentHostRepository,
  createCurrentUserRepository,
-  createCurrentSharedHostAuthOverrideRepository,
  createCurrentHostDefaultsRepository,
 } from "../repositories/factory.js";
 import {
@@ -41,7 +37,6 @@ import {
  OWNER_PRIVATE_AUTH_FIELDS,
  OWNER_PRIVATE_SSH_OPTION_FIELDS,
  OWNER_PRIVATE_TERMINAL_CONFIG_FIELDS,
-  hostTerminalExport,
  sanitizeHostForRecipient,
  stripSensitiveFields,
  transformHostResponse,
@@ -67,14 +62,8 @@ import {
  getAuditUsername,
  getRequestMeta,
 } from "../../utils/audit-logger.js";
-import type {
-  HostResolutionCredentialRecord,
-  HostResolutionHostRecord,
-} from "../repositories/host-resolution-repository.js";
-import {
-  requiresPersonalHostAuthentication,
-  resolveRecipientSharedHostAuthentication,
-} from "../../utils/shared-host-auth-resolver.js";
+import type { HostResolutionCredentialRecord } from "../repositories/host-resolution-repository.js";
+
 import { rejectSharedCopyWrites } from "../../sync/shared-copy-guard.js";
 import { sshOptionsForWrite } from "../../hosts/ssh-options.js";
 import {
@@ -91,15 +80,16 @@ import {
  planProtocolAuthWrite,
  ProtocolAuthWriteError,
  readProtocolAuthPayload,
-  toPortableLogins,
  withProtocolAuth,
  writeProtocolAuth,
  type PlannedProtocolAuth,
 } from "../../hosts/protocol-auth/protocol-auth.js";
+import { findHostProtocol } from "../../hosts/protocol-auth/registry.js";
 import {
-  findHostProtocol,
-  listHostProtocols,
-} from "../../hosts/protocol-auth/registry.js";
+  manualCreateBlockedBy,
+  requireManualCreate,
+  requireUnlockedHost,
+} from "../../hosts/locks.js";
 import {
  mergeStoredSshOptions,
  parseTerminalConfig,
@@ -172,6 +162,7 @@ router.post(
  authenticateJWT,
  permissionManager.requirePermission("hosts.create"),
  requireDataAccess,
+  requireManualCreate,
  requireHostEnrollmentAccessForPath,
  upload.single("key"),
  async (req: Request, res: Response) => {
@@ -751,6 +742,7 @@ router.put(
  authenticateJWT,
  permissionManager.requirePermission("hosts.edit"),
  requireDataAccess,
+  requireUnlockedHost,
  upload.single("key"),
  async (req: Request, res: Response) => {
    const hostId = Array.isArray(req.params.id)
@@ -1220,6 +1212,27 @@ router.put(
  },
 );

+/**
+ * @openapi
+ * /host/policy:
+ *   get:
+ *     summary: Host creation policy
+ *     description: Whether hosts can be added by hand, or a plugin manages them all.
+ *     tags:
+ *       - SSH
+ *     responses:
+ *       200:
+ *         description: "{ manualCreate, blockedBy? } where blockedBy is the managing plugin's name."
+ */
+router.get("/policy", authenticateJWT, (_req: Request, res: Response) => {
+  const blocked = manualCreateBlockedBy();
+  res.json(
+    blocked
+      ? { manualCreate: false, blockedBy: blocked.pluginName }
+      : { manualCreate: true },
+  );
+});
+
 /**
 * @openapi
 * /host/db/host:
@@ -1688,340 +1701,6 @@ router.get(
  },
 );

-/**
- * @openapi
- * /host/db/host/{id}/export:
- *   get:
- *     summary: Export SSH host
- *     description: Exports a specific SSH host with decrypted credentials.
- *     tags:
- *       - SSH
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: integer
- *     responses:
- *       200:
- *         description: The exported SSH host.
- *       400:
- *         description: Invalid userId or hostId.
- *       404:
- *         description: SSH host not found.
- *       500:
- *         description: Failed to export SSH host.
- */
-router.get(
-  "/db/host/:id/export",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const hostId = Array.isArray(req.params.id)
-      ? req.params.id[0]
-      : req.params.id;
-    const userId = (req as AuthenticatedRequest).userId;
-
-    if (!isNonEmptyString(userId) || !hostId) {
-      return res.status(400).json({ error: "Invalid userId or hostId" });
-    }
-
-    try {
-      const host =
-        await createCurrentHostResolutionRepository().findHostByIdForUser(
-          Number(hostId),
-          userId,
-        );
-
-      if (!host) {
-        return res.status(404).json({ error: "SSH host not found" });
-      }
-
-      const resolvedHost = (await resolveHostCredentials(host, userId)) || host;
-      const hostPluginSettings = (
-        await loadHostPluginSettings([Number(hostId)])
-      ).get(Number(hostId));
-
-      const exportedConnectionType =
-        (resolvedHost.connectionType as string) || "ssh";
-      const isRemoteDesktop = exportedConnectionType !== "ssh";
-
-      const baseExportData = {
-        exportId: resolvedHost.id,
-        connectionType: exportedConnectionType,
-        name: resolvedHost.name,
-        ip: resolvedHost.ip,
-        port: resolvedHost.port,
-        username: resolvedHost.username,
-        password: resolvedHost.password || null,
-        folder: resolvedHost.folder,
-        tags:
-          typeof resolvedHost.tags === "string"
-            ? resolvedHost.tags.split(",").filter(Boolean)
-            : resolvedHost.tags || [],
-        pin: !!resolvedHost.pin,
-        notes: resolvedHost.notes || null,
-        // Every plugin's host settings, secrets redacted, for import to hand back.
-        pluginSettings: hostPluginSettings ?? {},
-        // Each plugin protocol's login, secrets included like the SSH ones.
-        protocolAuth: toPortableLogins(
-          await listProtocolLogins(Number(hostId), userId),
-        ),
-      };
-
-      const exportData = isRemoteDesktop
-        ? baseExportData
-        : {
-            ...baseExportData,
-            authType: resolvedHost.authType,
-            key: resolvedHost.key || null,
-            keyPassword: resolvedHost.keyPassword || null,
-            keyType: resolvedHost.keyType || null,
-            credentialId: resolvedHost.credentialId || null,
-            overrideCredentialUsername:
-              !!resolvedHost.overrideCredentialUsername,
-            sudoPassword: resolvedHost.sudoPassword || null,
-            jumpHosts: resolvedHost.jumpHosts
-              ? JSON.parse(resolvedHost.jumpHosts as string)
-              : null,
-            terminalConfig:
-              hostTerminalExport(resolvedHost).terminalConfig ?? null,
-            sshOptions: hostTerminalExport(resolvedHost).sshOptions,
-            forceKeyboardInteractive:
-              resolvedHost.forceKeyboardInteractive === "true",
-            useSocks5: !!resolvedHost.useSocks5,
-            socks5Host: resolvedHost.socks5Host || null,
-            socks5Port: resolvedHost.socks5Port || null,
-            socks5Username: resolvedHost.socks5Username || null,
-            socks5Password: resolvedHost.socks5Password || null,
-            socks5ProxyChain: resolvedHost.socks5ProxyChain
-              ? JSON.parse(resolvedHost.socks5ProxyChain as string)
-              : null,
-            portKnockSequence: resolvedHost.portKnockSequence
-              ? JSON.parse(resolvedHost.portKnockSequence as string)
-              : null,
-          };
-
-      sshLogger.success("Host exported with decrypted credentials", {
-        operation: "host_export",
-        hostId: parseInt(hostId),
-        userId,
-      });
-
-      res.json(exportData);
-    } catch (err) {
-      sshLogger.error("Failed to export SSH host", err, {
-        operation: "host_export",
-        hostId: parseInt(hostId),
-        userId,
-      });
-      res.status(500).json({ error: "Failed to export SSH host" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /host/db/hosts/export:
- *   get:
- *     summary: Export all SSH hosts
- *     description: Exports all SSH hosts for the current user. By default credentials are decrypted and embedded. With `share=1`, secrets are omitted and credential-authenticated hosts instead reference a scrubbed `credentials` array by alias, suitable for handing off to another user.
- *     tags:
- *       - SSH
- *     parameters:
- *       - in: query
- *         name: share
- *         required: false
- *         schema:
- *           type: string
- *         description: Set to "1" to export without embedded secrets.
- *     responses:
- *       200:
- *         description: All exported SSH hosts.
- *       400:
- *         description: Invalid userId.
- *       500:
- *         description: Failed to export SSH hosts.
- */
-router.get(
-  "/db/hosts/export",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const shareMode = req.query.share === "1" || req.query.share === "true";
-
-    if (!isNonEmptyString(userId)) {
-      return res.status(400).json({ error: "Invalid userId" });
-    }
-
-    try {
-      const allHosts =
-        await createCurrentHostResolutionRepository().findHostsByUserId(userId);
-      const pluginSettingsByHost = await loadHostPluginSettings(
-        allHosts.map((h) => h.id as number),
-      );
-
-      const exportedHosts = [];
-      const usedCredentialIds = new Set<number>();
-
-      for (const host of allHosts) {
-        const resolvedHost = shareMode
-          ? host
-          : (await resolveHostCredentials(host, userId)) || host;
-        const hostPluginSettings = pluginSettingsByHost.get(host.id as number);
-
-        const exportedConnectionType =
-          (resolvedHost.connectionType as string) || "ssh";
-        const isRemoteDesktop = exportedConnectionType !== "ssh";
-
-        const baseExportData = {
-          exportId: resolvedHost.id,
-          connectionType: exportedConnectionType,
-          name: resolvedHost.name,
-          ip: resolvedHost.ip,
-          port: resolvedHost.port,
-          username: resolvedHost.username,
-          password: shareMode ? null : resolvedHost.password || null,
-          folder: resolvedHost.folder,
-          tags:
-            typeof resolvedHost.tags === "string"
-              ? resolvedHost.tags.split(",").filter(Boolean)
-              : resolvedHost.tags || [],
-          pin: !!resolvedHost.pin,
-          notes: resolvedHost.notes || null,
-          // Every plugin's host settings, secrets redacted, for import to hand back.
-          pluginSettings: hostPluginSettings ?? {},
-          protocolAuth: shareableLogins(
-            toPortableLogins(
-              await listProtocolLogins(host.id as number, userId),
-            ),
-            shareMode,
-          ),
-        };
-
-        const exportData = isRemoteDesktop
-          ? baseExportData
-          : {
-              ...baseExportData,
-              authType: resolvedHost.authType,
-              key: shareMode ? null : resolvedHost.key || null,
-              keyPassword: shareMode ? null : resolvedHost.keyPassword || null,
-              keyType: resolvedHost.keyType || null,
-              credentialId: resolvedHost.credentialId || null,
-              overrideCredentialUsername:
-                !!resolvedHost.overrideCredentialUsername,
-              sudoPassword: shareMode
-                ? null
-                : resolvedHost.sudoPassword || null,
-              jumpHosts: resolvedHost.jumpHosts
-                ? JSON.parse(resolvedHost.jumpHosts as string)
-                : null,
-              terminalConfig:
-                hostTerminalExport(resolvedHost).terminalConfig ?? null,
-              sshOptions: hostTerminalExport(resolvedHost).sshOptions,
-              forceKeyboardInteractive:
-                resolvedHost.forceKeyboardInteractive === "true",
-              useSocks5: !!resolvedHost.useSocks5,
-              socks5Host: resolvedHost.socks5Host || null,
-              socks5Port: resolvedHost.socks5Port || null,
-              socks5Username: resolvedHost.socks5Username || null,
-              socks5Password: shareMode
-                ? null
-                : resolvedHost.socks5Password || null,
-              socks5ProxyChain: resolvedHost.socks5ProxyChain
-                ? JSON.parse(resolvedHost.socks5ProxyChain as string)
-                : null,
-            };
-
-        if (
-          shareMode &&
-          !isRemoteDesktop &&
-          resolvedHost.authType === "credential" &&
-          resolvedHost.credentialId
-        ) {
-          usedCredentialIds.add(resolvedHost.credentialId as number);
-        }
-
-        exportedHosts.push(exportData);
-      }
-
-      if (!shareMode) {
-        sshLogger.success("All hosts exported with decrypted credentials", {
-          operation: "hosts_export_all",
-          count: exportedHosts.length,
-          userId,
-        });
-
-        return res.json({ hosts: exportedHosts });
-      }
-
-      const exportedCredentials: Record<string, unknown>[] = [];
-      if (usedCredentialIds.size > 0) {
-        const credentialRepository = createCurrentCredentialRepository();
-        const ownedCredentials =
-          await credentialRepository.listDecryptedByUserId(userId);
-        const credentialById = new Map(
-          ownedCredentials.map((credential) => [credential.id, credential]),
-        );
-
-        for (const host of exportedHosts as Record<string, unknown>[]) {
-          const credentialId = host.credentialId as number | null;
-          if (!credentialId) continue;
-          const credential = credentialById.get(credentialId);
-          if (!credential) continue;
-
-          host.credentialAlias = credential.name;
-
-          if (
-            !exportedCredentials.some(
-              (entry) => entry.alias === credential.name,
-            )
-          ) {
-            exportedCredentials.push({
-              alias: credential.name,
-              name: credential.name,
-              description: credential.description || null,
-              folder: credential.folder || null,
-              tags:
-                typeof credential.tags === "string"
-                  ? credential.tags.split(",").filter(Boolean)
-                  : [],
-              authType: credential.authType,
-              username: credential.username || null,
-              keyType: credential.keyType || null,
-            });
-          }
-        }
-      }
-
-      for (const host of exportedHosts as Record<string, unknown>[]) {
-        delete host.credentialId;
-      }
-
-      sshLogger.success("All hosts exported for sharing without secrets", {
-        operation: "hosts_export_all_share",
-        count: exportedHosts.length,
-        credentialCount: exportedCredentials.length,
-        userId,
-      });
-
-      res.json({
-        version: "1",
-        exportedAt: new Date().toISOString(),
-        credentials: exportedCredentials,
-        hosts: exportedHosts,
-      });
-    } catch (err) {
-      sshLogger.error("Failed to export all SSH hosts", err, {
-        operation: "hosts_export_all",
-        userId,
-      });
-      res.status(500).json({ error: "Failed to export SSH hosts" });
-    }
-  },
-);
-
 /**
 * @openapi
 * /host/db/host/{id}:
@@ -2051,6 +1730,7 @@ router.delete(
  authenticateJWT,
  permissionManager.requirePermission("hosts.delete"),
  requireDataAccess,
+  requireUnlockedHost,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
    const hostId = Array.isArray(req.params.id)
@@ -2117,231 +1797,6 @@ router.delete(
 // the file-manager plugin, under /plugin-api/file-manager/, and command
 // history to the ssh-terminal plugin, under /plugin-api/ssh-terminal/.

-/**
- * A share export leaves out every secret and credential link, the same as
- * it does for SSH.
- */
-function shareableLogins(
-  logins: ReturnType<typeof toPortableLogins>,
-  shareMode: boolean,
-): ReturnType<typeof toPortableLogins> {
-  if (!shareMode) return logins;
-  const out: ReturnType<typeof toPortableLogins> = {};
-  for (const [protocol, login] of Object.entries(logins)) {
-    const declared = findHostProtocol(protocol);
-    const secret = new Set(
-      (declared?.credentialFields ?? [])
-        .filter((field) => field.secret)
-        .map((field) => field.key),
-    );
-    out[protocol] = {
-      authType: login.authType === "credential" ? "direct" : login.authType,
-      credentialId: null,
-      username: login.username,
-      password: null,
-      fields: Object.fromEntries(
-        Object.entries(login.fields).filter(
-          ([key]) => declared && !secret.has(key),
-        ),
-      ),
-    };
-  }
-  return out;
-}
-
-async function resolveHostCredentials(
-  host: Record<string, unknown>,
-  requestingUserId?: string,
-  /**
-   * Credentials already fetched for this request, keyed by id. The host list
-   * preloads them in one query; single-host callers omit it and fall back to
-   * fetching the one credential they need.
-   */
-  preloadedCredentials?: Map<number, HostResolutionCredentialRecord>,
-): Promise<Record<string, unknown>> {
-  try {
-    const ownerId = (host.ownerId || host.userId) as string | undefined;
-    if (
-      requestingUserId &&
-      ownerId &&
-      requestingUserId !== ownerId &&
-      typeof host.id === "number"
-    ) {
-      const authHost = host as unknown as HostResolutionHostRecord;
-      const needsPersonalCredential = requiresPersonalHostAuthentication(
-        authHost,
-        "ssh",
-      );
-      const baseSshOverrideState = {
-        required: needsPersonalCredential,
-        ownerAuthShared: !!host.shareSshAuth,
-      };
-      // Owner auth for the remote desktop protocols is always snapshotted
-      // for recipients; only their own override credential varies per user.
-      const authOverrides: Record<string, unknown> = {
-        ssh: baseSshOverrideState,
-      };
-      const overrideCredentialIds =
-        await createCurrentSharedHostAuthOverrideRepository().listCredentialIds(
-          host.id,
-          requestingUserId,
-        );
-      // Whether a plugin protocol is on is its plugin's host setting; the
-      // client only offers an override for one that is.
-      for (const { id: protocol } of listHostProtocols()) {
-        authOverrides[protocol] = {
-          credentialId: overrideCredentialIds[protocol],
-          required: false,
-          ownerAuthShared: true,
-        };
-      }
-      const recipientHost: Record<string, unknown> = {
-        ...host,
-        credentialId: null,
-        password: null,
-        key: null,
-        keyPassword: null,
-        keyType: null,
-        authOverrides,
-      };
-
-      try {
-        const resolution = await resolveRecipientSharedHostAuthentication(
-          authHost,
-          host.id,
-          requestingUserId,
-          "ssh",
-        );
-
-        if (resolution.source === "personal-override") {
-          const credential = resolution.credential;
-          return {
-            ...recipientHost,
-            authOverrides: {
-              ...authOverrides,
-              ssh: {
-                credentialId: resolution.credentialId,
-                required: false,
-                ownerAuthShared: !!host.shareSshAuth,
-              },
-            },
-            authType:
-              credential.key || credential.privateKey
-                ? "key"
-                : credential.password
-                  ? "password"
-                  : "none",
-            username: credential.username || recipientHost.username,
-            password: credential.password,
-            key: credential.privateKey || credential.key,
-            keyPassword: credential.keyPassword,
-            keyType: credential.keyType,
-          };
-        }
-
-        if (resolution.source === "owner-shared") {
-          if (resolution.authType === "agent") {
-            return {
-              ...recipientHost,
-              authOverrides: {
-                ...authOverrides,
-                ssh: {
-                  required: false,
-                  ownerAuthShared: true,
-                },
-              },
-              authType: "agent",
-            };
-          }
-
-          const sharedAuth = resolution.secret;
-          if (sharedAuth) {
-            const resolvedUsername = pickResolvedUsername(
-              recipientHost.username,
-              sharedAuth.username,
-              host.overrideCredentialUsername,
-            );
-            return {
-              ...recipientHost,
-              authOverrides: {
-                ...authOverrides,
-                ssh: {
-                  required: false,
-                  ownerAuthShared: true,
-                },
-              },
-              authType: sharedAuth.key
-                ? "key"
-                : sharedAuth.password
-                  ? "password"
-                  : "none",
-              username: resolvedUsername,
-              password: sharedAuth.password,
-              key: sharedAuth.key,
-              keyPassword: sharedAuth.keyPassword,
-              keyType: sharedAuth.keyType,
-            };
-          }
-        }
-
-        if (resolution.source === "secretless") {
-          return {
-            ...recipientHost,
-            authOverrides: {
-              ...authOverrides,
-              ssh: {
-                required: false,
-                ownerAuthShared: !!host.shareSshAuth,
-              },
-            },
-          };
-        }
-      } catch {
-        // A missing/deleted override or snapshot behaves like unavailable auth.
-      }
-
-      return recipientHost;
-    }
-
-    if (host.credentialId && (host.userId || host.ownerId)) {
-      const credentialId = host.credentialId as number;
-      const credentialOwnerId = (host.ownerId || host.userId) as string;
-
-      const credential =
-        preloadedCredentials?.get(credentialId) ??
-        (await findUsableCredential(credentialId, credentialOwnerId));
-
-      if (credential) {
-        const resolvedHost: Record<string, unknown> = {
-          ...host,
-          password: pickResolvedPassword(host.password, credential.password),
-          key: credential.key,
-          keyPassword: credential.keyPassword,
-          keyType: credential.keyType,
-        };
-
-        const resolvedUsername = pickResolvedUsername(
-          host.username,
-          credential.username,
-          host.overrideCredentialUsername,
-        );
-        if (resolvedUsername !== undefined) {
-          resolvedHost.username = resolvedUsername;
-        }
-
-        return resolvedHost;
-      }
-    }
-
-    return { ...host };
-  } catch (error) {
-    sshLogger.warn(
-      `Failed to resolve credentials for host ${host.id}: ${getErrorMessage(error)}`,
-    );
-    return host;
-  }
-}
-
 registerHostFolderRoutes(router, {
  authenticateJWT,
  requireViewPermission: permissionManager.requirePermission("hosts.view"),
@@ -2355,7 +1810,6 @@ registerHostFolderRoutes(router, {
 registerHostBulkRoutes(
  router,
  authenticateJWT,
-  permissionManager.requirePermission("hosts.create"),
  permissionManager.requirePermission("hosts.edit"),
  requireDataAccess,
 );
@@ -18,6 +18,7 @@ import {
  safeLayoutForced,
  unavailableLooks,
 } from "../../plugins/looks.js";
+import { safeModeOn } from "../../plugins/safe-mode.js";

 const router = express.Router();
 const authManager = AuthManager.getInstance();
@@ -36,7 +37,7 @@ async function adminDefaults() {
 * /user-preferences/look:
 *   get:
 *     summary: Get the layout and theme to show the current user
- *     description: The user's own choice, the admin defaults (a layout no installed plugin brings reads as null), the default look of the bundled plugins, whether TERMIX_SAFE_LAYOUT forces the repair view, and installed layout or theme plugins that could not load. The browser resolves the final look from these.
+ *     description: The user's own choice, the admin defaults (a layout no installed plugin brings reads as null), the default look of the bundled plugins, whether TERMIX_SAFE_LAYOUT forces the repair view, whether TERMIX_SAFE_MODE runs only layout and theme plugins, and installed layout or theme plugins that could not load. The browser resolves the final look from these.
 *     tags:
 *       - User Preferences
 *     responses:
@@ -75,6 +76,8 @@ async function adminDefaults() {
 *                       nullable: true
 *                 safeLayout:
 *                   type: boolean
+ *                 safeMode:
+ *                   type: boolean
 *                 unavailable:
 *                   type: array
 *                   items:
@@ -112,6 +115,7 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
      defaults: { ...defaults, layout: known(defaults.layout) },
      defaultLook: resolveDefaultLook(loader),
      safeLayout: safeLayoutForced(),
+      safeMode: safeModeOn(),
      unavailable: unavailableLooks(loader),
    });
  } catch (error) {
@@ -13,8 +13,10 @@ import {
  createCurrentPluginRepository,
 } from "../repositories/factory.js";
 import { getPluginRuntime } from "../../plugins/index.js";
+import { resolvePluginDesktopMode } from "@termix-ssh/plugin-sdk/manifest";
 import { describePluginFrontend } from "../../plugins/assets.js";
 import { isDefaultLookPlugin } from "../../plugins/bundled-index.js";
+import { mayRunInSafeMode } from "../../plugins/safe-mode.js";
 import { invalidatePluginPermissionCache } from "../../plugins/permissions.js";
 import { getPluginPublicHttpRoutes } from "../../plugins/http.js";
 import { getPluginPublicWsRoutes } from "../../plugins/ws.js";
@@ -43,6 +45,7 @@ import {
  validateSettingsSave,
  type PluginSettingsScope,
 } from "../../plugins/settings.js";
+import { assertHostsUnlocked, sendHostLocked } from "../../hosts/locks.js";
 import {
  getAuditUsername,
  getRequestMeta,
@@ -247,6 +250,9 @@ export async function listPreLoginPlugins(): Promise<
 *       only run on that server and stay off here on purpose, and, for
 *       admins, `managedByServer` marks plugins whose on/off state the server
 *       decides.
+ *
+ *       While TERMIX_SAFE_MODE is on, an enabled plugin that safe mode keeps
+ *       off reports `state: "safe-mode"`.
 *     tags:
 *       - Plugins
 *     responses:
@@ -297,7 +303,9 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
        let features: string[] = [];
        let docs: string | undefined;
        let env: PluginEnvVar[] = [];
-        let desktopMode: unknown = loaded?.manifest.desktop;
+        let desktopMode: unknown = loaded
+          ? resolvePluginDesktopMode(loaded.manifest)
+          : undefined;
        try {
          const manifest = JSON.parse(record.manifestJson) as {
            contributes?: unknown;
@@ -313,8 +321,12 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
            dependencies?: Record<string, string>;
            optionalDependencies?: Record<string, string>;
            desktop?: unknown;
+            runtime?: unknown;
          };
-          desktopMode = loaded?.manifest.desktop ?? manifest?.desktop;
+          desktopMode = loaded
+            ? resolvePluginDesktopMode(loaded.manifest)
+            : (manifest?.desktop ??
+              (manifest?.runtime === "desktop" ? "local" : undefined));
          contributes = manifest?.contributes ?? null;
          capabilities = Array.isArray(manifest?.capabilities)
            ? (manifest.capabilities as string[])
@@ -346,7 +358,12 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
          name: record.name,
          version: record.version,
          enabled: record.state === "enabled",
-          state: loaded?.state ?? record.state,
+          state:
+            record.state === "enabled" &&
+            loaded?.state !== "active" &&
+            !mayRunInSafeMode(record.id, loader.list())
+              ? "safe-mode"
+              : (loaded?.state ?? record.state),
          runsOnServer: linked && desktopMode === "server",
          contributes,
          icon,
@@ -928,7 +945,7 @@ router.delete(
 *       404:
 *         description: No such plugin.
 *       409:
- *         description: This desktop is linked to a server, which decides whether the plugin runs.
+ *         description: This desktop is linked to a server, which decides whether the plugin runs, or safe mode is on and the plugin is not a layout or theme.
 */
 router.patch(
  "/:id/state",
@@ -1042,6 +1059,8 @@ router.patch(
 *         description: The caller lacks admin.plugins.manage.
 *       404:
 *         description: No such plugin, or it is not on disk.
+ *       409:
+ *         description: Safe mode is on and the plugin is not a layout or theme.
 *       500:
 *         description: The plugin failed to start again.
 */
@@ -1065,6 +1084,13 @@ router.post(
        res.status(404).json({ error: "Plugin is not present on disk" });
        return;
      }
+      if (!mayRunInSafeMode(pluginId, loader.list())) {
+        res.status(409).json({
+          error: "Safe mode is on, so only layout and theme plugins can start",
+          code: "SAFE_MODE",
+        });
+        return;
+      }

      await repository.update(pluginId, {
        state: "enabled",
@@ -1871,6 +1897,18 @@ router.put(
      const inherit = Array.isArray(inheritRaw)
        ? inheritRaw.filter((key): key is string => typeof key === "string")
        : [];
+      // A managed host keeps its settings; only personal ones stay per user.
+      const changesShared = [...Object.keys(written), ...inherit].some(
+        (key) => !findField(manifest, "host", key)?.personal,
+      );
+      if (changesShared) {
+        try {
+          assertHostsUnlocked([hostId]);
+        } catch (error) {
+          if (sendHostLocked(res, error)) return;
+          throw error;
+        }
+      }
      const errors = await applySettings(
        userId,
        manifest,
@@ -9,6 +9,12 @@ import {
  logAudit,
 } from "../../utils/audit-logger.js";
 import { isAuthOverrideProtocol } from "../../hosts/protocol-auth/registry.js";
+import {
+  assertHostsUnlocked,
+  hasHostLocks,
+  requireUnlockedHost,
+  sendHostLocked,
+} from "../../hosts/locks.js";
 import {
  SharedHostAuthOverrideService,
  SharedHostAuthOverrideServiceError,
@@ -229,6 +235,7 @@ router.post(
  "/host/:id/share",
  authenticateJWT,
  permissionManager.requirePermission("hosts.share"),
+  requireUnlockedHost,
  async (req: AuthenticatedRequest, res: Response) => {
    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const hostId = parseInt(id, 10);
@@ -451,6 +458,14 @@ router.post(
    }

    try {
+      if (hasHostLocks()) {
+        const inFolder =
+          await createCurrentHostFolderRepository().listHostsInFolder(
+            userId,
+            folder,
+          );
+        assertHostsUnlocked(inFolder.map((host) => host.id));
+      }
      const targets = parseShareTargets(req.body ?? {});
      if (!targets) {
        return res.status(400).json({
@@ -613,6 +628,7 @@ router.post(
        hostResults,
      });
    } catch (error) {
+      if (sendHostLocked(res, error)) return;
      databaseLogger.error("Failed to share folder", error, {
        operation: "share_folder",
        folder,
@@ -786,6 +802,7 @@ router.delete(
 router.patch(
  "/host/:id/access/:accessId",
  authenticateJWT,
+  requireUnlockedHost,
  async (req: AuthenticatedRequest, res: Response) => {
    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const accessIdParam = Array.isArray(req.params.accessId)
@@ -908,6 +925,7 @@ router.patch(
 router.delete(
  "/host/:id/access/:accessId",
  authenticateJWT,
+  requireUnlockedHost,
  async (req: AuthenticatedRequest, res: Response) => {
    const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
    const accessIdParam = Array.isArray(req.params.accessId)
@@ -2,13 +2,13 @@ import type { Router } from "express";
 import crypto from "crypto";
 import bcrypt from "bcryptjs";
 import { nanoid } from "nanoid";
+import { recentActivity } from "../../plugins/activity-provider.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import { authLogger } from "../../utils/logger.js";
 import { loginRateLimiter } from "../../utils/login-rate-limiter.js";
 import {
  createCurrentCredentialRepository,
  createCurrentHostRepository,
-  createCurrentRecentActivityRepository,
  createCurrentSettingsRepository,
  createCurrentSshCredentialUsageRepository,
  createCurrentUserRepository,
@@ -68,7 +68,7 @@ export async function resetUserPassword(
  await userRepository.update(userId, { passwordHash });

  await createCurrentSshCredentialUsageRepository().deleteByUserId(userId);
-  await createCurrentRecentActivityRepository().deleteByUserId(userId);
+  await recentActivity.deleteByUserId(userId);
  await createCurrentHostRepository().deleteByUserId(userId);
  await createCurrentCredentialRepository().deleteByUserId(userId);
  // A plugin holding this user's data (anything keyed by
Author	SHA1	Message	Date
Luke GustafsonandLukas	96b8520fb4	v26.10.5 (#1710 ) * feat: add an auto or fixed columns picker to card grids * feat: add safe mode that only runs layout and theme plugins * docs: add simple layout to plugin table * fix: ask for local network access in the macOS app * feat: allow plugin registries on listed private hosts (#1705) * chore: add private registry hosts to the changelog * feat: use the proxy for plugin registry downloads * fix: allow changing connection origin on shared hosts * chore: update translations and plugin pins * chore: lint, format, and bump version to 26.10.5 --------- Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>	2026-10-22 13:30:48 -05:00
LukeGus	7b7b17e31f	chore: add six new plugins to the readme table	2026-10-21 16:25:59 -05:00
LukeGus	53c4e5fe9c	fix: let the repair screen turn the layout plugin back on	2026-10-21 11:55:50 -05:00
LukeGus	28cb1bc554	feat: make all buttons brand orange and lint against white ones	2026-10-21 10:44:53 -05:00
LukeGus	b691d4f7cb	fix: retry dmg detach in macOS sharp check	2026-10-21 09:54:43 -05:00
Luke Gustafson	a65b4a5d48	v26.10.4 (#1701 ) * Update package.json * chore: lint, format, and bump version to 26.10.4	2026-10-21 08:40:42 -05:00
Luke Gustafson	abaf89b732	Update package version from 26.10.3 to 26.10.4	2026-10-21 08:31:57 -05:00
Luke Gustafson	72d868afc7	Update CHANGELOG.md	2026-10-21 08:30:07 -05:00
LukeGus	d35304e107	chore: bump Homebrew cask to 26.10.3	2026-10-21 01:06:39 +00:00
LukeGus	f4d87ddd8d	fix: pin classic layout 1.0.1	2026-10-20 18:58:00 -05:00
LukeGus	4d7385f51d	fix: pin the classic layout title bar fix	2026-10-20 18:52:58 -05:00
LukeGus	d3fc32928b	chore: bump Homebrew cask to 26.10.3	2026-10-20 22:42:52 +00:00
LukeGus	1533c6837a	fix: start npm through a shell in the windows sharp install	2026-10-20 16:56:04 -05:00
Luke Gustafson SirHephaistos Giovanny Aranda	a89ccc6b07	v26.10.3 (#1692 ) * feat: shell controller, TabStage, layout and theme plugins with repair view * feat: move the classic layout into its own bundled plugin * feat: move color themes into a bundled themes plugin * fix: plugin tests and type checks work with a linked sdk * fix: home tab, layout switch and missing layout fallbacks for looks * chore: add classic layout and themes to the readme * chore: drop example plugin links from the plugin guide * feat: plugin filters by type, paged browse, hide plugins needing newer termix * feat: move desktop, status, import, audit and branding features into plugins * feat: host lock api so a plugin can load hosts from a config file (#1581) * chore: add hosts config to the plugin table * feat: login policy hook for plugins and optional https redirect (#1584) * chore: add login security to the plugin table * feat: api key socket tickets so a master can open remote sessions (#1654) * feat: sync moves to a plugin, desktop gets multiple accounts (#1580, #1654) * chore: add sync to the plugin table * feat: move the sync screens and wizard out of core into the plugin (#1580) * fix: add a neutral linked desktop hook for plugins (#1580) * fix: show the linked account's name and admin flag in the app (#1580) * feat: ssh transport providers, core ssh relay and plugin folders api * feat: support FIDO2 security keys through ssh agent * feat: add companion panels beside host tabs * feat: mTLS client certificates for desktop server links * feat: native web view for plugins in the desktop app * fix: detect the desktop link window by Electron's default user agent Fixes #1675 * fix: changelog for desktop link fix * fix: keep text primary keys in the plugin data export * fix: ship sharp binaries for Windows arm64 builds * feat: client cert on the sync link types (sdk 1.0.18) * chore: update translations * feat: themed title bar for the desktop app (#1690) * chore: changelog for the themed title bar * fix: draw the title bar in the sidebar color * feat: per host layout for the terminal panel bar * chore: sdk 1.0.19 for the panel bar layout * chore: bundle all 43 plugins for 26.10.3 * chore: update translations --------- Co-authored-by: SirHephaistos <60616553+SirHephaistos@users.noreply.github.com> Co-authored-by: Giovanny Aranda <garanda21@gmail.com>	2026-10-20 16:03:29 -05:00