fix: deleting your own account removes all of its data

* feat: add an auto or fixed columns picker to card grids

* feat: add safe mode that only runs layout and theme plugins

* docs: add simple layout to plugin table

* fix: ask for local network access in the macOS app

* feat: allow plugin registries on listed private hosts (#1705)

* chore: add private registry hosts to the changelog

* feat: use the proxy for plugin registry downloads

* fix: allow changing connection origin on shared hosts

* chore: update translations and plugin pins

* chore: lint, format, and bump version to 26.10.5

---------

Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>

.github/workflows/docker.yml

@@ -41,9 +41,15 @@ on:
         default: ""
 
 jobs:
+  # One image per plugin profile (docker/bundled-plugins.json). standard keeps
+  # the plain tags; minimal and full add a suffix.
   build:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [standard, minimal, full]
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -80,12 +86,17 @@ jobs:
           TAGS=()
           ALL_TAGS=()
 
+          SUFFIX=""
+          if [ "${{ matrix.profile }}" != "standard" ]; then
+            SUFFIX="-${{ matrix.profile }}"
+          fi
+
           if [ "$BUILD_TYPE" = "Production" ]; then
-            TAGS+=("$VERSION" "latest")
+            TAGS+=("$VERSION$SUFFIX" "latest$SUFFIX")
           elif [ "$BUILD_TYPE" = "Beta" ]; then
-            TAGS+=("beta" "$VERSION")
+            TAGS+=("beta$SUFFIX" "$VERSION$SUFFIX")
           else
-            TAGS+=("dev-$VERSION")
+            TAGS+=("dev-$VERSION$SUFFIX")
           fi
 
           for tag in "${TAGS[@]}"; do
@@ -124,6 +135,7 @@ jobs:
           tags: ${{ env.ALL_TAGS }}
           build-args: |
             BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
+            PLUGIN_PROFILE=${{ matrix.profile }}
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ env.SOURCE_SHA }}

.github/workflows/electron.yml

@@ -115,7 +115,18 @@ jobs:
           Write-Host "Spectre libs present: $($found.FullName)"
 
       - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci
+          node scripts/install-windows-sharp.cjs
+
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
 
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
@@ -134,7 +145,12 @@ jobs:
       - name: Build Windows (All Architectures)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run build && npx electron-builder --win --x64 --ia32
+        run: npm run build && npx electron-builder --win --x64 --ia32 --arm64 --publish never
+
+      # The updater only installs the x64 NSIS build; 32-bit and ARM installs get a link.
+      # The combined multi-arch installer is never uploaded.
+      - name: Fix Windows update files
+        run: node scripts/fix-update-info.cjs --drop ia32 --drop arm64 --drop termix_windows_nsis.exe release/latest.yml release/beta.yml
 
       - name: Upload Windows x64 NSIS Installer
         uses: actions/upload-artifact@v7
@@ -152,6 +168,14 @@ jobs:
           path: release/termix_windows_ia32_nsis.exe
           retention-days: 30
 
+      - name: Upload Windows arm64 NSIS Installer
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/termix_windows_arm64_nsis.exe') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_nsis
+          path: release/termix_windows_arm64_nsis.exe
+          retention-days: 30
+
       - name: Upload Windows x64 MSI Installer
         uses: actions/upload-artifact@v7
         if: hashFiles('release/termix_windows_x64_msi.msi') != '' && inputs.artifact_destination != 'none'
@@ -168,6 +192,14 @@ jobs:
           path: release/termix_windows_ia32_msi.msi
           retention-days: 30
 
+      - name: Upload Windows arm64 MSI Installer
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/termix_windows_arm64_msi.msi') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_msi
+          path: release/termix_windows_arm64_msi.msi
+          retention-days: 30
+
       - name: Create Windows x64 Portable zip
         if: hashFiles('release/win-unpacked/*') != ''
         run: |
@@ -178,6 +210,22 @@ jobs:
         run: |
           Compress-Archive -Path "release\win-ia32-unpacked\*" -DestinationPath "termix_windows_ia32_portable.zip"
 
+      - name: Create Windows arm64 Portable zip
+        if: hashFiles('release/win-arm64-unpacked/*') != ''
+        run: |
+          Compress-Archive -Path "release\win-arm64-unpacked\*" -DestinationPath "termix_windows_arm64_portable.zip"
+
+      - name: Upload Windows update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_update_meta
+          path: |
+            release/*.yml
+            release/termix_windows_x64_nsis.exe.blockmap
+            !release/builder-debug.yml
+          retention-days: 30
+
       - name: Upload Windows x64 Portable
         uses: actions/upload-artifact@v7
         if: hashFiles('termix_windows_x64_portable.zip') != '' && inputs.artifact_destination != 'none'
@@ -194,6 +242,14 @@ jobs:
           path: termix_windows_ia32_portable.zip
           retention-days: 30
 
+      - name: Upload Windows arm64 Portable
+        uses: actions/upload-artifact@v7
+        if: hashFiles('termix_windows_arm64_portable.zip') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_portable
+          path: termix_windows_arm64_portable.zip
+          retention-days: 30
+
   build-linux:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     if: (inputs.build_type == 'all' || inputs.build_type == 'linux' || inputs.build_type == '') && inputs.artifact_destination != 'submit'
@@ -225,6 +281,15 @@ jobs:
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -234,12 +299,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEBUG: electron-builder
-        run: npm run build && npx electron-builder --linux --x64
+        run: npm run build && npx electron-builder --linux --x64 --publish never
 
       - name: Build Linux arm64 and armv7l
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx electron-builder --linux --arm64 --armv7l
+        run: npx electron-builder --linux --arm64 --armv7l --publish never
 
       - name: Rename Linux artifacts for consistency
         run: |
@@ -255,6 +320,19 @@ jobs:
 
           cd ..
 
+          node scripts/fix-update-info.cjs \
+            --rename termix_linux_amd64_deb.deb=termix_linux_x64_deb.deb \
+            --rename termix_linux_x86_64_appimage.AppImage=termix_linux_x64_appimage.AppImage \
+            release/*-linux*.yml
+
+      - name: Upload Linux update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*-linux*.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_linux_update_meta
+          path: release/*-linux*.yml
+          retention-days: 30
+
       - name: Upload Linux x64 AppImage
         uses: actions/upload-artifact@v7
         if: hashFiles('release/termix_linux_x64_appimage.AppImage') != '' && inputs.artifact_destination != 'none'
@@ -439,6 +517,15 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -494,7 +581,7 @@ jobs:
         run: |
           BUILD_VERSION="${{ github.run_number }}"
 
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
 
       - name: Clean up MAS keychain before DMG build
         if: steps.check_certs.outputs.has_certs == 'true'
@@ -553,7 +640,24 @@ jobs:
           if [ "${{ steps.mas_build.outcome }}" != "success" ]; then
             npm run build
           fi
-          npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
+          npx electron-builder --mac dmg zip --universal --x64 --arm64 --publish never
+
+      # The updater picks the x64 or arm64 zip, so the universal one is left out.
+      - name: Fix macOS update files
+        run: node scripts/fix-update-info.cjs --drop universal release/*-mac.yml
+
+      - name: Upload macOS update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*-mac.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_macos_update_meta
+          path: |
+            release/*-mac.yml
+            release/termix_macos_x64_update.zip
+            release/termix_macos_x64_update.zip.blockmap
+            release/termix_macos_arm64_update.zip
+            release/termix_macos_arm64_update.zip.blockmap
+          retention-days: 30
 
       - name: Verify macOS sharp packaging
         run: |
@@ -771,144 +875,6 @@ jobs:
           path: choco-build/*.nupkg
           retention-days: 30
 
-  submit-to-flatpak:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'linux' || inputs.build_type == '')
-    needs: []
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.source_ref || github.ref }}
-          fetch-depth: 1
-
-      - name: Get version from package.json
-        id: package-version
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          RELEASE_DATE=$(date +%Y-%m-%d)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
-
-      - name: Download and prepare AppImage info from public release
-        id: appimage-info
-        run: |
-          VERSION="${{ steps.package-version.outputs.version }}"
-          mkdir -p release_assets
-
-          APPIMAGE_X64_NAME="termix_linux_x64_appimage.AppImage"
-          URL_X64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_X64_NAME"
-          PATH_X64="release_assets/$APPIMAGE_X64_NAME"
-          echo "Downloading x64 AppImage from $URL_X64"
-          curl -L -o "$PATH_X64" "$URL_X64"
-          chmod +x "$PATH_X64"
-          CHECKSUM_X64=$(sha256sum "$PATH_X64" | awk '{print $1}')
-
-          APPIMAGE_ARM64_NAME="termix_linux_arm64_appimage.AppImage"
-          URL_ARM64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_ARM64_NAME"
-          PATH_ARM64="release_assets/$APPIMAGE_ARM64_NAME"
-          echo "Downloading arm64 AppImage from $URL_ARM64"
-          curl -L -o "$PATH_ARM64" "$URL_ARM64"
-          chmod +x "$PATH_ARM64"
-          CHECKSUM_ARM64=$(sha256sum "$PATH_ARM64" | awk '{print $1}')
-
-          echo "appimage_x64_name=$APPIMAGE_X64_NAME" >> $GITHUB_OUTPUT
-          echo "checksum_x64=$CHECKSUM_X64" >> $GITHUB_OUTPUT
-          echo "appimage_arm64_name=$APPIMAGE_ARM64_NAME" >> $GITHUB_OUTPUT
-          echo "checksum_arm64=$CHECKSUM_ARM64" >> $GITHUB_OUTPUT
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y imagemagick
-
-      - name: Prepare Flatpak submission files
-        run: |
-          VERSION="${{ steps.package-version.outputs.version }}"
-          CHECKSUM_X64="${{ steps.appimage-info.outputs.checksum_x64 }}"
-          CHECKSUM_ARM64="${{ steps.appimage-info.outputs.checksum_arm64 }}"
-          RELEASE_DATE="${{ steps.package-version.outputs.release_date }}"
-
-          mkdir -p flatpak-submission
-
-          cp packaging/flatpak/com.karmaa.termix.yml flatpak-submission/
-          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-submission/
-          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-submission/
-          cp packaging/flatpak/flathub.json flatpak-submission/
-
-          cp public/icon.svg flatpak-submission/com.karmaa.termix.svg
-          convert public/icon.png -resize 256x256 flatpak-submission/icon-256.png
-          convert public/icon.png -resize 128x128 flatpak-submission/icon-128.png
-
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" flatpak-submission/com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" flatpak-submission/com.karmaa.termix.yml
-
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.metainfo.xml
-          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" flatpak-submission/com.karmaa.termix.metainfo.xml
-
-      - name: Upload Flatpak submission as artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: flatpak-submission
-          path: flatpak-submission/*
-          retention-days: 30
-
-      - name: Check for Flathub token
-        id: check_flathub_token
-        run: |
-          if [ -n "${{ secrets.FLATHUB_TOKEN }}" ]; then
-            echo "has_token=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Open PR on Flathub repo
-        if: steps.check_flathub_token.outputs.has_token == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.FLATHUB_TOKEN }}
-          VERSION: ${{ steps.package-version.outputs.version }}
-        run: |
-          FLATHUB_REPO="flathub/com.karmaa.termix"
-          BRANCH="release-$VERSION"
-
-          git config --global user.name "LukeGus"
-          git config --global user.email "bugattiguy527@gmail.com"
-
-          git clone "https://x-access-token:${GH_TOKEN}@github.com/${FLATHUB_REPO}.git" flathub-repo
-          cd flathub-repo
-
-          git checkout -b "$BRANCH"
-
-          cp ../flatpak-submission/com.karmaa.termix.yml ./
-          cp ../flatpak-submission/com.karmaa.termix.desktop ./
-          cp ../flatpak-submission/com.karmaa.termix.metainfo.xml ./
-          cp ../flatpak-submission/flathub.json ./
-          cp ../flatpak-submission/com.karmaa.termix.svg ./
-          cp ../flatpak-submission/icon-256.png ./
-          cp ../flatpak-submission/icon-128.png ./
-
-          if git diff --quiet && git diff --cached --quiet; then
-            echo "No changes to submit for $VERSION; Flathub repo already up to date."
-            exit 0
-          fi
-
-          git add -A
-          git commit -m "Update to $VERSION"
-          git push origin "$BRANCH"
-
-          EXISTING_PR=$(gh pr list --repo "$FLATHUB_REPO" --head "$BRANCH" --state open --json number -q '.[0].number' || true)
-          if [ -z "$EXISTING_PR" ]; then
-            gh pr create --repo "$FLATHUB_REPO" \
-              --base master \
-              --head "$BRANCH" \
-              --title "Update to $VERSION" \
-              --body "Automated release update to version $VERSION."
-          else
-            echo "PR #$EXISTING_PR already open for $BRANCH."
-          fi
-
   submit-to-homebrew:
     runs-on: blacksmith-6vcpu-macos-latest
     if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'macos')
@@ -1007,18 +973,15 @@ jobs:
             echo "RELEASE_TAG=$(gh release list --repo ${{ github.repository }} --limit 1 --json tagName -q '.[0].tagName')" >> $GITHUB_ENV
           fi
 
+      # Update files go up last: the desktop updater treats a release as ready
+      # once its update file is there, so every installer must already be up.
       - name: Upload artifacts to latest release
         run: |
-          cd artifacts
-          for dir in */; do
-            cd "$dir"
-            for file in *;
-            do
-              if [ -f "$file" ]; then
-                gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
-              fi
-            done
-            cd ..
+          find artifacts -type f ! -name '*.yml' -print0 | while IFS= read -r -d '' file; do
+            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
+          done
+          find artifacts -type f -name '*.yml' -print0 | while IFS= read -r -d '' file; do
+            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
           done
         env:
           GH_TOKEN: ${{ github.token }}
@@ -1050,6 +1013,15 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
       - name: Check for Code Signing Certificates
         id: check_certs
         run: |
@@ -1188,7 +1160,7 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=4096
         run: |
           BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
 
       - name: Verify macOS sharp packaging
         if: steps.check_certs.outputs.has_certs == 'true'
@@ -1212,6 +1184,49 @@ jobs:
             --locales "en-US"
           echo "metadata_path=$META_DIR" >> "$GITHUB_OUTPUT"
 
+      # Apple won't create a new version while the last one is still in
+      # review. Pull it out so deliver can rename it to this version.
+      - name: Cancel pending App Store review
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          LANE_DIR="$RUNNER_TEMP/asc_cancel/fastlane"
+          mkdir -p "$LANE_DIR"
+
+          cat > "$LANE_DIR/Fastfile" <<'EOF'
+          default_platform(:mac)
+
+          lane :cancel_pending_review do
+            Spaceship::ConnectAPI.token = Spaceship::ConnectAPI::Token.from_json_file("/tmp/asc_keys/api_key.json")
+            app = Spaceship::ConnectAPI::App.find("com.karmaa.termix")
+            UI.user_error!("App not found") unless app
+
+            app.get_app_store_versions(filter: { platform: "MAC_OS" }, limit: 5).each do |v|
+              UI.message("Version #{v.version_string}: #{v.app_version_state || v.app_store_state}")
+            end
+
+            active = %w[WAITING_FOR_REVIEW IN_REVIEW UNRESOLVED_ISSUES]
+            canceled = false
+            app.get_review_submissions(filter: { platform: "MAC_OS" }).each do |sub|
+              UI.message("Review submission #{sub.id}: #{sub.state}")
+              next unless active.include?(sub.state)
+              sub.cancel_submission
+              canceled = true
+              UI.important("Canceled review submission #{sub.id}")
+            end
+            next unless canceled
+
+            30.times do
+              busy = app.get_review_submissions(filter: { platform: "MAC_OS" }).any? do |sub|
+                (active + %w[CANCELING]).include?(sub.state)
+              end
+              break unless busy
+              sleep(10)
+            end
+          end
+          EOF
+
+          cd "$RUNNER_TEMP/asc_cancel" && fastlane cancel_pending_review
+
       - name: Upload and submit to Mac App Store
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         run: |

.github/workflows/pr-check.yml

@@ -24,6 +24,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
       - name: Build plugin SDK
         run: npm run build:sdk
 

.github/workflows/release.yml

@@ -161,15 +161,70 @@ jobs:
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
           echo "prev_ref=$PREV" >> "$GITHUB_OUTPUT"
 
-  verify-beta:
+  # Translates new or changed strings with the Termix LLM server and pins the
+  # bundled plugins to their newest registry releases, then commits both to the
+  # dev branch so the beta or stable build includes them. If the server is down
+  # it warns and the release goes on with what is there.
+  translate:
     needs: [prep]
+    if: ${{ needs.prep.outputs.skip != 'true' && needs.prep.outputs.mode != 'Overwrite release' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      sha: ${{ steps.commit.outputs.sha }}
+    steps:
+      - name: Checkout dev branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.prep.outputs.sha || needs.prep.outputs.dev_branch }}
+          fetch-depth: 1
+          token: ${{ secrets.TERMIX_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Translate
+        uses: Termix-SSH/Termix-Registry/translate@main
+        with:
+          source: src/ui/locales/en.json
+          out: src/ui/locales/translated
+          languages: src/ui/locales/languages.json
+          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      # Newest stable plugin release whose engine.termix allows this version.
+      - name: Pin bundled plugins
+        run: node scripts/pin-bundled-plugins.cjs --all --core-version "${{ needs.prep.outputs.version }}"
+
+      - name: Commit translations and plugin pins
+        id: commit
+        run: |
+          git add src/ui/locales docker/bundled-plugins.json
+          if git diff --cached --quiet; then
+            echo "No translation changes."
+          elif [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
+            echo "DRY RUN: would commit these translation and pin changes:"
+            git --no-pager diff --cached --stat
+          else
+            git config user.name "LukeGus"
+            git config user.email "bugattiguy527@gmail.com"
+            git commit -m "chore: update translations and plugin pins"
+            git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
+          fi
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  verify-beta:
+    needs: [prep, translate]
     if: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.skip != 'true' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout beta commit
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.prep.outputs.sha }}
+          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
           fetch-depth: 1
 
       - name: Setup Node.js
@@ -181,6 +236,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
       - name: Build plugin SDK
         run: npm run build:sdk
 
@@ -197,7 +261,7 @@ jobs:
         run: npm run test
 
   normalize:
-    needs: [prep]
+    needs: [prep, translate]
     if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
@@ -284,8 +348,8 @@ jobs:
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
   merge-to-main:
-    needs: [prep, normalize, sync-main]
-    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.sync-main.result == 'success' || needs.sync-main.result == 'skipped') }}
+    needs: [prep, translate, normalize, sync-main]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.translate.result == 'success' || needs.translate.result == 'skipped') && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.sync-main.result == 'success' || needs.sync-main.result == 'skipped') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       main_sha: ${{ steps.merge.outputs.main_sha }}
@@ -353,14 +417,14 @@ jobs:
           echo "build_ref=$MAIN_SHA" >> "$GITHUB_OUTPUT"
 
   docker:
-    needs: [prep, verify-beta, merge-to-main]
+    needs: [prep, translate, verify-beta, merge-to-main]
     if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.skip != 'true' && (needs.merge-to-main.result == 'success' || needs.verify-beta.result == 'success') }}
     uses: ./.github/workflows/docker.yml
     with:
       version: ${{ needs.prep.outputs.version }}
       build_type: ${{ needs.prep.outputs.channel == 'Beta' && 'Beta' || 'Production' }}
       dry_run: ${{ needs.prep.outputs.mode == 'Dry run' }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
   create-release:
@@ -418,7 +482,7 @@ jobs:
           fi
 
   create-beta-release:
-    needs: [prep, docker]
+    needs: [prep, translate, docker]
     if: ${{ always() && needs.prep.outputs.channel == 'Beta' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
@@ -427,7 +491,7 @@ jobs:
       - name: Checkout beta commit
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.prep.outputs.sha }}
+          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
           fetch-depth: 0
 
       - name: Setup Node.js
@@ -440,7 +504,7 @@ jobs:
           node scripts/generate-beta-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --branch "${{ needs.prep.outputs.dev_branch }}" \
-            --sha "${{ needs.prep.outputs.sha }}" \
+            --sha "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}" \
             --prev "${{ needs.prep.outputs.prev_ref }}" > BETA_BODY.md
 
       - name: Create beta release
@@ -456,11 +520,19 @@ jobs:
           else
             gh release create "$TAG" --repo ${{ github.repository }} \
               --title "$TITLE" --notes-file BETA_BODY.md \
-              --prerelease --target "${{ needs.prep.outputs.sha }}"
+              --prerelease --target "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}"
           fi
 
   electron-release:
-    needs: [prep, merge-to-main, docker, create-release, create-beta-release]
+    needs:
+      [
+        prep,
+        translate,
+        merge-to-main,
+        docker,
+        create-release,
+        create-beta-release,
+      ]
     if: ${{ always() && needs.prep.outputs.skip != 'true' && needs.docker.result == 'success' && needs.create-release.result != 'failure' && needs.create-beta-release.result != 'failure' }}
     uses: ./.github/workflows/electron.yml
     with:
@@ -468,7 +540,7 @@ jobs:
       artifact_destination: ${{ needs.prep.outputs.mode == 'Dry run' && 'file' || 'release' }}
       release_tag: ${{ needs.prep.outputs.release_tag }}
       version_override: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.version || '' }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
   electron-submit:
@@ -541,8 +613,48 @@ jobs:
 
   # The docs site reads the env catalog, API spec and download list from the
   # newest stable release.
-  docs-refresh:
+  # Docs written for this release live on dev-X.Y.Z in the Docs repo. Squash
+  # merge it into main once the release is out. No branch means nothing to do.
+  docs-merge:
     needs: [prep, electron-release]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Merge the docs dev branch into main
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+          REPO: Termix-SSH/Docs
+          VERSION: ${{ needs.prep.outputs.version }}
+        run: |
+          BRANCH="dev-$VERSION"
+          if ! gh api "repos/$REPO/branches/$BRANCH" > /dev/null 2>&1; then
+            echo "$REPO has no $BRANCH branch, nothing to merge."
+            exit 0
+          fi
+
+          AHEAD=$(gh api "repos/$REPO/compare/main...$BRANCH" -q .ahead_by)
+          if [ "$AHEAD" = "0" ]; then
+            echo "$BRANCH has nothing main doesn't, deleting it."
+            gh api -X DELETE "repos/$REPO/git/refs/heads/$BRANCH"
+            exit 0
+          fi
+
+          PR_NUMBER=$(gh pr list --repo "$REPO" --head "$BRANCH" --base main --state open --json number -q '.[0].number')
+          if [ -z "$PR_NUMBER" ]; then
+            PR_NUMBER=$(gh pr create --repo "$REPO" --base main --head "$BRANCH" \
+              --title "v$VERSION" --body "Docs for Termix v$VERSION." | grep -oE '[0-9]+$')
+          fi
+
+          gh pr merge "$PR_NUMBER" --repo "$REPO" --squash --admin --delete-branch
+
+          STATE=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json state -q .state)
+          if [ "$STATE" != "MERGED" ]; then
+            echo "Docs PR #$PR_NUMBER did not merge (state: $STATE)."
+            exit 1
+          fi
+
+  docs-refresh:
+    needs: [prep, electron-release, docs-merge]
     if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:

.github/workflows/translate.yml

@@ -0,0 +1,53 @@
+name: Translate
+
+on:
+  workflow_dispatch:
+    inputs:
+      retranslate:
+        description: "Translate every string again, not only new or changed ones"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+concurrency:
+  group: translate-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  translate:
+    if: ${{ startsWith(github.ref, 'refs/heads/dev-') }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          token: ${{ secrets.TERMIX_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Translate
+        uses: Termix-SSH/Termix-Registry/translate@main
+        with:
+          source: src/ui/locales/en.json
+          out: src/ui/locales/translated
+          languages: src/ui/locales/languages.json
+          retranslate: ${{ inputs.retranslate }}
+          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
+
+      - name: Commit translations
+        run: |
+          git add src/ui/locales
+          if git diff --cached --quiet; then
+            echo "No translation changes."
+            exit 0
+          fi
+          git config user.name "LukeGus"
+          git config user.email "bugattiguy527@gmail.com"
+          git commit -m "chore: update translations"
+          git push origin HEAD:"${GITHUB_REF_NAME}"

.prettierignore

@@ -11,4 +11,3 @@ db
 *.min.css
 openapi.json
 drizzle/
-src/ui/settings/settings-search-index.ts

CHANGELOG.md

@@ -1,5 +1,183 @@
 # Changelog
 
+## 26.10.6
+
+### Added
+
+- The mobile app can sign in through your browser with any login method, including passkeys and security keys
+- Plugins can say how they show in the mobile app
+- The plugin list tells the mobile app which plugin API each plugin needs, so the app can say when it or a plugin needs an update
+- Hosts can have a color and an icon, which sync to the desktop and mobile apps
+
+### Fixed
+
+- The log line for a rejected proxy login now shows the source address, so you can add it to TRUSTED_PROXY_AUTH_TRUSTED_PROXIES
+- Deleting your own account now removes all of its data, like an admin delete does, instead of leaving some behind
+
+## 26.10.5
+
+### Added
+
+- Safe mode: start the server with TERMIX_SAFE_MODE=1 to run only layout and theme plugins, so a broken plugin can be turned off
+- TERMIX_PLUGIN_REGISTRY_PRIVATE_HOSTS lets plugin registries live on a private address, like a registry in your LAN
+- Plugin registry browsing and downloads use HTTP_PROXY and HTTPS_PROXY when they are set
+- Docker image sizes: the default image now ships the most used plugins, the minimal tag ships only the look plugins and the full tag ships every official plugin
+- Plugins an older image shipped and you had on are downloaded from the registry on the first start of a smaller image, so nothing goes missing
+
+### Changed
+
+- Card grids in the Plugins tab and in plugins can show Auto (as many as fit) or a set number of cards per row
+
+### Fixed
+
+- The macOS app asks for Local Network access, so it can reach servers on your LAN
+- The desktop app can change the connection origin of a host shared with you, instead of failing to save
+
+## 26.10.4
+
+### Fixed
+
+- Pin classic layout plugin (fixes proxmox install)
+
+## 26.10.3
+
+### Added
+
+- Choose the layout of the whole app in Settings, Appearance. Admins can also set the default layout and theme for everyone
+- Plugins can add layouts and themes
+- A repair screen shows when the chosen layout cannot load, with ways to update, switch, reset or turn it off. Open it any time with ?safe-layout=1, or for everyone with TERMIX_SAFE_LAYOUT=1
+- Hovering a theme in Settings previews it
+- Restore the bundled copy of a plugin from the repair screen, which also pins the shipped version
+- Switching layouts closes the tabs only the old layout could show, like its Settings tab
+- A chosen layout whose plugin was uninstalled falls back to the default instead of the repair screen
+- Filter plugins by type, like layouts, themes or tabs, from a filter list beside the results
+- Browse shows plugins a page at a time
+- Plugins that need a newer Termix are hidden in Browse, with a toggle to show them
+- Hosts can be managed from a config file through a plugin. Managed hosts are read only for everyone, but pins and order still work
+- A plugin can block adding hosts by hand, so every host comes from one place
+- Plugins can set login rules: sign out after a time without activity, limit how long a session lasts, turn off remember me and require a second factor
+- A user who must have a second factor but has none can sign in only to set one up
+- Admins can redirect HTTP to HTTPS and send HSTS while HTTPS is on. Off by default so reverse proxies keep working
+- A plugin can answer all sync requests and use the replica store, change feed and linked server list, so sync no longer lives in the core app
+- The desktop app can hold several accounts, each with its own copy of a server's data. The app signs in as the active one and its auto session follows a switch
+- The linked server list holds one link per account, with room for more connection options per server
+- A plugin can carry SSH connections over its own stream, and core relays a host's connection over a socket for another Termix
+- Plugins can create a folder with a color and icon and remove it when it is empty
+- Another Termix server can manage this one with an API key, which can now ask for a one minute ticket to open plugin sockets as its user
+- FIDO2 security keys (ed25519-sk and ecdsa-sk) work through SSH Agent authentication when Termix runs in the desktop app. The key asks for a touch or PIN on your own machine
+- Pasting a security key file now explains how to use it instead of failing to decode it
+- Plugins can add a panel that sits beside a host tab, like a terminal. You can open, resize and move it
+- The desktop app can link to a server that requires a client certificate (mutual TLS). It uses a PFX or P12 file for sync and the certificate in your system store for the app window
+- Plugins can show a web page in a native view in the desktop app, for sites that do not load in an iframe
+- The desktop app draws its own title bar in the colors of your theme instead of the native white one
+
+### Changed
+
+- Server and desktop sync moved out of the core app into a plugin, including the Sync screen, the link wizard and the first run step. Existing links and offline copies keep working
+- The icon rail, sidebar, tab bar, dock, Dashboard, Manage, Settings and command palette now come from a bundled layout. It can be swapped for another layout but not removed, and a fix to it no longer needs a Termix release
+- Your theme is saved to your account so your other devices use it too, unless you keep settings on this device only
+- The themes besides light and dark now come from a bundled themes plugin. It can be swapped but not removed, and Termix keeps a basic light and dark theme of its own
+- A theme that no longer exists shows as System instead of an unstyled page
+- Installs and updates from a registry check the Termix version a plugin needs, not only its plugin API
+- Host online and offline dots now come from the Host Status plugin. The check interval setting moved to its settings and keeps its value. Without the plugin hosts show no dot
+- Audit log forwarding and the CSV and NDJSON export now come from the Audit Tools plugin. The collector URL and token move to its settings on upgrade. The audit log viewer, retention and the audit log itself stay in Termix
+- Client tunnels on your own computer and opening a host in Windows Remote Desktop moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The local terminal, the local side of the file manager with its transfers, and opening a file in an external editor moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The recent activity list and the first run steps for the preset and for theme, accent, font and language now come from bundled plugins. Existing entries and choices are kept, and people who went through those steps are not asked again
+- Branding (app name, tagline and logo) is now saved by the bundled layout plugin. An existing setup keeps its branding, and the sign in screen still reads it from Termix
+- Without the plugin that stores recent activity, the list stays empty and nothing is recorded
+- Importing hosts from a JSON or SSH config file and exporting hosts now come from the Import and Export plugin. Exports are now written to the audit log. Without the plugin there is no import or export
+- Generating and checking SSH keys in the credential editor and deploying a key to a host now come from the Credential Tools plugin. Deploys are now written to the audit log. Without the plugin those buttons are hidden
+
+### Fixed
+
+- Linking the desktop app to a server no longer stalls on the server dashboard after sign in
+- Exporting your data no longer fails when a plugin table has a text key, like saved passkeys
+- The Windows on ARM desktop app starts again instead of failing with a local server error
+
+### Removed
+
+- The desktop app no longer has its own client tunnel and native Remote Desktop code
+
+## 26.10.2
+
+### Added
+
+- Hide sidebar after opening, in Customize Sidebar, closes the host list once you open a host
+- Sort the dashboard's Host Status card by name, IP address or status
+- Windows on ARM builds of the desktop app (installer, MSI and portable)
+- Plugins get an event when a host is added
+- Plugins can start a short-lived session as a user and read the user's language, for tasks that run without a browser
+- Plugins can pin a panel to the right edge of the window that pushes the page over
+
+### Changed
+
+- The Docker Compose files no longer start a guacd container. npm run dev -- --guacd also points remote desktop at the guacd it starts
+- The side menu now opens over the page when it expands on hover, so open sessions like remote desktop are not resized each time. Turn on Push content when it expands in Settings to get the old behavior back
+- On macOS, moving between split panes is now Cmd+Option+Arrow, so Option+Arrow can move the cursor by word in a terminal
+
+### Fixed
+
+- Picking a section lower down in the host editor, like Warpgate, stuttered on the way and sometimes stopped before it got there
+- Sorting hosts by IP address put 10.0.0.210 before 10.0.0.3
+- The local terminal failed to start in the universal macOS build
+- Hosts shared with you never showed up on a linked desktop
+- A linked desktop could never turn on an unsigned plugin the server had enabled
+- Creating, cloning or deleting hosts failed with "no such table: main.p_vault_profiles" after the Vault plugin was removed
+- Opening a user in Settings, Users blocked the other admin sections until you went back to the user list
+- A linked desktop could keep showing the same sync conflicts, or delete a local host, when the server could not send its copy
+- Usernames are now unique
+- Importing user data keeps foreign keys on
+- Trusted proxy login checks the address nginx saw, not nginx itself
+- The desktop login frame only trusts the server's own origin
+- External login URLs and callback ports are checked on the desktop app
+- A changed jump host key is no longer accepted without asking
+- Synced plugins signed only by a key the server sent are no longer turned on by themselves
+- Two connects to the same host at once could overwrite each other's connection
+- Indonesian uses the same technical terms everywhere
+- When the server was down or still starting, the login page said it could not connect to the database and stopped trying. It now says the server is not responding and continues on its own once the server is back
+- nginx answered 404 instead of 502 while the backend was down
+- A client tunnel that could not start always said "Endpoint SSH connection closed" on the desktop app instead of the real reason, like the target refusing the connection
+- The Docker server crashed and restarted every few hours in ssh2's native crypto on Node 24
+- Plugin names and descriptions showed in English in the plugin manager, setup picker and host editor no matter the UI language
+- Creating a host through the API without an auth type failed with a server error. It now picks the type from the credential, key or password, or says auth type is required
+- The desktop app would not start its local server when another program used port 30001. It now picks a free port on its own
+- A linked desktop could never finish syncing with a server on Postgres
+- Routine plugin activity filled the audit log and pushed out real security entries
+- Opening a full-screen view link while signed out showed a spinner forever. It now shows the login and opens the link after
+- A linked desktop behind a proxy that needs extra headers, or with an allowed self-signed certificate, could not open remote terminals or tunnels
+
+## 26.10.1
+
+### Added
+
+- Slovak, Croatian, Slovenian, Lithuanian, Latvian, Estonian and Malay
+- The desktop app can update itself. Pick Automatic, Ask first or Never in Settings, Updates. Store and package manager installs keep updating the way they do now
+- Community plugins. Turn on the community registry in Plugins, Registries to browse and install plugins made by other people, each version reviewed before it is listed
+- Custom plugin registries. Add your own registry by its index URL; its signing key is pinned when you add it
+
+### Changed
+
+- Every language is now fully translated, in Termix and in every plugin, and stays up to date with each release
+- Languages with more than two plural forms, like Russian, Polish and Arabic, now use the right one
+- The Plugins tab shows how many times each plugin was downloaded, in a Downloads column
+- Plugins, Browse hides plugins you already have. Turn on Show installed to see them
+
+### Fixed
+
+- Regional browser languages like `es-MX`, `pt` or `zh-HK` showed English instead of the closest translation
+- Counts like "1 keys" or "Moved 1 host(s)" now use the singular
+- Plugin updates on the desktop app, synced or installed from the Plugins tab, failed to start with "Cannot find package"
+- The desktop app showed plugins that only run on the server as not running and out of date
+- Keep the terminal WebSocket open past nginx's 60s default
+- Plugin download counts now show in the Plugins tab without waiting for the background check
+- Clicking into a saved password, key passphrase or sudo password field and saving without typing erased it, which stopped sudo autofill
+- The desktop app now says when its data is from 2.8 or older and needs 2.9 first, instead of only saying the local server could not start
+- Client tunnels on the desktop app stopped with "Endpoint SSH connection closed" when a reverse proxy dropped their idle connection
+- Typing right after opening a host from the sidebar went to the host search instead of the new session
+- SSH config import failed on files that put a tab or `=` between a keyword and its value
+- App icons and the favicon have rounded corners again
+
 ## 26.10.0
 
 ### Added

CONTRIBUTING.md

@@ -25,7 +25,7 @@ Termix is a small core plus plugins. This repo is the core: hosts, credentials,
 npm run dev
 ```
 
-This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Termix-Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
+This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
 
 ## Useful commands
 
@@ -38,21 +38,21 @@ npm run format       # format the code with Prettier
 
 ## Making a change
 
-1. **Fork the repository**: Click "Fork" at the top right of the [repository page](https://github.com/Termix-SSH/Termix).
-2. **Create a branch**:
+1. Fork the [repo](https://github.com/Termix-SSH/Termix).
+2. Create a branch:
    ```sh
    git checkout -b feature/my-new-feature
    ```
-3. **Make your changes** and add or update tests for them.
-4. **Commit your changes**:
+3. Make your changes and add or update tests for them.
+4. Commit your changes:
    ```sh
    git commit -m "feat: add my new feature"
    ```
-5. **Push to your fork**:
+5. Push to your fork:
    ```sh
    git push origin feature/my-new-feature
    ```
-6. **Open a pull request** against the current `dev-*` branch with a clear description.
+6. Open a pull request against the current `dev-*` branch with a clear description.
 
 ## Guidelines
 
@@ -72,4 +72,4 @@ Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Tem
 
 ## Support
 
-Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Please be as detailed as possible, preferably in English. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.
+Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Add as much detail as you can, in English if possible. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.

Casks/termix.rb

@@ -1,6 +1,6 @@
 cask "termix" do
-  version "26.10.0"
-  sha256 "66a76a62fbea3306bdf35b0951e9b1200fd1a084a95b4fee9d40edd6e326e11a"
+  version "26.10.5"
+  sha256 "808c467c5c34402193c7950ce61df0fa0445782f276348cf31ef235a6427d21c"
 
   url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
   name "Termix"
@@ -12,6 +12,8 @@ cask "termix" do
     strategy :github_latest
   end
 
+  auto_updates true
+
   app "Termix.app"
 
   zap trash: [

README.md

@@ -18,36 +18,38 @@
   <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
 </p>
 
+<a href="https://www.youtube.com/watch?v=vhtkP-UqV5U"><img src="./.github/readme/overview.jpg" width="720" alt="Watch the Termix overview on YouTube" /></a>
+
 </div>
 
 <br />
 
 ## Overview
 
-Termix is a free, open source, self-hosted platform for managing your servers, built on plugins. The core is small. It keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, turn off or remove.
+Termix is a free, open source, self-hosted server management platform built on plugins. The core keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, off or remove.
 
-It runs on web, desktop and mobile, and it is a self-hosted alternative to Termius that stays free forever.
+It runs on web, desktop and mobile. Think of it as a free, self-hosted Termius.
 
 <br />
 
 ## Try the Demo
 
-Want to see it before you install it? Try the demo at [demo.termix.site](https://demo.termix.site/). Any username and password works.
+Try it at [demo.termix.site](https://demo.termix.site/). Any username and password works.
 
 <br />
 
 ## Core
 
-What every Termix install has, with or without plugins:
+What every install has, with or without plugins:
 
-- **Hosts:** Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
-- **Credentials:** Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
-- **Sharing and Roles:** Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
-- **Accounts:** Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
-- **Security:** Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
-- **Desktop Sync:** The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
-- **Interface:** Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
-- **Databases:** SQLite by default, with PostgreSQL and MySQL supported too
+- Hosts: Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
+- Credentials: Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
+- Sharing and Roles: Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
+- Accounts: Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
+- Security: Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
+- Desktop Sync: The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
+- Interface: Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
+- Databases: SQLite by default, with PostgreSQL and MySQL supported too
 
 <br />
 
@@ -55,44 +57,60 @@ What every Termix install has, with or without plugins:
 
 Plugins add everything else. The official ones ship with Termix, and admins can install, update or remove plugins from the Plugins tab. Each plugin has its own repo.
 
-| Plugin                                                                      | What it does                                                                                                |
-| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.            |
-| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                              |
-| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                    |
-| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                            |
-| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                 |
-| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                       |
-| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.        |
-| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                               |
-| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.            |
-| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                             |
-| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                           |
-| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                   |
-| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider. |
-| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                               |
-| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                  |
-| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.         |
-| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.             |
-| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                       |
-| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                      |
-| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.         |
-| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                 |
-| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                   |
-| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.     |
-| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                         |
-| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                |
-| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.              |
-| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                      |
-| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                |
-| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                   |
-| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                      |
-| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                |
-| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                            |
-| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                         |
-| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                         |
+| Plugin                                                                      | What it does                                                                                                                    |
+| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.                                |
+| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                                                  |
+| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                                        |
+| [Audit Tools](https://github.com/Termix-SSH/Plugin-Audit-Tools)             | Send the audit log to your SIEM and export it as CSV or NDJSON.                                                                 |
+| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                                                |
+| [Classic Layout](https://github.com/Termix-SSH/Plugin-Classic-Layout)       | The classic Termix layout with an icon rail, sidebar, tab bar and dock.                                                         |
+| [Classic Themes](https://github.com/Termix-SSH/Plugin-Classic-Themes)       | Light, dark and seven more color themes for Termix.                                                                             |
+| [Cloud Providers](https://github.com/Termix-SSH/Plugin-Cloud-Providers)     | Add hosts from AWS, Azure, Google Cloud, DigitalOcean, Hetzner and other clouds, and keep them in sync.                         |
+| [Credential Tools](https://github.com/Termix-SSH/Plugin-Credential-Tools)   | Generate SSH keys, check them and copy a public key to a host.                                                                  |
+| [Databases](https://github.com/Termix-SSH/Plugin-Databases)                 | Browse and edit MySQL, MariaDB, PostgreSQL and SQLite databases on your hosts from one tab.                                     |
+| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                                     |
+| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                                           |
+| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.                            |
+| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                                                   |
+| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.                                |
+| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                                                 |
+| [Host Status](https://github.com/Termix-SSH/Plugin-Host-Status)             | Shows if each host is online with a dot in the host list, checked by connecting to its port.                                    |
+| [Hosts Config](https://github.com/Termix-SSH/Plugin-Hosts-Config)           | Keep hosts, folders and sharing in a YAML or JSON file. Termix loads them as read only hosts and reloads when the file changes. |
+| [Import and Export](https://github.com/Termix-SSH/Plugin-Import-Export)     | Import hosts from a JSON file or an SSH config file and export them to share or back up.                                        |
+| [Kubernetes](https://github.com/Termix-SSH/Plugin-Kubernetes)               | Manage Kubernetes clusters from your hosts over SSH, with logs, metrics, YAML and a shell.                                      |
+| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                                               |
+| [Login Security](https://github.com/Termix-SSH/Plugin-Login-Security)       | Sign people out when idle, limit session length, turn off remember me and require a second factor at login.                     |
+| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                                       |
+| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider.                     |
+| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                                                   |
+| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                                      |
+| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.                             |
+| [Reverse Proxy](https://github.com/Termix-SSH/Plugin-Reverse-Proxy)         | Reverse proxy for TCP, UDP, HTTP and HTTPS with free certificates and Termix login, managed per host.                           |
+| [Samba Shares](https://github.com/Termix-SSH/Plugin-Samba)                  | Create and manage Samba (SMB) file shares, users and permissions on your hosts from one tab.                                    |
+| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.                                 |
+| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                                           |
+| [Services](https://github.com/Termix-SSH/Plugin-Service-Manager)            | Manage services, timers and logs on your hosts over SSH.                                                                        |
+| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                                          |
+| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.                             |
+| [Simple Layout](https://github.com/Termix-SSH/Plugin-Simple-Layout)         | A simple Termix layout for small setups with a top bar, a Home screen and only the basics.                                      |
+| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                                     |
+| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                                       |
+| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.                         |
+| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                                             |
+| [Sync](https://github.com/Termix-SSH/Plugin-Sync)                           | Sync the desktop app with one or more servers, and manage other Termix servers as remote sites from a master.                   |
+| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                                    |
+| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.                                  |
+| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                                          |
+| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                                    |
+| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                                       |
+| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                                          |
+| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                                    |
+| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                                                |
+| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                                             |
+| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                                             |
 
-Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Its community registry is open for submissions now, and Termix will be able to install community plugins in a later update. See [submitting a plugin](https://docs.termix.site/develop/community-registry).
+Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Turn on the community registry in Plugins, Registries to install plugins made by other people, or add your own registry. See [submitting a plugin](https://docs.termix.site/develop/community-registry) and [hosting your own registry](https://docs.termix.site/develop/registries#host-your-own-registry).
 
 <br />
 
@@ -133,9 +151,9 @@ Want to build your own? Start from the [plugin template](https://github.com/Term
 
 ## Installation
 
-Visit the [Termix Docs](https://docs.termix.site/install) for full install steps on every platform.
+See the [docs](https://docs.termix.site/install) for install steps on every platform.
 
-Sample Docker Compose file (you can leave out `guacd` and the network if you don't plan to use the Remote Desktop plugin):
+Sample Docker Compose file. Remote desktop (RDP, VNC and Telnet) is built in, so nothing else needs to run next to it:
 
 ```yaml
 services:
@@ -149,44 +167,23 @@ services:
       - termix-data:/app/data
     environment:
       PORT: "8080"
-      GUACD_HOST: "guacd"
-      GUACD_TUNNEL_HOST: "termix"
-      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
-      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    volumes:
-      - termix-data:/termix-data
-    networks:
-      - termix-net
 
 volumes:
   termix-data:
     driver: local
-
-networks:
-  termix-net:
-    driver: bridge
 ```
 
 ### Cloud Hosting
 
-You can run Termix on a VPS instead of inside your own network. If Termix runs on the network it manages, an outage takes Termix down with it, right when you need it to fix things. Running it somewhere else keeps it reachable, gives you a static IP and lets you get in from anywhere without a VPN or port forward.
+If Termix runs on the network it manages, an outage takes it down right when you need it. A VPS keeps it reachable, gives you a static IP and works from anywhere without a VPN or port forward.
 
-[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix, and the docs have a step by step guide for their VPS platform.
+[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix and the docs have a setup guide for their VPS.
 
 <br />
 
 ## Donate
 
-Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains and development time.
+Termix has no paid plans. Donations cover servers, domains and development time.
 
 [Donate](https://donate.termix.site/)
 
@@ -194,7 +191,7 @@ Termix is free and open source with no subscriptions or paid plans. If you find
 
 ## Sponsors
 
-Interested in a paid placement to support development? Email [mail@termix.site](mailto:mail@termix.site).
+For a paid sponsor spot, email [mail@termix.site](mailto:mail@termix.site).
 
 <!-- SPONSORS:START -->
 
@@ -242,7 +239,7 @@ Bugs and ideas for Termix itself (login, hosts, credentials, sharing, sync, the
 
 Every plugin has its own repo, so a problem with the terminal, file manager, Docker, remote desktop or any other plugin goes in that plugin's repo (see the table above, or use Report an issue on the plugin's page in the app, which fills in your versions for you). Not sure where it goes? Open it here and it will be moved.
 
-You need to be logged in to GitHub. Please be as detailed as possible, preferably in English.
+You need a GitHub account. Add as much detail as you can, in English if possible.
 
 For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server. Update videos are on [YouTube](https://www.youtube.com/@TermixSSH/videos).
 
@@ -250,4 +247,4 @@ For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf)
 
 ## License
 
-Distributed under the Apache License Version 2.0. See [LICENSE](LICENSE) for more information.
+Apache License 2.0. See [LICENSE](LICENSE).

docker/Dockerfile

@@ -26,7 +26,7 @@ COPY . .
 RUN find public/fonts -name "*.ttf" ! -name "*Regular.ttf" ! -name "*Bold.ttf" ! -name "*Italic.ttf" -delete
 
 RUN npm cache clean --force && \
-    NODE_OPTIONS="--max-old-space-size=3072" npm run build
+    TERMIX_RUNTIME_BASE_PATH=true NODE_OPTIONS="--max-old-space-size=3072" npm run build
 
 # Stage 3: Build backend
 FROM deps AS backend-builder
@@ -34,7 +34,20 @@ WORKDIR /app
 
 COPY . .
 
-RUN npm run build:backend
+RUN npm run build:backend:core
+
+# Stage 3b: Stage the bundled plugins for one profile (minimal, standard or
+# full, see docker/bundled-plugins.json). Only this stage and the final one
+# differ between profiles, so the other stages are built once.
+FROM deps AS plugins
+WORKDIR /app
+ARG PLUGIN_PROFILE=standard
+COPY scripts/build-plugins.cjs ./scripts/build-plugins.cjs
+COPY scripts/lib/bundled-plugins.cjs ./scripts/lib/bundled-plugins.cjs
+COPY docker/bundled-plugins.json ./docker/bundled-plugins.json
+# Bundled plugin downloads show in the plugin store, so keep them between builds.
+RUN --mount=type=cache,target=/app/node_modules/.cache/termix-bundled-plugins \
+    node scripts/build-plugins.cjs --profile "$PLUGIN_PROFILE"
 
 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
 FROM node:24-slim AS opkssh-downloader
@@ -72,12 +85,15 @@ COPY vendor ./vendor
 
 COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
+# ssh2's native crypto crashes Node 24 when a cipher is freed, so ssh2 uses
+# OpenSSL instead (chacha20-poly1305 is then left out).
 RUN npm ci --omit=dev --ignore-scripts && \
     node scripts/patch-ssh2-agent.cjs && \
     rm -rf node_modules/better-sqlite3/prebuilds && \
     npm run build-release --prefix node_modules/better-sqlite3 && \
     test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
-    npm rebuild bcryptjs ssh2 && \
+    npm rebuild bcryptjs && \
+    rm -rf node_modules/ssh2/lib/protocol/crypto/build && \
     npm cache clean --force
 
 # Stage 6: Final optimized image
@@ -112,9 +128,9 @@ COPY --chown=node:node --from=frontend-builder /app/dist /app/html
 
 COPY --chown=node:node --from=production-deps /app/node_modules /app/node_modules
 COPY --chown=node:node --from=backend-builder /app/dist/backend ./dist/backend
-# Plugins pinned in docker/bundled-plugins.json, resolved as dist/plugins by
-# getBundledPluginsDir().
-COPY --chown=node:node --from=backend-builder /app/dist/plugins ./dist/plugins
+# Plugins of the chosen profile pinned in docker/bundled-plugins.json, resolved
+# as dist/plugins by getBundledPluginsDir().
+COPY --chown=node:node --from=plugins /app/dist/plugins ./dist/plugins
 # Target of node_modules/@termix-ssh/plugin-sdk, which core and the plugins import.
 COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/dist ./packages/plugin-sdk/dist

docker/bundled-plugins.json

@@ -3,36 +3,85 @@
     {
       "id": "acme-ssl",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.0/acme-ssl-1.0.0.tmxplug",
-      "sha256": "34aa172b2f6bc6a773ebdff2ec0f590d411ce258fd43176bdddb4c30d1fe30da"
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.1.0/acme-ssl-1.1.0.tmxplug",
+      "sha256": "fb75541fae110007b45ed69d58aa4b9b6f6a79b6b1b762c6e54b635aa7cb6e4a",
+      "tier": "full"
     },
     {
       "id": "ai",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.0/ai-1.0.0.tmxplug",
-      "sha256": "ad291a2c6f6f01b72ebd275e8d202b78f55bc13a1e1a40f419d04e71b2fbd06b"
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.3.0/ai-1.3.0.tmxplug",
+      "sha256": "87ad17324cec6036dc224135fee342250c37413dccb2963f5f6b554d4ab8f5a6",
+      "tier": "full"
     },
     {
       "id": "alerts",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.0/alerts-1.0.0.tmxplug",
-      "sha256": "3fe008f9d2a32e2b7111399054a2264ea5cf5d71264cc31e85cdab3e909cc62f",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.1.0/alerts-1.1.0.tmxplug",
+      "sha256": "a7ce9e20ce3c15f77c15479b4901563adf3c793e24a3aacd7226950491f0434c",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
       }
     },
+    {
+      "id": "audit-tools",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Audit-Tools/releases/download/v1.0.0/audit-tools-1.0.0.tmxplug",
+      "sha256": "131479c294d692b1c0ed4d6cec273730a3a67a28ecd44825ffd36bade9aa863b",
+      "tier": "full"
+    },
     {
       "id": "automations",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.0/automations-1.0.0.tmxplug",
-      "sha256": "76d4cff6e78d40ec67e899f0c7b2aca43d35a47b9a15071d0a8f5a8d939af9a9"
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.2.0/automations-1.2.0.tmxplug",
+      "sha256": "2ec9c718d73a094be3b59121aea049f0237e5783f53d193c4ea24a524584aeea",
+      "tier": "full"
+    },
+    {
+      "id": "classic-layout",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Classic-Layout/releases/download/v1.0.2/classic-layout-1.0.2.tmxplug",
+      "sha256": "cf54f9b2e81c33b7e58cd3a21e203805f08ba37b3bc78412a08eb21b9fef8f14",
+      "tier": "minimal",
+      "defaultLook": true
+    },
+    {
+      "id": "classic-themes",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Classic-Themes/releases/download/v1.0.0/classic-themes-1.0.0.tmxplug",
+      "sha256": "919283f95701d41727c826637a7d349bd6a646abd61f9ac9017149bd0bee782c",
+      "tier": "minimal",
+      "defaultLook": true
+    },
+    {
+      "id": "cloud-providers",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Cloud-Providers/releases/download/v1.1.0/cloud-providers-1.1.0.tmxplug",
+      "sha256": "7f61eafc3b99bdf1328fffa95791db1d27f8e1b683e5a5925603b5840057a9c7",
+      "tier": "full"
+    },
+    {
+      "id": "credential-tools",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Credential-Tools/releases/download/v1.0.0/credential-tools-1.0.0.tmxplug",
+      "sha256": "413eff710b5c832a2575a890bbab1c90d28ea55f10cd7a7b94b851d51dd77dce",
+      "tier": "standard"
+    },
+    {
+      "id": "databases",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Databases/releases/download/v1.1.0/databases-1.1.0.tmxplug",
+      "sha256": "4d9504cde705688a6f1f7706139d4e4c49b2276eccc67538fdee8251f29920b8",
+      "tier": "full"
     },
     {
       "id": "docker",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.0/docker-1.0.0.tmxplug",
-      "sha256": "641e564ba915a72efed4236272d63f6fff43904309833870f3554d3e9bd28dfa",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.2.1/docker-1.2.1.tmxplug",
+      "sha256": "b2ca797465d88cfb549a04c3f0161708669def22a5ca73cb107879847c2db8ff",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -41,8 +90,9 @@
     {
       "id": "file-manager",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.0/file-manager-1.0.0.tmxplug",
-      "sha256": "1cafccfe86a29e2f318026ca7bc20629df94331c81209607976dafd7feac0ca4",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.1.1/file-manager-1.1.1.tmxplug",
+      "sha256": "ebba0b7d14facb3354f22a00e059e9f5a69e233458cb24985bf4ed5e5f8d2abd",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -51,92 +101,168 @@
     {
       "id": "fleets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.0/fleets-1.0.0.tmxplug",
-      "sha256": "1ebeccd6b2a8e9510ab56658374d0b87f652149101d14956752a696ca920f611"
+      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.2/fleets-1.0.2.tmxplug",
+      "sha256": "50dab38e1c6c95fdb4d0544ce50cdf84dae84789e64aa34ea9d04fdac3a38c59",
+      "tier": "full"
     },
     {
       "id": "homepage",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.0/homepage-1.0.0.tmxplug",
-      "sha256": "65cd21802f6a71f3b3c582bc0007bfc91160abc161b2390bce715fd2ed987f99"
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.1.0/homepage-1.1.0.tmxplug",
+      "sha256": "5a9d5d2cc337fcee5590ea957e35ddeea5a71596aeb59410bf1420065b9b5b00",
+      "tier": "full"
     },
     {
       "id": "host-metrics",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.0/host-metrics-1.0.0.tmxplug",
-      "sha256": "1afce5489038e5e30b55210e8e43ba93e0446fe087e2952af75a402dbf809ea9",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.2.0/host-metrics-1.2.0.tmxplug",
+      "sha256": "8522cd23b558c3209821cee6d177daeb80f439b8ff652c577c5e4955315cc7a3",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
       }
     },
+    {
+      "id": "host-status",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Status/releases/download/v1.0.0/host-status-1.0.0.tmxplug",
+      "sha256": "1ba62577dc7373a2a2787bab7efdb89b544a30a8003b1de91ce51f372fc4f170",
+      "tier": "standard"
+    },
+    {
+      "id": "hosts-config",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Hosts-Config/releases/download/v1.0.0/hosts-config-1.0.0.tmxplug",
+      "sha256": "60a2b2a6d9ba13bad12a511c93af70a30a10fbc560066b6419acf533d806a3ad",
+      "tier": "full"
+    },
+    {
+      "id": "import-export",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Import-Export/releases/download/v1.0.0/import-export-1.0.0.tmxplug",
+      "sha256": "6670b6c147e81eed0ddfd249f9a7c9564f1ab50e45f2771161d2e30c47f6fd58",
+      "tier": "standard"
+    },
+    {
+      "id": "kubernetes",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Kubernetes/releases/download/v1.0.1/kubernetes-1.0.1.tmxplug",
+      "sha256": "31d6b200579d326d07244712713ae291ff473270d44b478a884d07c863a394f0",
+      "tier": "full"
+    },
     {
       "id": "ldap",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.0/ldap-1.0.0.tmxplug",
-      "sha256": "1df08a931457043ba500689a73b4b5ab2bfb43630f377557e0fb13280b996334"
+      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.2/ldap-1.0.2.tmxplug",
+      "sha256": "9ef269ad281f1c68cea53e0d43ccb7a5d4f949f11b30b22eac3d01047b20eb03",
+      "tier": "full"
+    },
+    {
+      "id": "login-security",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Login-Security/releases/download/v1.0.0/login-security-1.0.0.tmxplug",
+      "sha256": "b21dff5722e72a02022d563ef27130e8b56a53e273f1668fade4ec7d030374aa",
+      "tier": "full"
     },
     {
       "id": "network-topology",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.0/network-topology-1.0.0.tmxplug",
-      "sha256": "dc3ad943c1753b352b4d80c09836a293a8767293061ddf2e641575bae97124e9"
+      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.2/network-topology-1.0.2.tmxplug",
+      "sha256": "8d32340a0d0f9674b872da5d3d53e90f529b80dfe0d73ab294eed00e565fbb56",
+      "tier": "full"
     },
     {
       "id": "opkssh",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.0/opkssh-1.0.0.tmxplug",
-      "sha256": "91cc1575aa1ff84632e0b6a4da68df3a7df4b8e18431b9c0378d314b886ed55d"
+      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.2/opkssh-1.0.2.tmxplug",
+      "sha256": "4bb8f1ac5d39bd18ac3d0fe82ddbf2f26ab4c01bd75e6f7a073d65c2e9aef219",
+      "tier": "full"
     },
     {
       "id": "proxmox",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.0/proxmox-1.0.0.tmxplug",
-      "sha256": "09891a3ab67a5b6589d8ab9e0fc88d8c63ff9d4e52ed8e7cbd0801a5e64e593f"
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.1.0/proxmox-1.1.0.tmxplug",
+      "sha256": "8937d239ad40033d69fba59085fe8896ee25c61951c21f66ff98531fd4c63cbf",
+      "tier": "full"
     },
     {
       "id": "remote-desktop",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.0/remote-desktop-1.0.0.tmxplug",
-      "sha256": "7b24691953550458ee1609372443eeb5580d20091b02c95011c0427268350efc",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.2.1/remote-desktop-1.2.1.tmxplug",
+      "sha256": "ad244f31016f0ea5df5c303bf6f48af35c6c8e52b12098d381c8296626b73de7",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
       }
     },
+    {
+      "id": "reverse-proxy",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Reverse-Proxy/releases/download/v1.1.0/reverse-proxy-1.1.0.tmxplug",
+      "sha256": "c8a9851da7ca6291c1f47cf6ab235da5057455a86b4ed0dc1c1a3026afb30aa7",
+      "tier": "full"
+    },
+    {
+      "id": "samba",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Samba/releases/download/v1.0.0/samba-1.0.0.tmxplug",
+      "sha256": "6e131ccdca998a9d0802becdd439a88305b64fcd7f07335bec9c7ed6791c0f53",
+      "tier": "full"
+    },
     {
       "id": "secret-sources",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.0/secret-sources-1.0.0.tmxplug",
-      "sha256": "04e9cfca70ffafc41546ddf0f1f6411743a2e0e9835b26ad5c0b91ac11028485"
+      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.2/secret-sources-1.0.2.tmxplug",
+      "sha256": "82e2b1e95b0837dd3e5fee277be4eea2d1ce68567b0e204941c48150f415d134",
+      "tier": "full"
     },
     {
       "id": "serial",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.0/serial-1.0.0.tmxplug",
-      "sha256": "2470acbd6c4c343c3d89dada972051f1ee7aace88af1e6719b92f19a4a6e46ea",
+      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.2/serial-1.0.2.tmxplug",
+      "sha256": "6ede7e8726a7312429473f34a46f93ba6657c5b7ebc12bed18f80ec62c211715",
+      "tier": "standard",
       "onboarding": {
         "recommended": "desktop",
         "consent": false
       }
     },
+    {
+      "id": "service-manager",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Service-Manager/releases/download/v1.1.0/service-manager-1.1.0.tmxplug",
+      "sha256": "82b1c70abd97ed535f217535c667fe6c48e5e01e2bf8037a89b58b80d35206bf",
+      "tier": "full"
+    },
     {
       "id": "session-recording",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.0/session-recording-1.0.0.tmxplug",
-      "sha256": "6b630ca0e08d79be7cb49366c898586ee3416a518f8e200157a6191c2c7c9ab7"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.1.0/session-recording-1.1.0.tmxplug",
+      "sha256": "31cd78d67e061242f8776849a2fae5f84ab48c7c765d487b32c5e1693c54b46a",
+      "tier": "full"
     },
     {
       "id": "session-sharing",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.0/session-sharing-1.0.0.tmxplug",
-      "sha256": "0c0d3f2d63184d4a4b2a90b11a1ee247ddc937abba76af74eb39e27048b412f9"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.1.0/session-sharing-1.1.0.tmxplug",
+      "sha256": "2988b39221d93b3dbc5e2a81e104e5dc01ce264afb1e66df3407492658ab9fdc",
+      "tier": "full"
+    },
+    {
+      "id": "simple-layout",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Simple-Layout/releases/download/v1.0.1/simple-layout-1.0.1.tmxplug",
+      "sha256": "838f08050335b44b62295b87006b50d1db1029699bfe6a35fa75808d4aea2cde",
+      "tier": "full"
     },
     {
       "id": "snippets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.0/snippets-1.0.0.tmxplug",
-      "sha256": "47872d08cdf4a15b50c8f90ca125276a92579147a27cb6b5639a84a01160abe5",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.1.0/snippets-1.1.0.tmxplug",
+      "sha256": "e2d7d1ebe5bdf2986ffb4961ac6f6d32b392b02c30a64a333a7eeb2ce6a46bb3",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -145,8 +271,9 @@
     {
       "id": "ssh-terminal",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.0/ssh-terminal-1.0.0.tmxplug",
-      "sha256": "5b5a357bbf9a503c6b68725245712a99fa8ea0eec0baff64319be28950acac79",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.1.1/ssh-terminal-1.1.1.tmxplug",
+      "sha256": "5cfb381a2de10b7a6fab108d79645bb1e6e7316fb5e4150c4529a3e76a2193d8",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -155,31 +282,44 @@
     {
       "id": "sso",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.1/sso-1.0.1.tmxplug",
-      "sha256": "ba7485ba058c784975609f6960bbaf7ec2018bcdce40b47308efc92ca96fdab5",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.4/sso-1.0.4.tmxplug",
+      "sha256": "2aad33177085fbc92fe06cd007facffbfc8f42f9c9fa688ad5f37d68f62093d9",
+      "tier": "standard",
       "onboarding": {
         "recommended": false,
         "consent": false,
-        "enabledByEnv": ["OIDC_CLIENT_ID"]
+        "enabledByEnv": [
+          "OIDC_CLIENT_ID"
+        ]
       }
     },
     {
       "id": "step-ca",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.0/step-ca-1.0.0.tmxplug",
-      "sha256": "05209afbaeb104ff77fecb5cf26a7823b9ed66031eac7557d3216fc3b861f7a6"
+      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.2/step-ca-1.0.2.tmxplug",
+      "sha256": "685b644fe44c2d3fa007baee16e8ea8a7d5204f039ebc8aa65e8093ad93adf8a",
+      "tier": "full"
+    },
+    {
+      "id": "sync",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Sync/releases/download/v1.0.1/sync-1.0.1.tmxplug",
+      "sha256": "66a301fd04fb8d2a3ece18dfb230069cf78e1138ee78941dc511dfbd8ee4f91e",
+      "tier": "standard"
     },
     {
       "id": "tailscale",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.0/tailscale-1.0.0.tmxplug",
-      "sha256": "e9840bddef696b24354b9f04f2c97e164c3879f3fd1b337347de728db522874e"
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.1.0/tailscale-1.1.0.tmxplug",
+      "sha256": "8784a77a1fc1b0011d8243d9520574300df31bc40c31f86339868f4c9b76d1bf",
+      "tier": "full"
     },
     {
       "id": "telemetry",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.0/telemetry-1.0.0.tmxplug",
-      "sha256": "b41210d638b93470891ab238e3d1180a0e0d0f0c697b1c2079156416dec05966",
+      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.2/telemetry-1.0.2.tmxplug",
+      "sha256": "5ffdc58b05cd8b37fd0a207f99d2d3a256164130c950032501c499f869edb9ec",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": true
@@ -188,20 +328,23 @@
     {
       "id": "termix-identity",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.0/termix-identity-1.0.0.tmxplug",
-      "sha256": "facd9f1c6036202e7c6b1020408ce49c7ba4bc687a8f8b93ccf60e97f473f897"
+      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.2/termix-identity-1.0.2.tmxplug",
+      "sha256": "ac6c90a48b4f1e9cff6773a5fd267b2bf7319d2fc7e2aa2cd4004cec82f0f927",
+      "tier": "full"
     },
     {
       "id": "tmux-monitor",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.0/tmux-monitor-1.0.0.tmxplug",
-      "sha256": "d453e0c5f1bf54160615d5df4e12eac0d97fea3c78c0aad5ebe8552e1f2de42c"
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.1.0/tmux-monitor-1.1.0.tmxplug",
+      "sha256": "3cdc54a34e1ca30c4e3c217bbc612e40ef3cd3e4d5de704ea92d914b32d98006",
+      "tier": "full"
     },
     {
       "id": "totp",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.0/totp-1.0.0.tmxplug",
-      "sha256": "a2d389048d16e31c089cf211fe2fb37fcfb33369497b58ee445e8626e9ec494d",
+      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.2/totp-1.0.2.tmxplug",
+      "sha256": "94a0772660fa8e4dfd9afc15b68d5bc9fe02fe28a1acfd35e65a57c304d460c0",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -210,8 +353,9 @@
     {
       "id": "tunnels",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.0/tunnels-1.0.0.tmxplug",
-      "sha256": "dc6c2942490c07ec1f9a4065850288cbb00c42dae64397937d2551d689314939",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.2.1/tunnels-1.2.1.tmxplug",
+      "sha256": "2871a8d31854e1a31416c4afe5839099a4c489e34d9d31573659f73b2515f159",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -220,32 +364,37 @@
     {
       "id": "vault",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.0/vault-1.0.0.tmxplug",
-      "sha256": "bdad88ed576ed30b464c9cbddab4d9bb60696581dc1b815b76e1b4a08500f870"
+      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.2/vault-1.0.2.tmxplug",
+      "sha256": "48ef402d030912a836489edf0fdfcaf7929cbd67c21f16a2079cb4925134cc28",
+      "tier": "full"
     },
     {
       "id": "wake-on-lan",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.0/wake-on-lan-1.0.0.tmxplug",
-      "sha256": "3e7d4c8a9a20cde95d8594d4ae8e1fa0469d0751be9f00249f6431b10ada9ea9"
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.1.0/wake-on-lan-1.1.0.tmxplug",
+      "sha256": "1afb708c12631ededec40938aed3ab587bc9a519215fa5e93350b1f0a843d2a8",
+      "tier": "full"
     },
     {
       "id": "warpgate",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.0/warpgate-1.0.0.tmxplug",
-      "sha256": "18ed1c8238ecf57b5776ad93c6533d7040b988ae765012c5da591b85faa02d2e"
+      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.2/warpgate-1.0.2.tmxplug",
+      "sha256": "5c2c1c9aef40dbbf98424d02303f2ee77e6e869334247881e8aa0fcd8c415b47",
+      "tier": "full"
     },
     {
       "id": "web-endpoint",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.0/web-endpoint-1.0.0.tmxplug",
-      "sha256": "7f69e608eccd8cc6fa2436bffb3e2c3c8aae6cebebf7341913f15e7f9be58e42"
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.1.0/web-endpoint-1.1.0.tmxplug",
+      "sha256": "79e691abc456b17c8ce651017b47097a7ff71e94267e668341548a05b911a92c",
+      "tier": "full"
     },
     {
       "id": "webauthn",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.0/webauthn-1.0.0.tmxplug",
-      "sha256": "dafcd7bfffc39b60a14333164dfd8ca70986da1390285359669d0293cd050121",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.1.0/webauthn-1.1.0.tmxplug",
+      "sha256": "83a61a530db0273f9fef2080d6aa027a82ef8374fb4e0f158a8559a2770299de",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -254,8 +403,9 @@
     {
       "id": "workspaces",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.0/workspaces-1.0.0.tmxplug",
-      "sha256": "1ee3a07bd8d61b46b6fbe118d2a424f8027575282287622b467e83a4356e6412",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.1.0/workspaces-1.1.0.tmxplug",
+      "sha256": "7189d767c3f7cddfb59366f6cceeca27a0b29e41da1dcc89d57a25317a0fe4bf",
+      "tier": "standard",
       "onboarding": {
         "recommended": true,
         "consent": false

docker/compose-dev.yml

@@ -12,24 +12,9 @@ services:
     environment:
       PORT: "8080"
       NODE_ENV: development
-      GUACD_HOST: "guacd-dev"
-      GUACD_TUNNEL_HOST: "termix-dev"
-      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
-      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
       # REDIS_URL: "redis://redis:6379"
       # TERMIX_REDIS_PREFIX: "termix:collab"
       # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
-    depends_on:
-      - guacd-dev
-    networks:
-      - termix-dev-net
-
-  guacd-dev:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd-dev
-    restart: unless-stopped
-    volumes:
-      - termix-dev-data:/termix-data
     networks:
       - termix-dev-net
 

docker/docker-compose.yml

@@ -9,12 +9,6 @@ services:
       - termix-data:/app/data
     environment:
       PORT: "8080"
-      GUACD_HOST: "guacd"
-      GUACD_TUNNEL_HOST: "termix"
-      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
-      # Where guacd stores files for RDP drive redirection (one folder per
-      # user is created underneath). Must be writable by guacd's user.
-      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
       # Multi-instance deployments should point every backend at the same
       # Redis. Without it, collaboration rooms keep their single-instance
       # in-memory fallback.
@@ -28,21 +22,14 @@ services:
       # Trusted reverse-proxy authentication is disabled by default. When
       # enabled, do not expose this container directly to untrusted clients.
       # TRUSTED_PROXY_AUTH_ENABLED: "true"
-      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.16.0.0/12"
+      # List the address your authenticating proxy connects from, as this
+      # container sees it (for a proxy container on termix-net, its IP there).
+      # Keep it narrow: published ports can reach the container from the
+      # Docker gateway, so do not trust whole private ranges.
+      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
       # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
       # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
       # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    volumes:
-      - termix-data:/termix-data
     networks:
       - termix-net
 

docker/nginx-https.conf

@@ -200,6 +200,9 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
+            # The TCP peer before set_real_ip_from rewrites $remote_addr from
+            # X-Forwarded-For; trusted proxy login checks this address.
+            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -425,6 +428,16 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            # A terminal is quiet most of the time - waiting on a prompt, reading
+            # output, running something long. Every console plugin dials this route
+            # (terminal, serial, remote desktop), and nginx's default
+            # proxy_read_timeout of 60s closed the socket about a minute into any
+            # pause, which reaches the user as the SSH server disconnecting. The
+            # plugin WebSocket routes below already ask for 86400s; this is the same
+            # class of socket, so it asks for the same.
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_buffering off;
         }
 
         location /host/ {
@@ -463,9 +476,12 @@ http {
         }
 
         error_page 500 502 503 504 /50x.html;
+        # Only nginx's own errors land here (the backend is down or too slow).
+        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
-            root /app/html;
             internal;
+            default_type application/json;
+            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

docker/nginx.conf

@@ -169,6 +169,9 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
+            # The TCP peer before set_real_ip_from rewrites $remote_addr from
+            # X-Forwarded-For; trusted proxy login checks this address.
+            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -394,6 +397,16 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            # A terminal is quiet most of the time - waiting on a prompt, reading
+            # output, running something long. Every console plugin dials this route
+            # (terminal, serial, remote desktop), and nginx's default
+            # proxy_read_timeout of 60s closed the socket about a minute into any
+            # pause, which reaches the user as the SSH server disconnecting. The
+            # plugin WebSocket routes below already ask for 86400s; this is the same
+            # class of socket, so it asks for the same.
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_buffering off;
         }
 
         location /host/ {
@@ -432,9 +445,12 @@ http {
         }
 
         error_page 500 502 503 504 /50x.html;
+        # Only nginx's own errors land here (the backend is down or too slow).
+        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
-            root /app/html;
             internal;
+            default_type application/json;
+            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

drizzle/mysql/0071_drop_install_count_source.sql

@@ -0,0 +1 @@
+ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/mysql/0072_unique_username.sql

@@ -0,0 +1,19 @@
+-- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
+WITH ranked AS (
+  SELECT id, username,
+    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
+    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
+  FROM users
+), candidates AS (
+  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
+), available AS (
+  SELECT MIN(candidate) AS candidate FROM candidates
+  WHERE NOT EXISTS (
+    SELECT 1 FROM ranked WHERE username LIKE CONCAT(CONCAT('termix-recovered-', candidate, '-'), '%')
+  )
+)
+UPDATE users JOIN ranked ON ranked.id = users.id CROSS JOIN available
+SET users.username = CONCAT('termix-recovered-', available.candidate, '-', ranked.sequence)
+WHERE ranked.occurrence > 1;--> statement-breakpoint
+ALTER TABLE `users` MODIFY COLUMN `username` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `users` ADD CONSTRAINT `idx_users_username` UNIQUE(`username`);

drizzle/mysql/0073_user_look_preferences.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `user_preferences` ADD `layout_id` text;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `theme_id` text;

drizzle/mysql/0074_mature_puff_adder.sql

@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;

drizzle/mysql/0075_session_policy.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `sessions` ADD `restriction` text;--> statement-breakpoint
+ALTER TABLE `sessions` ADD `idle_timeout` int;

drizzle/mysql/0076_host_color_icon.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `color` text;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `icon` text;

drizzle/mysql/meta/_journal.json

@@ -498,6 +498,48 @@
       "when": 1791550497926,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
+    },
+    {
+      "idx": 71,
+      "version": "5",
+      "when": 1791755801066,
+      "tag": "0071_drop_install_count_source",
+      "breakpoints": true
+    },
+    {
+      "idx": 72,
+      "version": "5",
+      "when": 1791935283211,
+      "tag": "0072_unique_username",
+      "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "5",
+      "when": 1792357129912,
+      "tag": "0073_user_look_preferences",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "5",
+      "when": 1792374489419,
+      "tag": "0074_mature_puff_adder",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "5",
+      "when": 1792430772041,
+      "tag": "0075_session_policy",
+      "breakpoints": true
+    },
+    {
+      "idx": 76,
+      "version": "5",
+      "when": 1792945361809,
+      "tag": "0076_host_color_icon",
+      "breakpoints": true
     }
   ]
 }

drizzle/postgres/0071_drop_install_count_source.sql

@@ -0,0 +1 @@
+ALTER TABLE "plugin_install_counts" DROP COLUMN "source";

drizzle/postgres/0072_unique_username.sql

@@ -0,0 +1,18 @@
+-- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
+WITH ranked AS MATERIALIZED (
+  SELECT id, username,
+    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
+    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
+  FROM users
+), candidates AS (
+  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
+), available AS (
+  SELECT MIN(candidate) AS candidate FROM candidates
+  WHERE NOT EXISTS (
+    SELECT 1 FROM ranked WHERE username LIKE 'termix-recovered-' || candidate || '-' || '%'
+  )
+)
+UPDATE users SET username = 'termix-recovered-' || (SELECT candidate FROM available) || '-' || ranked.sequence
+FROM ranked WHERE ranked.id = users.id AND ranked.occurrence > 1;--> statement-breakpoint
+ALTER TABLE "users" ALTER COLUMN "username" SET DATA TYPE varchar(255);--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_users_username" ON "users" USING btree ("username");

drizzle/postgres/0073_user_look_preferences.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "user_preferences" ADD COLUMN "layout_id" text;--> statement-breakpoint
+ALTER TABLE "user_preferences" ADD COLUMN "theme_id" text;

drizzle/postgres/0074_bouncy_sersi.sql

@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;

drizzle/postgres/0075_session_policy.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "sessions" ADD COLUMN "restriction" text;--> statement-breakpoint
+ALTER TABLE "sessions" ADD COLUMN "idle_timeout" integer;

drizzle/postgres/0076_host_color_icon.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "ssh_data" ADD COLUMN "color" text;--> statement-breakpoint
+ALTER TABLE "ssh_data" ADD COLUMN "icon" text;

drizzle/postgres/meta/_journal.json

@@ -498,6 +498,48 @@
       "when": 1791550496661,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
+    },
+    {
+      "idx": 71,
+      "version": "7",
+      "when": 1791755800419,
+      "tag": "0071_drop_install_count_source",
+      "breakpoints": true
+    },
+    {
+      "idx": 72,
+      "version": "7",
+      "when": 1791935282340,
+      "tag": "0072_unique_username",
+      "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1792357128746,
+      "tag": "0073_user_look_preferences",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1792374488837,
+      "tag": "0074_bouncy_sersi",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "7",
+      "when": 1792430770990,
+      "tag": "0075_session_policy",
+      "breakpoints": true
+    },
+    {
+      "idx": 76,
+      "version": "7",
+      "when": 1792945360507,
+      "tag": "0076_host_color_icon",
+      "breakpoints": true
     }
   ]
 }

drizzle/sqlite/0066_drop_install_count_source.sql

@@ -0,0 +1 @@
+ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/sqlite/0067_unique_username.sql

@@ -0,0 +1,17 @@
+-- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
+WITH ranked AS MATERIALIZED (
+  SELECT id, username,
+    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
+    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
+  FROM users
+), candidates AS (
+  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
+), available AS (
+  SELECT MIN(candidate) AS candidate FROM candidates
+  WHERE NOT EXISTS (
+    SELECT 1 FROM ranked WHERE username LIKE 'termix-recovered-' || candidate || '-' || '%'
+  )
+)
+UPDATE users SET username = 'termix-recovered-' || (SELECT candidate FROM available) || '-' || ranked.sequence
+FROM ranked WHERE ranked.id = users.id AND ranked.occurrence > 1;--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_users_username` ON `users` (`username`);

drizzle/sqlite/0068_user_look_preferences.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `user_preferences` ADD `layout_id` text;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `theme_id` text;

drizzle/sqlite/0069_normal_ozymandias.sql

@@ -0,0 +1,4 @@
+-- recent_activity moved to the homepage plugin, whose migration renames it to
+-- p_homepage_recent_activity. Dropping it here would lose every entry, so this
+-- only stops drizzle tracking it. SELECT 1 because MySQL rejects an empty query.
+SELECT 1;

drizzle/sqlite/0070_session_policy.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `sessions` ADD `restriction` text(32);--> statement-breakpoint
+ALTER TABLE `sessions` ADD `idle_timeout` integer;

drizzle/sqlite/0071_host_color_icon.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `color` text;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `icon` text;

drizzle/sqlite/meta/_journal.json

@@ -463,6 +463,48 @@
       "when": 1791550495357,
       "tag": "0065_drop_donation_modal",
       "breakpoints": true
+    },
+    {
+      "idx": 66,
+      "version": "6",
+      "when": 1791755799726,
+      "tag": "0066_drop_install_count_source",
+      "breakpoints": true
+    },
+    {
+      "idx": 67,
+      "version": "6",
+      "when": 1791935281343,
+      "tag": "0067_unique_username",
+      "breakpoints": true
+    },
+    {
+      "idx": 68,
+      "version": "6",
+      "when": 1792357127581,
+      "tag": "0068_user_look_preferences",
+      "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "6",
+      "when": 1792374488196,
+      "tag": "0069_normal_ozymandias",
+      "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "6",
+      "when": 1792430769899,
+      "tag": "0070_session_policy",
+      "breakpoints": true
+    },
+    {
+      "idx": 71,
+      "version": "6",
+      "when": 1792945434651,
+      "tag": "0071_host_color_icon",
+      "breakpoints": true
     }
   ]
 }

electron-builder.json

@@ -1,7 +1,10 @@
 {
   "appId": "com.karmaa.termix",
   "productName": "Termix",
-  "publish": null,
+  "publish": {
+    "provider": "generic",
+    "url": "https://github.com/Termix-SSH/Termix/releases/latest/download"
+  },
   "directories": {
     "output": "release"
   },
@@ -43,11 +46,11 @@
     "target": [
       {
         "target": "nsis",
-        "arch": ["x64", "ia32"]
+        "arch": ["x64", "ia32", "arm64"]
       },
       {
         "target": "msi",
-        "arch": ["x64", "ia32"]
+        "arch": ["x64", "ia32", "arm64"]
       }
     ],
     "icon": "public/icon.ico",
@@ -114,12 +117,21 @@
       {
         "target": "dmg",
         "arch": ["universal", "x64", "arm64"]
+      },
+      {
+        "target": "zip",
+        "arch": ["x64", "arm64"]
       }
     ],
+    "artifactName": "termix_macos_${arch}_update.${ext}",
     "icon": "public/icon.icns",
     "category": "public.app-category.developer-tools",
     "hardenedRuntime": true,
     "gatekeeperAssess": false,
+    "extendInfo": {
+      "NSLocalNetworkUsageDescription": "Termix connects to servers and hosts on your local network.",
+      "NSBonjourServices": ["_http._tcp", "_https._tcp", "_ssh._tcp"]
+    },
     "entitlements": "packaging/build/entitlements.mac.plist",
     "entitlementsInherit": "packaging/build/entitlements.mac.inherit.plist",
     "type": "distribution",
@@ -145,9 +157,11 @@
     "artifactName": "termix_macos_${arch}_mas.${ext}",
     "extendInfo": {
       "ITSAppUsesNonExemptEncryption": false,
+      "NSLocalNetworkUsageDescription": "Termix connects to servers and hosts on your local network.",
+      "NSBonjourServices": ["_http._tcp", "_https._tcp", "_ssh._tcp"],
       "NSAppleEventsUsageDescription": "Termix needs access to control other applications for terminal operations."
     }
   },
-  "generateUpdatesFilesForAllChannels": true,
+  "generateUpdatesFilesForAllChannels": false,
   "msiProjectCreated": "packaging/build/msi-shortcuts.cjs"
 }

electron/auto-updater.cjs

@@ -0,0 +1,323 @@
+// Desktop self updates. The release is picked from the GitHub releases list
+// instead of electron-updater's GitHub provider, because the repo also holds
+// SDK and 2.9.x releases, and a new release exists a while before its files
+// finish uploading. The channel file is uploaded last, so a release counts
+// only once it has one for this platform.
+
+const path = require("path");
+
+const REPO = "Termix-SSH/Termix";
+const RELEASES_API = `https://api.github.com/repos/${REPO}/releases?per_page=30`;
+const DOWNLOAD_BASE = `https://github.com/${REPO}/releases/download/`;
+const MODES = ["automatic", "prompt", "never"];
+const DEFAULT_MODE = "prompt";
+const FIRST_CHECK_DELAY = 30 * 1000;
+const CHECK_INTERVAL = 6 * 60 * 60 * 1000;
+const VERSION = /^v?(\d+)\.(\d+)\.(\d+)(?:-beta\.(\d+))?$/;
+
+function parseVersion(value) {
+  const match = VERSION.exec(String(value || "").trim());
+  if (!match) return null;
+  return {
+    parts: match.slice(1, 4).map(Number),
+    beta: match[4] == null ? null : Number(match[4]),
+  };
+}
+
+// A beta sorts before the release it leads up to.
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a.parts[i] !== b.parts[i]) return a.parts[i] - b.parts[i];
+  }
+  if (a.beta === b.beta) return 0;
+  if (a.beta == null) return 1;
+  if (b.beta == null) return -1;
+  return a.beta - b.beta;
+}
+
+// Matches the names electron-builder writes and electron-updater reads.
+function channelFile(channel, platform, arch) {
+  if (platform === "win32") return `${channel}.yml`;
+  if (platform === "darwin") return `${channel}-mac.yml`;
+  return `${channel}-linux${arch === "x64" ? "" : `-${arch}`}.yml`;
+}
+
+/**
+ * The newest release this install should move to, or null. Stable installs
+ * only see stable releases; a beta install also sees newer betas.
+ */
+function resolveRelease(releases, { currentVersion, platform, arch }) {
+  const current = parseVersion(currentVersion);
+  if (!current || !Array.isArray(releases)) return null;
+  const allowBeta = current.beta != null;
+
+  const newest = releases
+    .filter((release) => release && !release.draft)
+    .map((release) => ({ release, version: parseVersion(release.tag_name) }))
+    .filter(
+      ({ release, version }) =>
+        version &&
+        release.tag_name.startsWith("v") &&
+        (allowBeta || version.beta == null) &&
+        compareVersions(version, current) > 0,
+    )
+    .sort((a, b) => compareVersions(b.version, a.version))[0];
+  if (!newest) return null;
+
+  const { release, version } = newest;
+  const channel = version.beta == null ? "latest" : "beta";
+  const file = channelFile(channel, platform, arch);
+  const assets = Array.isArray(release.assets) ? release.assets : [];
+  if (!assets.some((asset) => asset && asset.name === file)) return null;
+
+  return {
+    tag: release.tag_name,
+    version: release.tag_name.slice(1),
+    channel,
+    feedUrl: `${DOWNLOAD_BASE}${release.tag_name}`,
+    releaseUrl:
+      release.html_url ||
+      `https://github.com/${REPO}/releases/tag/${release.tag_name}`,
+  };
+}
+
+/**
+ * How this copy of the app was installed, which decides whether it can
+ * replace itself:
+ * - auto: NSIS, DMG, AppImage or deb, updated in place
+ * - manual: MSI, Chocolatey, Flatpak, portable builds and 32-bit Windows, told where to download
+ * - store: Mac App Store
+ * - disabled: dev builds
+ */
+function getInstallKind({
+  platform,
+  arch,
+  isPackaged,
+  mas,
+  env,
+  execPath,
+  resourcesPath,
+  exists,
+  readFile,
+}) {
+  if (!isPackaged) return "disabled";
+  if (mas) return "store";
+
+  if (platform === "linux") {
+    if (env.FLATPAK_ID || exists("/.flatpak-info")) return "manual";
+    if (env.APPIMAGE) return "auto";
+    try {
+      const type = readFile(path.join(resourcesPath, "package-type")).trim();
+      // The AUR package reuses the deb's files, so ask dpkg if it owns us.
+      if (type === "deb" && exists("/var/lib/dpkg/info/termix.list")) {
+        return "auto";
+      }
+    } catch {
+      // Not a package install.
+    }
+    return "manual";
+  }
+
+  if (platform === "win32") {
+    if (arch !== "x64") return "manual";
+    const uninstaller = path.join(
+      path.dirname(execPath),
+      "Uninstall Termix.exe",
+    );
+    return exists(uninstaller) ? "auto" : "manual";
+  }
+
+  if (platform === "darwin") {
+    // Still running from the mounted DMG.
+    return execPath.startsWith("/Volumes/") ? "manual" : "auto";
+  }
+
+  return "manual";
+}
+
+function normalizeMode(mode) {
+  return MODES.includes(mode) ? mode : DEFAULT_MODE;
+}
+
+function createUpdater({
+  currentVersion,
+  platform,
+  arch,
+  kind,
+  getMode,
+  saveMode,
+  fetchReleases,
+  loadAutoUpdater,
+  send,
+  log,
+  beforeInstall,
+}) {
+  const state = {
+    kind,
+    mode: normalizeMode(getMode()),
+    currentVersion,
+    status: "idle",
+    version: null,
+    releaseUrl: null,
+    progress: null,
+    error: null,
+  };
+  const enabled = kind === "auto" || kind === "manual";
+  let updater = null;
+  let timer = null;
+  let checkedOnce = false;
+
+  function update(patch) {
+    Object.assign(state, patch);
+    send({ ...state });
+  }
+
+  function getUpdater() {
+    if (updater) return updater;
+    updater = loadAutoUpdater();
+    updater.logger = {
+      info: (...args) => log("[updater]", ...args),
+      warn: (...args) => log("[updater]", ...args),
+      error: (...args) => log("[updater]", ...args),
+      debug: () => {},
+    };
+    updater.autoInstallOnAppQuit = true;
+    updater.on("update-available", (info) =>
+      update({
+        status: updater.autoDownload ? "downloading" : "available",
+        version: info.version,
+        progress: null,
+        error: null,
+      }),
+    );
+    updater.on("update-not-available", () =>
+      update({ status: "up-to-date", error: null }),
+    );
+    updater.on("download-progress", (progress) =>
+      update({
+        status: "downloading",
+        progress: Math.round(progress.percent || 0),
+      }),
+    );
+    updater.on("update-downloaded", (info) =>
+      update({
+        status: "downloaded",
+        version: info.version,
+        progress: 100,
+        error: null,
+      }),
+    );
+    updater.on("error", (error) => {
+      log("[updater] error:", error?.message || String(error));
+      update({ status: "error", error: error?.message || String(error) });
+    });
+    return updater;
+  }
+
+  async function check() {
+    if (!enabled) return { ...state };
+    if (["checking", "downloading", "downloaded"].includes(state.status)) {
+      return { ...state };
+    }
+    checkedOnce = true;
+    update({ status: "checking", error: null });
+
+    let release;
+    try {
+      release = resolveRelease(await fetchReleases(), {
+        currentVersion,
+        platform,
+        arch,
+      });
+    } catch (error) {
+      log("[updater] release lookup failed:", error?.message || String(error));
+      update({ status: "error", error: error?.message || String(error) });
+      return { ...state };
+    }
+
+    if (!release) {
+      update({ status: "up-to-date" });
+      return { ...state };
+    }
+
+    update({ version: release.version, releaseUrl: release.releaseUrl });
+    if (kind === "manual") {
+      update({ status: "available" });
+      return { ...state };
+    }
+
+    try {
+      const auto = getUpdater();
+      auto.setFeedURL({ provider: "generic", url: release.feedUrl });
+      auto.channel = release.channel;
+      auto.allowDowngrade = false;
+      auto.autoDownload = state.mode === "automatic";
+      await auto.checkForUpdates();
+    } catch (error) {
+      log("[updater] check failed:", error?.message || String(error));
+      update({ status: "error", error: error?.message || String(error) });
+    }
+    return { ...state };
+  }
+
+  async function download() {
+    if (kind !== "auto" || state.status !== "available") return { ...state };
+    update({ status: "downloading", progress: 0 });
+    try {
+      await getUpdater().downloadUpdate();
+    } catch (error) {
+      log("[updater] download failed:", error?.message || String(error));
+      update({ status: "error", error: error?.message || String(error) });
+    }
+    return { ...state };
+  }
+
+  function install() {
+    if (kind !== "auto" || state.status !== "downloaded") return false;
+    // The tray keeps windows alive on close, so mark the quit first.
+    beforeInstall?.();
+    setImmediate(() => getUpdater().quitAndInstall());
+    return true;
+  }
+
+  function setMode(mode) {
+    if (!MODES.includes(mode)) return { ...state };
+    saveMode(mode);
+    update({ mode });
+    if (updater) updater.autoDownload = mode === "automatic";
+    if (mode !== "never" && !checkedOnce) void check();
+    return { ...state };
+  }
+
+  function start() {
+    if (!enabled || timer) return;
+    setTimeout(() => {
+      if (state.mode !== "never") void check();
+    }, FIRST_CHECK_DELAY).unref?.();
+    timer = setInterval(() => {
+      if (state.mode !== "never") void check();
+    }, CHECK_INTERVAL);
+    timer.unref?.();
+  }
+
+  return {
+    getState: () => ({ ...state }),
+    check,
+    download,
+    install,
+    setMode,
+    start,
+  };
+}
+
+module.exports = {
+  DEFAULT_MODE,
+  RELEASES_API,
+  channelFile,
+  compareVersions,
+  createUpdater,
+  getInstallKind,
+  normalizeMode,
+  parseVersion,
+  resolveRelease,
+};

electron/backend-failure.cjs

@@ -35,7 +35,13 @@ function parseConflictingPort(stderr) {
  * stderr. Always returns a failure -- see the note above on why every exit
  * that reaches this point counts as one.
  */
+// Part of PRE_29_DATABASE_ERROR in src/backend/database/db/upgrade-guard.ts.
+const OLD_DATABASE_MARKER = "This database is from Termix 2.8 or older";
+
 function classifyBackendFailure(stderr = "") {
+  if (stderr.includes(OLD_DATABASE_MARKER)) {
+    return { reason: "old-database", port: null };
+  }
   if (stderr.includes("EADDRINUSE")) {
     return { reason: "port-in-use", port: parseConflictingPort(stderr) };
   }

electron/c2s-auth.cjs

@@ -1,78 +0,0 @@
-const { randomUUID } = require("node:crypto");
-
-function createC2SAuthBridge(ipcMain, getWindow) {
-  const pending = new Map();
-  ipcMain.handle("answer-c2s-auth", (event, id, answer) => {
-    const item = pending.get(id);
-    if (!item || item.sender !== event.sender) return false;
-    if (answer !== null && (typeof answer !== "string" || answer.length > 8192))
-      return false;
-    item.finish(answer);
-    return true;
-  });
-  return function attach(ws, tunnelName) {
-    const active = new Set();
-    const close = () => {
-      for (const id of active) pending.get(id)?.finish(null);
-      ws.off("message", onMessage);
-      ws.off("close", close);
-      ws.off("error", close);
-    };
-    const onMessage = (raw, binary) => {
-      if (binary) return;
-      let message;
-      try {
-        message = JSON.parse(raw.toString());
-      } catch {
-        return;
-      }
-      if (message.type !== "auth-prompt") return;
-      const window = getWindow();
-      if (
-        !window ||
-        window.isDestroyed() ||
-        active.size ||
-        typeof message.requestId !== "string" ||
-        !["totp", "input", "browser"].includes(message.request?.kind) // plugin-id-ok: SSH prompt kind, not the plugin
-      ) {
-        ws.close();
-        return;
-      }
-      const sender = window.webContents;
-      const id = randomUUID();
-      const finish = (answer) => {
-        if (!pending.delete(id)) return;
-        active.delete(id);
-        clearTimeout(timer);
-        sender.off("destroyed", cancelled);
-        sender.off("did-start-loading", cancelled);
-        if (!sender.isDestroyed())
-          sender.send("c2s-auth-prompt", { id, closed: true });
-        if (ws.readyState === 1)
-          ws.send(
-            JSON.stringify({
-              type: "auth-response",
-              requestId: message.requestId,
-              answer,
-            }),
-          );
-        if (answer === null) ws.close();
-      };
-      const cancelled = () => finish(null);
-      const timer = setTimeout(cancelled, 60_000);
-      active.add(id);
-      pending.set(id, { sender, finish });
-      sender.once("destroyed", cancelled);
-      sender.once("did-start-loading", cancelled);
-      sender.send("c2s-auth-prompt", {
-        id,
-        tunnelName,
-        request: message.request,
-      });
-    };
-    ws.on("message", onMessage);
-    ws.once("close", close);
-    ws.once("error", close);
-  };
-}
-module.exports = { createC2SAuthBridge };

electron/desktop-settings.cjs

@@ -32,7 +32,7 @@ function writeJson(filePath, value) {
   }
 }
 
-const DEFAULTS = { defaultConnectionOrigin: "local" };
+const DEFAULTS = { defaultConnectionOrigin: "local", updateMode: "prompt" };
 
 function getDesktopSettings() {
   return { ...DEFAULTS, ...readJson(dataPath("desktop-settings.json"), {}) };

electron/embedded-view.cjs

@@ -0,0 +1,165 @@
+const { isolatedUrl } = require("./isolated-window.cjs");
+
+function cleanBounds(bounds) {
+  const value = (n) => Math.max(0, Math.round(Number(n) || 0));
+  return {
+    x: value(bounds?.x),
+    y: value(bounds?.y),
+    width: value(bounds?.width),
+    height: value(bounds?.height),
+  };
+}
+
+/**
+ * Native web views drawn inside the main window, for pages that do not work
+ * in a sandboxed iframe. Each one is a WebContentsView in its own
+ * non-persistent session, with the same limits as an isolated window: no
+ * permissions, no downloads, http(s) and ws(s) only. The renderer owns the
+ * placement and sends the bounds of the element the view should cover.
+ */
+function createEmbeddedViews({ WebContentsView, session, getMainWindow }) {
+  const views = new Map();
+
+  function destroy(id) {
+    const entry = views.get(id);
+    if (!entry) return;
+    views.delete(id);
+    const main = getMainWindow();
+    if (main && !main.isDestroyed()) {
+      try {
+        main.contentView.removeChildView(entry.view);
+      } catch {
+        /* already detached */
+      }
+    }
+    if (!entry.view.webContents.isDestroyed()) entry.view.webContents.close();
+    void Promise.allSettled([
+      entry.session.clearStorageData(),
+      entry.session.clearCache(),
+      entry.session.closeAllConnections(),
+    ]);
+  }
+
+  function destroyAll() {
+    for (const id of [...views.keys()]) destroy(id);
+  }
+
+  function open(options = {}) {
+    const main = getMainWindow();
+    if (!main) throw new Error("No window to attach a view to");
+    const id = String(options.id || "");
+    if (!id) throw new Error("A view needs an id");
+    const url = isolatedUrl(options.url);
+    const existing = views.get(id);
+    if (existing) {
+      if (
+        existing.url === url.href &&
+        existing.ignoreCert === !!options.ignoreCert
+      ) {
+        setBounds(id, options.bounds);
+        setVisible(id, options.visible !== false);
+        return { success: true };
+      }
+      destroy(id);
+    }
+
+    const isolated = session.fromPartition(
+      `embedded-view-${id}-${Date.now()}`,
+      {
+        cache: false,
+      },
+    );
+    isolated.setPermissionRequestHandler((_c, _p, callback) => callback(false));
+    isolated.setPermissionCheckHandler(() => false);
+    isolated.on("will-download", (event) => event.preventDefault());
+    isolated.webRequest.onBeforeRequest((details, callback) => {
+      const protocol = new URL(details.url).protocol;
+      callback({
+        cancel: !["http:", "https:", "ws:", "wss:"].includes(protocol),
+      });
+    });
+
+    const view = new WebContentsView({
+      webPreferences: {
+        session: isolated,
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        webviewTag: false,
+        webSecurity: true,
+      },
+    });
+    const canNavigate = (target) => {
+      try {
+        return target === "about:blank" || !!isolatedUrl(target);
+      } catch {
+        return false;
+      }
+    };
+    for (const name of ["will-navigate", "will-redirect"]) {
+      view.webContents.on(name, (event, target) => {
+        if (!canNavigate(target)) event.preventDefault();
+      });
+    }
+    view.webContents.setWindowOpenHandler(({ url: target }) =>
+      canNavigate(target)
+        ? {
+            action: "allow",
+            overrideBrowserWindowOptions: {
+              webPreferences: { session: isolated, sandbox: true },
+            },
+          }
+        : { action: "deny" },
+    );
+
+    views.set(id, {
+      view,
+      session: isolated,
+      url: url.href,
+      origin: url.origin,
+      ignoreCert: !!options.ignoreCert,
+    });
+    main.contentView.addChildView(view);
+    setBounds(id, options.bounds);
+    setVisible(id, options.visible !== false);
+    view.webContents.loadURL(url.href).catch(() => {});
+    return { success: true };
+  }
+
+  function setBounds(id, bounds) {
+    const entry = views.get(id);
+    if (entry) entry.view.setBounds(cleanBounds(bounds));
+  }
+
+  function setVisible(id, visible) {
+    const entry = views.get(id);
+    if (entry) entry.view.setVisible(!!visible);
+  }
+
+  function handleCertificateError(event, contents, url, callback) {
+    for (const entry of views.values()) {
+      if (entry.view.webContents !== contents) continue;
+      event.preventDefault();
+      let allowed = false;
+      try {
+        allowed = entry.ignoreCert && new URL(url).origin === entry.origin;
+      } catch {
+        /* malformed URL is refused */
+      }
+      callback(allowed);
+      return true;
+    }
+    return false;
+  }
+
+  return {
+    open,
+    setBounds,
+    setVisible,
+    destroy,
+    destroyAll,
+    handleCertificateError,
+  };
+}
+
+module.exports = { createEmbeddedViews, cleanBounds };

electron/external-login.cjs

@@ -0,0 +1,20 @@
+/**
+ * The login URL a server hands the desktop app goes to shell.openExternal,
+ * so only web pages pass: any other scheme (file:, smb:, ms-msdt:, ...)
+ * would launch whatever OS handler is registered for it.
+ */
+function isExternalLoginUrl(value) {
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "https:" || protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+/** A non-privileged port for the loopback callback listener. */
+function isCallbackPort(value) {
+  return Number.isInteger(value) && value >= 1024 && value <= 65535;
+}
+
+module.exports = { isExternalLoginUrl, isCallbackPort };

electron/linked-server.cjs

@@ -6,9 +6,16 @@
 
 let linked = null;
 
+const WEBSOCKET_TO_HTTP = { "ws:": "http:", "wss:": "https:" };
+
+// A WebSocket to the linked server (wss://host/...) counts as the link's
+// https://host origin, so its upgrade carries the proxy headers too.
 function getOrigin(url) {
   try {
-    return new URL(url).origin;
+    const parsed = new URL(url);
+    const httpProtocol = WEBSOCKET_TO_HTTP[parsed.protocol];
+    if (httpProtocol) parsed.protocol = httpProtocol;
+    return parsed.origin;
   } catch {
     return null;
   }
@@ -27,6 +34,8 @@ function setLinkedServer(config) {
     basicAuth:
       config.basicAuth && config.basicAuth.username ? config.basicAuth : null,
     allowInvalidCertificate: !!config.allowInvalidCertificate,
+    clientCert:
+      config.clientCert && config.clientCert.pfx ? config.clientCert : null,
   };
 }
 
@@ -38,6 +47,16 @@ function isLinkedOrigin(url) {
   return !!linked && getOrigin(url) === linked.origin;
 }
 
+// The PFX of the link's client certificate, for TLS this process makes itself
+// to the linked origin. Null for any other origin.
+function clientCertOptionsFor(url) {
+  if (!isLinkedOrigin(url) || !linked.clientCert) return {};
+  return {
+    pfx: Buffer.from(linked.clientCert.pfx, "base64"),
+    passphrase: linked.clientCert.passphrase || "",
+  };
+}
+
 function basicAuthValue(basicAuth) {
   return `Basic ${Buffer.from(
     `${basicAuth.username}:${basicAuth.password || ""}`,
@@ -92,6 +111,7 @@ module.exports = {
   setLinkedServer,
   getLinkedServer,
   isLinkedOrigin,
+  clientCertOptionsFor,
   applyLinkHeaders,
   linkedRequestHeaders,
   answerLogin,

electron/local-shell.cjs

@@ -1,67 +0,0 @@
-const fs = require("node:fs");
-const path = require("node:path");
-
-function isUsableShell(file, exists) {
-  return !!file && (!path.isAbsolute(file) || exists(file));
-}
-
-function resolveLocalShell(
-  platform,
-  requestedShell,
-  env = process.env,
-  exists = fs.existsSync,
-) {
-  if (platform === "win32") {
-    if (requestedShell === "wsl") {
-      return { file: "wsl.exe", args: [] };
-    }
-    return {
-      file: env.TERMIX_LOCAL_SHELL || "powershell.exe",
-      args: ["-NoLogo"],
-    };
-  }
-
-  // A SHELL left pointing at an uninstalled shell makes the spawn fail.
-  const fallbacks =
-    platform === "darwin"
-      ? ["/bin/zsh", "/bin/bash", "/bin/sh"]
-      : ["/bin/bash", "/bin/sh"];
-  const file =
-    [env.TERMIX_LOCAL_SHELL, env.SHELL, ...fallbacks].find((candidate) =>
-      isUsableShell(candidate, exists),
-    ) || fallbacks[0];
-  return { file, args: ["-l"] };
-}
-
-/**
- * node-pty starts every shell through its spawn-helper binary, and a packaged
- * copy that lost its execute bit fails with "posix_spawnp failed". Returns
- * how many helpers were fixed.
- */
-function repairSpawnHelpers(ptyDir, fsImpl = fs) {
-  const dir = ptyDir.replace(/app\.asar(?!\.unpacked)/, "app.asar.unpacked");
-  const candidates = [
-    path.join(dir, "build", "Release", "spawn-helper"),
-    path.join(
-      dir,
-      "prebuilds",
-      `${process.platform}-${process.arch}`,
-      "spawn-helper",
-    ),
-  ];
-  let fixed = 0;
-  for (const helper of candidates) {
-    try {
-      const mode = fsImpl.statSync(helper).mode;
-      if ((mode & 0o111) === 0) {
-        fsImpl.chmodSync(helper, mode | 0o755);
-        fixed += 1;
-      }
-    } catch {
-      // Missing or read-only; nothing to fix here.
-    }
-  }
-  return fixed;
-}
-
-module.exports = { resolveLocalShell, repairSpawnHelpers };

electron/native-rdp.cjs

@@ -1,85 +0,0 @@
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { spawn } = require("child_process");
-
-function singleLine(value, maxLength = 255) {
-  return String(value ?? "")
-    .replace(/[\r\n\0]/g, "")
-    .trim()
-    .slice(0, maxLength);
-}
-
-function validateNativeRdpOptions(options) {
-  const host = singleLine(options?.host);
-  const port = Number(options?.port ?? 3389);
-  if (!host || host.length > 253 || /[\\/]/.test(host)) {
-    throw new Error("Invalid RDP host");
-  }
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error("Invalid RDP port");
-  }
-  return {
-    host,
-    port,
-    username: singleLine(options?.username),
-    domain: singleLine(options?.domain),
-  };
-}
-
-function buildRdpFile(options) {
-  const { host, port, username, domain } = validateNativeRdpOptions(options);
-  const address = host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`;
-  const qualifiedUsername = username
-    ? domain
-      ? `${domain}\\${username}`
-      : username
-    : "";
-  return [
-    `full address:s:${address}`,
-    "prompt for credentials:i:1",
-    "administrative session:i:0",
-    ...(qualifiedUsername ? [`username:s:${qualifiedUsername}`] : []),
-    "",
-  ].join("\r\n");
-}
-
-async function launchNativeRdp(options, platform = process.platform) {
-  if (platform !== "win32") {
-    return {
-      success: false,
-      error: "Windows Remote Desktop is only available on Windows",
-    };
-  }
-
-  const rdpContent = buildRdpFile(options);
-  const tempDir = await fs.promises.mkdtemp(
-    path.join(os.tmpdir(), "termix-rdp-"),
-  );
-  const rdpPath = path.join(tempDir, "connection.rdp");
-  await fs.promises.writeFile(rdpPath, rdpContent, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
-
-  return new Promise((resolve) => {
-    const child = spawn("mstsc.exe", [rdpPath], {
-      detached: true,
-      windowsHide: true,
-      stdio: "ignore",
-    });
-    const cleanup = () =>
-      fs.promises.rm(tempDir, { recursive: true, force: true }).catch(() => {});
-    child.once("error", (error) => {
-      cleanup();
-      resolve({ success: false, error: error.message });
-    });
-    child.once("spawn", () => {
-      child.unref();
-      setTimeout(cleanup, 30_000).unref();
-      resolve({ success: true });
-    });
-  });
-}
-
-module.exports = { buildRdpFile, launchNativeRdp, validateNativeRdpOptions };

electron/preload.js

@@ -14,7 +14,16 @@ function invokeAllowed(channel, ...args) {
   return ipcRenderer.invoke(channel, ...args);
 }
 
+// The embedded backend's port, picked by the main process at startup.
+const backendPortArg = process.argv.find((arg) =>
+  arg.startsWith("--termix-backend-port="),
+);
+const backendPort = backendPortArg
+  ? Number(backendPortArg.split("=")[1])
+  : undefined;
+
 contextBridge.exposeInMainWorld("electronAPI", {
+  backendPort,
   getAppVersion: () => ipcRenderer.invoke("get-app-version"),
   // Kept so the interface size can reset a zoom an earlier build applied.
   setZoomFactor: (factor) => {
@@ -23,45 +32,45 @@ contextBridge.exposeInMainWorld("electronAPI", {
     webFrame.setZoomFactor(Math.min(2, Math.max(0.5, value)));
   },
   getPlatform: () => ipcRenderer.invoke("get-platform"),
+
+  // Whether the app-drawn title bar shows in this window, and when it changes
+  // (full screen hides it).
+  getTitleBarVisible: () => ipcRenderer.invoke("get-title-bar-visible"),
+  onTitleBarVisibleChange: (callback) => {
+    const listener = (_event, visible) => callback(visible);
+    ipcRenderer.on("title-bar-visible-changed", listener);
+    return () =>
+      ipcRenderer.removeListener("title-bar-visible-changed", listener);
+  },
+  // Keeps the window controls the system draws in the colors of the theme.
+  setTitleBarOverlay: (colors) =>
+    ipcRenderer.invoke("set-title-bar-overlay", colors),
   getEmbeddedServerStatus: () =>
     ipcRenderer.invoke("get-embedded-server-status"),
 
+  // App Store builds are updated by the store.
+  updates: process.mas
+    ? undefined
+    : {
+        getState: () => ipcRenderer.invoke("desktop-update-get-state"),
+        check: () => ipcRenderer.invoke("desktop-update-check"),
+        download: () => ipcRenderer.invoke("desktop-update-download"),
+        install: () => ipcRenderer.invoke("desktop-update-install"),
+        setMode: (mode) => ipcRenderer.invoke("desktop-update-set-mode", mode),
+        onState: (callback) => {
+          const listener = (_event, state) => callback(state);
+          ipcRenderer.on("desktop-update-state", listener);
+          return () =>
+            ipcRenderer.removeListener("desktop-update-state", listener);
+        },
+      },
+
   removeAllListeners: (channel) => ipcRenderer.removeAllListeners(channel),
   isElectron: true,
   isDev: process.env.NODE_ENV === "development",
 
   getSetting: (key) => ipcRenderer.invoke("get-setting", key),
   setSetting: (key, value) => ipcRenderer.invoke("set-setting", key, value),
-  answerC2SAuth: (id, answer) =>
-    ipcRenderer.invoke("answer-c2s-auth", id, answer),
-  onC2SAuthPrompt: (callback) => {
-    const listener = (_event, prompt) => callback(prompt);
-    ipcRenderer.on("c2s-auth-prompt", listener);
-    return () => ipcRenderer.removeListener("c2s-auth-prompt", listener);
-  },
-  getC2STunnelConfig: () => ipcRenderer.invoke("get-c2s-tunnel-config"),
-  saveC2STunnelConfig: (config) =>
-    ipcRenderer.invoke("save-c2s-tunnel-config", config),
-  checkLocalPortAvailable: (host, port) =>
-    ipcRenderer.invoke("check-local-port-available", host, port),
-  getC2STunnelPresetDefaultName: () =>
-    ipcRenderer.invoke("get-c2s-tunnel-preset-default-name"),
-  startC2STunnel: (tunnel, index, authToken) =>
-    ipcRenderer.invoke("start-c2s-tunnel", tunnel, index, authToken),
-  testC2STunnel: (tunnel, index, authToken) =>
-    ipcRenderer.invoke("test-c2s-tunnel", tunnel, index, authToken),
-  stopC2STunnel: (tunnelName) =>
-    ipcRenderer.invoke("stop-c2s-tunnel", tunnelName),
-  getC2STunnelStatuses: () => ipcRenderer.invoke("get-c2s-tunnel-statuses"),
-  onC2STunnelStatuses: (callback) => {
-    const listener = (_event, statuses) => callback(statuses);
-    ipcRenderer.on("c2s-tunnel-statuses", listener);
-    return () => ipcRenderer.removeListener("c2s-tunnel-statuses", listener);
-  },
-  startC2SAutoStartTunnels: () =>
-    ipcRenderer.invoke("start-c2s-autostart-tunnels"),
-  setC2SRelayPath: (relayPath) =>
-    ipcRenderer.invoke("set-c2s-relay-path", relayPath),
 
   onCloseActiveTab: (callback) => {
     const listener = () => callback();
@@ -70,46 +79,12 @@ contextBridge.exposeInMainWorld("electronAPI", {
   },
 
   clearSessionCookies: () => ipcRenderer.invoke("clear-session-cookies"),
-  getSessionCookie: (name, targetUrl) =>
-    ipcRenderer.invoke("get-session-cookie", name, targetUrl),
-  waitForSessionCookie: (name, targetUrl, previousValue, timeoutMs) =>
-    ipcRenderer.invoke(
-      "wait-session-cookie",
-      name,
-      targetUrl,
-      previousValue,
-      timeoutMs,
-    ),
 
   externalBrowserLogin: (authUrl, callbackPort) =>
     ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),
 
-  openExternalEditor: (fileData) =>
-    ipcRenderer.invoke("open-external-editor", fileData),
-  closeExternalEditor: (editId) =>
-    ipcRenderer.invoke("close-external-editor", editId),
-  onExternalEditorSaved: (callback) => {
-    const listener = (_event, payload) => callback(payload);
-    ipcRenderer.on("external-editor-saved", listener);
-    return () => ipcRenderer.removeListener("external-editor-saved", listener);
-  },
-
   showSaveDialog: (options) => ipcRenderer.invoke("show-save-dialog", options),
   showOpenDialog: (options) => ipcRenderer.invoke("show-open-dialog", options),
-  getLocalHomeDirectory: () => ipcRenderer.invoke("get-local-home-directory"),
-  listLocalDirectory: (dirPath) =>
-    ipcRenderer.invoke("list-local-directory", dirPath),
-  statLocalPaths: (paths) => ipcRenderer.invoke("stat-local-paths", paths),
-  collectLocalFiles: (paths) =>
-    ipcRenderer.invoke("collect-local-files", paths),
-  createLocalFolder: (parentPath, folderName) =>
-    ipcRenderer.invoke("create-local-folder", parentPath, folderName),
-  renameLocalPath: (entryPath, newName) =>
-    ipcRenderer.invoke("rename-local-path", entryPath, newName),
-  trashLocalPath: (entryPath) =>
-    ipcRenderer.invoke("trash-local-path", entryPath),
-  chmodLocalPath: (entryPath, permissions) =>
-    ipcRenderer.invoke("chmod-local-path", entryPath, permissions),
   createTempFile: (fileData) =>
     ipcRenderer.invoke("create-temp-file", fileData),
   createTempFolder: (folderData) =>
@@ -118,61 +93,14 @@ contextBridge.exposeInMainWorld("electronAPI", {
     ipcRenderer.invoke("start-drag-to-desktop", dragData),
   cleanupTempFile: (tempId) => ipcRenderer.invoke("cleanup-temp-file", tempId),
 
-  startLocalTerminal: (dimensions) =>
-    ipcRenderer.invoke("local-terminal-start", dimensions),
-  writeLocalTerminal: (sessionId, data) =>
-    ipcRenderer.invoke("local-terminal-write", sessionId, data),
-  readyLocalTerminal: (sessionId) =>
-    ipcRenderer.invoke("local-terminal-ready", sessionId),
-  resizeLocalTerminal: (sessionId, cols, rows) =>
-    ipcRenderer.invoke("local-terminal-resize", sessionId, cols, rows),
-  closeLocalTerminal: (sessionId) =>
-    ipcRenderer.invoke("local-terminal-close", sessionId),
-  onLocalTerminalData: (sessionId, callback) => {
-    const channel = `local-terminal:data:${sessionId}`;
-    const listener = (_event, data) => callback(data);
-    ipcRenderer.on(channel, listener);
-    return () => ipcRenderer.removeListener(channel, listener);
-  },
-  onLocalTerminalExit: (sessionId, callback) => {
-    const channel = `local-terminal:exit:${sessionId}`;
-    const listener = (_event, exitCode) => callback(exitCode);
-    ipcRenderer.on(channel, listener);
-    return () => ipcRenderer.removeListener(channel, listener);
-  },
-
-  // Dual-pane file manager: local disk browsing and streamed transfers.
-  localFs: {
-    home: () => ipcRenderer.invoke("local-fs:home"),
-    list: (dirPath) => ipcRenderer.invoke("local-fs:list", dirPath),
-    mkdir: (parentPath, name) =>
-      ipcRenderer.invoke("local-fs:mkdir", parentPath, name),
-    createFile: (parentPath, name) =>
-      ipcRenderer.invoke("local-fs:create-file", parentPath, name),
-    rename: (oldPath, newName) =>
-      ipcRenderer.invoke("local-fs:rename", oldPath, newName),
-    trash: (paths) => ipcRenderer.invoke("local-fs:trash", paths),
-    ensureDir: (dirPath, rootPath) =>
-      ipcRenderer.invoke("local-fs:ensure-dir", dirPath, rootPath),
-    exists: (paths) => ipcRenderer.invoke("local-fs:exists", paths),
-    walk: (paths) => ipcRenderer.invoke("local-fs:walk", paths),
-    reveal: (targetPath) => ipcRenderer.invoke("local-fs:reveal", targetPath),
-    open: (targetPath) => ipcRenderer.invoke("local-fs:open", targetPath),
-  },
-  localTransfer: {
-    setApiPath: (apiPath) =>
-      ipcRenderer.invoke("local-transfer:set-api", apiPath),
-    upload: (options) => ipcRenderer.invoke("local-transfer:upload", options),
-    download: (options) =>
-      ipcRenderer.invoke("local-transfer:download", options),
-    cancel: (transferId) =>
-      ipcRenderer.invoke("local-transfer:cancel", transferId),
-    onProgress: (callback) => {
-      const listener = (_event, payload) => callback(payload);
-      ipcRenderer.on("local-transfer:progress", listener);
-      return () =>
-        ipcRenderer.removeListener("local-transfer:progress", listener);
-    },
+  // Native web views placed over an element of the page (WebContentsView).
+  embeddedView: {
+    open: (options) => ipcRenderer.invoke("embedded-view-open", options),
+    setBounds: (id, bounds) =>
+      ipcRenderer.invoke("embedded-view-bounds", id, bounds),
+    setVisible: (id, visible) =>
+      ipcRenderer.invoke("embedded-view-visible", id, visible),
+    close: (id) => ipcRenderer.invoke("embedded-view-close", id),
   },
 
   invoke: invokeAllowed,

electron/rename-local-path.cjs

@@ -1,22 +0,0 @@
-const fs = require("node:fs");
-
-function renameLocalPath(source, target) {
-  if (source === target) return;
-  try {
-    fs.lstatSync(target);
-    const error = new Error("A file or folder with that name already exists");
-    error.code = "EEXIST";
-    throw error;
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  if (fs.lstatSync(source).isDirectory()) {
-    fs.renameSync(source, target);
-    return;
-  }
-  // link is exclusive: a destination created concurrently is never replaced.
-  fs.linkSync(source, target);
-  fs.unlinkSync(source);
-}
-
-module.exports = { renameLocalPath };

env.catalog.json

@@ -71,7 +71,6 @@
       "group": "server",
       "description": "SSH agent socket used for hosts set to agent auth when they do not name their own socket."
     },
-
     {
       "name": "ENABLE_SSL",
       "group": "https",
@@ -108,7 +107,6 @@
       "internal": true,
       "description": "Set by the image when nginx serves HTTPS in front of the backend."
     },
-
     {
       "name": "DATABASE_DIALECT",
       "group": "database",
@@ -161,7 +159,6 @@
       "internal": true,
       "description": "Where database migrations are read from. Set by the image."
     },
-
     {
       "name": "JWT_SECRET",
       "group": "secrets",
@@ -204,7 +201,6 @@
       "secret": true,
       "description": "Only read to move data from installs older than 2.5. Never change it on an install that has it."
     },
-
     {
       "name": "ALLOW_PASSWORD_LOGIN",
       "group": "auth",
@@ -283,7 +279,6 @@
       "group": "auth",
       "description": "JSON map from proxy roles to Termix roles, like {\"admins\":[\"admin\"],\"staff\":[\"user\"]}. Required when trusted proxy login is on."
     },
-
     {
       "name": "TRUSTED_PROXIES",
       "group": "proxy",
@@ -303,7 +298,7 @@
     {
       "name": "HTTP_PROXY",
       "group": "proxy",
-      "description": "Proxy for outbound HTTP requests, like registry downloads and webhooks."
+      "description": "Proxy for outbound HTTP requests, like plugin registry downloads and webhooks."
     },
     {
       "name": "HTTPS_PROXY",
@@ -315,7 +310,6 @@
       "group": "proxy",
       "description": "Comma separated hosts that skip the proxy."
     },
-
     {
       "name": "LOG_LEVEL",
       "group": "logging",
@@ -338,33 +332,31 @@
       "default": "10000",
       "description": "Most audit entries kept. The oldest go first."
     },
-    {
-      "name": "AUDIT_LOG_FORWARD_URL",
-      "group": "logging",
-      "description": "Also POST every audit entry as JSON to this URL. Overrides the admin setting."
-    },
-    {
-      "name": "AUDIT_LOG_FORWARD_TOKEN",
-      "group": "logging",
-      "secret": true,
-      "description": "Bearer token sent with forwarded audit entries."
-    },
     {
       "name": "SESSION_RECORDING_RETENTION_DAYS",
       "group": "logging",
       "deprecated": "the session-recording plugin setting",
       "description": "Only read once to carry a 2.8 value into the session-recording plugin."
     },
-
     {
       "name": "TERMIX_PLUGIN_REGISTRY_URL",
       "group": "plugins",
       "description": "Use another plugin index instead of the official registry."
     },
+    {
+      "name": "TERMIX_COMMUNITY_REGISTRY_URL",
+      "group": "plugins",
+      "description": "Use another plugin index instead of the community registry. Its plugins still have to be signed with the community key."
+    },
     {
       "name": "TERMIX_PLUGIN_STATS_URL",
       "group": "plugins",
-      "description": "Where install counts are read from. Defaults to stats.json next to the registry index."
+      "description": "Where plugin download counts are read from. Defaults to stats.json next to the registry index."
+    },
+    {
+      "name": "TERMIX_PLUGIN_REGISTRY_PRIVATE_HOSTS",
+      "group": "plugins",
+      "description": "Comma-separated host names or IP addresses that plugin registry downloads may reach on a private address, like a registry in your LAN. List bare hosts: entries with a scheme, port or path are ignored. Matched by name only, on any port, so only list names your own DNS answers for. With HTTPS_PROXY set, add them to NO_PROXY too."
     },
     {
       "name": "TERMIX_REQUIRE_SIGNED_PLUGINS",
@@ -372,6 +364,18 @@
       "default": "false",
       "description": "Only load plugins signed by a trusted key. Blocks uploads of unsigned files even in developer mode."
     },
+    {
+      "name": "TERMIX_SAFE_LAYOUT",
+      "group": "plugins",
+      "default": "false",
+      "description": "Start everyone in the layout repair view instead of the chosen layout. Use it when a layout plugin breaks the app."
+    },
+    {
+      "name": "TERMIX_SAFE_MODE",
+      "group": "plugins",
+      "default": "false",
+      "description": "Start only layout and theme plugins. Every other plugin stays off until a restart without it, so you can turn off a plugin that breaks the server or the app."
+    },
     {
       "name": "TERMIX_BUNDLED_PLUGINS_DIR",
       "group": "plugins",
@@ -401,7 +405,6 @@
       "internal": true,
       "description": "Set by npm run dev."
     },
-
     {
       "name": "ENABLE_INSECURE_MODE",
       "group": "desktop",
@@ -430,6 +433,18 @@
       "internal": true,
       "description": "Set by the desktop app when it runs its own backend."
     },
+    {
+      "name": "ELECTRON_USER_DATA",
+      "group": "desktop",
+      "internal": true,
+      "description": "Set by the desktop app to its user data folder."
+    },
+    {
+      "name": "EMBEDDED_BACKEND_PORT",
+      "group": "desktop",
+      "internal": true,
+      "description": "Set by the desktop app to the port its own backend listens on. 30001 unless another program holds it."
+    },
     {
       "name": "TERMIX_DATA_DIR",
       "group": "desktop",
@@ -442,14 +457,24 @@
       "internal": true,
       "description": "Read on Linux to pick the password store and window behavior."
     },
-
+    {
+      "name": "APPIMAGE",
+      "group": "desktop",
+      "internal": true,
+      "description": "Set by AppImage. Tells the desktop app it can update itself."
+    },
+    {
+      "name": "FLATPAK_ID",
+      "group": "desktop",
+      "internal": true,
+      "description": "Set by Flatpak. The desktop app links new versions instead of installing them."
+    },
     {
       "name": "DESKTOP_SESSION",
       "group": "desktop",
       "internal": true,
       "description": "Read on Linux to pick the password store."
     },
-
     {
       "name": "VITE_BASE_PATH",
       "group": "internal",

index.html

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="favicon.ico" />
+    <link rel="icon" type="image/x-icon" href="favicon.ico" />
     <meta
       name="viewport"
       content="width=device-width, initial-scale=1.0, viewport-fit=cover"

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "termix",
-  "version": "26.10.0",
+  "version": "26.10.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "termix",
-      "version": "26.10.0",
+      "version": "26.10.6",
       "hasInstallScript": true,
       "workspaces": [
         "packages/*"
@@ -26,6 +26,7 @@
         "cors": "^2.8.6",
         "dotenv": "^17.4.2",
         "drizzle-orm": "^0.45.2",
+        "electron-updater": "^6.8.9",
         "express": "^5.2.1",
         "jsonwebtoken": "^9.0.3",
         "motion": "^13.1.1",
@@ -106,6 +107,7 @@
         "husky": "^9.1.7",
         "i18next": "^26.4.2",
         "i18next-browser-languagedetector": "^8.2.1",
+        "js-yaml": "^4.3.2",
         "jsdom": "^30.0.1",
         "lint-staged": "^17.2.0",
         "lucide-react": "^1.33.0",
@@ -7589,7 +7591,6 @@
       "version": "9.7.0",
       "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
       "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "debug": "^4.3.4",
@@ -9016,6 +9017,34 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/electron-updater": {
+      "version": "6.8.9",
+      "resolved": "https://registry.npmjs.org/electron-updater/-/electron-updater-6.8.9.tgz",
+      "integrity": "sha512-ZhVxM9iGONUpZGI1FxdMRgJjUFXi7AYGVa5PwKlO1tV1/4zDxQmfKpXOHVztKrd6L9rLcFjERvi1Mf2vxyTkig==",
+      "license": "MIT",
+      "dependencies": {
+        "builder-util-runtime": "9.7.0",
+        "fs-extra": "^10.1.0",
+        "js-yaml": "^4.1.0",
+        "lazy-val": "^1.0.5",
+        "lodash.escaperegexp": "^4.1.2",
+        "lodash.isequal": "^4.5.0",
+        "semver": "~7.7.3",
+        "tiny-typed-emitter": "^2.1.0"
+      }
+    },
+    "node_modules/electron-updater/node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/electron/node_modules/@types/node": {
       "version": "24.19.0",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.0.tgz",
@@ -9870,7 +9899,6 @@
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
       "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -10803,7 +10831,6 @@
       "version": "6.2.1",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
       "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "universalify": "^2.0.0"
@@ -10869,7 +10896,6 @@
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/lazy-val/-/lazy-val-1.0.5.tgz",
       "integrity": "sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/levn": {
@@ -11218,6 +11244,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/lodash.escaperegexp": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/lodash.escaperegexp/-/lodash.escaperegexp-4.1.2.tgz",
+      "integrity": "sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw==",
+      "license": "MIT"
+    },
     "node_modules/lodash.includes": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -11230,6 +11262,13 @@
       "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
       "license": "MIT"
     },
+    "node_modules/lodash.isequal": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz",
+      "integrity": "sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==",
+      "deprecated": "This package is deprecated. Use require('node:util').isDeepStrictEqual instead.",
+      "license": "MIT"
+    },
     "node_modules/lodash.isinteger": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
@@ -13020,7 +13059,6 @@
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
       "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
-      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -13780,6 +13818,12 @@
         "semver": "bin/semver"
       }
     },
+    "node_modules/tiny-typed-emitter": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tiny-typed-emitter/-/tiny-typed-emitter-2.1.0.tgz",
+      "integrity": "sha512-qVtvMxeXbVej0cQWKqVSSAHmKZEHAvxdF8HEUBFWts8h+xEo5m/lEiPakuyZ3BnCBjOD8i24kzNOiOLLgsSxhA==",
+      "license": "MIT"
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -14081,7 +14125,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
       "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 10.0.0"
@@ -15015,7 +15058,7 @@
     },
     "packages/plugin-sdk": {
       "name": "@termix-ssh/plugin-sdk",
-      "version": "1.0.5",
+      "version": "1.0.13",
       "license": "Apache-2.0",
       "dependencies": {
         "@deadendjs/swagger-jsdoc": "^8.1.2",

package.json

@@ -4,7 +4,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "26.10.0",
+  "version": "26.10.6",
   "description": "Self-hosted, plugin-based server management.",
   "author": "Karmaa",
   "main": "electron/main.cjs",
@@ -15,10 +15,10 @@
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-node-pty.cjs && node scripts/patch-ssh2-agent.cjs",
+    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-node-pty.cjs && node scripts/patch-ssh2-agent.cjs && node scripts/patch-ssh2-sk.cjs",
     "prepare": "husky || true",
     "prebuild": "node scripts/write-electron-build-info.cjs",
-    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/generate-settings-search-index.cjs --check && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
+    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/check-button-colors.cjs && node scripts/check-sdk-guide.cjs && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
     "lint:fix": "eslint --fix .",
     "type-check": "npm run build:sdk && tsc -b --force",
     "test": "vitest run",
@@ -30,8 +30,9 @@
     "dev:electron": "node scripts/dev.mjs electron",
     "dev:docker": "node scripts/dev.mjs docker",
     "dev:frontend": "vite",
-    "build": "npm run build:sdk && vite build && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\" && npm run build:plugins",
-    "build:backend": "npm run build:sdk && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\" && npm run build:plugins",
+    "build": "npm run build:sdk && vite build && node scripts/stamp-sw-build-info.cjs && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\" && npm run build:plugins",
+    "build:backend:core": "npm run build:sdk && tsc -p tsconfig.node.json && node -e \"require('fs').copyFileSync('src/backend/package.json','dist/backend/package.json')\"",
+    "build:backend": "npm run build:backend:core && npm run build:plugins",
     "generate:openapi": "npm run build:sdk && node scripts/generate-openapi.mjs",
     "electron:rebuild": "electron-rebuild -f -o better-sqlite3,@serialport/bindings-cpp,node-pty",
     "build:win-portable": "npm run build && npm run electron:rebuild && electron-builder --win --dir",
@@ -61,6 +62,7 @@
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
+    "electron-updater": "^6.8.9",
     "express": "^5.2.1",
     "jsonwebtoken": "^9.0.3",
     "motion": "^13.1.1",
@@ -141,6 +143,7 @@
     "husky": "^9.1.7",
     "i18next": "^26.4.2",
     "i18next-browser-languagedetector": "^8.2.1",
+    "js-yaml": "^4.3.2",
     "jsdom": "^30.0.1",
     "lint-staged": "^17.2.0",
     "lucide-react": "^1.33.0",

packages/plugin-sdk/CHANGELOG.md

@@ -1,5 +1,183 @@
 # Changelog
 
+## 1.0.22
+
+Plugin API 1.13.0.
+
+### Added
+
+- `contributes.mobile` in the manifest says how a plugin shows in the Termix mobile app: `webview`, `native` or `none`, with an optional mobile bundle, screen sizes, views and a note
+- `termix-plugin build` bundles `src/mobile` into the `contributes.mobile.entry` file, and `validate` checks that it exists
+- `@termix-ssh/plugin-sdk/frame-host` runs one plugin view outside the shell, with core's bridge, registries and CSS, so the mobile app can show `webview` plugins
+
+### Fixed
+
+- `@termix-ssh/plugin-sdk/ui` is built in production mode, so outside Termix it no longer sends requests to the Vite dev server path
+
+## 1.0.21
+
+Plugin API 1.12.0.
+
+### Added
+
+- `@termix-ssh/plugin-sdk/host-scripts`: Docker, Linux metrics, systemd, journal and OpenRC command builders and parsers, plus `scriptShell()` and `passwordSudoScript()` to send scripts to `bash -s` on stdin. It has no Node or ssh2 imports, so the Termix mobile app runs the same code
+
+## 1.0.20
+
+Plugin API 1.12.0.
+
+### Added
+
+- `columns` and `onColumns` on `ViewToggle` show a cards per row picker: Auto fits as many as the pane has room for, or pick 1 to 6
+- `size` and `minCardWidth` on `DataView`, so a card grid follows that pick, and the `GridSize` type
+- `usePluginPanelView` also keeps `columns`, the cards per row pick, with `setColumns`
+
+## 1.0.19
+
+Plugin API 1.11.0.
+
+### Added
+
+- `app.registerCompanionLayout` and `useCompanions`, so a plugin can let each host turn the panel bar on or off, move it and choose which panels show and in what order
+
+## 1.0.18
+
+Plugin API 1.10.0.
+
+### Added
+
+- `clientCert` on the sync link, link patch and remote target, and the `client_cert` remote error kind, so a sync plugin can link to a server that needs mutual TLS
+
+## 1.0.17
+
+Plugin API 1.9.0.
+
+### Added
+
+- `app.registerCompanion` and `app.toggleCompanion`, so a plugin can add a panel beside any host tab. The user opens, resizes and moves it, and the tab keeps running
+- `NativeView` in `@termix-ssh/plugin-sdk/ui`, which shows a web page in a native view in the desktop app, for sites that do not work in an iframe
+
+## 1.0.16
+
+Plugin API 1.8.0.
+
+### Added
+
+- `ctx.sync.provide` and the `sync:provide` capability, so a plugin can answer every /sync request
+- `ctx.ssh.transports.provide` and the `ssh:transport` capability, so a plugin can carry SSH connections over its own stream
+- `ctx.hosts.folders.ensure` and `removeEmpty`
+
+### Removed
+
+- The sync screens and calls in `@termix-ssh/plugin-sdk/ui`: `LinkServerDialog`, `ProxySettingsFields`, `useSyncStatus`, `refreshSyncStatus`, `setSyncStatus`, `getSyncConflicts`, `getSyncErrors`, `retrySyncErrors`, `settleSyncConflict`, `syncNow`, `unlinkServer`, `updateSyncSettings` and their types. They moved into the sync plugin
+
+## 1.0.15
+
+Plugin API 1.7.0.
+
+### Added
+
+- `ctx.auth.policy.provide` and the `auth:policy` capability, so a plugin can set an idle timeout, cap session length, turn off remember me and require a second factor
+- `ctx.auth.listSecondFactors` lists the second factors from every running plugin
+- `AuthEnrollmentSections` takes `factorsOnly`
+- `getHttpsSettings` and `updateHttpsSettings` in `@termix-ssh/plugin-sdk/ui`
+
+### Fixed
+
+- Plugin frontend tests against a locally linked SDK failed with a second copy of React
+
+## 1.0.14
+
+Plugin API 1.6.0.
+
+### Added
+
+- `ctx.hosts.locks.provide` and the `hosts:lock` capability, so a plugin can manage hosts that stay read only for everyone else and block adding hosts by hand
+- `ctx.hosts.setShares` to replace every grant on a host in one call
+- `ctx.credentials.list` returns the acting user's credentials by name, without secrets
+- `ctx.hosts.create` and `update` take `password`, `key`, `keyPassword`, `keyType`, `sudoPassword`, `protocolAuth` and `pluginEnable`
+
+## 1.0.13
+
+Plugin API 1.5.0.
+
+### Added
+
+- `runtime: "desktop"` in the manifest for a plugin that only loads on the desktop app
+- `desktop:local` and `ctx.desktop.local`: file system, local shell and machine info on the desktop app's own backend
+- `ctx.audit.subscribe`, `ctx.audit.list` and `ctx.audit.exportBatches` under `audit:read`
+- `ctx.hosts.importMany`, `importSshConfig`, `exportMany` and `registerImportNormalizer`, with the `hosts:export` capability
+- `ctx.credentials.publicKey` and `resolveKeyRefs`, `ctx.ssh.exec`, and `@termix-ssh/plugin-sdk/ssh-keys`
+- `ctx.hosts.status.provide` and `ctx.hosts.activity.provide` so a plugin can own host status and recent activity, with `ctx.network.tcpProbe`, `ctx.ssh.probe`, `ctx.hosts.probeTargets` and `ctx.hosts.sessionActive`
+- `registerHostStatusIndicator` and `registerHostEditorToolbarItem`, and `order` for host badges
+- Onboarding steps can sit in a `start` section, take a `position` and `replaces` a core step
+- A plugin can provide the app name, tagline and logo through the `<id>.brandingProvider` registry key
+
+## 1.0.12
+
+Plugin API 1.4.0.
+
+### Added
+
+- `contributes.layouts` and `app.registerLayout()` for a whole-app layout, with the `ui:layout` capability. Needs `engine.api` 1.4
+- `contributes.themes` for CSS-only themes, with the `ui:theme` capability. `termix-plugin validate` checks theme CSS and `pack` ships it
+- `useShell()` gives a layout the live shell: tabs, splits, hosts, docks, the command palette and the registries. The shell's home tab is left out until some plugin registers a `dashboard` tab type
+- `TabStage` and `ShellConfirmCapture` in `@termix-ssh/plugin-sdk/ui`, for a layout to place tabs
+- `validateThemeCss()` in `@termix-ssh/plugin-sdk/manifest`
+- `@termix-ssh/plugin-sdk/ui` also exports what a whole layout is built from: the API client, shared types, hooks, `useShellController()` and `APP_VERSION`. These reach into core, so they can change with a core release
+- `@termix-ssh/plugin-sdk/testing-host` exports the registries and permission seam a layout's own tests fill directly
+- A plugin that only holds themes needs no source: `termix-plugin build` writes an empty backend and `validate` does not ask for a frontend
+- `termix-plugin validate` flags `ui:layout` or `ui:theme` with nothing contributed, and a layout plugin with no frontend
+
+### Fixed
+
+- The manifest JSON schema lists the `notify:hub` and `plugins:read` capabilities
+- Plugin tests and type checks work with the SDK linked from a local Termix checkout
+
+## 1.0.11
+
+Plugin API 1.3.0.
+
+### Added
+
+- `ctx.auth.issueUserToken()` mints a short-lived session for a user, for calling Termix's own API as them from background work. Needs `users:impersonate` and `engine.api` 1.3
+- `ctx.users.getLocale()` reads a user's UI language. Needs `users:read` and `engine.api` 1.3
+
+## 1.0.10
+
+### Changed
+
+- `termix-plugin pack` includes the plugin's `LICENSE` and `NOTICE` files, so third-party notices ship with it
+
+## 1.0.9
+
+### Added
+
+- Worker entries in `package.json` `termix.workers`, each bundled on its own into `dist/workers/<name>.js`
+- A `.wasm`, `.ttf` or `.otf` import gives the file's bytes, in `termix-plugin build` and in plugin tests
+
+### Fixed
+
+- The plugin guide listed jszip, guacamole-lite and @anthropic-ai/sdk as shared packages, but they are bundled
+
+## 1.0.8
+
+### Added
+
+- `publicRateLimit` on `ctx.http.router()`, for a plugin whose public routes serve a proxied page
+
+## 1.0.7
+
+### Fixed
+
+- A migration file, or a part of one, holding only comments made core fail to start the plugin
+
+## 1.0.6
+
+### Added
+
+- `PLUGIN-GUIDE.md`, a guide to building, testing and releasing a plugin, written so AI coding tools can read it too
+
 ## 1.0.5
 
 ### Fixed

packages/plugin-sdk/README.md

@@ -50,7 +50,7 @@ in place of the flags. Reload the page to pick up frontend changes.
 
 ## Support
 
-Bugs and ideas for the SDK or the `termix-plugin` CLI go in the [Termix repo](https://github.com/Termix-SSH/Termix/issues/new/choose). You need to be logged in to GitHub. Please be as detailed as possible, preferably in English.
+Bugs and ideas for the SDK or the `termix-plugin` CLI go in the [Termix repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Add as much detail as you can, in English if possible.
 
 For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server.
 
@@ -58,4 +58,4 @@ For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf)
 
 ## License
 
-Distributed under the Apache License Version 2.0. See [LICENSE](https://github.com/Termix-SSH/Termix/blob/main/LICENSE) for more information.
+Apache License 2.0. See [LICENSE](https://github.com/Termix-SSH/Termix/blob/main/LICENSE).

packages/plugin-sdk/cli/commands/build.mjs

@@ -5,7 +5,12 @@ import { fileURLToPath } from "node:url";
 import * as esbuild from "esbuild";
 import { BACKEND_EXTERNALS, FRONTEND_EXTERNALS } from "../lib/externals.mjs";
 import { staticUrlImports } from "../lib/static-url-imports.mjs";
-import { readManifest, resolveEntry, copyDir } from "../lib/plugin-dir.mjs";
+import {
+  readManifest,
+  resolveEntry,
+  copyDir,
+  isThemeOnly,
+} from "../lib/plugin-dir.mjs";
 import { openapi } from "./openapi.mjs";
 import { splitByCoreClasses } from "../lib/css-classes.mjs";
 
@@ -20,6 +25,43 @@ const FRONTEND_ENTRIES = [
   "src/frontend/index.mjs",
   "src/frontend/index.js",
 ];
+const MOBILE_ENTRIES = [
+  "src/mobile/index.tsx",
+  "src/mobile/index.ts",
+  "src/mobile/index.mjs",
+  "src/mobile/index.js",
+];
+
+/** Builds a bundle that runs in a browser against core's shared modules. */
+async function buildBrowserBundle(entry, outfile, outDir) {
+  await esbuild.build({
+    entryPoints: [entry],
+    outfile,
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    jsx: "automatic",
+    sourcemap: true,
+    logLevel: "warning",
+    external: FRONTEND_EXTERNALS,
+    // Vite replaces these in the dev server; a plugin bundle has to have
+    // them too, or code that reads them throws when the plugin loads.
+    define: {
+      "process.env.NODE_ENV": '"production"',
+      "import.meta.env.DEV": "false",
+      "import.meta.env.PROD": "true",
+      "import.meta.env.MODE": '"production"',
+      "import.meta.env.SSR": "false",
+      "import.meta.env":
+        '{"DEV":false,"PROD":true,"MODE":"production","SSR":false,"BASE_URL":"/"}',
+    },
+    plugins: [
+      externalRequireInterop(FRONTEND_EXTERNALS),
+      staticUrlImports({ outDir }),
+    ],
+  });
+}
 
 /**
  * A bundled CommonJS package that calls require("react/jsx-runtime") (or any
@@ -52,6 +94,43 @@ export function externalRequireInterop(externals) {
   };
 }
 
+// A .wasm or font import becomes its bytes (a Uint8Array) inside the bundle,
+// so it ships in backend.js or a worker with no separate file to find.
+export const BINARY_EXTENSIONS = [".wasm", ".ttf", ".otf"];
+const BINARY_LOADERS = Object.fromEntries(
+  BINARY_EXTENSIONS.map((ext) => [ext, "binary"]),
+);
+
+const REQUIRE_BANNER =
+  "import { createRequire as __termixCreateRequire } from 'node:module'; const require = __termixCreateRequire(import.meta.url);";
+
+/**
+ * package.json "termix": { "workers": { "engine": "src/backend/engine/worker.ts" } }
+ * bundles each entry on its own into dist/workers/<name>.js, for
+ * new Worker(new URL("./workers/<name>.js", import.meta.url)). Nothing is left
+ * external: core's import fallback only runs on the main thread, so a worker
+ * can't rely on host packages and must not import the SDK.
+ */
+export function readWorkerEntries(cwd, pluginId) {
+  const pkgPath = path.join(cwd, "package.json");
+  const pkg = fs.existsSync(pkgPath)
+    ? JSON.parse(fs.readFileSync(pkgPath, "utf8"))
+    : {};
+  const workers = pkg.termix?.workers ?? {};
+  return Object.entries(workers).map(([name, entry]) => {
+    if (!/^[a-z0-9-]+$/.test(name)) {
+      throw new Error(`${pluginId}: worker name "${name}" must be lowercase`);
+    }
+    const file = path.resolve(cwd, String(entry));
+    if (!fs.existsSync(file)) {
+      throw new Error(
+        `${pluginId}: worker "${name}" entry ${entry} is missing`,
+      );
+    }
+    return { name, file };
+  });
+}
+
 const SDK_PATCHES = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
   "..",
@@ -150,15 +229,12 @@ export async function buildTailwind(cwd, outDir) {
   // build() adds to what a compiler already emitted, so each half gets its own.
   const compiler = () =>
     compile(input, { base: path.dirname(THEME_CSS), onDependency: () => {} });
-  const scanner = new Scanner({
-    sources: [
-      {
-        base: path.join(cwd, "src", "frontend"),
-        pattern: "**/*",
-        negated: false,
-      },
-    ],
-  });
+  // The mobile bundle uses the same stylesheet.
+  const sources = ["frontend", "mobile"]
+    .map((dir) => path.join(cwd, "src", dir))
+    .filter((dir, index) => index === 0 || fs.existsSync(dir))
+    .map((base) => ({ base, pattern: "**/*", negated: false }));
+  const scanner = new Scanner({ sources });
   // Flattened and minified the way core's own CSS is, so it does not rely
   // on native CSS nesting.
   const emit = async (candidates, options) =>
@@ -195,33 +271,56 @@ export async function build({ cwd }) {
   fs.mkdirSync(outDir, { recursive: true });
 
   const backendEntry = resolveEntry(cwd, BACKEND_ENTRIES);
-  if (!backendEntry) {
+  if (!backendEntry && !isThemeOnly(manifest)) {
     throw new Error(
       `${pluginId}: no backend entry (looked for ${BACKEND_ENTRIES.join(", ")})`,
     );
   }
 
-  await esbuild.build({
-    entryPoints: [backendEntry],
-    outfile: path.join(outDir, "backend.js"),
-    bundle: true,
-    format: "esm",
-    platform: "node",
-    target: "node22",
-    sourcemap: true,
-    logLevel: "warning",
-    // A native dependency's compiled .node binary is resolved by the
-    // package's own relative paths, which break once esbuild inlines its JS
-    // elsewhere. Declaring it in nativeDependencies keeps it a real
-    // node_modules import instead, resolved at runtime like a host-provided
-    // package.
-    external: [...BACKEND_EXTERNALS, ...(manifest.nativeDependencies ?? [])],
-    // Bundled CJS deps still call require() for Node builtins at runtime.
-    // ESM has no ambient require, so give esbuild's require shim a real one.
-    banner: {
-      js: "import { createRequire as __termixCreateRequire } from 'node:module'; const require = __termixCreateRequire(import.meta.url);",
-    },
-  });
+  if (backendEntry) {
+    await esbuild.build({
+      entryPoints: [backendEntry],
+      outfile: path.join(outDir, "backend.js"),
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node22",
+      sourcemap: true,
+      logLevel: "warning",
+      // A native dependency's compiled .node binary is resolved by the
+      // package's own relative paths, which break once esbuild inlines its JS
+      // elsewhere. Declaring it in nativeDependencies keeps it a real
+      // node_modules import instead, resolved at runtime like a host-provided
+      // package.
+      external: [...BACKEND_EXTERNALS, ...(manifest.nativeDependencies ?? [])],
+      loader: BINARY_LOADERS,
+      // Bundled CJS deps still call require() for Node builtins at runtime.
+      // ESM has no ambient require, so give esbuild's require shim a real one.
+      banner: { js: REQUIRE_BANNER },
+    });
+  } else {
+    // Core loads every plugin through a backend entry, so a theme only
+    // plugin gets an empty one.
+    fs.writeFileSync(
+      path.join(outDir, "backend.js"),
+      "export function activate() {}\n",
+    );
+  }
+
+  for (const worker of readWorkerEntries(cwd, pluginId)) {
+    await esbuild.build({
+      entryPoints: [worker.file],
+      outfile: path.join(outDir, "workers", `${worker.name}.js`),
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node22",
+      sourcemap: true,
+      logLevel: "warning",
+      loader: BINARY_LOADERS,
+      banner: { js: REQUIRE_BANNER },
+    });
+  }
 
   // Without this Node finds the host's typeless package.json, tries backend.js
   // as CommonJS first and warns before reparsing it as ESM.
@@ -232,33 +331,18 @@ export async function build({ cwd }) {
 
   const frontendEntry = resolveEntry(cwd, FRONTEND_ENTRIES);
   if (frontendEntry) {
-    await esbuild.build({
-      entryPoints: [frontendEntry],
-      outfile: path.join(outDir, "frontend.js"),
-      bundle: true,
-      format: "esm",
-      platform: "browser",
-      target: "es2022",
-      jsx: "automatic",
-      sourcemap: true,
-      logLevel: "warning",
-      external: FRONTEND_EXTERNALS,
-      // Vite replaces these in the dev server; a plugin bundle has to have
-      // them too, or code that reads them throws when the plugin loads.
-      define: {
-        "process.env.NODE_ENV": '"production"',
-        "import.meta.env.DEV": "false",
-        "import.meta.env.PROD": "true",
-        "import.meta.env.MODE": '"production"',
-        "import.meta.env.SSR": "false",
-        "import.meta.env":
-          '{"DEV":false,"PROD":true,"MODE":"production","SSR":false,"BASE_URL":"/"}',
-      },
-      plugins: [
-        externalRequireInterop(FRONTEND_EXTERNALS),
-        staticUrlImports({ outDir }),
-      ],
-    });
+    await buildBrowserBundle(
+      frontendEntry,
+      path.join(outDir, "frontend.js"),
+      outDir,
+    );
+  }
+
+  // A bundle the mobile app loads in its WebView, next to the frontend one.
+  const mobileEntry = resolveEntry(cwd, MOBILE_ENTRIES);
+  const mobileOut = manifest.contributes?.mobile?.entry;
+  if (mobileEntry && typeof mobileOut === "string") {
+    await buildBrowserBundle(mobileEntry, path.join(cwd, mobileOut), outDir);
   }
 
   if (frontendEntry) await buildTailwind(cwd, outDir);

packages/plugin-sdk/cli/commands/pack.mjs

@@ -1,7 +1,12 @@
 import fs from "node:fs";
 import path from "node:path";
 import { readManifest } from "../lib/plugin-dir.mjs";
-import { collectFiles, createTmxplug } from "../lib/tmxplug.mjs";
+import {
+  collectFiles,
+  createTmxplug,
+  themeFiles,
+  TMXPLUG_CONTENTS,
+} from "../lib/tmxplug.mjs";
 import { sha256 } from "../lib/signing.mjs";
 import { validate } from "./validate.mjs";
 
@@ -32,7 +37,12 @@ export async function pack({ cwd, args = [] }) {
   fs.mkdirSync(outDir, { recursive: true });
   const outfile = path.join(outDir, `${pluginId}-${version}.tmxplug`);
 
-  const archive = createTmxplug(cwd, collectFiles(cwd));
+  const archive = createTmxplug(
+    cwd,
+    collectFiles(cwd, [
+      ...new Set([...TMXPLUG_CONTENTS, ...themeFiles(manifest)]),
+    ]),
+  );
   fs.writeFileSync(outfile, archive);
 
   console.log(`packed ${path.basename(outfile)}`);

packages/plugin-sdk/cli/commands/validate.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { readManifest } from "../lib/plugin-dir.mjs";
+import { readManifest, isThemeOnly } from "../lib/plugin-dir.mjs";
 
 /**
  * The manifest rules live in src/manifest.ts, which the server uses too, so
@@ -17,7 +17,7 @@ export async function loadSdkModule(name) {
 
 export async function validate({ cwd }) {
   const raw = readManifest(cwd);
-  const { parseManifest } = await loadSdkModule("manifest");
+  const { parseManifest, validateThemeCss } = await loadSdkModule("manifest");
   const { errors } = parseManifest(raw);
 
   const problems = [...errors];
@@ -25,8 +25,13 @@ export async function validate({ cwd }) {
   // The manifest names files. They have to be there.
   const referenced = [
     raw.backend ?? "dist/backend.js",
-    raw.frontend ?? "dist/frontend.js",
+    // A theme only plugin has no frontend code.
+    ...(isThemeOnly(raw) ? [] : [raw.frontend ?? "dist/frontend.js"]),
     raw.locales ?? "locales",
+    // Built from src/mobile by termix-plugin build.
+    ...(typeof raw.contributes?.mobile?.entry === "string"
+      ? [raw.contributes.mobile.entry]
+      : []),
   ];
   for (const rel of referenced) {
     if (!fs.existsSync(path.join(cwd, rel))) {
@@ -34,6 +39,8 @@ export async function validate({ cwd }) {
     }
   }
 
+  problems.push(...validateThemeFiles(cwd, raw, validateThemeCss));
+  problems.push(...validateLookCapabilities(cwd, raw));
   problems.push(
     ...(await validateMigrations(cwd, raw.id ?? path.basename(cwd))),
   );
@@ -53,6 +60,63 @@ export async function validate({ cwd }) {
   console.log(`ok  ${raw.id ?? path.basename(cwd)}`);
 }
 
+/** Every declared theme file exists and holds only CSS a theme may hold. */
+export function validateThemeFiles(cwd, raw, validateThemeCss) {
+  const problems = [];
+  const themes = raw?.contributes?.themes;
+  if (!Array.isArray(themes)) return problems;
+  for (const theme of themes) {
+    if (typeof theme?.css !== "string" || typeof theme?.id !== "string") {
+      continue;
+    }
+    const file = path.join(cwd, theme.css);
+    if (!fs.existsSync(file)) {
+      problems.push(`theme ${theme.id}: ${theme.css} does not exist`);
+      continue;
+    }
+    for (const error of validateThemeCss(
+      fs.readFileSync(file, "utf8"),
+      theme.id,
+    )) {
+      problems.push(`theme ${theme.id}: ${error}`);
+    }
+  }
+  return problems;
+}
+
+/**
+ * ui:layout and ui:theme must match what the manifest contributes, both
+ * ways. The manifest check already flags a contribution without its
+ * capability; this flags a capability with nothing behind it, and a layout
+ * with no frontend to register it.
+ */
+export function validateLookCapabilities(cwd, raw) {
+  const problems = [];
+  const capabilities = Array.isArray(raw?.capabilities) ? raw.capabilities : [];
+  const layouts = raw?.contributes?.layouts;
+  const themes = raw?.contributes?.themes;
+  const hasLayouts = Array.isArray(layouts) && layouts.length > 0;
+  const hasThemes = Array.isArray(themes) && themes.length > 0;
+  if (capabilities.includes("ui:layout") && !hasLayouts) {
+    problems.push('"ui:layout" is declared but contributes.layouts is empty');
+  }
+  if (capabilities.includes("ui:theme") && !hasThemes) {
+    problems.push('"ui:theme" is declared but contributes.themes is empty');
+  }
+  if (hasLayouts) {
+    const entries = ["index.tsx", "index.ts", "index.mjs", "index.js"];
+    const frontend = entries.some((entry) =>
+      fs.existsSync(path.join(cwd, "src", "frontend", entry)),
+    );
+    if (!frontend && raw.frontend === undefined) {
+      problems.push(
+        "contributes.layouts needs a frontend that calls app.registerLayout",
+      );
+    }
+  }
+  return problems;
+}
+
 /** Env vars core sets for everyone, so a plugin need not list them. */
 const CORE_ENV = new Set([
   "DATA_DIR",

packages/plugin-sdk/cli/lib/plugin-dir.mjs

@@ -14,6 +14,17 @@ export function readManifest(cwd) {
 }
 
 /** The first of these that exists, or null. */
+/** Only themes: CSS files and no code, so no source entry is needed. */
+export function isThemeOnly(manifest) {
+  const capabilities = manifest.capabilities ?? [];
+  return (
+    capabilities.length > 0 &&
+    capabilities.every((capability) => capability === "ui:theme") &&
+    Array.isArray(manifest.contributes?.themes) &&
+    manifest.contributes.themes.length > 0
+  );
+}
+
 export function resolveEntry(cwd, candidates) {
   for (const candidate of candidates) {
     const full = path.join(cwd, candidate);

packages/plugin-sdk/cli/lib/tmxplug.mjs

@@ -2,6 +2,15 @@ import fs from "node:fs";
 import path from "node:path";
 import zlib from "node:zlib";
 
+/** Theme CSS files a manifest declares, which travel with the plugin too. */
+export function themeFiles(manifest) {
+  const themes = manifest?.contributes?.themes;
+  if (!Array.isArray(themes)) return [];
+  return themes
+    .map((theme) => theme?.css)
+    .filter((css) => typeof css === "string");
+}
+
 /** What a .tmxplug holds, in the order the spec lists it. */
 export const TMXPLUG_CONTENTS = [
   "manifest.json",
@@ -11,6 +20,9 @@ export const TMXPLUG_CONTENTS = [
   "README.md",
   "CHANGELOG.md",
   "icon.svg",
+  // Licence texts, so third-party notices travel with the plugin.
+  "LICENSE",
+  "NOTICE",
 ];
 
 const BLOCK = 512;

packages/plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.5",
+  "version": "1.0.22",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {
@@ -81,10 +81,18 @@
       "types": "./dist/host-commands.d.ts",
       "default": "./dist/host-commands.js"
     },
+    "./host-scripts": {
+      "types": "./dist/host-scripts/index.d.ts",
+      "default": "./dist/host-scripts/index.js"
+    },
     "./ssh-certs": {
       "types": "./dist/ssh-certs.d.ts",
       "default": "./dist/ssh-certs.js"
     },
+    "./ssh-keys": {
+      "types": "./dist/ssh-keys.d.ts",
+      "default": "./dist/ssh-keys.js"
+    },
     "./tsconfig.plugin.json": "./tsconfig.plugin.json",
     "./schema/manifest.schema.json": "./schema/manifest.schema.json",
     "./ui": {
@@ -94,6 +102,10 @@
     "./testing-host": {
       "default": "./dist/host/testing-host.js"
     },
+    "./frame-host": {
+      "default": "./dist/host/frame-host.js"
+    },
+    "./frame-host.css": "./dist/host/frame-host.css",
     "./theme.css": "./dist/host/theme.css"
   },
   "files": [
@@ -103,6 +115,7 @@
     "tsconfig.plugin.json",
     "README.md",
     "CHANGELOG.md",
+    "PLUGIN-GUIDE.md",
     "client.d.ts"
   ],
   "scripts": {

packages/plugin-sdk/schema/manifest.schema.json

@@ -82,7 +82,11 @@
     "features": {
       "type": "array",
       "maxItems": 20,
-      "items": { "type": "string", "minLength": 1, "maxLength": 160 },
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 160
+      },
       "description": "Short lines listing what the plugin does, shown on its page."
     },
     "docs": {
@@ -98,11 +102,24 @@
         "additionalProperties": false,
         "required": ["name", "description"],
         "properties": {
-          "name": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{0,63}$" },
-          "description": { "type": "string", "minLength": 1, "maxLength": 300 },
-          "default": { "type": "string" },
-          "required": { "type": "boolean" },
-          "secret": { "type": "boolean" }
+          "name": {
+            "type": "string",
+            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
+          },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 300
+          },
+          "default": {
+            "type": "string"
+          },
+          "required": {
+            "type": "boolean"
+          },
+          "secret": {
+            "type": "boolean"
+          }
         }
       }
     },
@@ -134,9 +151,13 @@
           "process:spawn",
           "users:write",
           "auth:provide",
+          "auth:policy",
+          "sync:provide",
+          "ssh:transport",
           "system:tls",
           "device:serial",
           "hosts:write",
+          "hosts:export",
           "credentials:use",
           "credentials:write",
           "network:outbound",
@@ -146,7 +167,12 @@
           "events:core",
           "notify:send",
           "audit:read",
+          "network:probe",
+          "hosts:status-provide",
+          "hosts:activity-provide",
+          "hosts:lock",
           "desktop:window",
+          "desktop:local",
           "users:impersonate",
           "db:core-refs",
           "hosts:read",
@@ -155,7 +181,11 @@
           "files:own",
           "secrets:own",
           "settings:read-core",
-          "ui:surface"
+          "ui:surface",
+          "notify:hub",
+          "plugins:read",
+          "ui:layout",
+          "ui:theme"
         ]
       }
     },
@@ -944,7 +974,9 @@
                       "defaultLevels": {
                         "type": "array",
                         "minItems": 1,
-                        "items": { "enum": ["admin", "user", "folder"] },
+                        "items": {
+                          "enum": ["admin", "user", "folder"]
+                        },
                         "description": "Levels that may set a default for the field. All three by default."
                       },
                       "personal": {
@@ -1127,6 +1159,128 @@
             "type": "string",
             "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)+$"
           }
+        },
+        "layouts": {
+          "type": "array",
+          "description": "Whole-app layouts the frontend registers with app.registerLayout. Needs the ui:layout capability.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "label"],
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{1,39}$"
+              },
+              "label": {
+                "type": "string",
+                "minLength": 1,
+                "description": "i18n key in the plugin namespace, or plain text."
+              },
+              "description": {
+                "type": "string",
+                "minLength": 1
+              },
+              "defaultTheme": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{1,39}$",
+                "description": "Theme picked with this layout when nobody chose one."
+              },
+              "default": {
+                "type": "boolean",
+                "description": "The layout a default-look plugin starts with. At most one."
+              }
+            }
+          }
+        },
+        "themes": {
+          "type": "array",
+          "description": "Themes: one CSS file each with token rules scoped under .<id>. Needs the ui:theme capability.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "label", "mode", "css"],
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{1,39}$"
+              },
+              "label": {
+                "type": "string",
+                "minLength": 1
+              },
+              "mode": {
+                "type": "string",
+                "enum": ["light", "dark"]
+              },
+              "css": {
+                "type": "string",
+                "pattern": ".css$",
+                "description": "Path of the CSS file inside the plugin."
+              },
+              "swatch": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["background", "panel", "text"],
+                "properties": {
+                  "background": {
+                    "type": "string",
+                    "pattern": "^#[0-9a-fA-F]{3,8}$"
+                  },
+                  "panel": {
+                    "type": "string",
+                    "pattern": "^#[0-9a-fA-F]{3,8}$"
+                  },
+                  "text": {
+                    "type": "string",
+                    "pattern": "^#[0-9a-fA-F]{3,8}$"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "mobile": {
+          "type": "object",
+          "description": "How the plugin shows in the Termix mobile app. Needs plugin API 1.13 (Termix 26.10.6).",
+          "additionalProperties": false,
+          "required": ["mode"],
+          "properties": {
+            "mode": {
+              "type": "string",
+              "enum": ["webview", "native", "none"],
+              "description": "webview: the app shows the plugin's UI from the server. native: the app has its own screens. none: nothing to show in the app."
+            },
+            "entry": {
+              "type": "string",
+              "pattern": "\\.js$",
+              "description": "webview only. A bundle built for the app, in the same folder as the frontend bundle. Unset means the normal frontend runs in a phone sized frame."
+            },
+            "sizes": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": { "type": "string", "enum": ["phone", "tablet"] },
+              "description": "webview only. Screen sizes the UI works at. Defaults to both."
+            },
+            "views": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": { "type": "string", "minLength": 1 },
+              "description": "webview only. Tab, panel or card ids the app offers. Defaults to every tab."
+            },
+            "feature": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]{1,39}$",
+              "description": "native only. The app feature that stands in for this plugin. Defaults to the plugin id."
+            },
+            "note": {
+              "type": "string",
+              "minLength": 1,
+              "description": "i18n key in the plugin's namespace, or plain text, shown in the app."
+            }
+          }
         }
       }
     },
@@ -1158,6 +1312,11 @@
       "enum": ["mirror", "local", "server"],
       "description": "How a desktop linked to a server treats this plugin: mirror follows the server, local is decided on each desktop, server never runs on a linked desktop. Defaults to mirror."
     },
+    "runtime": {
+      "type": "string",
+      "enum": ["desktop"],
+      "description": "desktop: the plugin only loads on a desktop app's own embedded backend, never on a server. It implies desktop local and may declare desktop:local."
+    },
     "nativeDependencies": {
       "type": "array",
       "minItems": 1,

packages/plugin-sdk/src/capabilities.ts

@@ -47,20 +47,30 @@ export const CAPABILITY_CATALOG: readonly CapabilityInfo[] = [
   entry("users:impersonate", "high"),
   entry("db:core-refs", "high"),
   entry("auth:provide", "high"),
+  entry("auth:policy", "high"),
+  entry("sync:provide", "high"),
+  entry("ssh:transport", "high"),
   entry("device:serial", "high"),
   entry("notify:hub", "high"),
+  entry("ui:layout", "high"),
 
   entry("hosts:write", "medium"),
+  entry("hosts:export", "high"),
   entry("credentials:use", "medium"),
   entry("credentials:write", "medium"),
   entry("network:outbound", "medium"),
   entry("network:serve", "medium"),
   entry("network:broadcast", "medium"),
+  entry("network:probe", "medium"),
+  entry("hosts:status-provide", "medium"),
+  entry("hosts:activity-provide", "medium"),
+  entry("hosts:lock", "medium"),
   entry("users:read", "medium"),
   entry("events:core", "medium"),
   entry("notify:send", "medium"),
   entry("audit:read", "medium"),
   entry("desktop:window", "medium"),
+  entry("desktop:local", "high"),
 
   entry("hosts:read", "low"),
   entry("db:own", "low"),
@@ -70,6 +80,7 @@ export const CAPABILITY_CATALOG: readonly CapabilityInfo[] = [
   entry("settings:read-core", "low"),
   entry("plugins:read", "low"),
   entry("ui:surface", "low"),
+  entry("ui:theme", "low"),
 ] as const;
 
 export const CAPABILITY_IDS: readonly string[] = CAPABILITY_CATALOG.map(

packages/plugin-sdk/src/db.ts

@@ -256,6 +256,7 @@ export const LEGACY_TABLE_OWNERS: Readonly<Record<string, string>> = {
   homepage_items: "homepage",
   homepage_layouts: "homepage",
   dashboard_service_links: "homepage",
+  recent_activity: "homepage",
   secret_sources: "secret-sources",
   opkssh_tokens: "opkssh",
   vault_profiles: "vault",

packages/plugin-sdk/src/ddl.ts

@@ -309,17 +309,27 @@ export function splitStatements(source: string): string[] {
       continue;
     }
     if (char === ";") {
-      if (current.trim()) statements.push(current.trim());
+      if (hasSql(current)) statements.push(current.trim());
       current = "";
       continue;
     }
     current += char;
   }
 
-  if (current.trim()) statements.push(current.trim());
+  if (hasSql(current)) statements.push(current.trim());
   return statements;
 }
 
+/** False for a chunk that is only comments, which a driver refuses to run. */
+function hasSql(chunk: string): boolean {
+  return (
+    chunk
+      .replace(/--[^\n]*/g, "")
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .trim() !== ""
+  );
+}
+
 /** DROP statement for a definition, for removePluginData. */
 export function dropTableSql(
   dialect: SqlDialect,

packages/plugin-sdk/src/desktop.ts

@@ -3,8 +3,6 @@
  * only inside the Termix desktop app; check isElectron before calling it.
  */
 
-import type { PluginSshPromptRequest } from "./backend.js";
-
 export interface ServerConfig {
   serverUrl?: string;
   allowInvalidCertificate?: boolean;
@@ -33,31 +31,21 @@ export interface DialogResult {
   [key: string]: unknown;
 }
 
-export interface LocalDirectoryResult {
-  success: boolean;
-  path: string;
-  parent?: string;
-  entries: LocalFileEntry[];
-  error?: string;
-}
-
-export interface LocalCollectedFile {
-  path: string;
-  name: string;
-  relativePath: string;
-  size: number;
-  created?: string;
-  modified: string;
-}
-
-export type LocalPathMutationResult =
-  | ({ success: true } & Partial<LocalFileEntry>)
-  | { success: false; error?: string };
-
 export interface ElectronAPI {
   getAppVersion: () => Promise<string>;
   setZoomFactor?: (factor: number) => void;
   getPlatform: () => Promise<string>;
+  /** Whether the app-drawn title bar shows in this window. */
+  getTitleBarVisible?: () => Promise<boolean>;
+  /** Calls back when the title bar shows or hides; returns an unsubscribe. */
+  onTitleBarVisibleChange?: (
+    callback: (visible: boolean) => void,
+  ) => () => void;
+  /** Keeps the window controls the system draws in the colors of the theme. */
+  setTitleBarOverlay?: (colors: {
+    color?: string;
+    symbolColor?: string;
+  }) => Promise<void>;
   getSetting?: (key: string) => Promise<string | null | undefined>;
   setSetting?: (key: string, value: string) => Promise<void>;
 
@@ -67,60 +55,6 @@ export interface ElectronAPI {
     serverUrl: string,
     allowInvalidCertificate?: boolean,
   ) => Promise<ConnectionTestResult>;
-  answerC2SAuth: (id: string, answer: string | null) => Promise<boolean>;
-  onC2SAuthPrompt: (
-    callback: (prompt: {
-      id: string;
-      closed?: boolean;
-      tunnelName?: string;
-      request?: PluginSshPromptRequest;
-    }) => void,
-  ) => () => void;
-  getC2STunnelConfig: () => Promise<unknown[]>;
-  saveC2STunnelConfig: (
-    config: unknown[],
-  ) => Promise<{ success: boolean; error?: string }>;
-  checkLocalPortAvailable: (
-    host: string,
-    port: number,
-  ) => Promise<{ available: boolean; error?: string }>;
-  getC2STunnelPresetDefaultName: () => Promise<string>;
-  startC2STunnel: (
-    tunnel: unknown,
-    index: number,
-    authToken?: string,
-  ) => Promise<{
-    success: boolean;
-    tunnelName?: string;
-    error?: string;
-    code?: string;
-  }>;
-  testC2STunnel: (
-    tunnel: unknown,
-    index: number,
-    authToken?: string,
-  ) => Promise<{
-    success: boolean;
-    message?: string;
-    error?: string;
-    code?: string;
-  }>;
-  stopC2STunnel: (
-    tunnelName: string,
-  ) => Promise<{ success: boolean; error?: string }>;
-  getC2STunnelStatuses: () => Promise<Record<string, unknown>>;
-  onC2STunnelStatuses?: (
-    callback: (statuses: Record<string, unknown>) => void,
-  ) => () => void;
-  startC2SAutoStartTunnels: () => Promise<{
-    success: boolean;
-    started: number;
-    errors: string[];
-  }>;
-  /** Where the linked server relays client tunnel streams, a /plugin-ws/ path. */
-  setC2SRelayPath?: (
-    relayPath: string,
-  ) => Promise<{ success: boolean; error?: string }>;
   onCloseActiveTab?: (callback: () => void) => () => void;
   clearSessionCookies: () => Promise<void>;
   getSessionCookie: (
@@ -136,62 +70,6 @@ export interface ElectronAPI {
 
   showSaveDialog: (options: DialogOptions) => Promise<DialogResult>;
   showOpenDialog: (options: DialogOptions) => Promise<DialogResult>;
-  getLocalHomeDirectory?: () => Promise<string>;
-  listLocalDirectory?: (path?: string) => Promise<LocalDirectoryResult>;
-  statLocalPaths?: (
-    paths: string[],
-  ) => Promise<
-    Array<
-      | (LocalFileEntry & { success: true })
-      | { success: false; path: string; error?: string }
-    >
-  >;
-  collectLocalFiles?: (paths: string[]) => Promise<{
-    success: boolean;
-    files: LocalCollectedFile[];
-    truncated?: boolean;
-    error?: string;
-  }>;
-  createLocalFolder?: (
-    parentPath: string,
-    folderName: string,
-  ) => Promise<LocalPathMutationResult>;
-  renameLocalPath?: (
-    path: string,
-    newName: string,
-  ) => Promise<LocalPathMutationResult>;
-  trashLocalPath?: (path: string) => Promise<LocalPathMutationResult>;
-  chmodLocalPath?: (
-    path: string,
-    permissions: string,
-  ) => Promise<LocalPathMutationResult>;
-
-  openExternalEditor: (fileData: {
-    fileName: string;
-    content: string;
-    encoding?: "utf8" | "base64";
-    editorPath?: string | null;
-  }) => Promise<{
-    success: boolean;
-    editId?: string;
-    path?: string;
-    error?: string;
-  }>;
-
-  closeExternalEditor: (editId: string) => Promise<{
-    success: boolean;
-    error?: string;
-  }>;
-
-  onExternalEditorSaved?: (
-    callback: (payload: {
-      editId: string;
-      content: string;
-      encoding: "utf8";
-      path: string;
-    }) => void,
-  ) => () => void;
-
   onUpdateAvailable: (callback: () => void) => void;
   onUpdateDownloaded: (callback: () => void) => void;
 
@@ -238,159 +116,6 @@ export interface ElectronAPI {
     success: boolean;
     error?: string;
   }>;
-
-  startLocalTerminal(dimensions: {
-    cols: number;
-    rows: number;
-    shell?: "default" | "wsl";
-  }): Promise<{ sessionId: string; shell: string }>;
-  readyLocalTerminal(sessionId: string): Promise<boolean>;
-  writeLocalTerminal(sessionId: string, data: string): Promise<boolean>;
-  resizeLocalTerminal(
-    sessionId: string,
-    cols: number,
-    rows: number,
-  ): Promise<boolean>;
-  closeLocalTerminal(sessionId: string): Promise<boolean>;
-  onLocalTerminalData(
-    sessionId: string,
-    callback: (data: string) => void,
-  ): () => void;
-  onLocalTerminalExit(
-    sessionId: string,
-    callback: (exitCode: number) => void,
-  ): () => void;
-
-  /** Local disk browsing for the dual-pane file manager (desktop only). */
-  localFs?: {
-    home: () => Promise<LocalFsResult<LocalFsHomeInfo>>;
-    list: (dirPath: string) => Promise<LocalFsResult<LocalDirectoryListing>>;
-    mkdir: (
-      parentPath: string,
-      name: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    createFile: (
-      parentPath: string,
-      name: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    rename: (
-      oldPath: string,
-      newName: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    trash: (paths: string[]) => Promise<LocalFsResult<LocalTrashResult>>;
-    ensureDir: (
-      dirPath: string,
-      rootPath?: string,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    exists: (paths: string[]) => Promise<LocalFsResult<{ existing: string[] }>>;
-    walk: (paths: string[]) => Promise<LocalFsResult<LocalWalkResult>>;
-    reveal: (targetPath: string) => Promise<LocalFsResult<unknown>>;
-    open: (targetPath: string) => Promise<LocalFsResult<unknown>>;
-  };
-
-  /** Streamed local<->remote transfers driven by the main process. */
-  localTransfer?: {
-    /** The /plugin-api/<id> path that serves the streaming routes. */
-    setApiPath?: (apiPath: string) => Promise<LocalFsResult<object>>;
-    upload: (
-      options: LocalUploadRequest,
-    ) => Promise<LocalFsResult<{ bytes: number }>>;
-    download: (
-      options: LocalDownloadRequest,
-    ) => Promise<LocalFsResult<{ path: string }>>;
-    cancel: (
-      transferId: string,
-    ) => Promise<LocalFsResult<{ cancelled: boolean }>>;
-    onProgress: (
-      callback: (payload: LocalTransferProgress) => void,
-    ) => () => void;
-  };
-}
-
-export type LocalFsResult<T> =
-  ({ success: true } & T) | { success: false; error: string; code?: string };
-
-export interface LocalFsHomeInfo {
-  home: string;
-  separator: string;
-  platform: string;
-}
-
-export interface LocalFileEntry {
-  name: string;
-  path: string;
-  type: "file" | "directory" | "link" | "other";
-  created?: string;
-  modified?: string;
-  permissions?: string;
-  owner?: string;
-  group?: string;
-  size: number;
-  modifiedTimestamp?: number;
-  linkTarget?: string;
-  hidden: boolean;
-}
-
-export interface LocalDirectoryListing {
-  path: string;
-  parent: string | null;
-  entries: LocalFileEntry[];
-}
-
-export interface LocalTrashResult {
-  trashed: number;
-  failed: Array<{ path: string; error: string }>;
-}
-
-export interface LocalWalkFile {
-  localPath: string;
-  /** Path relative to the drop root; "/"-separated and includes the root's own name. */
-  relativePath: string;
-  size: number;
-}
-
-export interface LocalWalkResult {
-  files: LocalWalkFile[];
-  emptyDirs: string[];
-  totalBytes: number;
-}
-
-/**
- * Which Termix backend a transfer talks to. The main process resolves the
- * actual URL and credentials for the origin; the renderer never supplies them.
- */
-export type LocalTransferOrigin = "local" | "remote";
-
-export interface LocalUploadRequest {
-  transferId: string;
-  origin: LocalTransferOrigin;
-  fields: Record<string, string>;
-  localPath: string;
-  fileName: string;
-  deviceId?: string;
-  /** The renderer's token for the embedded backend (origin "local"); sent as a Bearer header. */
-  authToken?: string;
-}
-
-export interface LocalDownloadRequest {
-  transferId: string;
-  origin: LocalTransferOrigin;
-  body: Record<string, unknown>;
-  destPath: string;
-  /** Selected download folder; destPath must resolve strictly inside it (code EINVAL otherwise). */
-  rootPath: string;
-  expectedSize?: number;
-  /** Replace an existing file at destPath; otherwise the transfer is refused with code EEXIST. */
-  overwrite?: boolean;
-  deviceId?: string;
-  /** The renderer's token for the embedded backend (origin "local"); sent as a Bearer header. */
-  authToken?: string;
-}
-
-export interface LocalTransferProgress {
-  transferId: string;
-  transferred: number;
-  total?: number;
 }
 
 declare global {

packages/plugin-sdk/src/frontend.ts

@@ -248,6 +248,129 @@ export interface TabsApi extends Pick<
   onReady: (listener: () => void) => Disposer;
 }
 
+// ---------------------------------------------------------------------------
+// Layouts (plugin API 1.4)
+// ---------------------------------------------------------------------------
+
+/**
+ * A whole-app layout. Core renders the chosen one inside its providers and an
+ * error boundary; everything it shows comes from useShell(). Declare it in
+ * manifest contributes.layouts and add the ui:layout capability.
+ */
+export interface LayoutContribution {
+  id: string;
+  /** Your own i18n key or plain text, the same as the manifest's label. */
+  label: string;
+  component: ComponentType;
+  /** Shown on phones and narrow windows. The desktop app never uses it. */
+  mobileComponent?: ComponentType;
+  /** Theme to start with when nobody chose one. */
+  defaultTheme?: string;
+}
+
+/** A tab as a layout sees it. Splits are tabs too, with a `split` field. */
+export interface ShellTabState extends PluginTabRecord {
+  instanceId: string;
+  customLabel?: string;
+  /** Set while the tab sits in a split pane. */
+  parentSplitTabId?: string;
+  openedAt?: number;
+}
+
+/** What a dock region shows and how it is sized, in Normal-size pixels. */
+export interface ShellDockState {
+  view: string | null;
+  open: boolean;
+  width: number;
+  dragging: boolean;
+  setView: (view: string | null) => void;
+  setWidth: (width: number) => void;
+  /** Starts a drag from the dock's edge, from a mousedown. */
+  startResize: (event: { clientX: number; preventDefault: () => void }) => void;
+  resetWidth: () => void;
+}
+
+/** The live shell: state and actions, nothing drawn. Read with useShell(). */
+export interface ShellController {
+  tabs: {
+    list: ShellTabState[];
+    /** What a tab bar shows: tabs not sitting in a split. */
+    topLevel: ShellTabState[];
+    activeId: string;
+    /** True once saved tabs were restored after login. */
+    ready: boolean;
+    /** The user turned on tab numbers. */
+    showNumbers: boolean;
+    setActive: (id: string) => void;
+    reorder: (topLevel: ShellTabState[]) => void;
+    close: (id: string) => Promise<void>;
+    rename: (id: string, label: string) => void;
+    /** Reconnects or reloads a session tab. */
+    refresh: (id: string) => void;
+    reconnectAll: () => void;
+    openSingleton: (type: string) => string | undefined;
+  };
+  split: {
+    /** The split shown now, or null. */
+    activeId: string | null;
+    focusedPaneId: string | null;
+    /** Every split with its panes, for a split menu. */
+    summaries: Array<{
+      id: string;
+      label: string;
+      full: boolean;
+      panes: Array<{
+        id: string;
+        index: number;
+        tabId: string | null;
+        label: string | null;
+      }>;
+    }>;
+    activeFull: boolean;
+    /** Split a tab, apply a preset, unsplit, add to a pane. */
+    handleAction: (action: Record<string, unknown> & { kind: string }) => void;
+  };
+  hosts: {
+    list: PluginHostRecord[];
+    loading: boolean;
+    loaded: boolean;
+    reload: () => Promise<void>;
+  };
+  regions: {
+    left: ShellDockState & { view: string };
+    right: ShellDockState;
+    /** What a rail click does: toggles or switches the left dock. */
+    railClick: (view: string) => void;
+    openInRightDock: (view: string) => void;
+    toggleRightDock: () => void;
+  };
+  palette: { isOpen: boolean; open: () => void; close: () => void };
+  fullscreen: { active: boolean; toggle: () => void };
+  /** The same callbacks tabs and panels get. */
+  actions: ShellApi;
+  env: {
+    isMobile: boolean;
+    isElectron: boolean;
+    user: { username: string; isAdmin: boolean };
+    permissions: string[];
+    branding: {
+      appName: string | null;
+      tagline: string | null;
+      logo: string | null;
+    };
+  };
+  /** Core registries, as hooks a layout calls while rendering. */
+  registries: {
+    useRailItems: () => ReadonlyArray<{ id: string } & Record<string, unknown>>;
+    usePanels: () => ReadonlyArray<{ id: string } & Record<string, unknown>>;
+    useTabTypes: () => ReadonlyArray<{ id: string } & Record<string, unknown>>;
+    useDashboardCards: () => ReadonlyArray<
+      { id: string } & Record<string, unknown>
+    >;
+  };
+  logout: (options?: { manual?: boolean }) => void;
+}
+
 // ---------------------------------------------------------------------------
 // Registrations
 // ---------------------------------------------------------------------------
@@ -530,8 +653,16 @@ export interface HostBadgeContribution {
   id: string;
   when: (host: PluginHostRecord) => boolean;
   component: ComponentType<{ host: PluginHostRecord }>;
+  /** Lower comes first. Ties sort by id. */
+  order?: number;
 }
 
+/** The dot or stripe that shows a host's status on its row. */
+export type HostStatusIndicatorContribution = HostBadgeContribution;
+
+/** A control in the host editor's toolbar. */
+export type HostEditorToolbarItemContribution = HostBadgeContribution;
+
 export interface HostContextMenuItemContribution {
   id: string;
   titleKey: string;
@@ -683,6 +814,66 @@ export interface SettingsComponentProps {
   running: boolean;
 }
 
+/** What a companion starts with. Read from the plugin's own settings. */
+export interface CompanionDefaults {
+  /** Open by itself the first time a matching tab shows. */
+  open?: boolean;
+  side?: "left" | "right" | "bottom";
+  /** Pixels of width, or height at the bottom. */
+  size?: number;
+  /** Show the edge button that opens and closes it. Default true. */
+  edgeButton?: boolean;
+}
+
+/** A panel a tab type can show beside it, for a picker. */
+export interface CompanionInfo {
+  /** The id registerCompanionLayout's hidden and order lists use. */
+  id: string;
+  titleKey: string;
+  icon?: IconComponent;
+}
+
+/** How a host wants the panel bar beside a tab. */
+export interface CompanionLayout {
+  /** False removes the bar and its panels. */
+  enabled?: boolean;
+  /** Where a panel opens until the user moves it. */
+  side?: "left" | "right" | "bottom";
+  /** Companion ids in bar order. */
+  order?: string[];
+  /** Companion ids left out. */
+  hidden?: string[];
+}
+
+export interface CompanionProps {
+  /** The tab it sits beside. */
+  tab: PluginTabRecord;
+  host?: PluginHostRecord;
+  /** The host in the shape the connection APIs take. */
+  sshHost?: Record<string, unknown>;
+  /** The tab's surface handle (see TabHandle), read at call time. */
+  getHandle: () => TabHandle | null;
+  side: "left" | "right" | "bottom";
+  /** False while the tab is in the background or the panel is closed. */
+  isVisible: boolean;
+  close: () => void;
+  setSide: (side: "left" | "right" | "bottom") => void;
+}
+
+export interface CompanionOptions {
+  icon?: IconComponent;
+  titleKey?: string;
+  order?: number;
+  /** Tab types it applies to. Any tab with a host when empty. */
+  tabTypes?: string[];
+  when?: (tab: PluginTabRecord, host?: PluginHostRecord) => boolean;
+  /**
+   * A hook returning the starting state. It runs in the plugin's scope, so it
+   * can read the plugin's settings.
+   */
+  useDefaults?: () => CompanionDefaults;
+}
+
 export type ActionHandler = (...args: never[]) => unknown;
 
 export interface ActionSlotDefinition {
@@ -715,10 +906,11 @@ export type OnboardingMode = "full" | "partial" | "rerun";
  * Where a plugin step sits in onboarding. "setup" comes right after the
  * appearance steps, for things that need doing before the feature works
  * (like pointing at a guacd server). "explore" (the default) comes after
- * that, "security" after the account security step. Onboarding is for
+ * that, "security" after the account security step. "start" comes before
+ * the appearance steps, for choices that shape how the rest looks. Onboarding is for
  * choices, not for explaining features.
  */
-export type OnboardingSection = "setup" | "explore" | "security";
+export type OnboardingSection = "start" | "setup" | "explore" | "security";
 
 export interface OnboardingStepProps {
   /**
@@ -761,6 +953,16 @@ export interface OnboardingStepContribution {
   permission?: string;
   section?: OnboardingSection;
   order?: number;
+  /**
+   * Exact place in the flow, 1 to 99, instead of a section. Core steps sit at
+   * 10 (plugins), 20, 25, 30 (preset), 40 (appearance) and 90 (security).
+   */
+  position?: number;
+  /**
+   * Older step keys this step took over, like "preset". People who already
+   * saw one of them are not shown this step again.
+   */
+  replaces?: string[];
   when?: (context: {
     isAdmin: boolean;
     isDesktop: boolean;
@@ -926,12 +1128,40 @@ export interface TermixApp extends TermixAppInfo {
     component: ComponentType<TabProps>,
     options?: TabOptions,
   ) => Disposer;
+  /**
+   * A panel that sits beside any host tab the options match (a terminal, a
+   * desktop, ...), bound to that tab's host. The user opens, resizes and moves
+   * it; the tab keeps running underneath.
+   */
+  registerCompanion: (
+    id: string,
+    component: ComponentType<CompanionProps>,
+    options?: CompanionOptions,
+  ) => Disposer;
+  /**
+   * Lets a plugin decide, per host, how the panel bar looks on one tab type.
+   * Read from the host payload, so it must not call hooks.
+   */
+  registerCompanionLayout: (
+    tabType: string,
+    resolve: (host: PluginHostRecord | undefined) => CompanionLayout,
+  ) => Disposer;
+  /** Opens a companion on a tab, or closes it when it is showing. */
+  toggleCompanion: (tab: PluginTabRecord, id?: string) => void;
   registerHostEditorSection: (
     section: HostEditorSectionContribution,
   ) => Disposer;
   registerHostAction: (action: HostActionContribution) => Disposer;
   registerHostProtocol: (protocol: HostProtocolContribution) => Disposer;
   registerHostBadge: (badge: HostBadgeContribution) => Disposer;
+  /** Draws a host row's status. A layout renders every registered one. */
+  registerHostStatusIndicator: (
+    indicator: HostStatusIndicatorContribution,
+  ) => Disposer;
+  /** Adds a control to the host editor's toolbar. */
+  registerHostEditorToolbarItem: (
+    item: HostEditorToolbarItemContribution,
+  ) => Disposer;
   registerHostContextMenuItem: (
     item: HostContextMenuItemContribution,
   ) => Disposer;
@@ -988,6 +1218,12 @@ export interface TermixApp extends TermixAppInfo {
   registerSshAuthEditor: (editor: SshAuthEditorContribution) => Disposer;
   registerLoginMethod: (method: LoginMethodContribution) => Disposer;
   registerSecondFactorUI: (factor: SecondFactorContribution) => Disposer;
+  /**
+   * A whole-app layout. Declared in manifest contributes.layouts with the
+   * ui:layout capability. Only the chosen layout's plugin is loaded, so
+   * register it in activate. Needs plugin API 1.4.
+   */
+  registerLayout: (layout: LayoutContribution) => Disposer;
 
   /**
    * Translates a key from the plugin's own locales, for code outside a
@@ -1122,6 +1358,7 @@ export interface PluginHostBridge {
   useHosts: () => { hosts: PluginHostRecord[]; loaded: boolean };
   useCurrentUser: () => CurrentUser | null;
   useTheme: () => { theme: "light" | "dark" };
+  useShell: () => ShellController | null;
   toast: ToastApi;
   getApi: (pluginId: string) => PluginApiClient;
   getApiFor: (pluginId: string, origin: unknown) => PluginApiClient;
@@ -1138,6 +1375,7 @@ export interface PluginHostBridge {
   hostProtocols: (host: PluginHostRecord) => string[];
   useHostStatus: (hostId: number | undefined) => HostStatusInfo | null;
   useHostActions: () => HostActionContribution[];
+  useCompanions: (tabType: string) => CompanionInfo[];
   useActivityTypes: () => string[];
   activityTarget: (type: string) => ActivityTargetInfo | undefined;
   useExtensions: (pointId: string) => ExtensionContribution[];
@@ -1372,6 +1610,14 @@ export function useTheme(): { theme: "light" | "dark" } {
   return requireHost().useTheme();
 }
 
+/**
+ * The live shell, for a layout. Null outside the signed-in app. Needs plugin
+ * API 1.4.
+ */
+export function useShell(): ShellController | null {
+  return requireHost().useShell();
+}
+
 export function useToast(): ToastApi {
   return requireHost().toast;
 }
@@ -1465,28 +1711,49 @@ export function usePluginUiPreferences<
   return bridge.usePluginUiPreferences(bridge.usePluginId()) as never;
 }
 
+type PanelGridSize = "auto" | "1" | "2" | "3" | "4" | "5" | "6";
+const PANEL_GRID_SIZES: readonly string[] = [
+  "auto",
+  "1",
+  "2",
+  "3",
+  "4",
+  "5",
+  "6",
+];
+
 /**
- * Grid or list and row density for one of this plugin's views, kept in its
- * Appearance area as `<prefix>viewMode` and `<prefix>density`. Declare those
- * keys in contributes.uiPresets so each preset level can pick a default.
+ * Grid or list, row density and cards per row for one of this plugin's
+ * views, kept in its Appearance area as `<prefix>viewMode`, `<prefix>density`
+ * and `<prefix>columns`. Declare those keys in contributes.uiPresets so each
+ * preset level can pick a default. Hand columns to ViewToggle and DataView.
  */
 export function usePluginPanelView(prefix = ""): {
   view: "grid" | "list";
   density: "comfortable" | "compact";
   compact: boolean;
+  columns: PanelGridSize;
   setView: (view: "grid" | "list") => void;
   setDensity: (density: "comfortable" | "compact") => void;
+  setColumns: (columns: PanelGridSize) => void;
 } {
   const { values, set } = usePluginUiPreferences();
   const view = values[`${prefix}viewMode`] === "list" ? "list" : "grid";
   const density =
     values[`${prefix}density`] === "compact" ? "compact" : "comfortable";
+  const saved = values[`${prefix}columns`];
+  const columns =
+    typeof saved === "string" && PANEL_GRID_SIZES.includes(saved)
+      ? (saved as PanelGridSize)
+      : "auto";
   return {
     view,
     density,
     compact: density === "compact",
+    columns,
     setView: (next) => set(`${prefix}viewMode`, next),
     setDensity: (next) => set(`${prefix}density`, next),
+    setColumns: (next) => set(`${prefix}columns`, next),
   };
 }
 
@@ -1539,6 +1806,14 @@ export function useHostActions(): HostActionContribution[] {
   return requireHost().useHostActions();
 }
 
+/**
+ * Every panel that can open beside a tab of this type, for a settings screen
+ * that lets the user hide or reorder them. Reactive.
+ */
+export function useCompanions(tabType: string): CompanionInfo[] {
+  return requireHost().useCompanions(tabType);
+}
+
 /**
  * Recent-activity types every registered tab claims (registerTab's
  * activityTypes), core's and plugins'. For a filter that lists what a user

packages/plugin-sdk/src/host-commands.ts

@@ -11,6 +11,9 @@
 
 export type { Client, ClientChannel } from "ssh2";
 import type { Client, ClientChannel } from "ssh2";
+// Homebrew and OrbStack paths a non-interactive shell misses.
+import { EXTRA_PATH_DIRS } from "./host-scripts/docker.js";
+export { EXTRA_PATH_DIRS };
 
 export interface ExecResult {
   stdout: string;
@@ -114,14 +117,6 @@ export interface PlatformInfo {
   osPrettyName: string | null;
 }
 
-/**
- * Non-interactive SSH shells don't source ~/.zprofile or ~/.bash_profile,
- * so PATH additions from installers like Homebrew or OrbStack are missing.
- * Extend PATH with their common install locations before probing.
- */
-export const EXTRA_PATH_DIRS =
-  '/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:"$HOME/.orbstack/bin"';
-
 const DOCKER_PROBE =
   `command -v docker >/dev/null 2>&1` +
   ` || [ -S /var/run/docker.sock ]` +

packages/plugin-sdk/src/host-scripts/docker.ts

@@ -0,0 +1,468 @@
+/**
+ * Docker and Podman command builders and output parsers.
+ *
+ * Container ids and names are checked with CONTAINER_ID_RE before they go on
+ * a command line, so they need no quoting. Anything free form is quoted.
+ */
+import { HostScriptError } from "./text.js";
+
+export type ContainerRuntime = "docker" | "podman";
+
+export function normalizeContainerRuntime(value: unknown): ContainerRuntime {
+  return value === "podman" ? "podman" : "docker";
+}
+
+export function getRuntimeLabel(runtime: ContainerRuntime): string {
+  return runtime === "podman" ? "Podman" : "Docker";
+}
+
+/**
+ * Non-interactive SSH shells don't source ~/.zprofile or ~/.bash_profile,
+ * so PATH additions from installers like Homebrew or OrbStack are missing.
+ */
+export const EXTRA_PATH_DIRS =
+  '/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:"$HOME/.orbstack/bin"';
+
+export function containerCommand(
+  runtime: ContainerRuntime | undefined,
+  args: string,
+  isWindows = false,
+): string {
+  const cli = `${normalizeContainerRuntime(runtime)} ${args}`;
+  // cmd and PowerShell don't understand the POSIX env prefix.
+  return isWindows ? cli : `PATH="${EXTRA_PATH_DIRS}:$PATH" ${cli}`;
+}
+
+export const CONTAINER_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+export const DOCKER_TIMESTAMP_RE = /^[0-9T:.Z+-]+$/;
+
+export function isContainerId(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length <= 256 &&
+    CONTAINER_ID_RE.test(value)
+  );
+}
+
+function requireContainer(id: string): string {
+  if (!isContainerId(id))
+    throw new HostScriptError("That is not a valid container id");
+  return id;
+}
+
+export const CONTAINER_ACTIONS = [
+  "start",
+  "stop",
+  "restart",
+  "pause",
+  "unpause",
+] as const;
+export type ContainerAction = (typeof CONTAINER_ACTIONS)[number];
+
+const LIST_FORMAT_UNIX = `'{"id":"{{.ID}}","name":"{{.Names}}","image":"{{.Image}}","status":"{{.Status}}","state":"{{.State}}","ports":"{{.Ports}}","created":"{{.CreatedAt}}"}' `;
+const LIST_FORMAT_WINDOWS = `"{\\"id\\":\\"{{.ID}}\\",\\"name\\":\\"{{.Names}}\\",\\"image\\":\\"{{.Image}}\\",\\"status\\":\\"{{.Status}}\\",\\"state\\":\\"{{.State}}\\",\\"ports\\":\\"{{.Ports}}\\",\\"created\\":\\"{{.CreatedAt}}\\"}"`;
+const STATS_FORMAT_UNIX = `'{"cpu":"{{.CPUPerc}}","memory":"{{.MemUsage}}","memoryPercent":"{{.MemPerc}}","netIO":"{{.NetIO}}","blockIO":"{{.BlockIO}}","pids":"{{.PIDs}}"}' `;
+const STATS_FORMAT_WINDOWS = `"{\\"cpu\\":\\"{{.CPUPerc}}\\",\\"memory\\":\\"{{.MemUsage}}\\",\\"memoryPercent\\":\\"{{.MemPerc}}\\",\\"netIO\\":\\"{{.NetIO}}\\",\\"blockIO\\":\\"{{.BlockIO}}\\",\\"pids\\":\\"{{.PIDs}}\\"}"`;
+
+export function listFormat(isWindows: boolean): string {
+  return isWindows ? LIST_FORMAT_WINDOWS : LIST_FORMAT_UNIX;
+}
+
+export function statsFormat(isWindows: boolean): string {
+  return isWindows ? STATS_FORMAT_WINDOWS : STATS_FORMAT_UNIX;
+}
+
+/** One row of `ps --format listFormat()`. */
+export interface ContainerRow {
+  id: string;
+  name: string;
+  image: string;
+  status: string;
+  state: string;
+  ports: string;
+  created: string;
+}
+
+/** CLI arguments, without the runtime, for each container command. */
+export const dockerArgs = {
+  version: () => "--version",
+  ping: () => "ps",
+  list: (all: boolean, isWindows = false) =>
+    `ps ${all ? "-a " : ""}--format ${listFormat(isWindows)}`,
+  inspect: (id: string) => `inspect ${requireContainer(id)}`,
+  stats: (id: string, isWindows = false) =>
+    `stats ${requireContainer(id)} --no-stream --format ${statsFormat(isWindows)}`,
+  action: (action: ContainerAction, id: string) => {
+    if (!CONTAINER_ACTIONS.includes(action))
+      throw new HostScriptError("Unknown action");
+    return `${action} ${requireContainer(id)}`;
+  },
+  remove: (id: string, force: boolean) =>
+    `rm ${force ? "-f " : ""}${requireContainer(id)}`,
+  logs: (
+    id: string,
+    options: {
+      tail?: number;
+      timestamps?: boolean;
+      since?: string;
+      until?: string;
+    } = {},
+  ) => {
+    let args = `logs ${requireContainer(id)}`;
+    if (options.tail && options.tail > 0)
+      args += ` --tail ${Math.floor(options.tail)}`;
+    if (options.timestamps) args += " --timestamps";
+    if (options.since && DOCKER_TIMESTAMP_RE.test(options.since)) {
+      args += ` --since ${options.since}`;
+    }
+    if (options.until && DOCKER_TIMESTAMP_RE.test(options.until)) {
+      args += ` --until ${options.until}`;
+    }
+    return `${args} 2>&1`;
+  },
+  states: () => `ps -a --format ${PS_STATE_FORMAT}`,
+  composeProjects: () => "compose ls -a --format json",
+};
+
+/** The version from `docker --version` or `podman --version`. */
+export function parseRuntimeVersion(output: string): string {
+  return output.match(/(?:Docker|podman) version ([^\s,]+)/i)?.[1] ?? "unknown";
+}
+
+export type RuntimeProblem =
+  "NOT_INSTALLED" | "DAEMON_NOT_RUNNING" | "PERMISSION_DENIED" | "DOCKER_ERROR";
+
+/** Sorts a failed `docker ps` into a reason the UI can explain. */
+export function classifyRuntimeError(message: string): RuntimeProblem {
+  if (
+    /command not found|not found: (docker|podman)|No such file or directory/i.test(
+      message,
+    )
+  ) {
+    return "NOT_INSTALLED";
+  }
+  if (message.includes("Cannot connect to the Docker daemon"))
+    return "DAEMON_NOT_RUNNING";
+  if (/permission denied/i.test(message)) return "PERMISSION_DENIED";
+  return "DOCKER_ERROR";
+}
+
+/** Parses `ps --format listFormat()` output, skipping lines that are not JSON. */
+export function parseContainerList(output: string): Record<string, unknown>[] {
+  return output
+    .split("\n")
+    .filter((line) => line.trim())
+    .flatMap((line) => {
+      try {
+        return [JSON.parse(line) as Record<string, unknown>];
+      } catch {
+        return [];
+      }
+    });
+}
+
+export interface ContainerStats {
+  cpu: string;
+  memoryUsed: string;
+  memoryLimit: string;
+  memoryPercent: string;
+  netInput: string;
+  netOutput: string;
+  blockRead: string;
+  blockWrite: string;
+  pids: string;
+}
+
+/** Parses one `stats --no-stream --format statsFormat()` line. Throws on bad JSON. */
+export function parseContainerStats(output: string): ContainerStats {
+  const raw = JSON.parse(output.trim()) as Record<string, string>;
+  const split = (value: string | undefined) => {
+    const [first, second] = (value ?? "").split(" / ");
+    return [first?.trim() || "0B", second?.trim() || "0B"];
+  };
+  const [memoryUsed, memoryLimit] = split(raw.memory);
+  const [netInput, netOutput] = split(raw.netIO);
+  const [blockRead, blockWrite] = split(raw.blockIO);
+  return {
+    cpu: raw.cpu,
+    memoryUsed,
+    memoryLimit,
+    memoryPercent: raw.memoryPercent,
+    netInput,
+    netOutput,
+    blockRead,
+    blockWrite,
+    pids: raw.pids,
+  };
+}
+
+export interface ContainerState {
+  /** Docker's own state word: running, exited, restarting, ... */
+  state: string;
+  /** Health from the status text, when the image declares a healthcheck. */
+  unhealthy: boolean;
+}
+
+export type DockerEventName = "exited" | "started" | "unhealthy" | "restarting";
+
+export const PS_STATE_FORMAT = `'{"name":"{{.Names}}","state":"{{.State}}","status":"{{.Status}}"}'`;
+
+/** Parses `ps -a --format PS_STATE_FORMAT` output, one JSON object per line. */
+export function parseContainerStates(
+  output: string,
+): Map<string, ContainerState> {
+  const states = new Map<string, ContainerState>();
+  for (const line of output.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed) as {
+        name?: string;
+        state?: string;
+        status?: string;
+      };
+      if (!parsed.name) continue;
+      states.set(parsed.name, {
+        state: (parsed.state ?? "").toLowerCase(),
+        unhealthy: /\(unhealthy\)/i.test(parsed.status ?? ""),
+      });
+    } catch {
+      // A partial line is not worth failing the whole poll over.
+    }
+  }
+  return states;
+}
+
+/**
+ * The events a pair of snapshots implies. A container missing from the
+ * previous snapshot counts as newly seen rather than started, so the first
+ * poll after a restart does not replay every running container.
+ */
+export function diffContainerStates(
+  previous: Map<string, ContainerState>,
+  current: Map<string, ContainerState>,
+): Array<{ container: string; event: DockerEventName }> {
+  const events: Array<{ container: string; event: DockerEventName }> = [];
+  for (const [name, now] of current) {
+    const before = previous.get(name);
+    if (!before) continue;
+    if (before.state !== now.state) {
+      if (now.state === "exited")
+        events.push({ container: name, event: "exited" });
+      else if (now.state === "running")
+        events.push({ container: name, event: "started" });
+      else if (now.state === "restarting") {
+        events.push({ container: name, event: "restarting" });
+      }
+    }
+    // A container can go unhealthy while it stays up.
+    if (!before.unhealthy && now.unhealthy) {
+      events.push({ container: name, event: "unhealthy" });
+    }
+  }
+  return events;
+}
+
+export interface ContainerCounts {
+  running: number;
+  stopped: number;
+  unhealthy: number;
+  total: number;
+}
+
+/** Counts from `ps -a --format PS_STATE_FORMAT` output. */
+export function countContainers(output: string): ContainerCounts {
+  const states = [...parseContainerStates(output).values()];
+  const running = states.filter((s) => s.state === "running").length;
+  return {
+    running,
+    stopped: states.length - running,
+    unhealthy: states.filter((s) => s.unhealthy).length,
+    total: states.length,
+  };
+}
+
+// Compose stacks
+
+export const STACK_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+export const STACK_SERVICE_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,126}$/;
+export const COMPOSE_FILES = [
+  "compose.yaml",
+  "compose.yml",
+  "docker-compose.yaml",
+  "docker-compose.yml",
+];
+
+export const STACK_ACTIONS = [
+  "deploy",
+  "redeploy",
+  "pull",
+  "start",
+  "stop",
+  "restart",
+  "pause",
+  "unpause",
+  "down",
+  "destroy",
+] as const;
+export type StackAction = (typeof STACK_ACTIONS)[number];
+
+/** Actions that can target one service of a stack. */
+export const STACK_SERVICE_ACTIONS: StackAction[] = [
+  "deploy",
+  "pull",
+  "start",
+  "stop",
+  "restart",
+  "pause",
+  "unpause",
+];
+
+export type StackState =
+  "running" | "partial" | "stopped" | "paused" | "not-deployed";
+
+export interface StackSummary {
+  name: string;
+  managed: boolean;
+  state: StackState;
+  running: number;
+  total: number;
+  composeFile: string | null;
+}
+
+export interface StackService {
+  service: string;
+  name: string;
+  id: string;
+  image: string;
+  state: string;
+  status: string;
+  health: string;
+  ports: string;
+}
+
+/** `compose ls` and `compose ps --format json` print one object per line or one array. */
+export function parseJsonLines(output: string): Record<string, unknown>[] {
+  const text = output.trim();
+  if (!text) return [];
+  if (text.startsWith("[")) {
+    try {
+      return JSON.parse(text) as Record<string, unknown>[];
+    } catch {
+      return [];
+    }
+  }
+  return text.split("\n").flatMap((line) => {
+    try {
+      return [JSON.parse(line) as Record<string, unknown>];
+    } catch {
+      return [];
+    }
+  });
+}
+
+const str = (value: unknown): string =>
+  typeof value === "string" ? value : "";
+
+export function parseServices(output: string): StackService[] {
+  return parseJsonLines(output).map((row) => {
+    const publishers = Array.isArray(row.Publishers)
+      ? (row.Publishers as Record<string, unknown>[])
+      : [];
+    const ports = publishers
+      .filter((p) => Number(p.PublishedPort) > 0)
+      .map((p) => `${p.PublishedPort}:${p.TargetPort}`)
+      .filter((value, index, all) => all.indexOf(value) === index)
+      .join(", ");
+    return {
+      service: str(row.Service),
+      name: str(row.Name),
+      id: str(row.ID),
+      image: str(row.Image),
+      state: str(row.State),
+      status: str(row.Status),
+      health: str(row.Health),
+      ports,
+    };
+  });
+}
+
+function stateOf(running: number, paused: number, total: number): StackState {
+  if (total === 0) return "not-deployed";
+  if (paused === total) return "paused";
+  if (running === total) return "running";
+  if (running > 0) return "partial";
+  return "stopped";
+}
+
+/** Turns the `compose ls` status text ("running(2), exited(1)") into a state. */
+export function parseStackStatus(status: string): {
+  state: StackState;
+  running: number;
+  total: number;
+} {
+  let running = 0;
+  let paused = 0;
+  let total = 0;
+  for (const part of status.split(",")) {
+    const match = part.trim().match(/^([a-z]+)\((\d+)\)$/i);
+    if (!match) continue;
+    const count = Number(match[2]);
+    total += count;
+    if (match[1] === "running") running += count;
+    if (match[1] === "paused") paused += count;
+  }
+  return { state: stateOf(running, paused, total), running, total };
+}
+
+export function stackStateFromServices(services: StackService[]) {
+  const total = services.length;
+  const running = services.filter((s) => s.state === "running").length;
+  const paused = services.filter((s) => s.state === "paused").length;
+  return { state: stateOf(running, paused, total), running, total };
+}
+
+/** Stacks from `compose ls -a --format json`, for hosts with no stacks folder. */
+export function parseComposeProjects(output: string): StackSummary[] {
+  return parseJsonLines(output)
+    .flatMap((project) => {
+      const name = str(project.Name);
+      if (!STACK_NAME_RE.test(name)) return [];
+      return [
+        {
+          name,
+          managed: false,
+          ...parseStackStatus(str(project.Status)),
+          composeFile: str(project.ConfigFiles).split(",")[0] || null,
+        },
+      ];
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** The compose commands one action runs, in order. */
+export function composeArgsFor(
+  action: StackAction,
+  service: string | undefined,
+  options: { removeVolumes?: boolean },
+): string[] {
+  const target = service ? ` ${service}` : "";
+  switch (action) {
+    case "deploy":
+      return [`up -d --remove-orphans${target}`];
+    case "redeploy":
+      return [`pull${target}`, `up -d --remove-orphans${target}`];
+    case "pull":
+      return [`pull${target}`];
+    case "start":
+    case "stop":
+    case "restart":
+    case "pause":
+    case "unpause":
+      return [`${action}${target}`];
+    case "down":
+      return ["down --remove-orphans"];
+    case "destroy":
+      return [`down --remove-orphans${options.removeVolumes ? " -v" : ""}`];
+  }
+}

packages/plugin-sdk/src/host-scripts/index.ts

@@ -0,0 +1,15 @@
+/**
+ * Host scripts: command builders and output parsers for Docker, Linux
+ * metrics, systemd, the journal and OpenRC.
+ *
+ * Pure TypeScript with no Node or ssh2 imports, so the same code runs in a
+ * plugin backend and in the mobile app. Run a script by sending it on stdin
+ * to the command from `scriptShell()`.
+ */
+export * from "./text.js";
+export * from "./shell.js";
+export * from "./docker.js";
+export * from "./metrics.js";
+export * from "./systemd.js";
+export * from "./journal.js";
+export * from "./openrc.js";

packages/plugin-sdk/src/host-scripts/journal.ts

@@ -0,0 +1,242 @@
+/** journalctl scripts and parsers. */
+import { isUnit } from "./systemd.js";
+import { HostScriptError, shellQuote as q, utf8Decode } from "./text.js";
+
+export const MAX_JOURNAL_LINES = 5000;
+const FIELDS = "MESSAGE,PRIORITY,_SYSTEMD_UNIT,SYSLOG_IDENTIFIER,_PID,_COMM";
+
+export interface JournalQuery {
+  units: string[];
+  priority?: number;
+  since?: string;
+  until?: string;
+  boot?: string;
+  grep?: string;
+  lines: number;
+  kernel: boolean;
+}
+
+export interface JournalEntry {
+  /** Unix ms. */
+  time: number;
+  priority: number;
+  unit: string;
+  ident: string;
+  pid: string;
+  message: string;
+}
+
+export interface BootView {
+  offset: number;
+  id: string;
+  first: string;
+  last: string;
+}
+
+const RELATIVE_RE = /^-\d{1,5}(s|m|min|h|d|w)$/;
+const DATE_RE = /^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}(:\d{2})?)?$/;
+const WORDS = ["today", "yesterday", "now"];
+
+export function isJournalTime(value: string): boolean {
+  return (
+    RELATIVE_RE.test(value) || DATE_RE.test(value) || WORDS.includes(value)
+  );
+}
+
+function str(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+/** Reads journal filters from a query string. Anything odd throws a HostScriptError. */
+export function parseJournalQuery(
+  input: Record<string, unknown>,
+): JournalQuery {
+  const rawUnits = Array.isArray(input.unit) ? input.unit : [input.unit];
+  const units = rawUnits.map(str).filter(Boolean);
+  for (const unit of units) {
+    if (!isUnit(unit))
+      throw new HostScriptError("That is not a valid unit name");
+  }
+  if (units.length > 20) throw new HostScriptError("Too many units");
+
+  const query: JournalQuery = {
+    units,
+    lines: 300,
+    kernel: input.kernel === "true" || input.kernel === true,
+  };
+  const priority = str(input.priority);
+  if (priority) {
+    const value = Number(priority);
+    if (!Number.isInteger(value) || value < 0 || value > 7) {
+      throw new HostScriptError("priority must be 0 to 7");
+    }
+    query.priority = value;
+  }
+  for (const key of ["since", "until"] as const) {
+    const value = str(input[key]);
+    if (!value) continue;
+    if (!isJournalTime(value))
+      throw new HostScriptError(`${key} is not a valid time`);
+    query[key] = value;
+  }
+  const boot = str(input.boot);
+  if (boot) {
+    if (!/^(-?\d{1,4}|[0-9a-f]{32})$/.test(boot))
+      throw new HostScriptError("boot is not valid");
+    query.boot = boot;
+  }
+  const grep = typeof input.grep === "string" ? input.grep : "";
+  if (grep) {
+    if (grep.length > 200 || /[\r\n\0]/.test(grep)) {
+      throw new HostScriptError("The search is too long");
+    }
+    query.grep = grep;
+  }
+  const lines = Number(str(input.lines) || 300);
+  if (Number.isFinite(lines) && lines > 0) {
+    query.lines = Math.min(MAX_JOURNAL_LINES, Math.round(lines));
+  }
+  return query;
+}
+
+/** journalctl arguments for a query, each one quoted. */
+export function journalArgs(
+  query: Omit<JournalQuery, "lines"> & { lines?: number },
+  options: { follow?: boolean; useGrep?: boolean } = {},
+): string {
+  const args = ["journalctl", "--no-pager", "-q", "-o", "json"];
+  args.push(`--output-fields=${FIELDS}`);
+  if (options.follow) args.push("-f");
+  if (query.lines) args.push("-n", String(Math.floor(query.lines)));
+  for (const unit of query.units) {
+    if (!isUnit(unit))
+      throw new HostScriptError("That is not a valid unit name");
+    args.push("-u", q(unit));
+  }
+  if (query.kernel) args.push("-k");
+  if (query.priority !== undefined)
+    args.push("-p", String(Math.floor(query.priority)));
+  if (query.since) args.push("--since", q(query.since));
+  if (query.until) args.push("--until", q(query.until));
+  if (query.boot) args.push("-b", q(query.boot));
+  if (query.grep && options.useGrep !== false) {
+    args.push("--case-sensitive=false", "-g", q(query.grep));
+  }
+  return args.join(" ");
+}
+
+export function journalScript(query: JournalQuery): string {
+  // Older journalctl builds have no -g. Then the search runs on our side instead.
+  const noGrep = journalArgs(
+    { ...query, lines: query.grep ? MAX_JOURNAL_LINES : query.lines },
+    { useGrep: false },
+  );
+  return `
+command -v journalctl >/dev/null 2>&1 || { echo "SCRIPT_ERR:This host has no journal"; exit 1; }
+${journalArgs(query)} 2>/tmp/termix-journal.$$
+RC=$?
+if [ $RC -ne 0 ] && grep -qi "pattern" /tmp/termix-journal.$$; then
+  rm -f /tmp/termix-journal.$$
+  echo "@@TERMIX_NOGREP@@"
+  ${noGrep}
+  exit 0
+fi
+cat /tmp/termix-journal.$$ >&2; rm -f /tmp/termix-journal.$$
+exit $RC
+`;
+}
+
+function messageOf(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    return utf8Decode(value.filter((n): n is number => typeof n === "number"));
+  }
+  return value == null ? "" : String(value);
+}
+
+/** One `journalctl -o json` line, or null when it is not an entry. */
+export function parseEntry(line: string): JournalEntry | null {
+  const text = line.trim();
+  if (!text.startsWith("{")) return null;
+  let raw: Record<string, unknown>;
+  try {
+    raw = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+  const micros = Number(raw.__REALTIME_TIMESTAMP);
+  const priority = Number(raw.PRIORITY);
+  return {
+    time: Number.isFinite(micros) ? Math.floor(micros / 1000) : 0,
+    priority: Number.isInteger(priority) ? priority : 6,
+    unit: messageOf(raw._SYSTEMD_UNIT),
+    ident: messageOf(raw.SYSLOG_IDENTIFIER ?? raw._COMM),
+    pid: messageOf(raw._PID),
+    message: messageOf(raw.MESSAGE),
+  };
+}
+
+export function parseJournal(
+  output: string,
+  query: JournalQuery,
+): JournalEntry[] {
+  const fallback = output.includes("@@TERMIX_NOGREP@@");
+  const body = fallback ? output.split("@@TERMIX_NOGREP@@")[1] : output;
+  let entries = body
+    .split("\n")
+    .map(parseEntry)
+    .filter((entry): entry is JournalEntry => entry !== null);
+  if (fallback && query.grep) {
+    const needle = query.grep.toLowerCase();
+    entries = entries
+      .filter((entry) => entry.message.toLowerCase().includes(needle))
+      .slice(-query.lines);
+  }
+  return entries;
+}
+
+export const BOOTS_SCRIPT = `journalctl --list-boots --no-pager 2>/dev/null | tail -n 50; exit 0\n`;
+
+export function parseBoots(output: string): BootView[] {
+  const boots: BootView[] = [];
+  for (const line of output.split("\n")) {
+    const match =
+      /^\s*(-?\d+)\s+([0-9a-f]{32})\s+(\w{3} \S+ \S+ \S+)\s*.?\s*(\w{3} \S+ \S+ \S+)?/.exec(
+        line,
+      );
+    if (!match) continue;
+    boots.push({
+      offset: Number(match[1]),
+      id: match[2],
+      first: match[3],
+      last: match[4] ?? "",
+    });
+  }
+  return boots.reverse();
+}
+
+export const USAGE_SCRIPT = `journalctl --disk-usage 2>&1; exit 0\n`;
+
+export function parseUsage(output: string): string {
+  return /take up (\S+)/.exec(output)?.[1] ?? "";
+}
+
+const SIZE_RE = /^\d{1,6}(K|M|G)$/;
+const AGE_RE = /^\d{1,4}(d|w|month|months|year|years)$/;
+
+export function vacuumScript(body: Record<string, unknown>): string {
+  const size = str(body.size);
+  const time = str(body.time);
+  if (!size && !time) throw new HostScriptError("Give a size or an age");
+  if (size && !SIZE_RE.test(size))
+    throw new HostScriptError("Size looks like 500M or 2G");
+  if (time && !AGE_RE.test(time))
+    throw new HostScriptError("Age looks like 7d or 4w");
+  const flags = [
+    size ? `--vacuum-size=${size}` : "",
+    time ? `--vacuum-time=${time}` : "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+  return `journalctl ${flags} 2>&1 || { echo "SCRIPT_ERR:journalctl vacuum failed"; exit 1; }\n`;
+}

packages/plugin-sdk/src/host-scripts/metrics.ts

@@ -0,0 +1,433 @@
+/**
+ * Linux metrics: one awk sample of /proc for CPU, memory, load, network and
+ * processes, plus df parsing for disks.
+ */
+
+// One awk reads every /proc file itself, so a sample is one exec of awk instead
+// of a shell plus six tools. Output sections are split by @@; each process line
+// is pid, utime+stime ticks, rss pages, starttime, state, ppid, comm.
+const AWK = String.raw`BEGIN{f="/proc/stat";while((getline l<f)>0)if(l~/^cpu/)print l;close(f);print "@@";f="/proc/meminfo";while((getline l<f)>0)if(l~/^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree):/)print l;close(f);print "@@";f="/proc/loadavg";getline l<f;print l;close(f);f="/proc/uptime";getline l<f;print l;close(f);print "@@";f="/proc/net/dev";while((getline l<f)>0)print l;close(f);print "@@";print pg;print "@@";for(i=1;i<ARGC;i++){f=ARGV[i];if((getline s<f)>0){a=index(s,"(");if(a&&match(s,/\)[^)]*$/)){split(substr(s,RSTART+2),x," ");print substr(s,1,a-2)"	"(x[12]+x[13])"	"x[22]"\t"x[20]"\t"x[1]"	"x[2]"	"substr(s,a+1,RSTART-a-1)}}close(f)}}`;
+
+/** The live sample command. The page size never changes on a host, so pass it back once known. */
+export const liveCmd = (pageBytes?: number) =>
+  "awk -v pg=" +
+  (pageBytes ?? '"$(getconf PAGESIZE)"') +
+  " '" +
+  AWK +
+  "' /proc/[0-9]*/stat";
+
+export interface LiveSample {
+  /** The admin minimum between samples; the client never polls faster. */
+  minIntervalS?: number;
+  cpu: number | null;
+  cpuMix?: { user: number; system: number; iowait: number; steal: number };
+  cores: Array<number | null>;
+  coreIds: string[];
+  memTotalKb: number;
+  memCachedKb: number;
+  memFreeKb: number;
+  memUsedKb: number;
+  swapTotalKb: number;
+  swapUsedKb: number;
+  load: [number, number, number];
+  net: Array<{ name: string; rxBps: number | null; txBps: number | null }>;
+  count: number;
+  running: number;
+  procs: Array<{
+    pid: number;
+    name: string;
+    cpu: number;
+    memKb: number;
+    state: string;
+    ppid: number;
+  }>;
+  /** Seconds since boot. */
+  uptime?: number;
+  /** Total bytes received and sent on every interface but lo, since boot. */
+  netTotals?: { rx: number; tx: number };
+}
+
+/** What the next call needs from this one. */
+export interface LivePrev {
+  at: number;
+  uptime: number;
+  pageBytes: number;
+  cpu: Map<string, { total: number; idle: number }>;
+  /** Aggregate user nice system idle iowait irq softirq steal ticks, for the breakdown. */
+  cpuRaw?: number[];
+  /** Keyed by pid:starttime so a reused pid never inherits another process's ticks. */
+  ticks: Map<string, number>;
+  net: Map<string, { rx: number; tx: number }>;
+}
+
+/** Total and idle ticks from a /proc/stat `cpu` line. */
+export function parseCpuLine(
+  cpuLine: string,
+): { total: number; idle: number } | undefined {
+  const parts = cpuLine.trim().split(/\s+/);
+  if (parts[0] !== "cpu") return undefined;
+  const nums = parts
+    .slice(1)
+    .map((n) => Number(n))
+    .filter((n) => Number.isFinite(n));
+  if (nums.length < 4) return undefined;
+  const idle = (nums[3] ?? 0) + (nums[4] ?? 0);
+  const total = nums.reduce((a, b) => a + b, 0);
+  return { total, idle };
+}
+
+const TOP_N = 60;
+
+/** Parses `liveCmd()` output. Rates need the `next` of the previous call. */
+export function parseLive(
+  output: string,
+  prev: LivePrev | undefined,
+  at = Date.now(),
+): { sample: LiveSample; next: LivePrev } {
+  const [cpuS = "", memS = "", loadS = "", netS = "", pageS = "", procS = ""] =
+    output.split("@@\n");
+
+  // Only the first 8 fields: guest and guest_nice are already inside user and nice.
+  const cpu = new Map<string, { total: number; idle: number }>();
+  let cpuRaw: number[] | undefined;
+  for (const l of cpuS.split("\n")) {
+    const name = l.split(/\s+/)[0];
+    if (!name.startsWith("cpu")) continue;
+    if (name === "cpu") cpuRaw = l.split(/\s+/).slice(1, 9).map(Number);
+    const c = parseCpuLine(
+      l
+        .replace(/^cpu\d*/, "cpu")
+        .split(/\s+/)
+        .slice(0, 9)
+        .join(" "),
+    );
+    if (c) cpu.set(name, c);
+  }
+  // Matched by name, so an offline core does not shift the ones after it.
+  const pct = (name: string) => {
+    const p = prev?.cpu.get(name);
+    const c = cpu.get(name);
+    if (!p || !c || c.total <= p.total) return null;
+    const used = c.total - p.total - (c.idle - p.idle);
+    return Math.max(0, Math.min(100, (used / (c.total - p.total)) * 100));
+  };
+
+  // Where the busy time went since the last sample, as percent of all ticks.
+  let cpuMix: LiveSample["cpuMix"];
+  if (prev?.cpuRaw && cpuRaw && cpuRaw.length === 8) {
+    const d = cpuRaw.map((v, i) => v - (prev.cpuRaw?.[i] ?? 0));
+    const total = d.reduce((a, b) => a + b, 0);
+    if (total > 0 && d.every((v) => v >= 0)) {
+      const p = (n: number) => (n / total) * 100;
+      cpuMix = {
+        user: p(d[0] + d[1]),
+        system: p(d[2] + d[5] + d[6]),
+        iowait: p(d[4]),
+        steal: p(d[7]),
+      };
+    }
+  }
+
+  const mem: Record<string, number> = {};
+  for (const l of memS.split("\n")) {
+    const m = l.match(/^(\w+):\s+(\d+)/);
+    if (m) mem[m[1]] = Number(m[2]);
+  }
+
+  const [la = "", up = ""] = loadS.trim().split("\n");
+  const laParts = la.split(/\s+/).map(Number);
+  const uptime = Number(up.split(/\s+/)[0]) || 0;
+
+  const nets = new Map<string, { rx: number; tx: number }>();
+  for (const l of netS.split("\n")) {
+    const [name, rest] = l.split(":");
+    if (!rest || name.trim() === "lo") continue;
+    const f = rest.trim().split(/\s+/);
+    nets.set(name.trim(), { rx: Number(f[0]) || 0, tx: Number(f[8]) || 0 });
+  }
+  // A reboot makes uptime go backwards, so rates start again.
+  const dt = prev && uptime > prev.uptime ? uptime - prev.uptime : 0;
+  const rate = (now: number, before: number | undefined) =>
+    dt > 0 && before !== undefined && now >= before
+      ? (now - before) / dt
+      : null;
+
+  const pageBytes = Number(pageS.trim()) || prev?.pageBytes || 4096;
+  const pageKb = pageBytes / 1024;
+  const aggDelta =
+    prev && cpu.has("cpu") && prev.cpu.has("cpu")
+      ? cpu.get("cpu")!.total - prev.cpu.get("cpu")!.total
+      : 0;
+  const cores = [...cpu.keys()].filter((k) => k !== "cpu");
+  const ncpu = Math.max(1, cores.length);
+  const ticks = new Map<string, number>();
+  const procs: LiveSample["procs"] = [];
+  for (const l of procS.split("\n")) {
+    const [pid, t, rss, start, state, ppid, ...rest] = l.split("\t");
+    const name = rest.join("\t");
+    if (!name) continue;
+    const key = pid + ":" + start;
+    const tk = Number(t) || 0;
+    ticks.set(key, tk);
+    const before = prev?.ticks.get(key);
+    procs.push({
+      pid: Number(pid),
+      name,
+      cpu:
+        before !== undefined && aggDelta > 0 && tk >= before
+          ? ((tk - before) / aggDelta) * ncpu * 100
+          : 0,
+      memKb: (Number(rss) || 0) * pageKb,
+      state: state || "?",
+      ppid: Number(ppid) || 0,
+    });
+  }
+  procs.sort((a, b) => b.cpu - a.cpu || b.memKb - a.memKb);
+
+  // Awk exits 0 when /proc is missing (macOS, restricted containers); that is not a sample.
+  if (!cpu.has("cpu") || !mem.MemTotal || !uptime) {
+    throw new Error("live sample unavailable: /proc data missing");
+  }
+  const memTotalKb = mem.MemTotal;
+  const swapTotalKb = mem.SwapTotal ?? 0;
+  let rxTotal = 0;
+  let txTotal = 0;
+  for (const c of nets.values()) {
+    rxTotal += c.rx;
+    txTotal += c.tx;
+  }
+  return {
+    sample: {
+      cpu: pct("cpu"),
+      cores: cores.map(pct),
+      coreIds: cores.map((k) => k.slice(3)),
+      cpuMix,
+      memTotalKb,
+      memCachedKb: (mem.Buffers ?? 0) + (mem.Cached ?? 0),
+      memFreeKb: mem.MemFree ?? 0,
+      memUsedKb: memTotalKb - (mem.MemAvailable ?? 0),
+      swapTotalKb,
+      swapUsedKb: swapTotalKb - (mem.SwapFree ?? 0),
+      load: [laParts[0] || 0, laParts[1] || 0, laParts[2] || 0],
+      net: [...nets].map(([name, c]) => ({
+        name,
+        rxBps: rate(c.rx, prev?.net.get(name)?.rx),
+        txBps: rate(c.tx, prev?.net.get(name)?.tx),
+      })),
+      count: procs.length,
+      running: procs.filter((p) => p.state === "R").length,
+      procs: procs.slice(0, TOP_N),
+      uptime,
+      netTotals: { rx: rxTotal, tx: txTotal },
+    },
+    next: { at, uptime, pageBytes, cpu, cpuRaw, ticks, net: nets },
+  };
+}
+
+// Disks
+
+const DARWIN_DATA_MOUNT = "/System/Volumes/Data";
+const PSEUDO_FS_RE =
+  /^(tmpfs|devtmpfs|overlay|udev|none|shm|squashfs|efivarfs)$/;
+
+/** GNU df sizes in KiB, without the header. */
+export const DF_BYTES_COMMAND = "df -TkP | tail -n +2";
+/** GNU df sizes as short human text, without the header. */
+export const DF_HUMAN_COMMAND = "df -hT -P | tail -n +2";
+
+export interface DfRow {
+  filesystem: string;
+  type: string;
+  mount: string;
+  parts: string[];
+}
+
+export interface DiskFilesystem {
+  filesystem: string;
+  type: string;
+  mount: string;
+  percent: number | null;
+  usedHuman: string | null;
+  totalHuman: string | null;
+  availableHuman: string | null;
+  usedBytes: number | null;
+  totalBytes: number | null;
+  availableBytes: number | null;
+  label?: string;
+}
+
+export interface MonitoredMount {
+  path: string;
+  label?: string;
+}
+
+function toFixedNum(n: number | null | undefined, digits = 2): number | null {
+  if (typeof n !== "number" || !Number.isFinite(n)) return null;
+  return Number(n.toFixed(digits));
+}
+
+/**
+ * Parses `df -T -P` style output: Filesystem, Type, then the size columns,
+ * with Mounted-on last. Pseudo filesystems are left out.
+ */
+export function parseDfLines(output: string): DfRow[] {
+  return output
+    .split("\n")
+    .map((l) => l.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const parts = line.split(/\s+/);
+      return {
+        filesystem: parts[0] || "",
+        type: parts[1] || "",
+        mount: parts[6] || "",
+        parts,
+      };
+    })
+    .filter((row) => row.parts.length >= 7 && !PSEUDO_FS_RE.test(row.type));
+}
+
+/** The most used real filesystem in a `df -TkP` row set. */
+export function findWorstMountIndex(bytesRows: DfRow[]): {
+  index: number;
+  usedBytes: number;
+  totalBytes: number;
+} {
+  let worstIndex = -1;
+  let worstUsedBytes = -1;
+  let worstTotalBytes = 0;
+  bytesRows.forEach((row, index) => {
+    const totalBytes = Number(row.parts[2]);
+    const usedBytes = Number(row.parts[3]);
+    if (
+      !Number.isFinite(totalBytes) ||
+      !Number.isFinite(usedBytes) ||
+      totalBytes <= 0
+    ) {
+      return;
+    }
+    const usedRatio = usedBytes / totalBytes;
+    const worstRatio =
+      worstTotalBytes > 0 ? worstUsedBytes / worstTotalBytes : -1;
+    if (usedRatio > worstRatio) {
+      worstIndex = index;
+      worstUsedBytes = usedBytes;
+      worstTotalBytes = totalBytes;
+    }
+  });
+  return {
+    index: worstIndex,
+    usedBytes: worstUsedBytes,
+    totalBytes: worstTotalBytes,
+  };
+}
+
+/**
+ * Merges `df -TkP` size rows (parts[2..4] in `blockSizeBytes` units) and
+ * `df -hT -P` human rows into one list. Human rows only supply the display
+ * text, matched by mount point so a mismatched row count can't shift them.
+ */
+export function buildFilesystemList(
+  bytesRows: DfRow[],
+  humanRows: DfRow[],
+  blockSizeBytes = 1,
+): DiskFilesystem[] {
+  const aligned = humanRows.length === bytesRows.length;
+  return bytesRows
+    .map((row, index) => {
+      const totalBytes = Number(row.parts[2]) * blockSizeBytes;
+      const usedBytes = Number(row.parts[3]) * blockSizeBytes;
+      const availableBytes = Number(row.parts[4]) * blockSizeBytes;
+      if (!Number.isFinite(totalBytes) || totalBytes <= 0) return null;
+      const humanRow = aligned
+        ? humanRows[index]
+        : humanRows.find((h) => h.mount === row.mount);
+      const percent = Number.isFinite(usedBytes)
+        ? Math.max(0, Math.min(100, (usedBytes / totalBytes) * 100))
+        : null;
+      return {
+        filesystem: row.filesystem,
+        type: row.type,
+        mount: row.mount,
+        percent: toFixedNum(percent, 0),
+        usedHuman: humanRow?.parts[3] || null,
+        totalHuman: humanRow?.parts[2] || null,
+        availableHuman: humanRow?.parts[4] || null,
+        usedBytes: Number.isFinite(usedBytes) ? usedBytes : null,
+        totalBytes,
+        availableBytes: Number.isFinite(availableBytes) ? availableBytes : null,
+      };
+    })
+    .filter((fs): fs is DiskFilesystem => fs !== null);
+}
+
+/**
+ * The headline disk is the root filesystem. On macOS "/" is the small sealed
+ * system volume, so the data volume wins there. With no root mount the most
+ * used one is shown.
+ */
+export function selectPrimaryFilesystem(
+  filesystems: DiskFilesystem[],
+): DiskFilesystem | null {
+  if (filesystems.length === 0) return null;
+  const root =
+    filesystems.find((fs) => fs.mount === DARWIN_DATA_MOUNT) ??
+    filesystems.find((fs) => fs.mount === "/");
+  if (root) return root;
+  let best = filesystems[0];
+  for (const fs of filesystems) {
+    const ratio = (fs.usedBytes ?? 0) / (fs.totalBytes || 1);
+    const bestRatio = (best.usedBytes ?? 0) / (best.totalBytes || 1);
+    if (ratio > bestRatio) best = fs;
+  }
+  return best;
+}
+
+/**
+ * Drops mounts by exact path ("/mnt/nas") or by filesystem type substring
+ * ("nfs" matches nfs and nfs4), so network shares can be hidden.
+ */
+export function filterExcludedFilesystems(
+  filesystems: DiskFilesystem[],
+  excludedMounts?: string[] | null,
+): DiskFilesystem[] {
+  if (!excludedMounts || excludedMounts.length === 0) return filesystems;
+  const normalized = excludedMounts
+    .map((entry) => entry.trim().toLowerCase())
+    .filter(Boolean);
+  if (normalized.length === 0) return filesystems;
+  return filesystems.filter((fs) => {
+    const mount = fs.mount.toLowerCase();
+    const type = fs.type.toLowerCase();
+    return !normalized.some(
+      (entry) => mount === entry || (type && type.includes(entry)),
+    );
+  });
+}
+
+export function mergeMonitoredFilesystems(
+  filesystems: DiskFilesystem[],
+  monitored: MonitoredMount[],
+  customFilesystems: Array<DiskFilesystem | null>,
+): DiskFilesystem[] {
+  const result = [...filesystems];
+  monitored.forEach((entry, index) => {
+    const path = entry.path.trim();
+    const custom = customFilesystems[index];
+    if (!path || !custom) return;
+    const existing = result.find((fs) => fs.mount === path);
+    if (existing) {
+      existing.label = entry.label?.trim() || undefined;
+      return;
+    }
+    result.push({
+      ...custom,
+      mount: path,
+      label: entry.label?.trim() || undefined,
+    });
+  });
+  return result;
+}
+
+/** Host name, OS, kernel and arch in one exec, as key=value lines. */
+export const SYSTEM_INFO_COMMAND = `echo "hostname=$(hostname 2>/dev/null || cat /etc/hostname 2>/dev/null)"; echo "os=$( . /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"; echo "kernel=$(uname -r 2>/dev/null)"; echo "arch=$(uname -m 2>/dev/null)"`;

packages/plugin-sdk/src/host-scripts/openrc.ts

@@ -0,0 +1,94 @@
+/** OpenRC scripts, with states mapped onto the words systemd uses. */
+import { isOpenRcName, type UnitAction, type UnitSummary } from "./systemd.js";
+import { HostScriptError, shellQuote as q } from "./text.js";
+
+export const OPENRC_LIST_SCRIPT = `
+rc-status --servicelist 2>/dev/null
+echo "@@TERMIX_RUNLEVELS@@"
+rc-update show -v 2>/dev/null
+exit 0
+`;
+
+function activeOf(state: string): { active: string; sub: string } {
+  switch (state) {
+    case "started":
+      return { active: "active", sub: "running" };
+    case "crashed":
+      return { active: "failed", sub: "crashed" };
+    case "starting":
+      return { active: "activating", sub: "starting" };
+    case "stopping":
+      return { active: "deactivating", sub: "stopping" };
+    case "inactive":
+    case "hotplugged":
+      return { active: "inactive", sub: state };
+    default:
+      return { active: "inactive", sub: state || "stopped" };
+  }
+}
+
+export function parseOpenRcList(output: string): UnitSummary[] {
+  const [list = "", levels = ""] = output.split("@@TERMIX_RUNLEVELS@@");
+  const units = new Map<string, UnitSummary>();
+  for (const line of list.split("\n")) {
+    const match = /^\s*(\S+)\s+\[\s*([a-z ]+?)\s*\]/.exec(line);
+    if (!match) continue;
+    const { active, sub } = activeOf(match[2]);
+    units.set(match[1], {
+      name: match[1],
+      type: "service",
+      load: "loaded",
+      active,
+      sub,
+      description: "",
+      fileState: "disabled",
+      preset: "",
+    });
+  }
+  for (const line of levels.split("\n")) {
+    const match = /^\s*(\S+)\s*\|\s*(.*)$/.exec(line);
+    if (!match) continue;
+    const runlevels = match[2].trim();
+    const known = units.get(match[1]) ?? {
+      name: match[1],
+      type: "service",
+      load: "loaded",
+      active: "inactive",
+      sub: "stopped",
+      description: "",
+      fileState: "disabled",
+      preset: "",
+    };
+    known.fileState = runlevels ? "enabled" : "disabled";
+    known.description = runlevels ? `Runlevels: ${runlevels}` : "";
+    units.set(match[1], known);
+  }
+  return [...units.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function requireName(name: string): string {
+  if (!isOpenRcName(name))
+    throw new HostScriptError("That is not a valid service name");
+  return name;
+}
+
+export function openRcActionScript(name: string, action: UnitAction): string {
+  const s = q(requireName(name));
+  switch (action) {
+    case "start":
+    case "stop":
+    case "restart":
+      return `rc-service ${s} ${action} 2>&1 || { echo "SCRIPT_ERR:rc-service ${action} failed"; exit 1; }\n`;
+    case "enable":
+      return `rc-update add ${s} default 2>&1 || { echo "SCRIPT_ERR:rc-update add failed"; exit 1; }\n`;
+    case "disable":
+      return `rc-update del ${s} 2>&1 || { echo "SCRIPT_ERR:rc-update del failed"; exit 1; }\n`;
+    default:
+      throw new HostScriptError("OpenRC can't do that", 400);
+  }
+}
+
+export function openRcStatusScript(name: string): string {
+  const s = q(requireName(name));
+  return `rc-service ${s} status 2>&1; rc-update show -v 2>/dev/null | grep -E '^ *'${s}' *\\|'; exit 0\n`;
+}

packages/plugin-sdk/src/host-scripts/shell.ts

@@ -0,0 +1,117 @@
+/**
+ * How a script reaches the host: the command line runs a shell that reads
+ * the script from stdin (`bash -s`), so names and values in a script are
+ * never parsed out of argv.
+ */
+import { shellQuote, toBase64 } from "./text.js";
+
+// systemctl and friends often live in sbin, which a normal login skips.
+// TZ=UTC so tools print every time in UTC, which parses the same anywhere.
+const ENV = "SYSTEMD_COLORS=0 SYSTEMD_PAGER=cat LC_ALL=C TZ=UTC";
+
+/** Puts sbin on PATH and sets a plain, UTC environment. */
+export const SCRIPT_PRELUDE = `export PATH="$PATH:/usr/sbin:/sbin:/usr/local/sbin"; export ${ENV}; `;
+const SUDO = `sudo -n env PATH="$PATH" ${ENV}`;
+
+/**
+ * - `plain`: the login user.
+ * - `auto`: root when it can be had without a password, else the login user.
+ * - `root`: root or passwordless sudo, fails on anything else.
+ * - `root-only`: root logins only, for hosts where sudo is turned off.
+ */
+export type ScriptShellMode = "plain" | "auto" | "root" | "root-only";
+
+const ERR = "SCRIPT_ERR:";
+
+/** The command line that runs a script sent on stdin. */
+export function scriptShell(mode: ScriptShellMode): string {
+  switch (mode) {
+    case "plain":
+      return `${SCRIPT_PRELUDE}exec bash -s`;
+    case "auto":
+      return `${SCRIPT_PRELUDE}if [ "$(id -u)" = "0" ]; then exec bash -s; elif sudo -n true 2>/dev/null; then exec ${SUDO} bash -s; else exec bash -s; fi`;
+    case "root":
+      return `${SCRIPT_PRELUDE}if [ "$(id -u)" = "0" ]; then exec bash -s; else exec ${SUDO} bash -s; fi`;
+    case "root-only":
+      return `${SCRIPT_PRELUDE}if [ "$(id -u)" = "0" ]; then exec bash -s; else echo "${ERR}This needs root, or turn on Use sudo for this host"; exit 1; fi`;
+  }
+}
+
+/**
+ * Runs a script as root with a sudo password. The command is `plain`; all of
+ * the returned stdin goes to the host. The password is read by the first
+ * line into a shell variable and piped to `sudo -S`, so it is never in argv,
+ * never in the environment and never run as a command. Root logins and
+ * passwordless sudo skip the password. The script itself travels as base64.
+ */
+export function passwordSudoScript(
+  script: string,
+  password: string,
+): { command: string; stdin: string } {
+  if (/[\r\n\0]/.test(password)) {
+    throw new Error("A sudo password can't contain a line break");
+  }
+  const run = `bash -c "$TERMIX_S"`;
+  const stdin = `IFS= read -r TERMIX_PW
+${password}
+TERMIX_S=$(printf '%s' ${shellQuote(toBase64(script))} | base64 -d)
+if [ "$(id -u)" = "0" ]; then unset TERMIX_PW; exec ${run}
+elif sudo -n true 2>/dev/null; then unset TERMIX_PW; exec ${SUDO} ${run}
+else P=$TERMIX_PW; unset TERMIX_PW; printf '%s\\n' "$P" | sudo -k -S -p '' env PATH="$PATH" ${ENV} ${run}; exit $?
+fi
+`;
+  return { command: scriptShell("plain"), stdin };
+}
+
+/** sudo asked for a password or a terminal it did not get. */
+export const SUDO_REFUSED_RE =
+  /password is required|a terminal is required|no tty present/i;
+/** sudo got a password and it was wrong. */
+export const SUDO_WRONG_RE =
+  /incorrect password|sorry, try again|no password was provided/i;
+/** The user may not use sudo at all. */
+export const NOT_SUDOER_RE =
+  /is not in the sudoers file|not allowed to run sudo/i;
+
+/**
+ * Scripts print `SCRIPT_ERR:` lines (or the older `SERVICES_ERR:`) before a
+ * non zero exit to explain a failure.
+ */
+export function scriptError(stdout: string): string {
+  return stdout
+    .split("\n")
+    .map((line) => {
+      if (line.startsWith(ERR)) return line.slice(ERR.length);
+      if (line.startsWith("SERVICES_ERR:")) return line.slice(13);
+      return null;
+    })
+    .filter((line): line is string => line !== null)
+    .join("\n")
+    .trim();
+}
+
+/** A line a script prints to explain why it stops. */
+export function errLine(message: string): string {
+  return `echo ${shellQuote(ERR + message)}`;
+}
+
+/**
+ * Runs a long command in the background and stops it once stdin closes,
+ * which happens when the SSH channel ends. A pty can't be trusted for this:
+ * sudo keeps its own and the command would outlive the viewer.
+ */
+export function watchdog(command: string): string {
+  return `${command} &
+P=$!
+trap 'kill $P 2>/dev/null' EXIT
+cat >/dev/null
+`;
+}
+
+/** The wrapper a streamed command runs in, as one shell command line. */
+export function streamCommand(script: string, sudo: boolean): string {
+  const quoted = shellQuote(`${SCRIPT_PRELUDE}${script}`);
+  return sudo
+    ? `if [ "$(id -u)" = "0" ]; then exec bash -c ${quoted}; elif sudo -n true 2>/dev/null; then exec ${SUDO} bash -c ${quoted}; else exec bash -c ${quoted}; fi`
+    : `exec bash -c ${quoted}`;
+}

packages/plugin-sdk/src/host-scripts/systemd.ts

@@ -0,0 +1,389 @@
+/**
+ * systemd unit scripts and parsers, plus init system detection.
+ * Every script is meant for `scriptShell()`, sent on stdin.
+ */
+import { HostScriptError, parseKeys, shellQuote as q } from "./text.js";
+
+export const UNIT_TYPES = [
+  "service",
+  "socket",
+  "timer",
+  "target",
+  "mount",
+  "automount",
+  "path",
+  "swap",
+  "slice",
+  "scope",
+  "device",
+] as const;
+export type UnitType = (typeof UNIT_TYPES)[number];
+
+// Backslash is allowed for escaped names like dev-disk-by\x2duuid.
+const UNIT_RE = new RegExp(
+  `^[A-Za-z0-9_][A-Za-z0-9:_.@\\\\-]{0,250}\\.(${UNIT_TYPES.join("|")})$`,
+);
+const OPENRC_RE = /^[A-Za-z0-9_][A-Za-z0-9_.@-]{0,127}$/;
+
+export function isUnit(name: unknown): name is string {
+  return typeof name === "string" && UNIT_RE.test(name);
+}
+
+export function unitType(name: string): UnitType {
+  return name.slice(name.lastIndexOf(".") + 1) as UnitType;
+}
+
+/** Units a file may be written for. Templates and device style names are out. */
+export function isWritableUnitName(name: string): boolean {
+  return (
+    isUnit(name) &&
+    !name.includes("\\") &&
+    ["service", "socket", "timer", "target", "path", "mount"].includes(
+      unitType(name),
+    )
+  );
+}
+
+export function isOpenRcName(name: unknown): name is string {
+  return typeof name === "string" && OPENRC_RE.test(name);
+}
+
+export function requireUnit(name: unknown): string {
+  if (!isUnit(name)) throw new HostScriptError("That is not a valid unit name");
+  return name;
+}
+
+export type InitSystem = "systemd" | "openrc" | "none";
+
+/** A unit name or, on OpenRC, a service name. */
+export function requireService(name: unknown, init: string): string {
+  if (init === "openrc") {
+    if (!isOpenRcName(name))
+      throw new HostScriptError("That is not a valid service name");
+    return name;
+  }
+  return requireUnit(name);
+}
+
+export interface UnitSummary {
+  name: string;
+  type: string;
+  load: string;
+  active: string;
+  sub: string;
+  description: string;
+  /** enabled, disabled, static, masked and so on. Empty when unknown. */
+  fileState: string;
+  preset: string;
+}
+
+export interface UnitDetail {
+  name: string;
+  props: Record<string, string>;
+  status: string;
+}
+
+export interface TimerView {
+  name: string;
+  description: string;
+  active: string;
+  fileState: string;
+  /** Unix ms, or null when not set. */
+  next: number | null;
+  last: number | null;
+  activates: string;
+  schedule: string[];
+}
+
+export const UNIT_ACTIONS = [
+  "start",
+  "stop",
+  "restart",
+  "reload",
+  "enable",
+  "disable",
+  "enable-now",
+  "disable-now",
+  "mask",
+  "unmask",
+  "reset-failed",
+  "revert",
+] as const;
+export type UnitAction = (typeof UNIT_ACTIONS)[number];
+
+/** Actions OpenRC can do. */
+export const OPENRC_ACTIONS: readonly UnitAction[] = [
+  "start",
+  "stop",
+  "restart",
+  "enable",
+  "disable",
+];
+
+export const DETECT_SCRIPT = `
+INIT=none
+if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then INIT=systemd
+elif command -v rc-service >/dev/null 2>&1; then INIT=openrc; fi
+echo "init=$INIT"
+if [ "$INIT" = systemd ]; then echo "version=$(systemctl --version 2>/dev/null | head -n1 | awk '{print $2}')"; fi
+if [ "$INIT" = openrc ]; then echo "version=$(openrc --version 2>/dev/null | head -n1 | awk '{print $NF}')"; fi
+echo "os=$( . /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"
+echo "hostname=$(hostname 2>/dev/null || cat /etc/hostname 2>/dev/null)"
+echo "uid=$(id -u)"
+if command -v journalctl >/dev/null 2>&1; then echo "journal=1"; fi
+if [ "$INIT" = systemd ]; then echo "failed=$(systemctl list-units --state=failed --plain --no-legend --no-pager 2>/dev/null | wc -l)"; fi
+if [ "$INIT" = openrc ]; then echo "failed=$(rc-status --crashed 2>/dev/null | wc -l)"; fi
+exit 0
+`;
+
+export interface Detected {
+  init: InitSystem;
+  version: string;
+  os: string;
+  hostname: string;
+  root: boolean;
+  journal: boolean;
+  failed: number;
+}
+
+export function parseDetect(output: string): Detected {
+  const keys = parseKeys(output);
+  const init =
+    keys.init === "systemd" || keys.init === "openrc" ? keys.init : "none";
+  return {
+    init,
+    version: keys.version ?? "",
+    os: keys.os ?? "",
+    hostname: keys.hostname ?? "",
+    root: keys.uid === "0",
+    journal: keys.journal === "1",
+    failed: Number(keys.failed) || 0,
+  };
+}
+
+/** Types the list can show. */
+export const LIST_TYPES = [
+  "service",
+  "socket",
+  "timer",
+  "target",
+  "path",
+  "mount",
+] as const;
+export type ListType = (typeof LIST_TYPES)[number] | "all";
+
+export function listUnitsScript(type: ListType): string {
+  const types = type === "all" ? LIST_TYPES.join(",") : type;
+  if (type !== "all" && !LIST_TYPES.includes(type))
+    throw new HostScriptError("Unknown unit type");
+  return `
+systemctl list-units --all --plain --no-legend --no-pager --full --type=${types} 2>/dev/null
+echo "@@TERMIX_FILES@@"
+systemctl list-unit-files --plain --no-legend --no-pager --full --type=${types} 2>/dev/null
+exit 0
+`;
+}
+
+/** Merges list-units and list-unit-files. Template units are left out. */
+export function parseUnitList(output: string): UnitSummary[] {
+  const [loaded = "", files = ""] = output.split("@@TERMIX_FILES@@");
+  const units = new Map<string, UnitSummary>();
+  for (const raw of loaded.split("\n")) {
+    const line = raw.replace(/^[●*\s]+/, "").trimEnd();
+    if (!line) continue;
+    const match = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s*(.*)$/.exec(line);
+    if (!match) continue;
+    const [, name, load, active, sub, description] = match;
+    if (!name.includes(".") || name.includes("@.")) continue;
+    units.set(name, {
+      name,
+      type: unitType(name),
+      load,
+      active,
+      sub,
+      description: description.trim(),
+      fileState: "",
+      preset: "",
+    });
+  }
+  for (const raw of files.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    const [name, state = "", preset = ""] = line.split(/\s+/);
+    if (!name || !name.includes(".") || name.includes("@.")) continue;
+    const known = units.get(name);
+    const cleanPreset = preset === "-" ? "" : preset;
+    if (known) {
+      known.fileState = state;
+      known.preset = cleanPreset;
+    } else {
+      units.set(name, {
+        name,
+        type: unitType(name),
+        load: state === "masked" ? "masked" : "unloaded",
+        active: "inactive",
+        sub: "dead",
+        description: "",
+        fileState: state,
+        preset: cleanPreset,
+      });
+    }
+  }
+  return [...units.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export const DETAIL_PROPS = [
+  "Id",
+  "Description",
+  "LoadState",
+  "ActiveState",
+  "SubState",
+  "UnitFileState",
+  "UnitFilePreset",
+  "Result",
+  "MainPID",
+  "ExecMainStartTimestamp",
+  "ActiveEnterTimestamp",
+  "InactiveEnterTimestamp",
+  "MemoryCurrent",
+  "MemoryPeak",
+  "CPUUsageNSec",
+  "TasksCurrent",
+  "NRestarts",
+  "FragmentPath",
+  "DropInPaths",
+  "Requires",
+  "Wants",
+  "After",
+  "WantedBy",
+  "TriggeredBy",
+  "Triggers",
+  "User",
+  "Group",
+  "Restart",
+  "Type",
+  "ExecStart",
+  "CanStart",
+  "CanStop",
+  "CanReload",
+] as const;
+
+export function detailScript(unit: string): string {
+  const props = DETAIL_PROPS.map((p) => `-p ${p}`).join(" ");
+  return `
+systemctl show --no-pager ${props} -- ${q(requireUnit(unit))}
+echo "@@TERMIX_STATUS@@"
+systemctl status --no-pager --full -n 0 -- ${q(unit)} 2>&1
+exit 0
+`;
+}
+
+export function parseDetail(unit: string, output: string): UnitDetail {
+  const [props = "", status = ""] = output.split("@@TERMIX_STATUS@@");
+  return { name: unit, props: parseKeys(props), status: status.trim() };
+}
+
+const VERBS: Record<UnitAction, string> = {
+  start: "start",
+  stop: "stop",
+  restart: "restart",
+  reload: "reload",
+  enable: "enable",
+  disable: "disable",
+  "enable-now": "enable --now",
+  "disable-now": "disable --now",
+  mask: "mask",
+  unmask: "unmask",
+  "reset-failed": "reset-failed",
+  revert: "revert",
+};
+
+/** The systemctl call for an action. Prints `state=` after it. */
+export function actionScript(unit: string, action: UnitAction): string {
+  const verb = VERBS[action];
+  if (!verb) throw new HostScriptError("Unknown action");
+  const u = q(requireUnit(unit));
+  return `
+systemctl ${verb} -- ${u} 2>&1 || { echo "SCRIPT_ERR:systemctl ${verb} failed"; exit 1; }
+echo "state=$(systemctl is-active -- ${u} 2>/dev/null)"
+`;
+}
+
+/** Times systemctl prints under TZ=UTC, like "Thu 2026-10-22 02:03:51 UTC". */
+export function parseSystemdTime(value: string | undefined): number | null {
+  if (!value) return null;
+  const match = /(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(value);
+  if (!match) return null;
+  const [, y, mo, d, h, mi, s] = match.map(Number);
+  return Date.UTC(y, mo - 1, d, h, mi, s);
+}
+
+export const TIMERS_SCRIPT = `
+UNITS=$( { systemctl list-units --all --type=timer --plain --no-legend --no-pager --full 2>/dev/null | awk '{print $1}'; systemctl list-unit-files --type=timer --plain --no-legend --no-pager --full 2>/dev/null | awk '{print $1}'; } | grep '\\.timer$' | grep -v '@\\.timer$' | sort -u)
+[ -n "$UNITS" ] || exit 0
+systemctl show --no-pager -p Id -p Description -p ActiveState -p UnitFileState -p NextElapseUSecRealtime -p LastTriggerUSec -p Triggers -p TimersCalendar -p TimersMonotonic -- $UNITS
+exit 0
+`;
+
+/** Reads systemctl show output for many units, split by blank lines. */
+export function parseShowBlocks(output: string): Array<Record<string, string>> {
+  const blocks: Array<Record<string, string>> = [];
+  for (const block of output.split(/\n\s*\n/)) {
+    const lines = block.split("\n").filter((line) => line.includes("="));
+    if (!lines.length) continue;
+    // A unit can have several TimersCalendar lines; keep all of them.
+    const keys: Record<string, string> = {};
+    for (const line of lines) {
+      const eq = line.indexOf("=");
+      const key = line.slice(0, eq).trim();
+      const value = line.slice(eq + 1).trim();
+      keys[key] = key in keys ? `${keys[key]}\n${value}` : value;
+    }
+    blocks.push(keys);
+  }
+  return blocks;
+}
+
+function schedules(value: string | undefined): string[] {
+  if (!value) return [];
+  const out: string[] = [];
+  for (const line of value.split("\n")) {
+    const match = /\{\s*(\w+)=(.+?)\s*;/.exec(line);
+    if (match) out.push(`${match[1]}=${match[2]}`);
+  }
+  return out;
+}
+
+export function parseTimers(output: string): TimerView[] {
+  return parseShowBlocks(output)
+    .filter((keys) => keys.Id?.endsWith(".timer"))
+    .map((keys) => ({
+      name: keys.Id,
+      description: keys.Description ?? "",
+      active: keys.ActiveState ?? "",
+      fileState: keys.UnitFileState ?? "",
+      next: parseSystemdTime(keys.NextElapseUSecRealtime),
+      last: parseSystemdTime(keys.LastTriggerUSec),
+      activates: (keys.Triggers ?? "").split(/\s+/)[0] ?? "",
+      schedule: [
+        ...schedules(keys.TimersCalendar),
+        ...schedules(keys.TimersMonotonic),
+      ],
+    }))
+    .sort((a, b) => (a.next ?? Infinity) - (b.next ?? Infinity));
+}
+
+/** One line per unit from systemctl is-active, in the order asked. */
+export function isActiveScript(units: string[]): string {
+  return `systemctl is-active -- ${units.map((u) => q(requireUnit(u))).join(" ")} 2>/dev/null; exit 0\n`;
+}
+
+export function parseIsActive(
+  units: string[],
+  output: string,
+): Map<string, string> {
+  const lines = output.split("\n").map((line) => line.trim());
+  const out = new Map<string, string>();
+  units.forEach((unit, i) => out.set(unit, lines[i] || "unknown"));
+  return out;
+}

packages/plugin-sdk/src/host-scripts/text.ts

@@ -0,0 +1,118 @@
+/**
+ * Quoting, encoding and the error type the host scripts share.
+ *
+ * No Node APIs here: this entry also runs in the mobile app.
+ */
+
+/** A bad input to a host script builder. `status` is the HTTP status to answer with. */
+export class HostScriptError extends Error {
+  constructor(
+    message: string,
+    readonly status = 400,
+    readonly extra: Record<string, unknown> = {},
+  ) {
+    super(message);
+    this.name = "HostScriptError";
+  }
+}
+
+/** Wraps a value in single quotes for a POSIX shell. */
+export function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+// Written by hand because some JS engines (Hermes) have no TextDecoder.
+
+/** UTF-8 bytes of a string. */
+export function utf8Encode(text: string): Uint8Array {
+  const out: number[] = [];
+  for (const char of text) {
+    const cp = char.codePointAt(0) ?? 0xfffd;
+    if (cp < 0x80) out.push(cp);
+    else if (cp < 0x800) out.push(0xc0 | (cp >> 6), 0x80 | (cp & 63));
+    else if (cp < 0x10000) {
+      out.push(0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 63), 0x80 | (cp & 63));
+    } else {
+      out.push(
+        0xf0 | (cp >> 18),
+        0x80 | ((cp >> 12) & 63),
+        0x80 | ((cp >> 6) & 63),
+        0x80 | (cp & 63),
+      );
+    }
+  }
+  return Uint8Array.from(out);
+}
+
+/** A string from UTF-8 bytes. Bad sequences become U+FFFD. */
+export function utf8Decode(bytes: ArrayLike<number>): string {
+  let out = "";
+  let i = 0;
+  while (i < bytes.length) {
+    const b = bytes[i];
+    let need = 0;
+    let cp = 0;
+    if (b < 0x80) cp = b;
+    else if (b >= 0xc2 && b < 0xe0) [need, cp] = [1, b & 31];
+    else if (b >= 0xe0 && b < 0xf0) [need, cp] = [2, b & 15];
+    else if (b >= 0xf0 && b < 0xf5) [need, cp] = [3, b & 7];
+    else {
+      out += "\ufffd";
+      i++;
+      continue;
+    }
+    let j = 1;
+    for (; j <= need; j++) {
+      const next = bytes[i + j];
+      if (next === undefined || (next & 0xc0) !== 0x80) break;
+      cp = (cp << 6) | (next & 63);
+    }
+    const tooSmall = [0, 0x80, 0x800, 0x10000][need];
+    if (
+      j <= need ||
+      cp < tooSmall ||
+      cp > 0x10ffff ||
+      (cp >= 0xd800 && cp < 0xe000)
+    ) {
+      out += "\ufffd";
+      i += Math.max(1, j);
+      continue;
+    }
+    out += String.fromCodePoint(cp);
+    i += need + 1;
+  }
+  return out;
+}
+
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/** Base64 of the UTF-8 bytes of a string, for `base64 -d` on the host. */
+export function toBase64(text: string): string {
+  const bytes = utf8Encode(text);
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const n = (a << 16) | (b << 8) | c;
+    out += B64[(n >> 18) & 63] + B64[(n >> 12) & 63];
+    out += i + 1 < bytes.length ? B64[(n >> 6) & 63] : "=";
+    out += i + 2 < bytes.length ? B64[n & 63] : "=";
+  }
+  return out;
+}
+
+/** Reads key=value lines. Only the first = splits a line. */
+export function parseKeys(output: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of output.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0) out[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+  }
+  return out;
+}
+
+/** Trims output and keeps it short enough to show. */
+export function scrub(text: string, max = 600): string {
+  return text.trim().slice(0, max);
+}

packages/plugin-sdk/src/manifest.ts

@@ -19,6 +19,7 @@ import {
   type PluginEnvVar,
 } from "./docs.js";
 
+export { validateThemeCss } from "./theme-css.js";
 export {
   ENV_NAME_PATTERN,
   MAX_ENV_DESCRIPTION_LENGTH,
@@ -36,7 +37,7 @@ export {
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.2.0";
+export const PLUGIN_API_VERSION = "1.13.0";
 
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(
@@ -426,6 +427,40 @@ export interface PluginAuthContribution {
   keyboardInteractive?: string[];
 }
 
+/** A layout id or theme id: short, lowercase, used as a CSS class for themes. */
+export const LOOK_ID_PATTERN = /^[a-z][a-z0-9-]{1,39}$/;
+
+/**
+ * A whole-app layout the frontend registers with app.registerLayout. Needs
+ * the ui:layout capability. Declared here so core can list and choose it
+ * before any plugin code runs.
+ */
+export interface PluginLayoutContribution {
+  id: string;
+  /** i18n key in the plugin's namespace, or plain text. */
+  label: string;
+  description?: string;
+  /** Theme picked with this layout when nobody chose one. */
+  defaultTheme?: string;
+  /** The layout a default-look plugin starts with. */
+  default?: boolean;
+}
+
+/**
+ * A theme: one CSS file of token rules scoped under `.<id>`, applied as a
+ * class on <html>. Needs the ui:theme capability. No code runs for a theme.
+ */
+export interface PluginThemeContribution {
+  id: string;
+  /** i18n key in the plugin's namespace, or plain text. */
+  label: string;
+  mode: "light" | "dark";
+  /** Path of the CSS file inside the plugin. */
+  css: string;
+  /** Colors the theme picker previews it with. */
+  swatch?: { background: string; panel: string; text: string };
+}
+
 export interface PluginContributions {
   tabs?: PluginTabContribution[];
   panels?: PluginViewContribution[];
@@ -487,6 +522,40 @@ export interface PluginContributions {
    * ctx.credentials.resolveHostProtocol.
    */
   protocols?: PluginProtocolContribution[];
+  /** Whole-app layouts. Needs the ui:layout capability. */
+  layouts?: PluginLayoutContribution[];
+  /** Themes. Needs the ui:theme capability. */
+  themes?: PluginThemeContribution[];
+  /** How the plugin shows in the Termix mobile app. Plugin API 1.13. */
+  mobile?: PluginMobileContribution;
+}
+
+/**
+ * - "webview": the app shows the plugin's UI from the server in a WebView.
+ * - "native": the app has its own screens for this plugin.
+ * - "none": nothing to show in the app.
+ */
+export const MOBILE_MODES = ["webview", "native", "none"] as const;
+export type PluginMobileMode = (typeof MOBILE_MODES)[number];
+
+export const MOBILE_SIZES = ["phone", "tablet"] as const;
+export type PluginMobileSize = (typeof MOBILE_SIZES)[number];
+
+export interface PluginMobileContribution {
+  mode: PluginMobileMode;
+  /**
+   * webview: a bundle built for the app, in the same folder as the frontend
+   * bundle. Unset means the normal frontend runs in a phone sized frame.
+   */
+  entry?: string;
+  /** webview: screen sizes the UI works at. Defaults to both. */
+  sizes?: PluginMobileSize[];
+  /** webview: tab, panel or card ids the app offers. Defaults to every tab. */
+  views?: string[];
+  /** native: the app feature that stands in for it. Defaults to the plugin id. */
+  feature?: string;
+  /** i18n key in the plugin's namespace, or plain text, shown in the app. */
+  note?: string;
 }
 
 /** A field a protocol login carries besides username and password. */
@@ -649,6 +718,21 @@ export interface PluginManifest {
   nativeDependencies?: string[];
   /** How a linked desktop treats this plugin. Defaults to "mirror". */
   desktop?: PluginDesktopMode;
+  /**
+   * "desktop": the plugin only loads on a desktop app's own embedded backend,
+   * never on a server. It implies desktop "local" and may declare desktop:local.
+   */
+  runtime?: PluginRuntime;
+}
+
+export type PluginRuntime = "desktop";
+export const PLUGIN_RUNTIMES: readonly PluginRuntime[] = ["desktop"];
+
+/** The desktop mode a manifest resolves to. */
+export function resolvePluginDesktopMode(
+  m: Pick<PluginManifest, "desktop" | "runtime">,
+): PluginDesktopMode {
+  return m.desktop ?? (m.runtime === "desktop" ? "local" : "mirror");
 }
 
 export const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
@@ -688,6 +772,7 @@ const ALLOWED_TOP_LEVEL = new Set([
   "platforms",
   "nativeDependencies",
   "desktop",
+  "runtime",
 ]);
 
 const ALLOWED_CONTRIBUTES = new Set([
@@ -708,6 +793,9 @@ const ALLOWED_CONTRIBUTES = new Set([
   "uses",
   "keybindingActions",
   "protocols",
+  "layouts",
+  "themes",
+  "mobile",
 ]);
 
 const ALLOWED_SETTINGS_FIELD = [
@@ -863,6 +951,21 @@ export function validateManifest(manifest: unknown): string[] {
       `Field "desktop" must be one of: ${PLUGIN_DESKTOP_MODES.join(", ")}`,
     );
   }
+  if (
+    m.runtime !== undefined &&
+    !PLUGIN_RUNTIMES.includes(m.runtime as PluginRuntime)
+  ) {
+    errors.push(
+      `Field "runtime" must be one of: ${PLUGIN_RUNTIMES.join(", ")}`,
+    );
+  }
+  if (
+    m.runtime === "desktop" &&
+    m.desktop !== undefined &&
+    m.desktop !== "local"
+  ) {
+    errors.push(`A "desktop" runtime plugin must use desktop "local"`);
+  }
   validateDependencyMap(m.dependencies, "dependencies", errors);
   validateDependencyMap(m.optionalDependencies, "optionalDependencies", errors);
   validateProvides(m.provides, errors);
@@ -874,10 +977,135 @@ export function validateManifest(manifest: unknown): string[] {
     typeof m.id === "string" ? m.id : undefined,
     errors,
   );
+  if (isPlainObject(m.contributes)) {
+    validateMobile(
+      m.contributes,
+      typeof m.frontend === "string" ? m.frontend : DEFAULT_FRONTEND_ENTRY,
+      errors,
+    );
+  }
 
   return errors;
 }
 
+function folderOf(file: string): string {
+  const parts = file.split("/").filter((part) => part !== "" && part !== ".");
+  return parts.slice(0, -1).join("/");
+}
+
+function validateMobile(
+  contributes: Record<string, unknown>,
+  frontend: string,
+  errors: string[],
+): void {
+  const mobile = contributes.mobile;
+  if (mobile === undefined) return;
+  const where = "contributes.mobile";
+  if (!isPlainObject(mobile)) {
+    errors.push(`Field "${where}" must be an object`);
+    return;
+  }
+  rejectUnknown(
+    mobile,
+    ["mode", "entry", "sizes", "views", "feature", "note"],
+    `"${where}"`,
+    errors,
+  );
+  const mode = mobile.mode;
+  if (!(MOBILE_MODES as readonly unknown[]).includes(mode)) {
+    errors.push(`${where}.mode must be one of: ${MOBILE_MODES.join(", ")}`);
+    return;
+  }
+  for (const key of ["entry", "sizes", "views"]) {
+    if (mobile[key] !== undefined && mode !== "webview") {
+      errors.push(`${where}.${key} is only for mode "webview"`);
+    }
+  }
+  if (mobile.feature !== undefined && mode !== "native") {
+    errors.push(`${where}.feature is only for mode "native"`);
+  }
+
+  if (
+    mobile.entry !== undefined &&
+    requireString(mobile.entry, `${where}.entry`, errors)
+  ) {
+    const before = errors.length;
+    requireRelativePath(mobile.entry, `${where}.entry`, errors);
+    if (!mobile.entry.endsWith(".js")) {
+      errors.push(`${where}.entry must be a .js file`);
+    } else if (
+      errors.length === before &&
+      folderOf(mobile.entry) !== folderOf(frontend)
+    ) {
+      // Core only serves the folder the frontend bundle sits in.
+      errors.push(
+        `${where}.entry must sit in the same folder as the frontend bundle (${frontend})`,
+      );
+    }
+  }
+
+  if (mobile.sizes !== undefined) {
+    const sizes = mobile.sizes;
+    if (!Array.isArray(sizes) || sizes.length === 0) {
+      errors.push(`${where}.sizes must be a non-empty array`);
+    } else {
+      const seen = new Set<unknown>();
+      for (const size of sizes) {
+        if (!(MOBILE_SIZES as readonly unknown[]).includes(size)) {
+          errors.push(
+            `${where}.sizes entries must be one of: ${MOBILE_SIZES.join(", ")}`,
+          );
+        } else if (seen.has(size)) {
+          errors.push(`${where}.sizes duplicates "${String(size)}"`);
+        }
+        seen.add(size);
+      }
+    }
+  }
+
+  if (mobile.views !== undefined) {
+    const views = mobile.views;
+    if (!Array.isArray(views) || views.length === 0) {
+      errors.push(`${where}.views must be a non-empty array`);
+    } else {
+      const declared = new Set<string>();
+      for (const field of ["tabs", "panels", "dashboardCards"]) {
+        const list = contributes[field];
+        if (!Array.isArray(list)) continue;
+        for (const view of list) {
+          if (isPlainObject(view) && typeof view.id === "string") {
+            declared.add(view.id);
+          }
+        }
+      }
+      const seen = new Set<unknown>();
+      for (const view of views) {
+        if (typeof view !== "string" || !declared.has(view)) {
+          errors.push(
+            `${where}.views entries must be ids from contributes.tabs, panels or dashboardCards, got: ${JSON.stringify(view)}`,
+          );
+        } else if (seen.has(view)) {
+          errors.push(`${where}.views duplicates "${view}"`);
+        }
+        seen.add(view);
+      }
+    }
+  }
+
+  if (
+    mobile.feature !== undefined &&
+    (typeof mobile.feature !== "string" ||
+      !LOOK_ID_PATTERN.test(mobile.feature))
+  ) {
+    errors.push(
+      `${where}.feature must match ${LOOK_ID_PATTERN} (lowercase letters, digits, dashes)`,
+    );
+  }
+  if (mobile.note !== undefined) {
+    requireString(mobile.note, `${where}.note`, errors);
+  }
+}
+
 function validateFeatures(features: unknown, errors: string[]): void {
   if (features === undefined) return;
   if (!Array.isArray(features)) {
@@ -1300,6 +1528,111 @@ function validateContributes(
   validateUiPresets(contributes.uiPresets, errors);
   validateKeybindingActions(contributes.keybindingActions, errors);
   validateProtocols(contributes.protocols, errors);
+  validateLayouts(contributes.layouts, errors);
+  validateThemes(contributes.themes, errors);
+}
+
+/** An array of objects with unique look ids; calls `each` for every valid entry. */
+function validateLookList(
+  value: unknown,
+  field: string,
+  allowed: string[],
+  errors: string[],
+  each: (raw: Record<string, unknown>, where: string) => void,
+): void {
+  if (value === undefined) return;
+  if (!Array.isArray(value)) {
+    errors.push(`Field "contributes.${field}" must be an array`);
+    return;
+  }
+  const seen = new Set<string>();
+  value.forEach((raw, index) => {
+    const where = `contributes.${field}[${index}]`;
+    if (!isPlainObject(raw)) {
+      errors.push(`${where} must be an object`);
+      return;
+    }
+    rejectUnknown(raw, allowed, where, errors);
+    if (typeof raw.id !== "string" || !LOOK_ID_PATTERN.test(raw.id)) {
+      errors.push(
+        `${where}.id must match ${LOOK_ID_PATTERN} (lowercase letters, digits, dashes)`,
+      );
+    } else {
+      if (seen.has(raw.id)) errors.push(`${where}.id duplicates "${raw.id}"`);
+      seen.add(raw.id);
+    }
+    requireString(raw.label, `${where}.label`, errors);
+    each(raw, where);
+  });
+}
+
+function validateLayouts(value: unknown, errors: string[]): void {
+  validateLookList(
+    value,
+    "layouts",
+    ["id", "label", "description", "defaultTheme", "default"],
+    errors,
+    (raw, where) => {
+      if (raw.description !== undefined)
+        requireString(raw.description, `${where}.description`, errors);
+      if (
+        raw.defaultTheme !== undefined &&
+        (typeof raw.defaultTheme !== "string" ||
+          !LOOK_ID_PATTERN.test(raw.defaultTheme))
+      ) {
+        errors.push(`${where}.defaultTheme must be a theme id`);
+      }
+      if (raw.default !== undefined && typeof raw.default !== "boolean") {
+        errors.push(`${where}.default must be a boolean`);
+      }
+    },
+  );
+  if (
+    Array.isArray(value) &&
+    value.filter((raw) => isPlainObject(raw) && raw.default === true).length > 1
+  ) {
+    errors.push('Only one entry in "contributes.layouts" may set default');
+  }
+}
+
+const HEX_COLOR = /^#[0-9a-fA-F]{3,8}$/;
+
+function validateThemes(value: unknown, errors: string[]): void {
+  validateLookList(
+    value,
+    "themes",
+    ["id", "label", "mode", "css", "swatch"],
+    errors,
+    (raw, where) => {
+      if (raw.mode !== "light" && raw.mode !== "dark") {
+        errors.push(`${where}.mode must be "light" or "dark"`);
+      }
+      if (requireString(raw.css, `${where}.css`, errors)) {
+        requireRelativePath(raw.css, `${where}.css`, errors);
+        if (!raw.css.endsWith(".css")) {
+          errors.push(`${where}.css must be a .css file`);
+        }
+      }
+      if (raw.swatch !== undefined) {
+        if (!isPlainObject(raw.swatch)) {
+          errors.push(`${where}.swatch must be an object`);
+          return;
+        }
+        rejectUnknown(
+          raw.swatch,
+          ["background", "panel", "text"],
+          `${where}.swatch`,
+          errors,
+        );
+        for (const key of ["background", "panel", "text"]) {
+          const color = raw.swatch[key];
+          if (typeof color !== "string" || !HEX_COLOR.test(color)) {
+            errors.push(`${where}.swatch.${key} must be a hex color`);
+          }
+        }
+      }
+    },
+  );
 }
 
 export const PROTOCOL_ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
@@ -2324,6 +2657,23 @@ export function parseManifest(raw: unknown): ParsedManifest {
     );
   }
 
+  if (
+    (manifest.contributes?.layouts?.length ?? 0) > 0 &&
+    !manifest.capabilities.includes("ui:layout")
+  ) {
+    errors.push(
+      'contributes.layouts needs the "ui:layout" capability in the capabilities array',
+    );
+  }
+  if (
+    (manifest.contributes?.themes?.length ?? 0) > 0 &&
+    !manifest.capabilities.includes("ui:theme")
+  ) {
+    errors.push(
+      'contributes.themes needs the "ui:theme" capability in the capabilities array',
+    );
+  }
+
   for (const secret of manifest.requiresSecret ?? []) {
     if (secret.plugin === manifest.id) {
       errors.push(