fix: plugin validate accepts beta versions

Bumps the dev-minor-updates group with 1 update: [globals](https://github.com/sindresorhus/globals).


Updates `globals` from 17.12.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/electron.yml

@@ -117,15 +117,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -143,12 +134,7 @@ jobs:
       - name: Build Windows (All Architectures)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run build && npx electron-builder --win --x64 --ia32 --publish never
-
-      # The updater only installs the x64 NSIS build; 32-bit installs get a link.
-      # The combined x64+ia32 installer is never uploaded.
-      - name: Fix Windows update files
-        run: node scripts/fix-update-info.cjs --drop ia32 --drop termix_windows_nsis.exe release/latest.yml release/beta.yml release/alpha.yml
+        run: npm run build && npx electron-builder --win --x64 --ia32
 
       - name: Upload Windows x64 NSIS Installer
         uses: actions/upload-artifact@v7
@@ -192,17 +178,6 @@ jobs:
         run: |
           Compress-Archive -Path "release\win-ia32-unpacked\*" -DestinationPath "termix_windows_ia32_portable.zip"
 
-      - name: Upload Windows update files
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/*.yml') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_windows_update_meta
-          path: |
-            release/*.yml
-            release/termix_windows_x64_nsis.exe.blockmap
-            !release/builder-debug.yml
-          retention-days: 30
-
       - name: Upload Windows x64 Portable
         uses: actions/upload-artifact@v7
         if: hashFiles('termix_windows_x64_portable.zip') != '' && inputs.artifact_destination != 'none'
@@ -250,15 +225,6 @@ jobs:
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -268,12 +234,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEBUG: electron-builder
-        run: npm run build && npx electron-builder --linux --x64 --publish never
+        run: npm run build && npx electron-builder --linux --x64
 
       - name: Build Linux arm64 and armv7l
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx electron-builder --linux --arm64 --armv7l --publish never
+        run: npx electron-builder --linux --arm64 --armv7l
 
       - name: Rename Linux artifacts for consistency
         run: |
@@ -289,19 +255,6 @@ jobs:
 
           cd ..
 
-          node scripts/fix-update-info.cjs \
-            --rename termix_linux_amd64_deb.deb=termix_linux_x64_deb.deb \
-            --rename termix_linux_x86_64_appimage.AppImage=termix_linux_x64_appimage.AppImage \
-            release/*-linux*.yml
-
-      - name: Upload Linux update files
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/*-linux*.yml') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_update_meta
-          path: release/*-linux*.yml
-          retention-days: 30
-
       - name: Upload Linux x64 AppImage
         uses: actions/upload-artifact@v7
         if: hashFiles('release/termix_linux_x64_appimage.AppImage') != '' && inputs.artifact_destination != 'none'
@@ -486,15 +439,6 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -550,7 +494,7 @@ jobs:
         run: |
           BUILD_VERSION="${{ github.run_number }}"
 
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
 
       - name: Clean up MAS keychain before DMG build
         if: steps.check_certs.outputs.has_certs == 'true'
@@ -609,24 +553,7 @@ jobs:
           if [ "${{ steps.mas_build.outcome }}" != "success" ]; then
             npm run build
           fi
-          npx electron-builder --mac dmg zip --universal --x64 --arm64 --publish never
-
-      # The updater picks the x64 or arm64 zip, so the universal one is left out.
-      - name: Fix macOS update files
-        run: node scripts/fix-update-info.cjs --drop universal release/*-mac.yml
-
-      - name: Upload macOS update files
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/*-mac.yml') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_macos_update_meta
-          path: |
-            release/*-mac.yml
-            release/termix_macos_x64_update.zip
-            release/termix_macos_x64_update.zip.blockmap
-            release/termix_macos_arm64_update.zip
-            release/termix_macos_arm64_update.zip.blockmap
-          retention-days: 30
+          npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
 
       - name: Verify macOS sharp packaging
         run: |
@@ -844,6 +771,144 @@ jobs:
           path: choco-build/*.nupkg
           retention-days: 30
 
+  submit-to-flatpak:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'linux' || inputs.build_type == '')
+    needs: []
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.source_ref || github.ref }}
+          fetch-depth: 1
+
+      - name: Get version from package.json
+        id: package-version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          RELEASE_DATE=$(date +%Y-%m-%d)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
+
+      - name: Download and prepare AppImage info from public release
+        id: appimage-info
+        run: |
+          VERSION="${{ steps.package-version.outputs.version }}"
+          mkdir -p release_assets
+
+          APPIMAGE_X64_NAME="termix_linux_x64_appimage.AppImage"
+          URL_X64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_X64_NAME"
+          PATH_X64="release_assets/$APPIMAGE_X64_NAME"
+          echo "Downloading x64 AppImage from $URL_X64"
+          curl -L -o "$PATH_X64" "$URL_X64"
+          chmod +x "$PATH_X64"
+          CHECKSUM_X64=$(sha256sum "$PATH_X64" | awk '{print $1}')
+
+          APPIMAGE_ARM64_NAME="termix_linux_arm64_appimage.AppImage"
+          URL_ARM64="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$APPIMAGE_ARM64_NAME"
+          PATH_ARM64="release_assets/$APPIMAGE_ARM64_NAME"
+          echo "Downloading arm64 AppImage from $URL_ARM64"
+          curl -L -o "$PATH_ARM64" "$URL_ARM64"
+          chmod +x "$PATH_ARM64"
+          CHECKSUM_ARM64=$(sha256sum "$PATH_ARM64" | awk '{print $1}')
+
+          echo "appimage_x64_name=$APPIMAGE_X64_NAME" >> $GITHUB_OUTPUT
+          echo "checksum_x64=$CHECKSUM_X64" >> $GITHUB_OUTPUT
+          echo "appimage_arm64_name=$APPIMAGE_ARM64_NAME" >> $GITHUB_OUTPUT
+          echo "checksum_arm64=$CHECKSUM_ARM64" >> $GITHUB_OUTPUT
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y imagemagick
+
+      - name: Prepare Flatpak submission files
+        run: |
+          VERSION="${{ steps.package-version.outputs.version }}"
+          CHECKSUM_X64="${{ steps.appimage-info.outputs.checksum_x64 }}"
+          CHECKSUM_ARM64="${{ steps.appimage-info.outputs.checksum_arm64 }}"
+          RELEASE_DATE="${{ steps.package-version.outputs.release_date }}"
+
+          mkdir -p flatpak-submission
+
+          cp packaging/flatpak/com.karmaa.termix.yml flatpak-submission/
+          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-submission/
+          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-submission/
+          cp packaging/flatpak/flathub.json flatpak-submission/
+
+          cp public/icon.svg flatpak-submission/com.karmaa.termix.svg
+          convert public/icon.png -resize 256x256 flatpak-submission/icon-256.png
+          convert public/icon.png -resize 128x128 flatpak-submission/icon-128.png
+
+          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.yml
+          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" flatpak-submission/com.karmaa.termix.yml
+          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" flatpak-submission/com.karmaa.termix.yml
+
+          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.metainfo.xml
+          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" flatpak-submission/com.karmaa.termix.metainfo.xml
+
+      - name: Upload Flatpak submission as artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: flatpak-submission
+          path: flatpak-submission/*
+          retention-days: 30
+
+      - name: Check for Flathub token
+        id: check_flathub_token
+        run: |
+          if [ -n "${{ secrets.FLATHUB_TOKEN }}" ]; then
+            echo "has_token=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Open PR on Flathub repo
+        if: steps.check_flathub_token.outputs.has_token == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.FLATHUB_TOKEN }}
+          VERSION: ${{ steps.package-version.outputs.version }}
+        run: |
+          FLATHUB_REPO="flathub/com.karmaa.termix"
+          BRANCH="release-$VERSION"
+
+          git config --global user.name "LukeGus"
+          git config --global user.email "bugattiguy527@gmail.com"
+
+          git clone "https://x-access-token:${GH_TOKEN}@github.com/${FLATHUB_REPO}.git" flathub-repo
+          cd flathub-repo
+
+          git checkout -b "$BRANCH"
+
+          cp ../flatpak-submission/com.karmaa.termix.yml ./
+          cp ../flatpak-submission/com.karmaa.termix.desktop ./
+          cp ../flatpak-submission/com.karmaa.termix.metainfo.xml ./
+          cp ../flatpak-submission/flathub.json ./
+          cp ../flatpak-submission/com.karmaa.termix.svg ./
+          cp ../flatpak-submission/icon-256.png ./
+          cp ../flatpak-submission/icon-128.png ./
+
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "No changes to submit for $VERSION; Flathub repo already up to date."
+            exit 0
+          fi
+
+          git add -A
+          git commit -m "Update to $VERSION"
+          git push origin "$BRANCH"
+
+          EXISTING_PR=$(gh pr list --repo "$FLATHUB_REPO" --head "$BRANCH" --state open --json number -q '.[0].number' || true)
+          if [ -z "$EXISTING_PR" ]; then
+            gh pr create --repo "$FLATHUB_REPO" \
+              --base master \
+              --head "$BRANCH" \
+              --title "Update to $VERSION" \
+              --body "Automated release update to version $VERSION."
+          else
+            echo "PR #$EXISTING_PR already open for $BRANCH."
+          fi
+
   submit-to-homebrew:
     runs-on: blacksmith-6vcpu-macos-latest
     if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'macos')
@@ -942,15 +1007,18 @@ jobs:
             echo "RELEASE_TAG=$(gh release list --repo ${{ github.repository }} --limit 1 --json tagName -q '.[0].tagName')" >> $GITHUB_ENV
           fi
 
-      # Update files go up last: the desktop updater treats a release as ready
-      # once its update file is there, so every installer must already be up.
       - name: Upload artifacts to latest release
         run: |
-          find artifacts -type f ! -name '*.yml' -print0 | while IFS= read -r -d '' file; do
-            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
-          done
-          find artifacts -type f -name '*.yml' -print0 | while IFS= read -r -d '' file; do
-            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
+          cd artifacts
+          for dir in */; do
+            cd "$dir"
+            for file in *;
+            do
+              if [ -f "$file" ]; then
+                gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
+              fi
+            done
+            cd ..
           done
         env:
           GH_TOKEN: ${{ github.token }}
@@ -982,15 +1050,6 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Check for Code Signing Certificates
         id: check_certs
         run: |
@@ -1129,7 +1188,7 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=4096
         run: |
           BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
 
       - name: Verify macOS sharp packaging
         if: steps.check_certs.outputs.has_certs == 'true'

.github/workflows/pr-check.yml

@@ -24,15 +24,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Build plugin SDK
         run: npm run build:sdk
 

.github/workflows/release.yml

@@ -161,62 +161,15 @@ jobs:
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
           echo "prev_ref=$PREV" >> "$GITHUB_OUTPUT"
 
-  # Translates new or changed strings with the Termix LLM server and commits
-  # them to the dev branch, so the beta or stable build includes them. If the
-  # server is down it warns and the release goes on with what is there.
-  translate:
-    needs: [prep]
-    if: ${{ needs.prep.outputs.skip != 'true' && needs.prep.outputs.mode != 'Overwrite release' }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    outputs:
-      sha: ${{ steps.commit.outputs.sha }}
-    steps:
-      - name: Checkout dev branch
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prep.outputs.sha || needs.prep.outputs.dev_branch }}
-          fetch-depth: 1
-          token: ${{ secrets.TERMIX_PAT }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: ".nvmrc"
-
-      - name: Translate
-        uses: Termix-SSH/Termix-Registry/translate@main
-        with:
-          source: src/ui/locales/en.json
-          out: src/ui/locales/translated
-          languages: src/ui/locales/languages.json
-          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
-
-      - name: Commit translations
-        id: commit
-        run: |
-          git add src/ui/locales
-          if git diff --cached --quiet; then
-            echo "No translation changes."
-          elif [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
-            echo "DRY RUN: would commit these translation changes:"
-            git --no-pager diff --cached --stat
-          else
-            git config user.name "LukeGus"
-            git config user.email "bugattiguy527@gmail.com"
-            git commit -m "chore: update translations"
-            git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
-          fi
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
   verify-beta:
-    needs: [prep, translate]
+    needs: [prep]
     if: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.skip != 'true' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout beta commit
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
+          ref: ${{ needs.prep.outputs.sha }}
           fetch-depth: 1
 
       - name: Setup Node.js
@@ -228,15 +181,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Build plugin SDK
         run: npm run build:sdk
 
@@ -253,7 +197,7 @@ jobs:
         run: npm run test
 
   normalize:
-    needs: [prep, translate]
+    needs: [prep]
     if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
@@ -309,7 +253,7 @@ jobs:
           git commit -m "chore: lint, format, and bump version to ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
-  sync-main:
+  crowdin:
     needs: [prep, normalize]
     if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
@@ -321,27 +265,79 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.TERMIX_PAT }}
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
       - name: Merge main into dev branch
         run: |
           git config user.name "LukeGus"
           git config user.email "bugattiguy527@gmail.com"
           git fetch origin main
-          # -X ours leaves modify/delete conflicts, so settle those to the dev side too
-          if ! git merge origin/main -X ours --no-edit; then
-            git diff --name-only --diff-filter=U | while read -r f; do
-              if git cat-file -e "HEAD:$f" 2>/dev/null; then
-                git checkout --ours -- "$f" && git add -- "$f"
-              else
-                git rm -q -- "$f"
-              fi
-            done
-            git commit --no-edit
+          git merge origin/main -X ours --no-edit || true
+          git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
+
+      - name: Clean up stale Crowdin git integration branch
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: |
+          PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head i18n_translate --state open --json number -q '.[0].number' || true)
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr close "$PR_NUMBER" --repo ${{ github.repository }} --delete-branch || true
           fi
+          git push origin --delete i18n_translate || true
+
+      - name: Upload sources to Crowdin
+        uses: crowdin/github-action@v3
+        with:
+          upload_sources: true
+          upload_translations: false
+          download_translations: false
+          create_pull_request: false
+          push_translations: false
+          token: ${{ secrets.CROWDIN_API_KEY }}
+          project_id: "858252"
+        env:
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
+
+      # Off until the machine translation credits are topped up.
+      - name: Pre-translate untranslated strings
+        if: false
+        env:
+          CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
+        run: node scripts/crowdin-pretranslate.cjs
+
+      - name: Download translations from Crowdin
+        uses: crowdin/github-action@v3
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          create_pull_request: false
+          push_translations: false
+          token: ${{ secrets.CROWDIN_API_KEY }}
+          project_id: "858252"
+        env:
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
+
+      - name: Commit translations to dev branch
+        run: |
+          git config user.name "LukeGus"
+          git config user.email "bugattiguy527@gmail.com"
+
+          git add src/ui/locales/translated
+          if git diff --cached --quiet; then
+            echo "No translation changes to commit."
+            exit 0
+          fi
+          git commit -m "chore: sync Crowdin translations for ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
   merge-to-main:
-    needs: [prep, translate, normalize, sync-main]
-    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.translate.result == 'success' || needs.translate.result == 'skipped') && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.sync-main.result == 'success' || needs.sync-main.result == 'skipped') }}
+    needs: [prep, normalize, crowdin]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.crowdin.result == 'success' || needs.crowdin.result == 'skipped') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       main_sha: ${{ steps.merge.outputs.main_sha }}
@@ -409,14 +405,14 @@ jobs:
           echo "build_ref=$MAIN_SHA" >> "$GITHUB_OUTPUT"
 
   docker:
-    needs: [prep, translate, verify-beta, merge-to-main]
+    needs: [prep, verify-beta, merge-to-main]
     if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.skip != 'true' && (needs.merge-to-main.result == 'success' || needs.verify-beta.result == 'success') }}
     uses: ./.github/workflows/docker.yml
     with:
       version: ${{ needs.prep.outputs.version }}
       build_type: ${{ needs.prep.outputs.channel == 'Beta' && 'Beta' || 'Production' }}
       dry_run: ${{ needs.prep.outputs.mode == 'Dry run' }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
     secrets: inherit
 
   create-release:
@@ -474,7 +470,7 @@ jobs:
           fi
 
   create-beta-release:
-    needs: [prep, translate, docker]
+    needs: [prep, docker]
     if: ${{ always() && needs.prep.outputs.channel == 'Beta' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
@@ -483,7 +479,7 @@ jobs:
       - name: Checkout beta commit
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
+          ref: ${{ needs.prep.outputs.sha }}
           fetch-depth: 0
 
       - name: Setup Node.js
@@ -496,7 +492,7 @@ jobs:
           node scripts/generate-beta-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --branch "${{ needs.prep.outputs.dev_branch }}" \
-            --sha "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}" \
+            --sha "${{ needs.prep.outputs.sha }}" \
             --prev "${{ needs.prep.outputs.prev_ref }}" > BETA_BODY.md
 
       - name: Create beta release
@@ -512,19 +508,11 @@ jobs:
           else
             gh release create "$TAG" --repo ${{ github.repository }} \
               --title "$TITLE" --notes-file BETA_BODY.md \
-              --prerelease --target "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}"
+              --prerelease --target "${{ needs.prep.outputs.sha }}"
           fi
 
   electron-release:
-    needs:
-      [
-        prep,
-        translate,
-        merge-to-main,
-        docker,
-        create-release,
-        create-beta-release,
-      ]
+    needs: [prep, merge-to-main, docker, create-release, create-beta-release]
     if: ${{ always() && needs.prep.outputs.skip != 'true' && needs.docker.result == 'success' && needs.create-release.result != 'failure' && needs.create-beta-release.result != 'failure' }}
     uses: ./.github/workflows/electron.yml
     with:
@@ -532,12 +520,12 @@ jobs:
       artifact_destination: ${{ needs.prep.outputs.mode == 'Dry run' && 'file' || 'release' }}
       release_tag: ${{ needs.prep.outputs.release_tag }}
       version_override: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.version || '' }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.prep.outputs.sha }}
     secrets: inherit
 
   electron-submit:
     needs: [prep, merge-to-main, electron-release]
-    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}
     uses: ./.github/workflows/electron.yml
     with:
       build_type: all
@@ -547,7 +535,7 @@ jobs:
 
   cask-commit-back:
     needs: [prep, electron-release]
-    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' }}
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -605,48 +593,8 @@ jobs:
 
   # The docs site reads the env catalog, API spec and download list from the
   # newest stable release.
-  # Docs written for this release live on dev-X.Y.Z in the Docs repo. Squash
-  # merge it into main once the release is out. No branch means nothing to do.
-  docs-merge:
-    needs: [prep, electron-release]
-    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Merge the docs dev branch into main
-        env:
-          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
-          REPO: Termix-SSH/Docs
-          VERSION: ${{ needs.prep.outputs.version }}
-        run: |
-          BRANCH="dev-$VERSION"
-          if ! gh api "repos/$REPO/branches/$BRANCH" > /dev/null 2>&1; then
-            echo "$REPO has no $BRANCH branch, nothing to merge."
-            exit 0
-          fi
-
-          AHEAD=$(gh api "repos/$REPO/compare/main...$BRANCH" -q .ahead_by)
-          if [ "$AHEAD" = "0" ]; then
-            echo "$BRANCH has nothing main doesn't, deleting it."
-            gh api -X DELETE "repos/$REPO/git/refs/heads/$BRANCH"
-            exit 0
-          fi
-
-          PR_NUMBER=$(gh pr list --repo "$REPO" --head "$BRANCH" --base main --state open --json number -q '.[0].number')
-          if [ -z "$PR_NUMBER" ]; then
-            PR_NUMBER=$(gh pr create --repo "$REPO" --base main --head "$BRANCH" \
-              --title "v$VERSION" --body "Docs for Termix v$VERSION." | grep -oE '[0-9]+$')
-          fi
-
-          gh pr merge "$PR_NUMBER" --repo "$REPO" --squash --admin --delete-branch
-
-          STATE=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json state -q .state)
-          if [ "$STATE" != "MERGED" ]; then
-            echo "Docs PR #$PR_NUMBER did not merge (state: $STATE)."
-            exit 1
-          fi
-
   docs-refresh:
-    needs: [prep, electron-release, docs-merge]
+    needs: [prep, electron-release]
     if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:

.github/workflows/translate.yml

@@ -1,53 +0,0 @@
-name: Translate
-
-on:
-  workflow_dispatch:
-    inputs:
-      retranslate:
-        description: "Translate every string again, not only new or changed ones"
-        type: boolean
-        default: false
-
-permissions:
-  contents: write
-
-concurrency:
-  group: translate-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  translate:
-    if: ${{ startsWith(github.ref, 'refs/heads/dev-') }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-          token: ${{ secrets.TERMIX_PAT }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: ".nvmrc"
-
-      - name: Translate
-        uses: Termix-SSH/Termix-Registry/translate@main
-        with:
-          source: src/ui/locales/en.json
-          out: src/ui/locales/translated
-          languages: src/ui/locales/languages.json
-          retranslate: ${{ inputs.retranslate }}
-          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
-
-      - name: Commit translations
-        run: |
-          git add src/ui/locales
-          if git diff --cached --quiet; then
-            echo "No translation changes."
-            exit 0
-          fi
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-          git commit -m "chore: update translations"
-          git push origin HEAD:"${GITHUB_REF_NAME}"

CHANGELOG.md

@@ -1,36 +1,5 @@
 # Changelog
 
-## 26.10.1
-
-### Added
-
-- Slovak, Croatian, Slovenian, Lithuanian, Latvian, Estonian and Malay
-- The desktop app can update itself. Pick Automatic, Ask first or Never in Settings, Updates. Store and package manager installs keep updating the way they do now
-- Community plugins. Turn on the community registry in Plugins, Registries to browse and install plugins made by other people, each version reviewed before it is listed
-- Custom plugin registries. Add your own registry by its index URL; its signing key is pinned when you add it
-
-### Changed
-
-- Every language is now fully translated, in Termix and in every plugin, and stays up to date with each release
-- Languages with more than two plural forms, like Russian, Polish and Arabic, now use the right one
-- The Plugins tab shows how many times each plugin was downloaded, in a Downloads column
-- Plugins, Browse hides plugins you already have. Turn on Show installed to see them
-
-### Fixed
-
-- Regional browser languages like `es-MX`, `pt` or `zh-HK` showed English instead of the closest translation
-- Counts like "1 keys" or "Moved 1 host(s)" now use the singular
-- Plugin updates on the desktop app, synced or installed from the Plugins tab, failed to start with "Cannot find package"
-- The desktop app showed plugins that only run on the server as not running and out of date
-- Keep the terminal WebSocket open past nginx's 60s default
-- Plugin download counts now show in the Plugins tab without waiting for the background check
-- Clicking into a saved password, key passphrase or sudo password field and saving without typing erased it, which stopped sudo autofill
-- The desktop app now says when its data is from 2.8 or older and needs 2.9 first, instead of only saying the local server could not start
-- Client tunnels on the desktop app stopped with "Endpoint SSH connection closed" when a reverse proxy dropped their idle connection
-- Typing right after opening a host from the sidebar went to the host search instead of the new session
-- SSH config import failed on files that put a tab or `=` between a keyword and its value
-- App icons and the favicon have rounded corners again
-
 ## 26.10.0
 
 ### Added

Casks/termix.rb

@@ -1,6 +1,6 @@
 cask "termix" do
-  version "26.10.0"
-  sha256 "66a76a62fbea3306bdf35b0951e9b1200fd1a084a95b4fee9d40edd6e326e11a"
+  version "2.9.1"
+  sha256 "6d8847e18508314db8ed4380c63bf0dd31437102a288b8e861879c92ba25a254"
 
   url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
   name "Termix"
@@ -12,8 +12,6 @@ cask "termix" do
     strategy :github_latest
   end
 
-  auto_updates true
-
   app "Termix.app"
 
   zap trash: [

LICENSE

@@ -1,4 +1,3 @@
-Copyright 2026 Luke Gustafson
 
                                  Apache License
                            Version 2.0, January 2004

README.md

@@ -92,7 +92,7 @@ Plugins add everything else. The official ones ship with Termix, and admins can
 | [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                         |
 | [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                         |
 
-Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Turn on the community registry in Plugins, Registries to install plugins made by other people, or add your own registry. See [submitting a plugin](https://docs.termix.site/develop/community-registry) and [hosting your own registry](https://docs.termix.site/develop/registries#host-your-own-registry).
+Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Its community registry is open for submissions now, and Termix will be able to install community plugins in a later update. See [submitting a plugin](https://docs.termix.site/develop/community-registry).
 
 <br />
 
@@ -105,27 +105,27 @@ Want to build your own? Start from the [plugin template](https://github.com/Term
 </tr>
 <tr>
 <td align="center"><b>Web</b></td>
-<td>Any modern browser (Chrome, Safari, Firefox) | PWA support</td>
+<td>Any modern browser (Chrome, Safari, Firefox) · PWA support</td>
 </tr>
 <tr>
 <td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable | EXE and MSI Installer | Chocolatey</td>
+<td>Portable · EXE and MSI Installer · Chocolatey</td>
 </tr>
 <tr>
 <td align="center"><b>Linux</b> <sub>x64/arm64/armv7l</sub></td>
-<td>Portable | AUR | AppImage | Deb | Flatpak</td>
+<td>Portable · AUR · AppImage · Deb · Flatpak</td>
 </tr>
 <tr>
 <td align="center"><b>macOS</b> <sub>Universal/x64/arm64, v12.0+</sub></td>
-<td>Apple App Store | DMG | Homebrew</td>
+<td>Apple App Store · DMG · Homebrew</td>
 </tr>
 <tr>
 <td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store | IPA</td>
+<td>Apple App Store · IPA</td>
 </tr>
 <tr>
 <td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store | APK</td>
+<td>Google Play Store · APK</td>
 </tr>
 </table>
 
@@ -202,6 +202,14 @@ Interested in a paid placement to support development? Email [mail@termix.site](
 
 <br />
 
+<a href="https://www.digitalocean.com/">
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://crowdin.com/">
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
+</a>
+&nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
   <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>

crowdin.yml

@@ -0,0 +1,9 @@
+project_id: "858252"
+api_token: "env:CROWDIN_API_TOKEN"
+preserve_hierarchy: true
+
+files:
+  # Core has always lived at /en.json in Crowdin; moving it would orphan its translations.
+  - source: /src/ui/locales/en.json
+    dest: /en.json
+    translation: /src/ui/locales/translated/%locale_with_underscore%.json

docker/Dockerfile

@@ -34,9 +34,7 @@ WORKDIR /app
 
 COPY . .
 
-# Bundled plugin downloads show in the plugin store, so keep them between builds.
-RUN --mount=type=cache,target=/app/node_modules/.cache/termix-bundled-plugins \
-    npm run build:backend
+RUN npm run build:backend
 
 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
 FROM node:24-slim AS opkssh-downloader

docker/bundled-plugins.json

@@ -3,20 +3,20 @@
     {
       "id": "acme-ssl",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.1/acme-ssl-1.0.1.tmxplug",
-      "sha256": "cb5b7c56a281272cfff229d01a2729a4fa3936de04c0ac487d65bcf8dbd2f38e"
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.0/acme-ssl-1.0.0.tmxplug",
+      "sha256": "05b7b4c27897135437af6340c5c31501d2e96ac013dca0672940b74c76085433"
     },
     {
       "id": "ai",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.1/ai-1.0.1.tmxplug",
-      "sha256": "2558c91e3e6823b3e18873d7b074762c4d76a1a0b96ff38d2dad13e0404b74a7"
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.0/ai-1.0.0.tmxplug",
+      "sha256": "ed7a64a4be5978238427d4abbd2153ef2b44c17ebfec78fcb5df579967d01eed"
     },
     {
       "id": "alerts",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.1/alerts-1.0.1.tmxplug",
-      "sha256": "f5f233c0ffdeee956e1839a17a323c18ce8eb389a08569c3c6e5e24b698dd72a",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.0/alerts-1.0.0.tmxplug",
+      "sha256": "97e7be293ace897cd45615a8764e8395cf613546b86de82601ab49669dc36591",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -25,14 +25,14 @@
     {
       "id": "automations",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.1/automations-1.0.1.tmxplug",
-      "sha256": "d2bb5298f8afac3f479ded81d5b1a799d9844b3f4990c8aaf2dd8fed7222428d"
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.0/automations-1.0.0.tmxplug",
+      "sha256": "0972aef1c14917321c035f7497db81fe95f6b9e47d854b95b1c762444d9cb2a2"
     },
     {
       "id": "docker",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.1/docker-1.0.1.tmxplug",
-      "sha256": "00e170e61ea9b7952449ea9ce30b09b983433f8d18d29f523cf3c6f98e7286e3",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.0/docker-1.0.0.tmxplug",
+      "sha256": "ca9b8cf573d27a71adb544fd6ff4d19278349f10fdca98f9cc63d7fec63bc441",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -41,8 +41,8 @@
     {
       "id": "file-manager",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.2/file-manager-1.0.2.tmxplug",
-      "sha256": "4c735f5b795a8c676590a0dc25db1bcc6036ac250b9817a61867cebdc17931c6",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.0/file-manager-1.0.0.tmxplug",
+      "sha256": "d1d92ae051c79c7ce6f05c7dbf33c96de9d8b58083eaccb104d1d21a6bd8b58f",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -51,20 +51,20 @@
     {
       "id": "fleets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.1/fleets-1.0.1.tmxplug",
-      "sha256": "82ac71e69022c4991570e6fed109a9eec79421f081af0a1dcb6d8b8e4251ee3b"
+      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.0/fleets-1.0.0.tmxplug",
+      "sha256": "410b19f3a6f47e2a292821b11876b8b5a0bdf779f8d852d5ac04a7501d0f12c0"
     },
     {
       "id": "homepage",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.1/homepage-1.0.1.tmxplug",
-      "sha256": "573375726f334e37bbf504d9411c4ad2d4bfc4363219ff10dcea6cb2cb00ed32"
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.0/homepage-1.0.0.tmxplug",
+      "sha256": "5652e378dbb208c7bb349ba2262034077f1cfca95b2d6d029f4186c70ed27999"
     },
     {
       "id": "host-metrics",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.2/host-metrics-1.0.2.tmxplug",
-      "sha256": "433d5297e2fc263f2262b7ea33d7a795c9a970089aea328077861c3f032a23f5",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.0/host-metrics-1.0.0.tmxplug",
+      "sha256": "ca50e27f06bc7a275bd1bfb1deb5ac97f19023c84567105fe74e075602ec86da",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -73,32 +73,32 @@
     {
       "id": "ldap",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.1/ldap-1.0.1.tmxplug",
-      "sha256": "f5ba13c682d11060f373f85a9c7aaa131e587ec59c0498c0dabb013c2e474f5c"
+      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.0/ldap-1.0.0.tmxplug",
+      "sha256": "44d3f9e9be913b9791a084aff588d7d4217dd5cd3f61178006ed4fa2455cad23"
     },
     {
       "id": "network-topology",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.1/network-topology-1.0.1.tmxplug",
-      "sha256": "4c8ec1ae0c39b8b72a89e0dce4b20a36df4adc826abe215b8ee9b69b44fe75ca"
+      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.0/network-topology-1.0.0.tmxplug",
+      "sha256": "ba3db2a6bc87533c8273648549c466b95f2c7538700407b2d62e48f813526bac"
     },
     {
       "id": "opkssh",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.1/opkssh-1.0.1.tmxplug",
-      "sha256": "c19eadfe763e4dbecbd9a5e9e753576c577c75296ddc8e0af4cce98c2376b26f"
+      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.0/opkssh-1.0.0.tmxplug",
+      "sha256": "05884e2244b4cc7f7f0465fe4b775ff95a99183ce6aba60848b68f1f3ec4078f"
     },
     {
       "id": "proxmox",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.1/proxmox-1.0.1.tmxplug",
-      "sha256": "4e0989856e061b9ab1ec25cc727051e03ea5e3dc1603e08895bd54e7ce132db7"
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.0/proxmox-1.0.0.tmxplug",
+      "sha256": "3a304ba327352093f4bf5dff1a7d6fc981a83180ffc2e06fe1c63e59600e8e3c"
     },
     {
       "id": "remote-desktop",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.2/remote-desktop-1.0.2.tmxplug",
-      "sha256": "70823a3f5161f6722fee22a9d5fe274dd47623960bc2188429c39a1c7e3e2b39",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.0/remote-desktop-1.0.0.tmxplug",
+      "sha256": "2dd13c79066c99816f78b3c8aa5f3e31e17d3d2568f2e48575ef1e01f1195c28",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -107,14 +107,14 @@
     {
       "id": "secret-sources",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.1/secret-sources-1.0.1.tmxplug",
-      "sha256": "9f5246325d3128c6376962f4cdbed33e78c487a4837f69235dfdcafeb293229a"
+      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.0/secret-sources-1.0.0.tmxplug",
+      "sha256": "fdab87ca97ea05c60d7008b22da4f56c4897abf11505b6fa8b5c7bd8bc1a53e3"
     },
     {
       "id": "serial",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.1/serial-1.0.1.tmxplug",
-      "sha256": "9908467fc184e40f108ff750bf2fb8044e000a436f84d0a7121109f4fcd5d121",
+      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.0/serial-1.0.0.tmxplug",
+      "sha256": "a645144a11e591f9668f2e7b23b8423274006180862be9c5f3e59df361c27e5e",
       "onboarding": {
         "recommended": "desktop",
         "consent": false
@@ -123,20 +123,20 @@
     {
       "id": "session-recording",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.1/session-recording-1.0.1.tmxplug",
-      "sha256": "45a08f950244c862a3774f9a653b3e3645285edb507a49b5c8da123832faf1e7"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.0/session-recording-1.0.0.tmxplug",
+      "sha256": "3a9ab3a3638d0cf13a4c7debbcd315d9a324b9991faea1c192ae1e8fda1e525b"
     },
     {
       "id": "session-sharing",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.1/session-sharing-1.0.1.tmxplug",
-      "sha256": "753aa9c0998f194ccf5fc49fd39c133a87f21f21e803014c4bfac6ccc7f9acb1"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.0/session-sharing-1.0.0.tmxplug",
+      "sha256": "f838e53401f6d75923821797829806b9ca03f0dd64fe87f8524d14a2e05f684e"
     },
     {
       "id": "snippets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.1/snippets-1.0.1.tmxplug",
-      "sha256": "bf643828beba86677220d802c0df74b441d7954538637f37413f78d59c08585f",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.0/snippets-1.0.0.tmxplug",
+      "sha256": "a434dd442c54fd7a124f4ebc9579a0af1aa4b07b1a90e3875f8ae72c35ced410",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -145,8 +145,8 @@
     {
       "id": "ssh-terminal",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.2/ssh-terminal-1.0.2.tmxplug",
-      "sha256": "e65102a8cd6afdaa890095fa698f3f455a1035729b9fdca800a31cc6e5ed760f",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.0/ssh-terminal-1.0.0.tmxplug",
+      "sha256": "64031970a7b6eb1c860aac79c1587a582ccd38b2ffcd5974b51a716240a8474d",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -155,8 +155,8 @@
     {
       "id": "sso",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.2/sso-1.0.2.tmxplug",
-      "sha256": "29ab0e4748ee71cb11f9b8dacd630430d284b6ce24561cffae9b4d7fe64e9c3b",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.0/sso-1.0.0.tmxplug",
+      "sha256": "2045d1da03dcd47089cb6566a7f25fe021326cb556cbc36b01563a2c234d1230",
       "onboarding": {
         "recommended": false,
         "consent": false,
@@ -166,20 +166,20 @@
     {
       "id": "step-ca",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.1/step-ca-1.0.1.tmxplug",
-      "sha256": "ff4df5bae8c48ff61fe659b6ed69a40ac070862bc423972711a194d558d77cc8"
+      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.0/step-ca-1.0.0.tmxplug",
+      "sha256": "fc38ac6dcf8c43c550b7a7c65836a095ec5a8bae76c8797b5563b2c6c8e8dad1"
     },
     {
       "id": "tailscale",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.1/tailscale-1.0.1.tmxplug",
-      "sha256": "0efe1cbf0f431763611926b6a9e92630ca8c1a89ea57bb796c5d7bd3ce0ab55f"
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.0/tailscale-1.0.0.tmxplug",
+      "sha256": "f7732afe584044258cc46205fee327223cdd290e1ba6e6858ddd22be6b3ef12d"
     },
     {
       "id": "telemetry",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.1/telemetry-1.0.1.tmxplug",
-      "sha256": "c7f70e149c67a570f2b004c2cceeba27ffe8cbd95cd4df4bbffd880cc3451469",
+      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.0/telemetry-1.0.0.tmxplug",
+      "sha256": "103e2ef2d52993bf15fdf2cda0addfa4aeba5817b4340f28e3fdea634aba6af0",
       "onboarding": {
         "recommended": true,
         "consent": true
@@ -188,20 +188,20 @@
     {
       "id": "termix-identity",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.1/termix-identity-1.0.1.tmxplug",
-      "sha256": "dc423ec53f012fdcc2cdccd872ac01353025e4da2ee9fea0d2a2d5988518a5a0"
+      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.0/termix-identity-1.0.0.tmxplug",
+      "sha256": "f1f712178b5d64ae263227640b61d1f5ea5a301eae3ff8adb8b52de5f20892fe"
     },
     {
       "id": "tmux-monitor",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.2/tmux-monitor-1.0.2.tmxplug",
-      "sha256": "ea41f1f90bdeab6164cfa2a594f359492afa123ed06990afa338be69a9d974c6"
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.0/tmux-monitor-1.0.0.tmxplug",
+      "sha256": "d6a98bcf99dbb31201d7079baf348100bca1c0eda0928aec4aeb075ea373a8d5"
     },
     {
       "id": "totp",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.1/totp-1.0.1.tmxplug",
-      "sha256": "4a083871663c2f6034904bd49bb02c2d4dd4ed4d50fbce1522172dae84991474",
+      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.0/totp-1.0.0.tmxplug",
+      "sha256": "aed42422ccc38c661f1aac2f7409f7872acf271552d6623b79bbcc43813d4fca",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -210,8 +210,8 @@
     {
       "id": "tunnels",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.2/tunnels-1.0.2.tmxplug",
-      "sha256": "44799c0bdbcc576fb0e1c1ecce96f283d2cc32b44ac5aeeb7253f8ca0b650860",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.0/tunnels-1.0.0.tmxplug",
+      "sha256": "215eae643d61d032bb6190bab7ed42140fd91c2165e2c4de079ff541e1522763",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -220,32 +220,32 @@
     {
       "id": "vault",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.1/vault-1.0.1.tmxplug",
-      "sha256": "c828eeebe37bf576020908e16a28e73073fc77178062b323058624f557a8c72a"
+      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.0/vault-1.0.0.tmxplug",
+      "sha256": "0bbd95002866807ddd469f102d09bff9cf1b39e005dec6b96530066c6c3b0d19"
     },
     {
       "id": "wake-on-lan",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.1/wake-on-lan-1.0.1.tmxplug",
-      "sha256": "5301d26138cb37812e8ef1fc5d3df688415517d545667b365fca2f41166a8402"
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.0/wake-on-lan-1.0.0.tmxplug",
+      "sha256": "39b97642e44e7b128df3632b10962bff6a26313f2e989e5acd29760cf91c4e04"
     },
     {
       "id": "warpgate",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.1/warpgate-1.0.1.tmxplug",
-      "sha256": "2f3b3169101ff04d0ea6229b31270ba0b5b8ff2c3d16e3f21a9e6c569d463ea8"
+      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.0/warpgate-1.0.0.tmxplug",
+      "sha256": "a7b7ed6d39639d0d6050958417d33d646a0304f99dec4eb9da71a46e42ae80f1"
     },
     {
       "id": "web-endpoint",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.1/web-endpoint-1.0.1.tmxplug",
-      "sha256": "88477231ab3c93206c99393c6cc8628c1ff8159af6978d0d09db969c28e1d637"
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.0/web-endpoint-1.0.0.tmxplug",
+      "sha256": "22f5f276f6dab85e9b211f8e990f82fcbf63ebb8fa90379463f64d0fa38905ab"
     },
     {
       "id": "webauthn",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.1/webauthn-1.0.1.tmxplug",
-      "sha256": "f9ccd5d6fe110b5c7ad8b90fd95e0a201e03d440462c2c3f6559406222364464",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.0/webauthn-1.0.0.tmxplug",
+      "sha256": "50994ae148b2a5e68cf924b922eb2fb22cf6215905049dd5b61a16e30a376a50",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -254,8 +254,8 @@
     {
       "id": "workspaces",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.1/workspaces-1.0.1.tmxplug",
-      "sha256": "17f53044318d6f53ef1e332d204f6469c7043fd9985c4d1eae16b6a1c3248153",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.0/workspaces-1.0.0.tmxplug",
+      "sha256": "23c6d2b0845b0e854dc6dde0ab4b60b9a58af020099fd4f6fcc1463a48d9ee62",
       "onboarding": {
         "recommended": true,
         "consent": false

docker/nginx-https.conf

@@ -425,16 +425,6 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            # A terminal is quiet most of the time - waiting on a prompt, reading
-            # output, running something long. Every console plugin dials this route
-            # (terminal, serial, remote desktop), and nginx's default
-            # proxy_read_timeout of 60s closed the socket about a minute into any
-            # pause, which reaches the user as the SSH server disconnecting. The
-            # plugin WebSocket routes below already ask for 86400s; this is the same
-            # class of socket, so it asks for the same.
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
         }
 
         location /host/ {

docker/nginx.conf

@@ -394,16 +394,6 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            # A terminal is quiet most of the time - waiting on a prompt, reading
-            # output, running something long. Every console plugin dials this route
-            # (terminal, serial, remote desktop), and nginx's default
-            # proxy_read_timeout of 60s closed the socket about a minute into any
-            # pause, which reaches the user as the SSH server disconnecting. The
-            # plugin WebSocket routes below already ask for 86400s; this is the same
-            # class of socket, so it asks for the same.
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
         }
 
         location /host/ {

drizzle/mysql/0071_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/mysql/meta/_journal.json

@@ -498,13 +498,6 @@
       "when": 1791550497926,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 71,
-      "version": "5",
-      "when": 1791755801066,
-      "tag": "0071_drop_install_count_source",
-      "breakpoints": true
     }
   ]
 }

drizzle/postgres/0071_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE "plugin_install_counts" DROP COLUMN "source";

drizzle/postgres/meta/_journal.json

@@ -498,13 +498,6 @@
       "when": 1791550496661,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 71,
-      "version": "7",
-      "when": 1791755800419,
-      "tag": "0071_drop_install_count_source",
-      "breakpoints": true
     }
   ]
 }

drizzle/sqlite/0066_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/sqlite/meta/_journal.json

@@ -463,13 +463,6 @@
       "when": 1791550495357,
       "tag": "0065_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 66,
-      "version": "6",
-      "when": 1791755799726,
-      "tag": "0066_drop_install_count_source",
-      "breakpoints": true
     }
   ]
 }

electron-builder.json

@@ -1,10 +1,7 @@
 {
   "appId": "com.karmaa.termix",
   "productName": "Termix",
-  "publish": {
-    "provider": "generic",
-    "url": "https://github.com/Termix-SSH/Termix/releases/latest/download"
-  },
+  "publish": null,
   "directories": {
     "output": "release"
   },
@@ -117,13 +114,8 @@
       {
         "target": "dmg",
         "arch": ["universal", "x64", "arm64"]
-      },
-      {
-        "target": "zip",
-        "arch": ["x64", "arm64"]
       }
     ],
-    "artifactName": "termix_macos_${arch}_update.${ext}",
     "icon": "public/icon.icns",
     "category": "public.app-category.developer-tools",
     "hardenedRuntime": true,

electron/auto-updater.cjs

@@ -1,323 +0,0 @@
-// Desktop self updates. The release is picked from the GitHub releases list
-// instead of electron-updater's GitHub provider, because the repo also holds
-// SDK and 2.9.x releases, and a new release exists a while before its files
-// finish uploading. The channel file is uploaded last, so a release counts
-// only once it has one for this platform.
-
-const path = require("path");
-
-const REPO = "Termix-SSH/Termix";
-const RELEASES_API = `https://api.github.com/repos/${REPO}/releases?per_page=30`;
-const DOWNLOAD_BASE = `https://github.com/${REPO}/releases/download/`;
-const MODES = ["automatic", "prompt", "never"];
-const DEFAULT_MODE = "prompt";
-const FIRST_CHECK_DELAY = 30 * 1000;
-const CHECK_INTERVAL = 6 * 60 * 60 * 1000;
-const VERSION = /^v?(\d+)\.(\d+)\.(\d+)(?:-beta\.(\d+))?$/;
-
-function parseVersion(value) {
-  const match = VERSION.exec(String(value || "").trim());
-  if (!match) return null;
-  return {
-    parts: match.slice(1, 4).map(Number),
-    beta: match[4] == null ? null : Number(match[4]),
-  };
-}
-
-// A beta sorts before the release it leads up to.
-function compareVersions(a, b) {
-  for (let i = 0; i < 3; i++) {
-    if (a.parts[i] !== b.parts[i]) return a.parts[i] - b.parts[i];
-  }
-  if (a.beta === b.beta) return 0;
-  if (a.beta == null) return 1;
-  if (b.beta == null) return -1;
-  return a.beta - b.beta;
-}
-
-// Matches the names electron-builder writes and electron-updater reads.
-function channelFile(channel, platform, arch) {
-  if (platform === "win32") return `${channel}.yml`;
-  if (platform === "darwin") return `${channel}-mac.yml`;
-  return `${channel}-linux${arch === "x64" ? "" : `-${arch}`}.yml`;
-}
-
-/**
- * The newest release this install should move to, or null. Stable installs
- * only see stable releases; a beta install also sees newer betas.
- */
-function resolveRelease(releases, { currentVersion, platform, arch }) {
-  const current = parseVersion(currentVersion);
-  if (!current || !Array.isArray(releases)) return null;
-  const allowBeta = current.beta != null;
-
-  const newest = releases
-    .filter((release) => release && !release.draft)
-    .map((release) => ({ release, version: parseVersion(release.tag_name) }))
-    .filter(
-      ({ release, version }) =>
-        version &&
-        release.tag_name.startsWith("v") &&
-        (allowBeta || version.beta == null) &&
-        compareVersions(version, current) > 0,
-    )
-    .sort((a, b) => compareVersions(b.version, a.version))[0];
-  if (!newest) return null;
-
-  const { release, version } = newest;
-  const channel = version.beta == null ? "latest" : "beta";
-  const file = channelFile(channel, platform, arch);
-  const assets = Array.isArray(release.assets) ? release.assets : [];
-  if (!assets.some((asset) => asset && asset.name === file)) return null;
-
-  return {
-    tag: release.tag_name,
-    version: release.tag_name.slice(1),
-    channel,
-    feedUrl: `${DOWNLOAD_BASE}${release.tag_name}`,
-    releaseUrl:
-      release.html_url ||
-      `https://github.com/${REPO}/releases/tag/${release.tag_name}`,
-  };
-}
-
-/**
- * How this copy of the app was installed, which decides whether it can
- * replace itself:
- * - auto: NSIS, DMG, AppImage or deb, updated in place
- * - manual: MSI, Chocolatey, Flatpak, portable builds and 32-bit Windows, told where to download
- * - store: Mac App Store
- * - disabled: dev builds
- */
-function getInstallKind({
-  platform,
-  arch,
-  isPackaged,
-  mas,
-  env,
-  execPath,
-  resourcesPath,
-  exists,
-  readFile,
-}) {
-  if (!isPackaged) return "disabled";
-  if (mas) return "store";
-
-  if (platform === "linux") {
-    if (env.FLATPAK_ID || exists("/.flatpak-info")) return "manual";
-    if (env.APPIMAGE) return "auto";
-    try {
-      const type = readFile(path.join(resourcesPath, "package-type")).trim();
-      // The AUR package reuses the deb's files, so ask dpkg if it owns us.
-      if (type === "deb" && exists("/var/lib/dpkg/info/termix.list")) {
-        return "auto";
-      }
-    } catch {
-      // Not a package install.
-    }
-    return "manual";
-  }
-
-  if (platform === "win32") {
-    if (arch !== "x64") return "manual";
-    const uninstaller = path.join(
-      path.dirname(execPath),
-      "Uninstall Termix.exe",
-    );
-    return exists(uninstaller) ? "auto" : "manual";
-  }
-
-  if (platform === "darwin") {
-    // Still running from the mounted DMG.
-    return execPath.startsWith("/Volumes/") ? "manual" : "auto";
-  }
-
-  return "manual";
-}
-
-function normalizeMode(mode) {
-  return MODES.includes(mode) ? mode : DEFAULT_MODE;
-}
-
-function createUpdater({
-  currentVersion,
-  platform,
-  arch,
-  kind,
-  getMode,
-  saveMode,
-  fetchReleases,
-  loadAutoUpdater,
-  send,
-  log,
-  beforeInstall,
-}) {
-  const state = {
-    kind,
-    mode: normalizeMode(getMode()),
-    currentVersion,
-    status: "idle",
-    version: null,
-    releaseUrl: null,
-    progress: null,
-    error: null,
-  };
-  const enabled = kind === "auto" || kind === "manual";
-  let updater = null;
-  let timer = null;
-  let checkedOnce = false;
-
-  function update(patch) {
-    Object.assign(state, patch);
-    send({ ...state });
-  }
-
-  function getUpdater() {
-    if (updater) return updater;
-    updater = loadAutoUpdater();
-    updater.logger = {
-      info: (...args) => log("[updater]", ...args),
-      warn: (...args) => log("[updater]", ...args),
-      error: (...args) => log("[updater]", ...args),
-      debug: () => {},
-    };
-    updater.autoInstallOnAppQuit = true;
-    updater.on("update-available", (info) =>
-      update({
-        status: updater.autoDownload ? "downloading" : "available",
-        version: info.version,
-        progress: null,
-        error: null,
-      }),
-    );
-    updater.on("update-not-available", () =>
-      update({ status: "up-to-date", error: null }),
-    );
-    updater.on("download-progress", (progress) =>
-      update({
-        status: "downloading",
-        progress: Math.round(progress.percent || 0),
-      }),
-    );
-    updater.on("update-downloaded", (info) =>
-      update({
-        status: "downloaded",
-        version: info.version,
-        progress: 100,
-        error: null,
-      }),
-    );
-    updater.on("error", (error) => {
-      log("[updater] error:", error?.message || String(error));
-      update({ status: "error", error: error?.message || String(error) });
-    });
-    return updater;
-  }
-
-  async function check() {
-    if (!enabled) return { ...state };
-    if (["checking", "downloading", "downloaded"].includes(state.status)) {
-      return { ...state };
-    }
-    checkedOnce = true;
-    update({ status: "checking", error: null });
-
-    let release;
-    try {
-      release = resolveRelease(await fetchReleases(), {
-        currentVersion,
-        platform,
-        arch,
-      });
-    } catch (error) {
-      log("[updater] release lookup failed:", error?.message || String(error));
-      update({ status: "error", error: error?.message || String(error) });
-      return { ...state };
-    }
-
-    if (!release) {
-      update({ status: "up-to-date" });
-      return { ...state };
-    }
-
-    update({ version: release.version, releaseUrl: release.releaseUrl });
-    if (kind === "manual") {
-      update({ status: "available" });
-      return { ...state };
-    }
-
-    try {
-      const auto = getUpdater();
-      auto.setFeedURL({ provider: "generic", url: release.feedUrl });
-      auto.channel = release.channel;
-      auto.allowDowngrade = false;
-      auto.autoDownload = state.mode === "automatic";
-      await auto.checkForUpdates();
-    } catch (error) {
-      log("[updater] check failed:", error?.message || String(error));
-      update({ status: "error", error: error?.message || String(error) });
-    }
-    return { ...state };
-  }
-
-  async function download() {
-    if (kind !== "auto" || state.status !== "available") return { ...state };
-    update({ status: "downloading", progress: 0 });
-    try {
-      await getUpdater().downloadUpdate();
-    } catch (error) {
-      log("[updater] download failed:", error?.message || String(error));
-      update({ status: "error", error: error?.message || String(error) });
-    }
-    return { ...state };
-  }
-
-  function install() {
-    if (kind !== "auto" || state.status !== "downloaded") return false;
-    // The tray keeps windows alive on close, so mark the quit first.
-    beforeInstall?.();
-    setImmediate(() => getUpdater().quitAndInstall());
-    return true;
-  }
-
-  function setMode(mode) {
-    if (!MODES.includes(mode)) return { ...state };
-    saveMode(mode);
-    update({ mode });
-    if (updater) updater.autoDownload = mode === "automatic";
-    if (mode !== "never" && !checkedOnce) void check();
-    return { ...state };
-  }
-
-  function start() {
-    if (!enabled || timer) return;
-    setTimeout(() => {
-      if (state.mode !== "never") void check();
-    }, FIRST_CHECK_DELAY).unref?.();
-    timer = setInterval(() => {
-      if (state.mode !== "never") void check();
-    }, CHECK_INTERVAL);
-    timer.unref?.();
-  }
-
-  return {
-    getState: () => ({ ...state }),
-    check,
-    download,
-    install,
-    setMode,
-    start,
-  };
-}
-
-module.exports = {
-  DEFAULT_MODE,
-  RELEASES_API,
-  channelFile,
-  compareVersions,
-  createUpdater,
-  getInstallKind,
-  normalizeMode,
-  parseVersion,
-  resolveRelease,
-};

electron/backend-failure.cjs

@@ -35,13 +35,7 @@ function parseConflictingPort(stderr) {
  * stderr. Always returns a failure -- see the note above on why every exit
  * that reaches this point counts as one.
  */
-// Part of PRE_29_DATABASE_ERROR in src/backend/database/db/upgrade-guard.ts.
-const OLD_DATABASE_MARKER = "This database is from Termix 2.8 or older";
-
 function classifyBackendFailure(stderr = "") {
-  if (stderr.includes(OLD_DATABASE_MARKER)) {
-    return { reason: "old-database", port: null };
-  }
   if (stderr.includes("EADDRINUSE")) {
     return { reason: "port-in-use", port: parseConflictingPort(stderr) };
   }

electron/desktop-settings.cjs

@@ -32,7 +32,7 @@ function writeJson(filePath, value) {
   }
 }
 
-const DEFAULTS = { defaultConnectionOrigin: "local", updateMode: "prompt" };
+const DEFAULTS = { defaultConnectionOrigin: "local" };
 
 function getDesktopSettings() {
   return { ...DEFAULTS, ...readJson(dataPath("desktop-settings.json"), {}) };

electron/main.cjs

@@ -29,7 +29,6 @@ const pty = require("node-pty");
 const WebSocket = require("ws");
 const linkedServer = require("./linked-server.cjs");
 const desktopSettings = require("./desktop-settings.cjs");
-const autoUpdates = require("./auto-updater.cjs");
 const { launchNativeRdp } = require("./native-rdp.cjs");
 const { isCloseActiveTabInput } = require("./keyboard-shortcuts.cjs");
 const { quitApp } = require("./app-quit.cjs");
@@ -1753,65 +1752,6 @@ ipcMain.handle("save-desktop-settings", (_event, settings) => {
   return desktopSettings.saveDesktopSettings(settings);
 });
 
-let appUpdater = null;
-
-function startAppUpdater() {
-  const kind = autoUpdates.getInstallKind({
-    platform: process.platform,
-    arch: process.arch,
-    isPackaged: app.isPackaged,
-    mas: !!process.mas,
-    env: process.env,
-    execPath: process.execPath,
-    resourcesPath: process.resourcesPath,
-    exists: (target) => fs.existsSync(target),
-    readFile: (target) => fs.readFileSync(target, "utf8"),
-  });
-  logToFile("Updater install kind:", kind);
-  appUpdater = autoUpdates.createUpdater({
-    currentVersion: app.getVersion(),
-    platform: process.platform,
-    arch: process.arch,
-    kind,
-    getMode: () => desktopSettings.getDesktopSettings().updateMode,
-    saveMode: (mode) =>
-      desktopSettings.saveDesktopSettings({ updateMode: mode }),
-    fetchReleases: async () => {
-      const { net } = require("electron");
-      const response = await net.fetch(autoUpdates.RELEASES_API, {
-        headers: { Accept: "application/vnd.github+json" },
-      });
-      if (!response.ok) {
-        throw new Error(`GitHub releases returned ${response.status}`);
-      }
-      return response.json();
-    },
-    loadAutoUpdater: () => require("electron-updater").autoUpdater,
-    send: (state) => {
-      if (mainWindow && !mainWindow.isDestroyed()) {
-        mainWindow.webContents.send("desktop-update-state", state);
-      }
-    },
-    log: logToFile,
-    beforeInstall: () => {
-      isQuitting = true;
-    },
-  });
-  appUpdater.start();
-}
-
-ipcMain.handle(
-  "desktop-update-get-state",
-  () => appUpdater?.getState() ?? null,
-);
-ipcMain.handle("desktop-update-check", () => appUpdater?.check() ?? null);
-ipcMain.handle("desktop-update-download", () => appUpdater?.download() ?? null);
-ipcMain.handle("desktop-update-install", () => appUpdater?.install() ?? false);
-ipcMain.handle(
-  "desktop-update-set-mode",
-  (_event, mode) => appUpdater?.setMode(mode) ?? null,
-);
-
 // The server an older version of the app was pointed at, offered again when
 // linking so upgraded installs do not have to look it up.
 ipcMain.handle("get-previous-server-url", () => {
@@ -1984,16 +1924,6 @@ const C2S_WS_HIGH_WATERMARK = 1024 * 1024;
 const C2S_WS_LOW_WATERMARK = 256 * 1024;
 const C2S_STREAM_WRITE_LIMIT = 8 * 1024 * 1024;
 
-// A proxy in front of the server may drop an idle WebSocket, which stopped
-// the tunnel. Pings count as traffic.
-function keepC2SSocketAlive(ws) {
-  const timer = setInterval(() => {
-    if (ws.readyState === WebSocket.OPEN) ws.ping();
-  }, 25_000);
-  timer.unref?.();
-  ws.once("close", () => clearInterval(timer));
-}
-
 // C2S (client-to-server) tunnels relay through the server this desktop is
 // linked to, not the embedded backend.
 function getC2SRemoteBaseUrl() {
@@ -2262,7 +2192,6 @@ async function openC2SRelay(
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
   const pendingChunks = [];
   let ready = false;
   let closed = false;
@@ -2370,7 +2299,6 @@ async function testC2SRelay(
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
 
   if (runtime) runtime.authSocket = ws;
   return new Promise((resolve) => {
@@ -2681,7 +2609,6 @@ async function startC2SRemoteTunnel(tunnel, index = 0, authToken) {
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
   const sockets = new Map();
   let closed = false;
 
@@ -3877,7 +3804,6 @@ app.whenReady().then(async () => {
 
   createTray();
   createWindow();
-  startAppUpdater();
   desktopSettings.removeOldSyncFiles();
   logToFile("=== Startup complete ===");
 });

electron/preload.js

@@ -26,23 +26,6 @@ contextBridge.exposeInMainWorld("electronAPI", {
   getEmbeddedServerStatus: () =>
     ipcRenderer.invoke("get-embedded-server-status"),
 
-  // App Store builds are updated by the store.
-  updates: process.mas
-    ? undefined
-    : {
-        getState: () => ipcRenderer.invoke("desktop-update-get-state"),
-        check: () => ipcRenderer.invoke("desktop-update-check"),
-        download: () => ipcRenderer.invoke("desktop-update-download"),
-        install: () => ipcRenderer.invoke("desktop-update-install"),
-        setMode: (mode) => ipcRenderer.invoke("desktop-update-set-mode", mode),
-        onState: (callback) => {
-          const listener = (_event, state) => callback(state);
-          ipcRenderer.on("desktop-update-state", listener);
-          return () =>
-            ipcRenderer.removeListener("desktop-update-state", listener);
-        },
-      },
-
   removeAllListeners: (channel) => ipcRenderer.removeAllListeners(channel),
   isElectron: true,
   isDev: process.env.NODE_ENV === "development",

env.catalog.json

@@ -361,15 +361,10 @@
       "group": "plugins",
       "description": "Use another plugin index instead of the official registry."
     },
-    {
-      "name": "TERMIX_COMMUNITY_REGISTRY_URL",
-      "group": "plugins",
-      "description": "Use another plugin index instead of the community registry. Its plugins still have to be signed with the community key."
-    },
     {
       "name": "TERMIX_PLUGIN_STATS_URL",
       "group": "plugins",
-      "description": "Where plugin download counts are read from. Defaults to stats.json next to the registry index."
+      "description": "Where install counts are read from. Defaults to stats.json next to the registry index."
     },
     {
       "name": "TERMIX_REQUIRE_SIGNED_PLUGINS",
@@ -447,18 +442,6 @@
       "internal": true,
       "description": "Read on Linux to pick the password store and window behavior."
     },
-    {
-      "name": "APPIMAGE",
-      "group": "desktop",
-      "internal": true,
-      "description": "Set by AppImage. Tells the desktop app it can update itself."
-    },
-    {
-      "name": "FLATPAK_ID",
-      "group": "desktop",
-      "internal": true,
-      "description": "Set by Flatpak. The desktop app links new versions instead of installing them."
-    },
 
     {
       "name": "DESKTOP_SESSION",

index.html

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/x-icon" href="favicon.ico" />
+    <link rel="icon" type="image/svg+xml" href="favicon.ico" />
     <meta
       name="viewport"
       content="width=device-width, initial-scale=1.0, viewport-fit=cover"

package-lock.json

@@ -1,18 +1,17 @@
 {
   "name": "termix",
-  "version": "26.10.1",
+  "version": "26.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "termix",
-      "version": "26.10.1",
+      "version": "26.10.0",
       "hasInstallScript": true,
       "workspaces": [
         "packages/*"
       ],
       "dependencies": {
-        "@noble/hashes": "^2.4.0",
         "@tanstack/react-virtual": "^3.14.13",
         "@types/compression": "^1.8.1",
         "@types/semver": "^7.8.0",
@@ -26,7 +25,6 @@
         "cors": "^2.8.6",
         "dotenv": "^17.4.2",
         "drizzle-orm": "^0.45.2",
-        "electron-updater": "^6.8.9",
         "express": "^5.2.1",
         "jsonwebtoken": "^9.0.3",
         "motion": "^13.1.1",
@@ -107,7 +105,6 @@
         "husky": "^9.1.7",
         "i18next": "^26.4.2",
         "i18next-browser-languagedetector": "^8.2.1",
-        "js-yaml": "^4.3.2",
         "jsdom": "^30.0.1",
         "lint-staged": "^17.2.0",
         "lucide-react": "^1.33.0",
@@ -2879,6 +2876,7 @@
       "version": "2.4.0",
       "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz",
       "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20.19.0"
@@ -7591,6 +7589,7 @@
       "version": "9.7.0",
       "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
       "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "debug": "^4.3.4",
@@ -9017,34 +9016,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/electron-updater": {
-      "version": "6.8.9",
-      "resolved": "https://registry.npmjs.org/electron-updater/-/electron-updater-6.8.9.tgz",
-      "integrity": "sha512-ZhVxM9iGONUpZGI1FxdMRgJjUFXi7AYGVa5PwKlO1tV1/4zDxQmfKpXOHVztKrd6L9rLcFjERvi1Mf2vxyTkig==",
-      "license": "MIT",
-      "dependencies": {
-        "builder-util-runtime": "9.7.0",
-        "fs-extra": "^10.1.0",
-        "js-yaml": "^4.1.0",
-        "lazy-val": "^1.0.5",
-        "lodash.escaperegexp": "^4.1.2",
-        "lodash.isequal": "^4.5.0",
-        "semver": "~7.7.3",
-        "tiny-typed-emitter": "^2.1.0"
-      }
-    },
-    "node_modules/electron-updater/node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/electron/node_modules/@types/node": {
       "version": "24.19.0",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.0.tgz",
@@ -9899,6 +9870,7 @@
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
       "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -10831,6 +10803,7 @@
       "version": "6.2.1",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
       "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "universalify": "^2.0.0"
@@ -10896,6 +10869,7 @@
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/lazy-val/-/lazy-val-1.0.5.tgz",
       "integrity": "sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/levn": {
@@ -11244,12 +11218,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/lodash.escaperegexp": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/lodash.escaperegexp/-/lodash.escaperegexp-4.1.2.tgz",
-      "integrity": "sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw==",
-      "license": "MIT"
-    },
     "node_modules/lodash.includes": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -11262,13 +11230,6 @@
       "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
       "license": "MIT"
     },
-    "node_modules/lodash.isequal": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz",
-      "integrity": "sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==",
-      "deprecated": "This package is deprecated. Use require('node:util').isDeepStrictEqual instead.",
-      "license": "MIT"
-    },
     "node_modules/lodash.isinteger": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
@@ -13059,6 +13020,7 @@
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
       "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -13818,12 +13780,6 @@
         "semver": "bin/semver"
       }
     },
-    "node_modules/tiny-typed-emitter": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/tiny-typed-emitter/-/tiny-typed-emitter-2.1.0.tgz",
-      "integrity": "sha512-qVtvMxeXbVej0cQWKqVSSAHmKZEHAvxdF8HEUBFWts8h+xEo5m/lEiPakuyZ3BnCBjOD8i24kzNOiOLLgsSxhA==",
-      "license": "MIT"
-    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -14125,6 +14081,7 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
       "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 10.0.0"
@@ -15058,7 +15015,7 @@
     },
     "packages/plugin-sdk": {
       "name": "@termix-ssh/plugin-sdk",
-      "version": "1.0.6",
+      "version": "1.0.5",
       "license": "Apache-2.0",
       "dependencies": {
         "@deadendjs/swagger-jsdoc": "^8.1.2",

package.json

@@ -4,7 +4,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "26.10.1",
+  "version": "26.10.0",
   "description": "Self-hosted, plugin-based server management.",
   "author": "Karmaa",
   "main": "electron/main.cjs",
@@ -18,7 +18,7 @@
     "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs && node scripts/patch-node-pty.cjs && node scripts/patch-ssh2-agent.cjs",
     "prepare": "husky || true",
     "prebuild": "node scripts/write-electron-build-info.cjs",
-    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/check-sdk-guide.cjs && node scripts/generate-settings-search-index.cjs --check && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
+    "lint": "node scripts/generate-dialect-schema.cjs --check && eslint . && node scripts/check-importmap-csp.cjs && node scripts/check-core-plugin-ids.cjs && node scripts/check-sdk-ui-exports.cjs && node scripts/generate-settings-search-index.cjs --check && node scripts/check-test-locations.cjs && node scripts/check-changelog.cjs && node scripts/check-env-catalog.cjs",
     "lint:fix": "eslint --fix .",
     "type-check": "npm run build:sdk && tsc -b --force",
     "test": "vitest run",
@@ -47,7 +47,6 @@
     "plugins:pin": "node scripts/pin-bundled-plugins.cjs"
   },
   "dependencies": {
-    "@noble/hashes": "^2.4.0",
     "@tanstack/react-virtual": "^3.14.13",
     "@types/compression": "^1.8.1",
     "@types/semver": "^7.8.0",
@@ -61,7 +60,6 @@
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
-    "electron-updater": "^6.8.9",
     "express": "^5.2.1",
     "jsonwebtoken": "^9.0.3",
     "motion": "^13.1.1",
@@ -142,7 +140,6 @@
     "husky": "^9.1.7",
     "i18next": "^26.4.2",
     "i18next-browser-languagedetector": "^8.2.1",
-    "js-yaml": "^4.3.2",
     "jsdom": "^30.0.1",
     "lint-staged": "^17.2.0",
     "lucide-react": "^1.33.0",

packages/plugin-sdk/CHANGELOG.md

@@ -1,11 +1,5 @@
 # Changelog
 
-## 1.0.6
-
-### Added
-
-- `PLUGIN-GUIDE.md`, a guide to building, testing and releasing a plugin, written so AI coding tools can read it too
-
 ## 1.0.5
 
 ### Fixed

packages/plugin-sdk/PLUGIN-GUIDE.md

@@ -1,780 +0,0 @@
-# Termix plugin guide
-
-SDK 1.0.6 | Plugin API 1.2.0
-
-This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
-`@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
-Run `npm update @termix-ssh/plugin-sdk` to get the newest one.
-
-If this guide and the SDK's TypeScript types disagree, the types are right. They live next to this file
-in `dist/*.d.ts`. The long form of everything here is at https://docs.termix.site/develop, and the raw
-Markdown of each page is at
-`https://raw.githubusercontent.com/Termix-SSH/Docs/main/develop/<page>.md` (for example
-`develop/backend.md`), which is easier for tools to read than the site.
-
-## What a plugin is
-
-Termix is self-hosted, plugin-based server management. Core keeps hosts, credentials, users, sharing and
-the shell. Everything else, even the SSH terminal, is a plugin built with this SDK.
-
-A plugin is:
-
-- `manifest.json`: what it is, what it adds and what it may do. Termix reads it without running any code.
-- A backend, `src/backend/index.ts`, run inside the Termix server process. It exports `activate(ctx)`.
-- A frontend, `src/frontend/index.tsx`, run in the browser in the same page as Termix. It exports
-  `activate(app)`.
-
-There is no sandbox. Capabilities make a plugin honest and easy to audit, but code runs with the server's
-rights. Write it as if an admin will read every line, because reviewers do.
-
-## Hard rules
-
-Break one of these and the plugin fails to load, fails validation or gets rejected in review.
-
-1. Import only `@termix-ssh/plugin-sdk/*`, your own files and npm packages. Never import Termix's own code.
-2. Create everything inside `activate`. No servers, timers, sockets or connections at the top of a module.
-   Disable then enable runs `activate` again on the same module, and it must work without a restart.
-3. Clean up what you make yourself with `ctx.disposables.add(fn)` (backend) or `app.onDispose(fn)`
-   (frontend). Things made through `ctx` and `app` are cleaned up for you.
-4. Never call `process.exit` or touch signals.
-5. Never open your own SSH connection. Use `ctx.ssh` so jump hosts, proxies, host keys, every auth type and
-   sharing work the way the user set them up.
-6. Outbound HTTP goes through `ctx.fetch` (needs `network:outbound`), not a raw `fetch` or axios.
-7. Ask for the fewest capabilities you can. A call that needs one you didn't list throws
-   `PluginCapabilityError`.
-8. Never take a user id from a request body or a service caller. Use `ctx.currentActor()`.
-9. Check permissions on the backend. Frontend checks only hide UI.
-10. Call `await ctx.db.persist()` after every database write. On SQLite a write without it can be lost on
-    restart.
-11. Never use `.returning()` in a query. MySQL doesn't have it. Read a new row back by a key you chose.
-12. Never edit a migration that has shipped. Termix checks a checksum and refuses to start the plugin. Add a
-    new one.
-13. Never index a `text()` or `json()` column. Use `varchar(n)` for anything you index.
-14. Never hard code UI text. Every string goes in `locales/en.json` and is read with `t()`.
-15. The plugin `id` never changes once released. It names your tables, routes and permissions.
-16. The version in `manifest.json`, `package.json` and the newest `CHANGELOG.md` section must match.
-17. Put an `@openapi` JSDoc block above every route.
-18. No obfuscated or minified source, and no code downloaded and run at runtime.
-19. No tracking, telemetry or network calls the user didn't ask for. If you need one, make it off by
-    default and explain it in your docs.
-
-## Project layout
-
-```
-manifest.json            what the plugin is, adds and may do
-package.json             npm scripts and dependencies
-CHANGELOG.md             release notes, one section per version
-README.md                the repo front page
-AGENTS.md                notes for AI tools working on this plugin
-docs/index.md            the plugin's docs page (more pages next to it)
-src/backend/index.ts     activate(ctx), runs in the Termix server
-src/backend/tables.ts    table definitions, exports `tables`
-src/backend/routes.ts    HTTP routes
-src/frontend/index.tsx   activate(app), runs in the browser
-locales/en.json          every string the plugin shows
-locales/translated/      other languages, like de_DE.json (optional)
-migrations/              sqlite/, postgres/, mysql/ and snapshot.json, made by npm run migrations
-tests/backend/           backend tests (Node)
-tests/frontend/          frontend tests (jsdom)
-vitest.config.ts         uses the SDK preset
-.github/workflows/       ci.yml and release.yml, calling shared workflows in Termix-Registry
-dist/                    build output, never commit it
-```
-
-## Commands
-
-```bash
-npm install
-npm run build        # termix-plugin build: dist/backend.js, dist/frontend.js, CSS, openapi.json
-npm test             # termix-plugin test: Vitest
-npm run typecheck    # tsc
-npm run validate     # termix-plugin validate: manifest, files, migrations, changelog, docs
-npm run migrations   # termix-plugin migrations: write migrations after changing tables.ts
-npm run pack         # termix-plugin pack: write <id>-<version>.tmxplug
-npm run format       # Prettier
-npm run format:check
-```
-
-## Done checklist
-
-Before you call a change finished:
-
-- [ ] `npm test` passes
-- [ ] `npm run typecheck` passes
-- [ ] `npm run validate` passes with no warnings you can fix
-- [ ] `npm run build` passes
-- [ ] `npm run format:check` passes
-- [ ] `npx termix-plugin migrations --check` passes (you ran `npm run migrations` after changing tables)
-- [ ] New strings are in `locales/en.json`
-- [ ] New routes have an `@openapi` block and a test, including without the permission
-- [ ] New env vars are listed in `env` in the manifest
-- [ ] `docs/` and the "About this plugin" section of `AGENTS.md` still match what the plugin does
-- [ ] User facing changes are in `CHANGELOG.md` under the version they will ship in
-
-## Manifest
-
-```json
-{
-  "$schema": "./node_modules/@termix-ssh/plugin-sdk/schema/manifest.schema.json",
-  "id": "hello",
-  "name": "Hello",
-  "version": "1.0.0",
-  "description": "Says hello and keeps a few notes.",
-  "author": { "name": "You", "url": "https://example.com" },
-  "license": "Apache-2.0",
-  "repository": "https://github.com/you/termix-plugin-hello",
-  "docs": "https://github.com/you/termix-plugin-hello/tree/main/docs",
-  "category": "Productivity",
-  "icon": "Hand",
-  "features": ["A tab from the sidebar", "Notes per user"],
-  "engine": { "termix": ">=26.10.0", "api": "^1.2" },
-  "capabilities": ["db:own", "network:serve", "ui:surface"],
-  "env": [],
-  "contributes": {
-    "tabs": [
-      {
-        "id": "hello",
-        "titleKey": "tab.title",
-        "icon": "Hand",
-        "openFrom": ["rail"]
-      }
-    ],
-    "permissions": [
-      {
-        "name": "use",
-        "titleKey": "permissions.use.title",
-        "descriptionKey": "permissions.use.description",
-        "defaultRoles": ["admin", "user"]
-      }
-    ]
-  },
-  "locales": "locales",
-  "platforms": ["linux", "win32", "darwin"]
-}
-```
-
-Unknown fields are refused at every level, so a typo fails validation. The schema at
-`node_modules/@termix-ssh/plugin-sdk/schema/manifest.schema.json` has every field.
-
-| Field                                  | Notes                                                                                                               |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| `id`                                   | Lowercase, starts with a letter, 2 to 40 characters, letters, numbers and dashes. Can't be an official plugin's id. |
-| `version`                              | Semver. Betas are `X.Y.Z-beta.N`.                                                                                   |
-| `category`                             | One of: Terminal, Files & Transfer, Infrastructure, Monitoring, Networking, Access & Security, Productivity.        |
-| `icon`                                 | A [Lucide](https://lucide.dev/icons/) icon name, like `Hand`.                                                       |
-| `features`                             | Up to 20 short lines shown on the plugin's page.                                                                    |
-| `docs`                                 | An https link to your docs.                                                                                         |
-| `engine.termix`                        | Termix versions you work with, like `>=26.10.0`.                                                                    |
-| `engine.api`                           | Plugin API range, like `^1.2`. A major bump of the API is breaking.                                                 |
-| `capabilities`                         | What your code may do. See the reference at the end.                                                                |
-| `dependencies`, `optionalDependencies` | Other plugins, `{ "snippets": "^1.0.0" }`. You must keep working without optional ones.                             |
-| `provides`, `requires`                 | Services you offer and use.                                                                                         |
-| `env`                                  | Every environment variable your backend reads. `validate` warns about unlisted `process.env.X`. Prefer settings.    |
-| `desktop`                              | `mirror` (default), `local` or `server`: how a linked desktop app treats the plugin.                                |
-| `nativeDependencies`                   | npm packages with `.node` bindings. Avoid them: community plugins can't count on them.                              |
-
-`contributes` holds `tabs`, `panels`, `dashboardCards`, `actions`, `actionSlots`, `permissions`,
-`settings`, `protocols`, `auth`, `syncEntities`, `keybindingActions`, `http`, `guest`, `guestViews`,
-`uiPresets` and `uses`. Frontend `register*` calls need their ids declared here first.
-
-Capabilities and permissions are different things. A capability (`hosts:read`, with a colon) is what your
-code may reach. A permission (`hello.use`, with a dot) is what a user may do.
-
-## Backend
-
-```ts
-import type { Router } from "express";
-import type { PluginContext } from "@termix-ssh/plugin-sdk/backend";
-import { notes } from "./tables.js";
-import { registerRoutes } from "./routes.js";
-
-export async function activate(ctx: PluginContext) {
-  const notesTable = await ctx.db.define(notes);
-  registerRoutes(ctx.http.router<Router>(), ctx, notesTable);
-}
-
-export async function deactivate() {
-  // Everything registered through ctx is disposed by core.
-}
-```
-
-Bundled as ESM for Node 22+ into `dist/backend.js`. Backend imports of your own files use `.js`.
-
-### What ctx has
-
-| Member                 | Capability                       | What it does                                                   |
-| ---------------------- | -------------------------------- | -------------------------------------------------------------- |
-| `pluginId`, `manifest` | none                             | Your id and manifest                                           |
-| `log`                  | none                             | Log lines tagged with your plugin                              |
-| `db`                   | `db:own`                         | Your own tables                                                |
-| `kv`                   | `kv:own`                         | Small key value state                                          |
-| `files.dataDir()`      | `files:own`                      | A folder of your own                                           |
-| `settings`             | none                             | Your settings                                                  |
-| `secrets`              | `secrets:own`                    | Encrypted values per user, `seal`/`unseal` for your own tables |
-| `http`, `ws`           | `network:serve`                  | Routes and sockets                                             |
-| `rbac`                 | none                             | Check the actor's permissions                                  |
-| `hosts`                | `hosts:read`, `hosts:write`      | List, read, create, update and share hosts as the actor        |
-| `ssh`                  | `ssh:connect`, `credentials:use` | Connect to hosts through Termix's SSH pipeline                 |
-| `credentials`          | varies                           | The actor's saved keys, and protocol logins                    |
-| `services`             | per service                      | Call other plugins and offer your own                          |
-| `events`               | `events:core` for core topics    | Emit and listen for events                                     |
-| `notify`               | `notify:send`                    | Send alerts to the Alerts inbox                                |
-| `fetch`                | `network:outbound`               | Outbound HTTP with SSRF protection                             |
-| `process`              | `process:spawn`                  | Run programs on the server                                     |
-| `schedule`             | none                             | Timers that stop on disable and never overlap                  |
-| `audit.record`         | none                             | Write your own audit line                                      |
-| `sync`                 | none                             | Sync your tables to a linked desktop                           |
-| `auth`                 | `auth:provide`                   | Login methods, second factors, SSH auth types                  |
-| `system`               | `system:tls`                     | The server's HTTPS certificate                                 |
-| `plugins.list()`       | `plugins:read`                   | Which plugins are installed                                    |
-| `asUser(userId, fn)`   | always audited                   | Run background work as a user                                  |
-| `currentActor()`       | none                             | The user the current call runs for                             |
-| `disposables.add(fn)`  | none                             | Extra cleanup on disable                                       |
-
-### The actor
-
-In a route the actor is the signed-in user, set by Termix. `ctx.currentActor()` returns it. Background
-work with no request (a timer, an event) uses `ctx.asUser(userId, fn)`, which is audited and still applies
-that user's permissions.
-
-### Routes
-
-Routes live at `/plugin-api/<id>/`, sockets at `/plugin-ws/<id>/`, on the main Termix port. You never need
-your own port or an nginx change. Before your handler runs, Termix checks sign in, sets the actor, answers
-503 if the plugin is off, parses JSON up to 2 MB and catches errors.
-
-```ts
-router.use(ctx.rbac.require("use") as never);
-
-/**
- * @openapi
- * /plugin-api/hello/notes:
- *   post:
- *     summary: Add a note for the signed-in user
- *     tags:
- *       - Hello
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               text:
- *                 type: string
- *     responses:
- *       201:
- *         description: Note added
- *       400:
- *         description: Missing or empty text
- */
-router.post("/notes", async (req, res) => {
-  const text = typeof req.body?.text === "string" ? req.body.text.trim() : "";
-  if (!text) return res.status(400).json({ error: "text is required" });
-  const db = await ctx.db.client<BetterSQLite3Database>();
-  await db
-    .insert(notesTable)
-    .values({ userId: ctx.currentActor() as string, text });
-  await ctx.db.persist();
-  res.status(201).json({ success: true });
-});
-```
-
-- The `@openapi` path is the full path, starting with `/plugin-api/<id>/`. `build` turns these into
-  `dist/openapi.json` and the docs site renders them.
-- `ctx.http.router({ public: ["/webhook/:token"], bodyLimit: "20mb", rawBody: false })`. Public routes
-  have no actor: check their token yourself and rate limit them.
-- `ctx.http.baseUrl(req)` is the public address, for callback URLs.
-- `ctx.ws.route("/live", (socket, conn) => ...)`. Long lived sockets should check
-  `conn.isDataUnlocked()` per message.
-- `ctx.rbac.require("manage")` on a single route, `await ctx.rbac.has("manage")` in code. A full id like
-  `hosts.edit` checks a core permission.
-- Host access: `ctx.hosts.checkAccess(hostId, "connect" | "view" | "edit" | "manage")`.
-
-### Errors
-
-Errors from routes, sockets, listeners and timers count against an error budget. Five in a minute and
-Termix turns the plugin off (state `failed`). A 4xx you send on purpose doesn't count. Validate input and
-send 400s instead of throwing.
-
-### SSH
-
-```ts
-const { client, dispose } = await ctx.ssh.connect(hostId, {
-  purpose: "hello",
-  profile: "background",
-});
-try {
-  // use the ssh2 client
-} finally {
-  dispose();
-}
-```
-
-`ctx.ssh.withConnection(hostId, { pool, purpose }, fn)` borrows a pooled connection for frequent short
-commands. `@termix-ssh/plugin-sdk/host-commands` has helpers to detect the OS and run package manager and
-sudo commands. Hosts from `ctx.hosts` never carry secrets. Pass the host or its id to `ctx.ssh`.
-
-### Events, timers, alerts, services
-
-```ts
-ctx.events.on("host.deleted", ({ hostId }) => cleanUp(hostId)); // core topics need events:core
-ctx.events.emit("plugin.hello.greeted", { name }); // your own: plugin.<id>.<name>
-ctx.schedule.every(60_000, () => refresh(), { jitterMs: 5_000 });
-```
-
-- Alerts go through `ctx.notify.send` (`notify:send`). Never build your own notification system.
-- Offer a service: declare it in `provides` with a version and a permission, then
-  `ctx.services.provide("hello.greetings", impl)`. The name starts with your id. Methods read the caller
-  from `ctx.currentActor()`.
-- Use a service: declare it in `requires`, then `ctx.services.get<T>("snippets.access")`. It returns
-  nothing while no provider runs, so always handle that.
-
-### Shared packages
-
-These come from Termix and are never bundled: `@termix-ssh/plugin-sdk`, `express`, `ssh2`, `ws`, `multer`,
-`cookie-parser`, `axios`, `jszip`, `guacamole-lite`, `@anthropic-ai/sdk`, `drizzle-orm`, `sharp` and every
-Node builtin. List the ones you use in `peerDependencies`. Any other npm package is bundled.
-
-## Database
-
-Needs `db:own`. Define tables once in TypeScript, generate migrations for SQLite, PostgreSQL and MySQL,
-query with [Drizzle](https://orm.drizzle.team/).
-
-```ts
-// src/backend/tables.ts
-import {
-  defineTable,
-  id,
-  refUser,
-  text,
-  timestamp,
-} from "@termix-ssh/plugin-sdk/db";
-
-export const notes = defineTable(
-  "notes",
-  {
-    id: id(),
-    userId: refUser(),
-    text: text().notNull(),
-    createdAt: timestamp().notNull().defaultNow(),
-  },
-  { indexes: [{ name: "idx_p_hello_notes_user_id", columns: ["userId"] }] },
-);
-
-export const tables = [notes]; // termix-plugin migrations reads this
-```
-
-The table is stored as `p_<id with dashes as underscores>_notes`. Index names should use the same prefix.
-
-| Builder                                        | Type                                                                        |
-| ---------------------------------------------- | --------------------------------------------------------------------------- |
-| `id()`                                         | Auto increment key                                                          |
-| `text()`                                       | Any length string. Not indexable                                            |
-| `varchar(n)`                                   | String up to `n` (255 default). Indexable                                   |
-| `integer()`, `bigint()`, `real()`, `boolean()` | Numbers and booleans                                                        |
-| `timestamp()`                                  | A time, stored as text                                                      |
-| `json()`                                       | JSON stored as text. Not indexable                                          |
-| `encryptedText()`                              | Text encrypted with the owning user's key                                   |
-| `refUser()`                                    | A user id. Rows are deleted with the user and included in their data export |
-| `refHost()`                                    | A host id. Rows are deleted with the host                                   |
-
-Modifiers: `.notNull()`, `.unique()`, `.primaryKey()`, `.default(value)`, `.defaultNow()`.
-
-After any change to `tables.ts`, run `npm run migrations` and read the three new files. Renames and type
-changes are refused rather than guessed: write those by hand, for all three databases. A migration may only
-touch your own tables. `createTestDb` applies them in tests, so a broken one fails `npm test`.
-
-Query through `const db = await ctx.db.client()`, then `await ctx.db.persist()` after writes
-(`persist({ lazy: true })` for frequent low value writes). `ctx.db.dialect` says which database runs.
-
-Other storage: `ctx.kv` for a few values, `ctx.settings` for settings, `ctx.secrets` for secrets,
-`ctx.files.dataDir()` for files. To sync a table to a linked desktop, use `ctx.sync.registerEntity` and
-`contributes.syncEntities`. The entity name is part of the protocol and never changes.
-
-## Frontend
-
-```tsx
-import {
-  useTranslation,
-  type TabProps,
-  type TermixApp,
-} from "@termix-ssh/plugin-sdk/frontend";
-import { EmptyState, PanelShell } from "@termix-ssh/plugin-sdk/ui";
-import { Hand } from "lucide-react";
-
-function HelloTab(_props: TabProps) {
-  const { t } = useTranslation();
-  return (
-    <PanelShell icon={<Hand className="size-4" />} title={t("tab.title")}>
-      <EmptyState title={t("tab.empty")} />
-    </PanelShell>
-  );
-}
-
-export function activate(app: TermixApp) {
-  app.registerRailItem({
-    id: "hello",
-    icon: Hand,
-    titleKey: "tab.title",
-    kind: "tab",
-    permission: "use",
-  });
-  app.registerTab("hello", HelloTab, {
-    icon: Hand,
-    titleKey: "tab.title",
-    singleton: true,
-    hostless: true,
-  });
-}
-```
-
-Every `register*` returns an undo function, and everything is undone on disable. Each component runs in
-your plugin's error boundary and Suspense.
-
-| Member                                                                             | What it does                                                      |
-| ---------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
-| `registerRailItem`                                                                 | A sidebar rail button                                             |
-| `registerTab`, `registerPanel`                                                     | A tab type or sidebar panel (id in `contributes.tabs` / `panels`) |
-| `registerDashboardCard`                                                            | A dashboard card (`contributes.dashboardCards`)                   |
-| `registerHostAction`                                                               | A host button, palette entry or default connect                   |
-| `registerHostEditorSection`                                                        | Your own host editor section (host settings get one for free)     |
-| `registerHostProtocol`                                                             | A connection protocol next to SSH                                 |
-| `registerHostBadge`, `registerHostContextMenuItem`                                 | Badges and menu items on host rows                                |
-| `registerPaletteEntry`, `registerPaletteGroup`                                     | Command palette entries                                           |
-| `registerKeybindingAction`, `registerKeybindingDefault`                            | Bindable actions                                                  |
-| `registerSettingsComponent`                                                        | A component for a `custom` settings field                         |
-| `registerAction`, `invokeAction`                                                   | Actions across plugins                                            |
-| `registerSlotContribution`, `declareActionSlot`                                    | Fill or own a UI slot                                             |
-| `registerComponent`, `registerExtension`                                           | Offer a component by id, add to an extension point                |
-| `registerOnboardingStep`                                                           | A first run setup step                                            |
-| `registerLoginMethod`, `registerSecondFactorUI`, `registerSshAuthEditor`           | Sign in UI                                                        |
-| `api`                                                                              | Axios client for your `/plugin-api/<id>/` routes, auth included   |
-| `fetch(path)`, `wsUrl(path)`                                                       | Raw fetch for streams, socket URL and auth                        |
-| `docs`, `tabs`, `confirm`, `listHosts`, `getHost`, `t`, `hasPermission`, `desktop` | Helpers                                                           |
-| `onSettingsChanged`, `onDispose`                                                   | Hooks                                                             |
-
-Hooks from `@termix-ssh/plugin-sdk/frontend`: `useTranslation`, `usePermission`, `useSettings`, `useHost`,
-`useHosts`, `usePluginApi`, `useCurrentUser`, `useTheme`, `useToast`, `useDocsUrl`, `useTabs`,
-`useSlotContributions`, `useSshAuthTypes`, `useExtensions`.
-
-Shared from Termix and never bundled: `react`, `react-dom`, `i18next`, `react-i18next`, `sonner` and the
-SDK's `frontend` and `ui`. Anything else, like `lucide-react`, is bundled. A host your code gets only carries
-your own host settings, under `host.pluginSettings[<id>]`.
-
-Slots you can fill include `terminal.toolbar`, `terminal.toolbarStatus`, `terminal.sidePanel`,
-`terminal.overlay`, `dashboard.counters`, `dashboard.hostMetrics`, `admin.userTabs`, `hosts.importMenu`,
-`hosts.panel`, `credentials.badges`, `shell.overlay` and `tab.menu`. See
-https://docs.termix.site/develop/more-extension-points.
-
-## Looking native
-
-Build UI from `@termix-ssh/plugin-sdk/ui` so it matches Termix and follows the theme. The full list of
-exports with props is `ui.api.txt` in the Termix repo
-(https://github.com/Termix-SSH/Termix/blob/main/packages/plugin-sdk/ui.api.txt).
-
-- Square: panels, cards and containers have no rounded corners. Small controls may stay rounded.
-- Flat: borders, not shadows. Use theme tokens like `border-border`, `bg-background`,
-  `text-muted-foreground`, `text-destructive`. One accent, `text-accent-brand`. Don't add colors.
-- Small type: most text 11 to 13px.
-- No new modal dialogs. Ask with `useConfirm()`, open views in place with `InlineView`, and use
-  `PanePrompt` for small prompts.
-- Every tab or panel sits in `PanelShell`. Lists use `PanelList` and `ListRow`, add with `AddButton`,
-  forms end with `FormFooter`, empty lists show `EmptyState`.
-- Forms: `TextField`, `NumberField`, `SelectField`, `SwitchRow`, `SecretField`, `SettingRow` and friends.
-- Host sessions use `ConnectionGate` for the whole connect flow (host keys, TOTP, passphrases, errors).
-- Mobile: check `useIsMobile()` and give small screens a layout that works. The desktop app always uses the
-  desktop layout.
-- Tailwind classes work. `build` compiles the ones you use against Termix's theme.
-- Link to your docs with `DocsLink` or `PanelShell`'s `docs` prop, never a hard coded URL.
-
-## Settings
-
-Declare them in `contributes.settings` and Termix draws the form, stores values, encrypts secrets and
-checks saves. You don't build settings UI.
-
-- Scopes: `admin` (for everyone), `user` (each person), `host` (a section in the host editor, with an
-  `enableKey` switch first).
-- Types: `boolean`, `string`, `number`, `select`, `multiselect`, `secret`, `textarea`, `json`, `custom`.
-- Options: `labelKey`, `descriptionKey`, `placeholderKey`, `default`, `options`, `min`, `max`, `requires`,
-  `group`, `permission`, `hidden`, `component`.
-- Read: `ctx.settings.get(key)`, `getUser(userId, key)`, `getHost(hostId, key)`. Write: `set`, `setHost`.
-  React: `ctx.settings.onChange`. Check: `ctx.settings.onValidate("admin", values => ({ key: "message" }))`.
-- Frontend: `useSettings("user")` gives values and `save`.
-
-Prefer settings to environment variables. Use an env var only for something needed before Termix starts.
-
-## Permissions
-
-Declare short names in `contributes.permissions`. Termix registers them as `<id>.<name>`. `defaultRoles`
-gives them to the built in `admin` and `user` roles on first install. You can't claim a core group
-(`hosts`, `credentials`, `admin`) or another plugin's. Labels are locale keys.
-
-## Translations
-
-Every string goes in `locales/en.json`, nested by area. Manifest keys (`titleKey`, `labelKey`) and `t()`
-read it from your own namespace. Unknown keys fall back to Termix's shared strings like `common.save`.
-Plurals use `_one` and `_other` with `t("hosts", { count })`. Other languages go in
-`locales/translated/<code>.json` (like `de_DE.json`) with the same keys. Keep `{{placeholders}}` as they are.
-Untranslated strings show in English.
-
-## Docs
-
-`docs/index.md` is the first page: what the plugin does in a sentence or two, how to turn it on, how to use
-it. More pages sit next to it with `title` and `order` front matter. Plain Markdown, no MDX. Images go in
-`docs/img/`.
-
-Don't write by hand what is generated: features, settings, permissions, capabilities, env vars, services,
-the API reference (from `@openapi`) and the changelog. Write short sentences in plain words and name
-buttons exactly as the UI does.
-
-## Auth and protocols
-
-Login methods, second factors and SSH auth types need `auth:provide`, which is high risk and reviewed
-closely. Declare ids in `contributes.auth` and register them with `ctx.auth.registerLoginMethod`,
-`registerSecondFactor` or `registerSshAuthProvider`. Connection protocols go in `contributes.protocols`
-and `app.registerHostProtocol`. Read https://docs.termix.site/develop/auth before starting one.
-
-## Testing
-
-```ts
-// vitest.config.ts
-import { pluginVitestConfig } from "@termix-ssh/plugin-sdk/vitest-preset";
-export default pluginVitestConfig(import.meta.url);
-```
-
-Backend tests go in `tests/backend/` (Node), frontend tests in `tests/frontend/` (jsdom). Never next to the
-source.
-
-Backend, from `@termix-ssh/plugin-sdk/testing`:
-
-```ts
-const db = await createTestDb(pluginDir); // in memory SQLite, your migrations, stub users/ssh_data/roles
-let router: Router | null = null;
-const mock = createMockCtx({
-  pluginId: manifest.id,
-  manifest,
-  capabilities: manifest.capabilities, // calls outside these throw, like the real thing
-  db: db.database,
-  router: () => (router = express.Router()),
-  permissions: ["hello.use"], // leave out to allow everything
-});
-await activate(mock.ctx);
-mock.setActor("user-1");
-```
-
-`createMockCtx` also takes `hosts` and `services`. `createFakeContext()` is a looser double that skips the
-capability checks. The template's `tests/backend/routes.test.ts` serves the router with Express and calls
-it with `fetch`: start from it.
-
-Frontend:
-
-```tsx
-import { renderWithApp } from "@termix-ssh/plugin-sdk/testing";
-import * as plugin from "../../src/frontend/index.js";
-
-const app = await renderWithApp(plugin, {
-  api: { get: async () => ({ data: [] }) },
-});
-expect(app.registered.tabs()).toContain("hello");
-```
-
-Test every route, with and without the permission. Test that disable then enable works, and that the plugin
-works when an optional dependency is missing.
-
-## Running it on a server
-
-1. You need Node 24 and a Termix server (26.10 or newer) you are an admin on. A local Docker one is fine.
-2. In Termix, open Settings, General and turn on Plugin developer mode.
-3. Make an API key in Settings, API keys.
-4. Run `npx termix-plugin dev --server http://localhost:30001 --key tmx_...` (or set `TERMIX_SERVER_URL`
-   and `TERMIX_API_KEY`). It builds, installs and reinstalls on every save. Reload the page for frontend
-   changes. `--once` installs once.
-
-Or `npm run build && npm run pack` and install the `.tmxplug` from Plugins, Install from file. Dev installs
-are marked unverified. You can't use the id of a plugin that ships with Termix, and a registry copy of the
-same plugin must be uninstalled first.
-
-## Releasing
-
-Plugins use semver. Work happens on a `dev-X.Y.Z` branch made from `main`, named after the version it will
-ship as. `main` only changes when a stable release merges a dev branch into it.
-
-`CHANGELOG.md`, newest first, no `## Unreleased` section and no dates:
-
-```md
-# Changelog
-
-## 1.1.0
-
-### Added
-
-- A wave button in the terminal toolbar
-
-### Fixed
-
-- Notes keep their order after a restart
-```
-
-Sections: `### Added`, `### Changed`, `### Fixed`, `### Removed`, `### Deprecated`, `### Security`.
-`termix-plugin changelog --version 1.1.0` prints one version's notes.
-
-Run the Release workflow by hand from the dev branch on GitHub:
-
-| Choice    | What it does                                                                      |
-| --------- | --------------------------------------------------------------------------------- |
-| stable    | Tests, builds and publishes `X.Y.Z`, merges the branch into `main` and deletes it |
-| beta      | Publishes `X.Y.Z-beta.N`, N counts up on its own                                  |
-| overwrite | Releases the manifest version again from this commit                              |
-| dry-run   | Builds and packs, publishes nothing                                               |
-
-No secrets are needed. The workflow records GitHub build provenance for the `.tmxplug`, and the run summary
-shows the `sha256` for a registry submission. If a dev branch changes `.github/workflows`, add a
-`TERMIX_PAT` secret (a token with `repo` and `workflow` scopes). To also sign with your own key, set
-`TERMIX_PLUGIN_SIGNING_KEY`. Keep `.github/workflows/release.yml` as the template has it: the community
-registry checks provenance from it.
-
-## Submitting to the community registry
-
-Before you submit:
-
-- The repo is public with an open source license, made from the template or using its `release.yml`.
-- `npm test`, `npm run typecheck`, `npm run validate` and `npm run build` pass.
-- The `id` isn't used by an official plugin or another submission.
-- `name`, `description`, `author`, `repository` (your repo) and `docs` (or a README that explains use) are
-  set.
-
-Then release a stable or beta version and fork https://github.com/Termix-SSH/Termix-Registry. Add
-`community/plugins/<id>.json`:
-
-```json
-{
-  "$schema": "../../community-submission-schema.json",
-  "id": "my-plugin",
-  "repository": "https://github.com/you/termix-plugin-my-plugin",
-  "maintainers": ["your-github-username"],
-  "versions": [
-    { "version": "1.0.0", "sha256": "<from the release run summary>" }
-  ]
-}
-```
-
-Open a pull request. The Check submission job downloads the `v<version>` release and checks the `sha256`,
-that the manifest inside has your id, version and repo, that it has build provenance from the release
-workflow, and that you are a maintainer. Then a person reviews the source at the tag and merges it. The
-registry signs it with the community key and lists it a few minutes later.
-
-Reviewers check that:
-
-- The source does what the name and description say, and nothing else.
-- Nothing is obfuscated or minified, and no code is downloaded and run at runtime.
-- There are no network calls, tracking or telemetry the user didn't ask for.
-- Capabilities and permissions are the fewest needed.
-- `package.json` scripts and dependencies don't fetch or run anything unexpected at install or build.
-- Secrets are only used for what the plugin is for.
-- The name and icon don't pretend to be an official plugin.
-
-Every version needs its own PR that adds it to the top of `versions`. Overwriting a reviewed release drops
-it from the registry until a new version is submitted. Admins see the plugin once they turn on the community
-registry in Plugins, Registries.
-
-To run your own registry instead, see https://docs.termix.site/develop/registries.
-
-## termix-plugin CLI
-
-| Command                        | What it does                                                                                   |
-| ------------------------------ | ---------------------------------------------------------------------------------------------- |
-| `build`                        | Bundle `dist/backend.js` and `dist/frontend.js`, CSS, locales, migrations, `dist/openapi.json` |
-| `validate`                     | Check the manifest, its files, migrations for every database, the changelog and `package.json` |
-| `test`                         | Apply patches, run Vitest                                                                      |
-| `migrations`                   | Write a migration per database from `tables.ts`. `--check` fails when one is missing           |
-| `openapi`                      | Write `dist/openapi.json` from `@openapi` blocks                                               |
-| `pack`                         | Validate, then write `<id>-<version>.tmxplug`. `--out <dir>`                                   |
-| `sign <file>`                  | Sign a `.tmxplug` with `TERMIX_PLUGIN_SIGNING_KEY`                                             |
-| `verify <file> --key <base64>` | Check a `.tmxplug` against its `.sig`                                                          |
-| `keygen`                       | Write a new signing key pair. `--out <dir>`                                                    |
-| `changelog`                    | Print one version's notes. `--version x.y.z`                                                   |
-| `patch`                        | Apply the plugin's dependency patches (`build` and `test` do this too)                         |
-| `dev`                          | Build, pack and install on a server, again on every change. `--server`, `--key`, `--once`      |
-
-## SDK entry points
-
-| Import                                                               | What it is                                                            |
-| -------------------------------------------------------------------- | --------------------------------------------------------------------- |
-| `@termix-ssh/plugin-sdk/backend`                                     | `PluginContext` and the backend types                                 |
-| `@termix-ssh/plugin-sdk/frontend`                                    | `TermixApp`, `TabProps` and the hooks                                 |
-| `@termix-ssh/plugin-sdk/ui`                                          | The UI kit, served by Termix at runtime                               |
-| `@termix-ssh/plugin-sdk/db`                                          | `defineTable` and column builders                                     |
-| `@termix-ssh/plugin-sdk/manifest`                                    | `PluginManifest` type and manifest checks                             |
-| `@termix-ssh/plugin-sdk/capabilities`                                | The capability catalog                                                |
-| `@termix-ssh/plugin-sdk/settings`                                    | Settings field validation                                             |
-| `@termix-ssh/plugin-sdk/testing`                                     | `createMockCtx`, `createTestDb`, `renderWithApp`, `createFakeContext` |
-| `@termix-ssh/plugin-sdk/vitest-preset`                               | `pluginVitestConfig`                                                  |
-| `@termix-ssh/plugin-sdk/host-commands`                               | OS detection, package manager and sudo helpers over ssh2              |
-| `@termix-ssh/plugin-sdk/ssh-certs`                                   | `applyCertificateAuth()` for certificate based SSH auth               |
-| `@termix-ssh/plugin-sdk/desktop`                                     | The desktop app bridge, typed. Check it exists before use             |
-| `@termix-ssh/plugin-sdk/openapi`                                     | `buildOpenApi()`                                                      |
-| `@termix-ssh/plugin-sdk/changelog`                                   | Changelog parsing and checks                                          |
-| `@termix-ssh/plugin-sdk/docs`                                        | Docs link and env var helpers                                         |
-| `@termix-ssh/plugin-sdk/ddl`, `@termix-ssh/plugin-sdk/table-builder` | Table to SQL and Drizzle mapping. You rarely need these               |
-
-## Capabilities
-
-| Capability           | Risk     | What it allows                                         |
-| -------------------- | -------- | ------------------------------------------------------ |
-| `credentials:read`   | critical | Read stored secrets for hosts the user can reach       |
-| `system:tls`         | critical | Replace the HTTPS certificate, answer CA domain checks |
-| `ssh:connect`        | high     | Run any command on hosts, with the user's access       |
-| `process:spawn`      | high     | Run programs on the Termix server                      |
-| `users:write`        | high     | Add users and change their roles                       |
-| `users:impersonate`  | high     | Run background work as another user, audited           |
-| `db:core-refs`       | high     | Query core users, roles and hosts tables (read only)   |
-| `auth:provide`       | high     | Add login methods, second factors, SSH auth types      |
-| `device:serial`      | high     | Open serial and USB ports on the server                |
-| `notify:hub`         | high     | Receive every alert (the alerts hub only)              |
-| `hosts:write`        | medium   | Add and edit hosts                                     |
-| `credentials:use`    | medium   | Connect with saved credentials without seeing them     |
-| `credentials:write`  | medium   | Save new credentials                                   |
-| `network:outbound`   | medium   | Outbound HTTP through `ctx.fetch`                      |
-| `network:serve`      | medium   | HTTP routes and sockets                                |
-| `network:broadcast`  | medium   | Local network broadcasts, like Wake-on-LAN             |
-| `users:read`         | medium   | Usernames and roles                                    |
-| `events:core`        | medium   | Listen to core events                                  |
-| `notify:send`        | medium   | Send alerts                                            |
-| `audit:read`         | medium   | Read the audit log                                     |
-| `desktop:window`     | medium   | Open windows in the desktop app                        |
-| `hosts:read`         | low      | Read hosts the user can see                            |
-| `db:own`             | low      | Your own tables                                        |
-| `kv:own`             | low      | Small key value state                                  |
-| `files:own`          | low      | Your own folder on disk                                |
-| `secrets:own`        | low      | Your own encrypted secrets                             |
-| `settings:read-core` | low      | Read Termix server settings                            |
-| `plugins:read`       | low      | See installed plugins                                  |
-| `ui:surface`         | low      | Add tabs, panels and settings                          |
-
-An update that adds a capability waits for an admin to approve it.
-
-## Common mistakes
-
-- Tests fail after `npm install`: usually a missing devDependency (`@testing-library/dom`, `jsdom`,
-  `better-sqlite3`) or a newer TypeScript major pulled in by another package. Pin `typescript` to the
-  template's range.
-- `hello-world`, `hello_world` or `Hello World` left over from the template in `package.json`, locales,
-  index names, API paths, tab ids or tests.
-- Changed `tables.ts` without running `npm run migrations`, or kept the template's `migrations/` folder
-  after renaming the id. Delete it and run `npm run migrations` once on a fresh plugin.
-- A rail item or tab id that isn't declared in `contributes`.
-- A string typed straight into JSX instead of `t()`.
-- Forgetting `await ctx.db.persist()` after a write.
-- Frontend changes not showing during `dev`: reload the page.
-- An id clash with an official plugin: dev installs and registry submissions are refused.
-
-## Where to look next
-
-- Docs: https://docs.termix.site/develop
-- Official plugins are all open source and built the same way. Plugin-Workspaces is a small one to start
-  from, Plugin-Docker runs commands on hosts, Plugin-Snippets offers a service, Plugin-Automations uses
-  services, Plugin-SSO and Plugin-TOTP add sign in, Plugin-Vault adds an SSH auth type and
-  Plugin-Remote-Desktop adds a protocol. All at https://github.com/Termix-SSH.
-- Help: the Discord at https://discord.gg/jVQGdvHDrf. SDK bugs go in
-  https://github.com/Termix-SSH/Termix/issues.

packages/plugin-sdk/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="https://termix.site/img/logo.svg" width="120" alt="Termix Logo" />
+<img src="https://raw.githubusercontent.com/Termix-SSH/Termix/main/public/icon.svg" width="120" height="120" alt="Termix Logo" />
 
 <h1>Termix Plugin SDK</h1>
 

packages/plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.6",
+  "version": "1.0.5",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {
@@ -103,7 +103,6 @@
     "tsconfig.plugin.json",
     "README.md",
     "CHANGELOG.md",
-    "PLUGIN-GUIDE.md",
     "client.d.ts"
   ],
   "scripts": {

packages/plugin-sdk/ui.api.txt

@@ -95,7 +95,7 @@ HostDefaultBadge (value): ({ settingKey }: { settingKey: string; }) => Element
 HostDefaultField (value): ({ settingKey, children, }: { settingKey: string; children: ReactNode; }) => Element
 HostFeatureFields (value): ({ form, updateForm, }: HostFeatureFieldsProps) => Element
 HostFeatureFieldsProps (type): HostFeatureFieldsProps
-HostKeyVerificationDialog (value): ({ isOpen, scenario, ip, port, hostname, fingerprint, oldFingerprint, onAccept, onReject, backgroundColor, }: HostKeyVerificationDialogProps) => Element
+HostKeyVerificationDialog (value): ({ isOpen, scenario, ip, port, hostname, fingerprint, oldFingerprint, algorithm, onAccept, onReject, backgroundColor, }: HostKeyVerificationDialogProps) => Element
 InlineView (value): ({ open, onOpenChange, title, icon, status, actions, toolbar, footer, width, onBeforeClose, scroll, bare, className, children, }: { open: boolean; onOpenChange: (open: boolean) => void; title: ReactNode; icon?: ReactNode; status?: ReactNode; actions?: ReactNode; toolbar?: ReactNode; footer?: ReactNode; width?: EditingWidth; onBeforeClose?: () => boolean | Promise<boolean>; scroll?: boolean; bare?: boolean; className?: string; children: ReactNode; }) => ReactPortal
 Input (value): ({ className, type, ...props }: DetailedHTMLProps<InputHTMLAttributes<HTMLInputElement>, HTMLInputElement>) => Element
 Kbd (value): ForwardRefExoticComponent<KbdProps & RefAttributes<HTMLElement>>

packaging/flatpak/flathub.json

@@ -0,0 +1,5 @@
+{
+  "only-arches": ["x86_64", "aarch64"],
+  "skip-icons-check": false,
+  "skip-appstream-check": false
+}

public/icon-square.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
-  <rect width="1024" height="1024" fill="#141513"/>
-  <rect x="227" y="244" width="570" height="92" rx="46" fill="#ffffff"/>
-  <path d="M474 336H550V786A38 38 0 0 1 474 786V572.2L542 545V447L474 419.8ZM498 647.5V761.5H550V647.5Z" fill="#ffffff" fill-rule="evenodd"/>
-  <path d="M306 387.2L510 468.8V523.2L306 604.8V547.5L435.5 496L306 444.5Z" fill="#f59145"/>
-  <rect x="530.5" y="679.5" width="213" height="50" fill="#f59145"/>
-</svg>

public/icon.svg

@@ -1,7 +1,7 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
-  <rect width="1024" height="1024" rx="225" fill="#141513"/>
-  <rect x="227" y="244" width="570" height="92" rx="46" fill="#ffffff"/>
-  <path d="M474 336H550V786A38 38 0 0 1 474 786V572.2L542 545V447L474 419.8ZM498 647.5V761.5H550V647.5Z" fill="#ffffff" fill-rule="evenodd"/>
-  <path d="M306 387.2L510 468.8V523.2L306 604.8V547.5L435.5 496L306 444.5Z" fill="#f59145"/>
-  <rect x="530.5" y="679.5" width="213" height="50" fill="#f59145"/>
+<?xml version="1.0" encoding="UTF-8"?>
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="1024" height="1024">
+<path d="M0 0 C1.24605143 -0.00320648 2.49210286 -0.00641296 3.77591342 -0.0097166 C7.20551324 -0.01654213 10.63489336 -0.01454336 14.06448046 -0.00866088 C17.80678204 -0.00446316 21.54906441 -0.01190796 25.29136121 -0.01781338 C31.84084796 -0.02655123 38.39030342 -0.02789611 44.93979454 -0.02431011 C54.67961151 -0.01899148 64.41939833 -0.02511011 74.15921202 -0.03339304 C92.56926142 -0.04861937 110.97929706 -0.05033948 129.38935144 -0.04787002 C143.60890976 -0.04603597 157.82846357 -0.0477993 172.04802132 -0.05209446 C174.09235779 -0.05269687 176.13669427 -0.05329806 178.18103074 -0.05389806 C181.26182901 -0.05480534 184.34262728 -0.05571401 187.42342555 -0.05663041 C216.06152484 -0.06505806 244.69962243 -0.06939698 273.33772278 -0.06522369 C274.95656045 -0.06498913 274.95656045 -0.06498913 276.60810192 -0.06474983 C282.07778518 -0.06394407 287.54746842 -0.0630983 293.01715167 -0.06223653 C294.64653437 -0.06197989 294.64653437 -0.06197989 296.30883388 -0.06171808 C298.50550538 -0.06137142 300.70217687 -0.06102289 302.89884837 -0.06067249 C337.07170733 -0.05531644 371.24454049 -0.06324318 405.41739464 -0.08170605 C443.83052411 -0.10243565 482.24363759 -0.11314686 520.65677297 -0.10913056 C524.75506425 -0.10873523 528.85335552 -0.10837368 532.9516468 -0.10803318 C533.96071349 -0.10794245 534.96978018 -0.10785172 536.00942464 -0.10775824 C551.22334929 -0.10659366 566.43725776 -0.11323001 581.65117836 -0.1238451 C598.96103916 -0.13591042 616.2708644 -0.13744077 633.58072574 -0.12505493 C643.25916158 -0.11843905 652.93751231 -0.12002798 662.6159413 -0.13364345 C669.09234848 -0.1419165 675.56869223 -0.13915349 682.04509432 -0.12766818 C685.72751758 -0.12143989 689.40977538 -0.11973724 693.09218879 -0.13153151 C742.29620511 -0.27803261 783.72404367 14.44275388 819.33878136 49.25447559 C838.15454949 68.05987805 851.6807596 92.15656693 859.15128136 117.62947559 C859.50259117 118.81223072 859.50259117 118.81223072 859.86099815 120.01887989 C864.84716349 137.93439184 865.34131204 155.41560974 865.28668402 173.91294083 C865.27899556 177.65690687 865.28888432 181.40083665 865.29641402 185.14479738 C865.3071966 191.69097825 865.30695291 198.23708474 865.29927254 204.78326893 C865.2878824 214.51804038 865.2937484 224.25274959 865.30289746 233.98752068 C865.31866453 251.37833898 865.3173375 268.76912415 865.30866072 286.15994558 C865.30110466 301.37985494 865.29914832 316.59975219 865.30272865 331.81966305 C865.30295781 332.83047421 865.30318696 333.84128537 865.30342306 334.88272717 C865.30435713 338.98627537 865.30531233 343.08982357 865.30630235 347.19337176 C865.3154731 385.66415573 865.30716901 424.13491865 865.29101166 462.60569937 C865.27677663 496.7590625 865.27804855 530.91239206 865.29239464 565.06575489 C865.30847087 603.46608751 865.31482155 641.86640153 865.30555785 680.26673704 C865.30459574 684.36298215 865.30365722 688.45922726 865.30272865 692.55547237 C865.3023728 694.06829454 865.3023728 694.06829454 865.30200977 695.61167876 C865.29860234 710.81857886 865.3025789 726.02546547 865.31016731 741.2323637 C865.31875621 758.53008151 865.31657695 775.82776109 865.30032508 793.12547415 C865.29153676 802.79747308 865.2909114 812.46938917 865.3022636 822.1413859 C865.30901854 828.61208821 865.30475417 835.08272447 865.2917493 841.55341703 C865.28465281 845.23332826 865.2820887 848.9130756 865.29296724 852.59298133 C865.3442355 871.30113003 864.89727324 889.46647244 859.15128136 907.44197559 C858.89524132 908.2652837 858.63920128 909.0885918 858.37540245 909.93684864 C855.79685812 917.9856683 852.58102984 925.65348896 848.90128136 933.25447559 C848.61591515 933.86033497 848.33054893 934.46619434 848.03653526 935.09041309 C830.37472338 972.22703729 796.06237029 1001.64914703 757.52628136 1015.44197559 C741.01943895 1021.1452558 724.41526408 1024.57505987 706.89996243 1024.5117445 C705.65228729 1024.51525057 704.40461215 1024.51875665 703.11912867 1024.52236897 C699.68034267 1024.53174518 696.24166373 1024.52885318 692.80287276 1024.52381342 C689.05227316 1024.52052693 685.3016955 1024.52884577 681.55110306 1024.53563178 C674.98544107 1024.54591004 668.41980856 1024.54877936 661.85413933 1024.54671955 C652.09014292 1024.54366388 642.32617902 1024.55200613 632.56218895 1024.5624688 C614.10585117 1024.58179372 595.64952453 1024.58743648 577.19317783 1024.58858292 C562.93642719 1024.5895027 548.6796809 1024.59362298 534.42293167 1024.59998417 C530.31618419 1024.60177932 526.2094367 1024.60355895 522.10268921 1024.60533392 C521.08167553 1024.60577602 520.06066186 1024.60621812 519.00870837 1024.60667361 C490.29523693 1024.61897939 461.581767 1024.62687502 432.86829281 1024.62598705 C431.78608639 1024.6259559 430.70387998 1024.62592474 429.58887942 1024.62589264 C424.10406817 1024.62572643 418.61925692 1024.62552835 413.13444567 1024.62532322 C412.04518472 1024.62528333 410.95592376 1024.62524344 409.8336549 1024.62520234 C407.63090343 1024.62512147 405.42815196 1024.62503787 403.22540049 1024.62495156 C368.96540695 10Line truncated
+<path d="M0 0 C2.3607826 -0.00533069 4.7215618 -0.01239937 7.08233458 -0.02104706 C12.86781777 -0.03768809 18.65308544 -0.03586118 24.43857937 -0.02603391 C31.37506207 -0.01528955 38.31145513 -0.02784201 45.24792682 -0.04094901 C58.83711965 -0.06583655 72.42624267 -0.0677834 86.01545164 -0.0596749 C97.90842776 -0.05259347 109.80137684 -0.05255306 121.6943531 -0.05953789 C123.29160454 -0.06044923 124.88885599 -0.06135999 126.48610743 -0.06227018 C128.89321227 -0.06365335 131.3003171 -0.06504445 133.70742193 -0.06645631 C156.07605562 -0.07943052 178.44468029 -0.0845595 200.81331539 -0.07292271 C202.07720574 -0.07226575 202.07720574 -0.07226575 203.36662924 -0.07159552 C210.20845318 -0.06798894 217.05027701 -0.06415405 223.89210082 -0.06030459 C250.57968088 -0.04545695 277.26715859 -0.05423912 303.95472717 -0.08226013 C333.96091556 -0.11370558 363.96704337 -0.12865264 393.97324854 -0.11846012 C397.17413714 -0.11742339 400.37502576 -0.11643616 403.57591438 -0.11547661 C404.75806397 -0.11510328 404.75806397 -0.11510328 405.96409537 -0.11472241 C417.84673069 -0.11128624 429.72931241 -0.12057354 441.61193657 -0.13624763 C455.12861173 -0.15403651 468.64515667 -0.15411882 482.16182631 -0.13089598 C489.05584211 -0.11951551 495.94963463 -0.11592963 502.84363937 -0.13519669 C509.15952167 -0.15202846 515.47494573 -0.1456129 521.79079849 -0.1209799 C524.07057599 -0.11610521 526.35039063 -0.11958862 528.63013696 -0.13246734 C545.55919757 -0.22117063 559.49258132 1.40958132 573.70204163 11.5146637 C574.65143616 12.18948792 574.65143616 12.18948792 575.62001038 12.87794495 C584.56469704 19.88757798 591.37473569 31.41173592 593.70204163 42.5146637 C593.95009484 46.21967671 593.9332442 49.92717174 593.95204163 53.6396637 C593.98297913 55.13239807 593.98297913 55.13239807 594.01454163 56.6552887 C594.09018739 71.14145219 588.46971331 82.75864333 578.63954163 93.3271637 C572.7611904 98.9075711 566.35707715 102.79152692 558.70204163 105.5146637 C557.98319668 105.77360066 557.26435173 106.03253763 556.5237236 106.29932117 C545.67592079 109.56985516 534.52679546 108.91143924 523.30848694 108.85523987 C520.90407196 108.85431984 518.49965616 108.85472308 516.09524155 108.85633564 C509.68138016 108.85701034 503.26768815 108.83967715 496.85386658 108.81850433 C490.82587678 108.80136501 484.79792729 108.80061201 478.76991272 108.79847717 C461.16393343 108.7827621 443.55798536 108.74087841 425.95204163 108.7021637 C386.59954163 108.6402887 347.24704163 108.5784137 306.70204163 108.5146637 C306.70204163 227.6446637 306.70204163 346.7746637 306.70204163 469.5146637 C286.90204163 469.5146637 267.10204163 469.5146637 246.70204163 469.5146637 C246.70204163 513.4046637 246.70204163 557.2946637 246.70204163 602.5146637 C266.50204163 602.5146637 286.30204163 602.5146637 306.70204163 602.5146637 C306.79485413 611.0843512 306.79485413 611.0843512 306.88954163 619.8271637 C306.91685364 621.60647278 306.94416565 623.38578186 306.9723053 625.2190094 C307.11177013 640.67747815 304.32285969 652.54241746 293.63954163 664.2646637 C283.35164203 674.1494599 271.29383334 675.99381057 257.74501038 675.7881012 C245.19699202 675.32053069 236.72499202 668.99701836 228.38954163 660.0771637 C220.57277107 650.9239274 218.39160693 641.68285062 218.46153259 629.87820435 C218.45896932 628.28889812 218.45896932 628.28889812 218.45635426 626.6674847 C218.45306486 623.123718 218.46405419 619.58014142 218.47499084 616.03639221 C218.47555508 613.49352015 218.47523817 610.95064775 218.47410583 608.40777588 C218.47365067 602.93649447 218.47931674 597.46527407 218.49058151 591.9940052 C218.50685769 584.08354929 218.51204668 576.17311643 218.5145575 568.26264559 C218.51893128 555.42744908 218.53223178 542.59227803 218.55116272 529.75709534 C218.56952972 517.29127632 218.58368221 504.82546422 218.59217834 492.3596344 C218.59270379 491.5908286 218.59322924 490.82202281 218.59377061 490.02991987 C218.59638074 486.17292397 218.59890815 482.31592802 218.60139441 478.45893204 C218.62211705 446.47749075 218.65733395 414.49608076 218.70204163 382.5146637 C224.61760486 380.08952596 230.53376566 377.66585017 236.45030212 375.24308777 C238.45381022 374.42248424 240.45719208 373.60157242 242.46043396 372.78031921 C294.33562193 351.5146637 294.33562193 351.5146637 297.70204163 351.5146637 C297.70204163 313.8946637 297.70204163 276.2746637 297.70204163 237.5146637 C293.24704163 236.0296637 293.24704163 236.0296637 288.70204163 234.5146637 C286.21106492 233.56633242 283.72835319 232.59599737 281.25453186 231.60377502 C280.55959405 231.32587222 279.86465624 231.04796942 279.14865971 230.76164532 C276.93500856 229.87574275 274.72279495 228.98631453 272.51063538 228.09669495 C271.12991114 227.54352131 269.74909265 226.9905829 268.36817932 226.43788147 C263.29082801 224.40381573 258.21529078 222.36522413 253.13954163 220.3271637 C241.77516663 215.7690387 230.41079163 211.2109137 218.70204163 206.5146637 C218.70204163 174.1746637 218.70204163 141.8346637 218.70204163 108.5146637 C211.4392218 1Line truncated
+<path d="M0 0 C5.86817508 1.95605836 11.59073119 3.95365747 17.30737305 6.27001953 C18.09306325 6.58584142 18.87875345 6.9016633 19.68825245 7.22705555 C22.29709699 8.27645462 24.90439611 9.32963844 27.51171875 10.3828125 C29.39488199 11.14115547 31.2781448 11.89925122 33.16149902 12.65711975 C37.21264727 14.28789145 41.26312379 15.92031644 45.31307983 17.55404663 C51.7542863 20.15236465 58.19696081 22.74702807 64.63989258 25.34106445 C71.41130904 28.06755974 78.18261714 30.79432275 84.95341492 33.52235413 C108.15087431 42.86883922 131.35537268 52.19778488 154.5609436 61.52410889 C159.994401 63.70786608 165.42764165 65.89216193 170.86079502 68.07667542 C193.23239581 77.07158187 215.60890835 86.05370489 238 95 C238 116.12 238 137.24 238 159 C232.01359375 161.39185547 232.01359375 161.39185547 225.90625 163.83203125 C206.57998543 171.55973546 187.26934996 179.32631616 167.95794678 187.09106445 C161.36560101 189.74165676 154.77289802 192.39135988 148.18017578 195.04101562 C126.79552102 203.63604381 105.41240644 212.23486217 84.03399658 220.84541321 C75.73587703 224.18760199 67.43708216 227.52811242 59.13812637 230.86822414 C52.33470621 233.60660835 45.53222385 236.34730609 38.73039818 239.08964825 C34.51543173 240.78839672 30.29959748 242.48498283 26.08351517 244.1809597 C24.12464123 244.96946815 22.16613491 245.75889055 20.20801926 246.54928017 C17.53921709 247.62640467 14.86914587 248.70032007 12.19873047 249.7734375 C11.02965778 250.24663689 11.02965778 250.24663689 9.83696747 250.72939587 C6.56202144 252.04197447 3.43106937 253.14223266 0 254 C0 231.56 0 209.12 0 186 C21.85641702 177.6267728 43.73124762 169.30784563 65.63814926 161.06789398 C71.62769516 158.81489337 77.61678737 156.56068672 83.60580635 154.30628586 C85.09797285 153.74460399 86.5901539 153.18296077 88.08234978 152.62135696 C97.85972778 148.94125789 107.63197621 145.24805417 117.3984375 141.5390625 C119.52367608 140.73273275 121.64892001 139.92641707 123.77416992 139.12011719 C127.62723328 137.65810939 131.4786996 136.19199339 135.3293457 134.72363281 C137.01507528 134.08382248 138.70086226 133.44416335 140.38671875 132.8046875 C141.51894363 132.37079208 141.51894363 132.37079208 142.67404175 131.9281311 C147.77255889 130 147.77255889 130 150 130 C149.67 128.02 149.34 126.04 149 124 C147.88878784 123.58995728 147.88878784 123.58995728 146.75512695 123.17163086 C117.43275623 112.3398187 88.19328622 101.28796181 58.94955444 90.24617195 C50.58387921 87.08758433 42.21738212 83.93117504 33.85093689 80.77462769 C22.56697288 76.5172614 11.28352836 72.25852172 0 68 C0 45.56 0 23.12 0 0 Z " fill="#F39044" transform="translate(272,342)"/>
+<path d="M0 0 C81.84 0 163.68 0 248 0 C248 19.47 248 38.94 248 59 C166.16 59 84.32 59 0 59 C0 39.53 0 20.06 0 0 Z " fill="#F39044" transform="translate(533,681)"/>
 </svg>

scripts/check-sdk-guide.cjs

@@ -1,117 +0,0 @@
-#!/usr/bin/env node
-/**
- * packages/plugin-sdk/PLUGIN-GUIDE.md ships with the SDK and is what plugin
- * authors and their AI tools read first. Fails when it misses a CLI command,
- * a capability or an entry point, or when its header names an older SDK or
- * plugin API version, so the guide is touched with every SDK release.
- */
-
-const fs = require("node:fs");
-const path = require("node:path");
-
-const ROOT = path.resolve(__dirname, "..");
-const SDK = path.join(ROOT, "packages", "plugin-sdk");
-
-// Exports that are plumbing, not something a plugin author imports.
-const INTERNAL_EXPORTS = new Set([
-  "./testing/setup",
-  "./testing-host",
-  "./tsconfig.plugin.json",
-  "./schema/manifest.schema.json",
-  "./theme.css",
-]);
-
-function cliCommands(source) {
-  const block = source.match(/const COMMANDS = \{([\s\S]*?)\n\};/);
-  if (!block) return [];
-  return [...block[1].matchAll(/^ {2}([a-z-]+)[:,]/gm)].map((m) => m[1]);
-}
-
-function capabilityIds(source) {
-  return [
-    ...new Set(
-      [...source.matchAll(/entry\("([a-z-]+:[a-z-]+)"/g)].map((m) => m[1]),
-    ),
-  ];
-}
-
-function entryPoints(pkg) {
-  return Object.keys(pkg.exports ?? {})
-    .filter((key) => key !== "." && !INTERNAL_EXPORTS.has(key))
-    .map((key) => `@termix-ssh/plugin-sdk/${key.slice(2)}`);
-}
-
-function apiVersion(source) {
-  return source.match(/PLUGIN_API_VERSION = "([^"]+)"/)?.[1] ?? null;
-}
-
-function findProblems({
-  guide,
-  commands,
-  capabilities,
-  entries,
-  sdkVersion,
-  api,
-}) {
-  const problems = [];
-  for (const command of commands) {
-    // `sign <file>` counts as well as `sign`.
-    if (!new RegExp(`\`${command}[\` ]`).test(guide))
-      problems.push(`CLI command "${command}" is not covered`);
-  }
-  for (const id of capabilities) {
-    if (!guide.includes(`\`${id}\``))
-      problems.push(`capability "${id}" is not covered`);
-  }
-  for (const entry of entries) {
-    if (!guide.includes(`\`${entry}\``))
-      problems.push(`entry point "${entry}" is not covered`);
-  }
-  const header = guide.match(/^SDK (\S+) \| Plugin API (\S+)$/m);
-  if (!header) {
-    problems.push('missing the "SDK x.y.z | Plugin API x.y.z" header line');
-  } else {
-    if (header[1] !== sdkVersion) {
-      problems.push(`header says SDK ${header[1]}, package is ${sdkVersion}`);
-    }
-    if (api && header[2] !== api) {
-      problems.push(`header says Plugin API ${header[2]}, SDK has ${api}`);
-    }
-  }
-  return problems;
-}
-
-function main() {
-  const read = (file) => fs.readFileSync(path.join(SDK, file), "utf8");
-  const pkg = JSON.parse(read("package.json"));
-  const problems = findProblems({
-    guide: read("PLUGIN-GUIDE.md"),
-    commands: cliCommands(read("cli/index.mjs")),
-    capabilities: capabilityIds(read("src/capabilities.ts")),
-    entries: entryPoints(pkg),
-    sdkVersion: pkg.version,
-    api: apiVersion(read("src/manifest.ts")),
-  });
-  if (!pkg.files?.includes("PLUGIN-GUIDE.md")) {
-    problems.push(
-      '"PLUGIN-GUIDE.md" is not in the SDK package.json files list',
-    );
-  }
-  if (problems.length > 0) {
-    console.error(
-      "check-sdk-guide: update packages/plugin-sdk/PLUGIN-GUIDE.md",
-    );
-    for (const problem of problems) console.error(`  ${problem}`);
-    process.exit(1);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = {
-  cliCommands,
-  capabilityIds,
-  entryPoints,
-  apiVersion,
-  findProblems,
-};

scripts/check-sdk-guide.test.ts

@@ -1,113 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createRequire } from "node:module";
-
-const require = createRequire(import.meta.url);
-const { cliCommands, capabilityIds, entryPoints, apiVersion, findProblems } =
-  require("./check-sdk-guide.cjs") as {
-    cliCommands: (source: string) => string[];
-    capabilityIds: (source: string) => string[];
-    entryPoints: (pkg: { exports?: Record<string, unknown> }) => string[];
-    apiVersion: (source: string) => string | null;
-    findProblems: (input: {
-      guide: string;
-      commands: string[];
-      capabilities: string[];
-      entries: string[];
-      sdkVersion: string;
-      api: string | null;
-    }) => string[];
-  };
-
-const GUIDE = [
-  "# Guide",
-  "",
-  "SDK 1.2.3 | Plugin API 1.4.0",
-  "",
-  "| `build` | builds |",
-  "| `sign <file>` | signs |",
-  "| `db:own` | tables |",
-  "| `@termix-ssh/plugin-sdk/db` | tables |",
-].join("\n");
-
-const input = {
-  guide: GUIDE,
-  commands: ["build", "sign"],
-  capabilities: ["db:own"],
-  entries: ["@termix-ssh/plugin-sdk/db"],
-  sdkVersion: "1.2.3",
-  api: "1.4.0",
-};
-
-describe("readers", () => {
-  it("reads command names from the COMMANDS map", () => {
-    const source = [
-      "const COMMANDS = {",
-      "  build,",
-      "  patch: async () => {},",
-      "  test: async (options) => {",
-      "    return run(options);",
-      "  },",
-      "  verify,",
-      "};",
-    ].join("\n");
-    expect(cliCommands(source)).toEqual(["build", "patch", "test", "verify"]);
-  });
-
-  it("reads capability ids once each", () => {
-    const source =
-      'entry("db:own", "low"),\nentry("ssh:connect", "high"),\nentry("db:own", "low")';
-    expect(capabilityIds(source)).toEqual(["db:own", "ssh:connect"]);
-  });
-
-  it("skips the root and internal exports", () => {
-    expect(
-      entryPoints({
-        exports: {
-          ".": {},
-          "./db": {},
-          "./testing/setup": {},
-          "./theme.css": "",
-        },
-      }),
-    ).toEqual(["@termix-ssh/plugin-sdk/db"]);
-  });
-
-  it("reads the plugin API version", () => {
-    expect(apiVersion('export const PLUGIN_API_VERSION = "1.2.0";')).toBe(
-      "1.2.0",
-    );
-  });
-});
-
-describe("findProblems", () => {
-  it("passes a guide that covers everything", () => {
-    expect(findProblems(input)).toEqual([]);
-  });
-
-  it("names what is missing", () => {
-    expect(
-      findProblems({
-        ...input,
-        commands: ["build", "dev"],
-        capabilities: ["db:own", "kv:own"],
-        entries: ["@termix-ssh/plugin-sdk/ui"],
-      }),
-    ).toEqual([
-      'CLI command "dev" is not covered',
-      'capability "kv:own" is not covered',
-      'entry point "@termix-ssh/plugin-sdk/ui" is not covered',
-    ]);
-  });
-
-  it("fails when the header is behind the SDK", () => {
-    expect(
-      findProblems({ ...input, sdkVersion: "1.2.4", api: "1.5.0" }),
-    ).toEqual([
-      "header says SDK 1.2.3, package is 1.2.4",
-      "header says Plugin API 1.4.0, SDK has 1.5.0",
-    ]);
-    expect(findProblems({ ...input, guide: "no header" })).toContain(
-      'missing the "SDK x.y.z | Plugin API x.y.z" header line',
-    );
-  });
-});

scripts/crowdin-pretranslate.cjs

@@ -0,0 +1,126 @@
+const API = "https://api.crowdin.com/api/v2";
+const ENGINE_ID = 649248; // Google Translate MT engine
+const PROJECT_NAME = "termix-ssh";
+const SOURCE_FILE = "en.json";
+
+function token() {
+  const t = process.env.CROWDIN_API_KEY;
+  if (!t) throw new Error("CROWDIN_API_KEY is not set");
+  return t;
+}
+
+async function request(method, pathname, body) {
+  const res = await fetch(`${API}${pathname}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token()}`,
+      "Content-Type": "application/json",
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`${method} ${pathname} -> ${res.status}: ${text}`);
+  }
+  return res.json();
+}
+
+async function paged(pathname) {
+  const items = [];
+  let offset = 0;
+  const limit = 500;
+  for (;;) {
+    const sep = pathname.includes("?") ? "&" : "?";
+    const page = await request(
+      "GET",
+      `${pathname}${sep}limit=${limit}&offset=${offset}`,
+    );
+    const batch = (page.data || []).map((row) => row.data);
+    items.push(...batch);
+    if (batch.length < limit) break;
+    offset += limit;
+  }
+  return items;
+}
+
+async function resolveProjectId() {
+  const projects = await paged("/projects");
+  const match = projects.find(
+    (p) => p.identifier === PROJECT_NAME || p.name === PROJECT_NAME,
+  );
+  if (!match) throw new Error(`project "${PROJECT_NAME}" not found`);
+  return { id: match.id, targetLanguageIds: match.targetLanguageIds || [] };
+}
+
+function isSourceFile(file) {
+  return file.path === `/${SOURCE_FILE}`;
+}
+
+async function resolveFileIds(projectId) {
+  const files = await paged(`/projects/${projectId}/files`);
+  const ids = files.filter(isSourceFile).map((f) => f.id);
+  if (ids.length === 0)
+    throw new Error(`no "${SOURCE_FILE}" source files found in project`);
+  return ids;
+}
+
+async function pollPreTranslation(projectId, preTranslationId) {
+  for (;;) {
+    const { data } = await request(
+      "GET",
+      `/projects/${projectId}/pre-translations/${preTranslationId}`,
+    );
+    if (data.status === "finished") return data;
+    if (data.status === "failed" || data.status === "canceled") {
+      throw new Error(
+        `pre-translation ${data.status} (progress ${data.progress}%)`,
+      );
+    }
+    await new Promise((r) => setTimeout(r, 5000));
+  }
+}
+
+async function main() {
+  const { id: projectId, targetLanguageIds } = await resolveProjectId();
+  if (targetLanguageIds.length === 0) {
+    throw new Error("project has no target languages configured");
+  }
+
+  const fileIds = await resolveFileIds(projectId);
+
+  console.log(
+    `Pre-translating project ${projectId}, ${fileIds.length} files, ${targetLanguageIds.length} languages`,
+  );
+
+  // Translation memory first so strings that moved between files keep their
+  // existing translations, then machine translation for whatever is left.
+  const passes = [
+    { method: "tm", translateUntranslatedOnly: true },
+    { method: "mt", engineId: ENGINE_ID, scope: "untranslated" },
+  ];
+  for (const pass of passes) {
+    const { data } = await request(
+      "POST",
+      `/projects/${projectId}/pre-translations`,
+      { languageIds: targetLanguageIds, fileIds, ...pass },
+    );
+    const result = await pollPreTranslation(projectId, data.identifier);
+    console.log(
+      `${pass.method} pre-translation finished (${result.progress}%)`,
+    );
+  }
+}
+
+module.exports = {
+  resolveProjectId,
+  resolveFileIds,
+  isSourceFile,
+  pollPreTranslation,
+};
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`crowdin-pretranslate: ${err.message}`);
+    process.exit(1);
+  });
+}

scripts/crowdin-pretranslate.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const { isSourceFile } = require("./crowdin-pretranslate.cjs") as {
+  isSourceFile: (file: { path?: string }) => boolean;
+};
+
+describe("isSourceFile", () => {
+  it("matches the core source file", () => {
+    expect(isSourceFile({ path: "/en.json" })).toBe(true);
+  });
+
+  it("skips anything else", () => {
+    expect(isSourceFile({ path: "/src/ui/locales/en.json" })).toBe(false);
+    expect(isSourceFile({ path: "/plugins/acme-ssl/locales/en.json" })).toBe(
+      false,
+    );
+    expect(isSourceFile({})).toBe(false);
+  });
+});

scripts/electron-auto-updater.test.ts

@@ -1,372 +0,0 @@
-import { createRequire } from "node:module";
-import path from "node:path";
-import { EventEmitter } from "node:events";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-const require = createRequire(import.meta.url);
-const updates = require("../electron/auto-updater.cjs") as {
-  channelFile: (channel: string, platform: string, arch: string) => string;
-  getInstallKind: (input: Record<string, unknown>) => string;
-  resolveRelease: (
-    releases: unknown,
-    opts: { currentVersion: string; platform: string; arch: string },
-  ) => {
-    tag: string;
-    version: string;
-    channel: string;
-    feedUrl: string;
-    releaseUrl: string;
-  } | null;
-  createUpdater: (deps: Record<string, unknown>) => {
-    getState: () => Record<string, unknown>;
-    check: () => Promise<Record<string, unknown>>;
-    download: () => Promise<Record<string, unknown>>;
-    install: () => boolean;
-    setMode: (mode: string) => Record<string, unknown>;
-  };
-};
-
-function release(tag: string, assets: string[], extra = {}) {
-  return {
-    tag_name: tag,
-    draft: false,
-    html_url: `https://github.com/Termix-SSH/Termix/releases/tag/${tag}`,
-    assets: assets.map((name) => ({ name })),
-    ...extra,
-  };
-}
-
-const ALL = [
-  "latest.yml",
-  "latest-mac.yml",
-  "latest-linux.yml",
-  "latest-linux-arm64.yml",
-  "latest-linux-arm.yml",
-  "beta.yml",
-  "beta-mac.yml",
-  "beta-linux.yml",
-];
-
-const win = { platform: "win32", arch: "x64" };
-
-describe("channelFile", () => {
-  it("matches the names electron-builder writes", () => {
-    expect(updates.channelFile("latest", "win32", "x64")).toBe("latest.yml");
-    expect(updates.channelFile("latest", "darwin", "arm64")).toBe(
-      "latest-mac.yml",
-    );
-    expect(updates.channelFile("latest", "linux", "x64")).toBe(
-      "latest-linux.yml",
-    );
-    expect(updates.channelFile("beta", "linux", "arm64")).toBe(
-      "beta-linux-arm64.yml",
-    );
-    expect(updates.channelFile("latest", "linux", "arm")).toBe(
-      "latest-linux-arm.yml",
-    );
-  });
-});
-
-describe("resolveRelease", () => {
-  it("picks the newest stable release and points the feed at its tag", () => {
-    const found = updates.resolveRelease(
-      [release("v26.10.2", ALL), release("v26.10.3", ALL)],
-      { currentVersion: "26.10.1", ...win },
-    );
-    expect(found).toMatchObject({
-      tag: "v26.10.3",
-      version: "26.10.3",
-      channel: "latest",
-      feedUrl:
-        "https://github.com/Termix-SSH/Termix/releases/download/v26.10.3",
-    });
-  });
-
-  it("ignores SDK, 2.9.x patch and draft releases", () => {
-    expect(
-      updates.resolveRelease(
-        [
-          release("sdk-v1.0.9", ALL),
-          release("release-2.9.4-tag", ALL),
-          release("v26.11.0", ALL, { draft: true }),
-        ],
-        { currentVersion: "26.10.1", ...win },
-      ),
-    ).toBeNull();
-  });
-
-  it("returns null when nothing is newer", () => {
-    expect(
-      updates.resolveRelease([release("v26.10.1", ALL)], {
-        currentVersion: "26.10.1",
-        ...win,
-      }),
-    ).toBeNull();
-  });
-
-  it("keeps stable installs off betas", () => {
-    expect(
-      updates.resolveRelease([release("v26.11.0-beta.1", ALL)], {
-        currentVersion: "26.10.1",
-        ...win,
-      }),
-    ).toBeNull();
-  });
-
-  it("moves a beta install to the next beta, then to stable", () => {
-    expect(
-      updates.resolveRelease(
-        [release("v26.11.0-beta.1", ALL), release("v26.11.0-beta.2", ALL)],
-        { currentVersion: "26.11.0-beta.1", ...win },
-      ),
-    ).toMatchObject({ tag: "v26.11.0-beta.2", channel: "beta" });
-    expect(
-      updates.resolveRelease(
-        [release("v26.11.0-beta.2", ALL), release("v26.11.0", ALL)],
-        { currentVersion: "26.11.0-beta.2", ...win },
-      ),
-    ).toMatchObject({ tag: "v26.11.0", channel: "latest" });
-  });
-
-  it("waits while the newest release is still uploading", () => {
-    expect(
-      updates.resolveRelease(
-        [release("v26.10.2", ALL), release("v26.10.3", ["termix.exe"])],
-        { currentVersion: "26.10.1", ...win },
-      ),
-    ).toBeNull();
-  });
-
-  it("needs this platform's channel file", () => {
-    const releases = [release("v26.10.2", ["latest.yml", "latest-mac.yml"])];
-    expect(
-      updates.resolveRelease(releases, {
-        currentVersion: "26.10.1",
-        platform: "linux",
-        arch: "x64",
-      }),
-    ).toBeNull();
-    expect(
-      updates.resolveRelease(releases, {
-        currentVersion: "26.10.1",
-        platform: "darwin",
-        arch: "arm64",
-      }),
-    ).not.toBeNull();
-  });
-
-  it("handles junk input", () => {
-    expect(
-      updates.resolveRelease(null, { currentVersion: "26.10.1", ...win }),
-    ).toBeNull();
-    expect(
-      updates.resolveRelease([release("v26.10.2", ALL)], {
-        currentVersion: "dev",
-        ...win,
-      }),
-    ).toBeNull();
-  });
-});
-
-describe("getInstallKind", () => {
-  const base = {
-    platform: "win32",
-    arch: "x64",
-    isPackaged: true,
-    mas: false,
-    env: {},
-    execPath: path.join("C:", "Program Files", "Termix", "Termix.exe"),
-    resourcesPath: "/opt/Termix/resources",
-    exists: () => false,
-    readFile: () => {
-      throw new Error("missing");
-    },
-  };
-
-  it("disables dev builds and leaves the App Store alone", () => {
-    expect(updates.getInstallKind({ ...base, isPackaged: false })).toBe(
-      "disabled",
-    );
-    expect(
-      updates.getInstallKind({ ...base, platform: "darwin", mas: true }),
-    ).toBe("store");
-  });
-
-  it("updates NSIS installs and only links MSI, portable and 32-bit", () => {
-    const uninstaller = path.join(
-      path.dirname(base.execPath),
-      "Uninstall Termix.exe",
-    );
-    const nsis = (target: string) => target === uninstaller;
-    expect(updates.getInstallKind({ ...base, exists: nsis })).toBe("auto");
-    expect(updates.getInstallKind(base)).toBe("manual");
-    expect(
-      updates.getInstallKind({ ...base, arch: "ia32", exists: nsis }),
-    ).toBe("manual");
-  });
-
-  it("updates DMG installs unless run from the mounted image", () => {
-    const mac = { ...base, platform: "darwin", arch: "arm64" };
-    expect(
-      updates.getInstallKind({
-        ...mac,
-        execPath: "/Applications/Termix.app/Contents/MacOS/Termix",
-      }),
-    ).toBe("auto");
-    expect(
-      updates.getInstallKind({
-        ...mac,
-        execPath: "/Volumes/Termix/Termix.app/Contents/MacOS/Termix",
-      }),
-    ).toBe("manual");
-  });
-
-  it("tells Linux installs apart", () => {
-    const linux = { ...base, platform: "linux" };
-    expect(updates.getInstallKind({ ...linux, env: { FLATPAK_ID: "x" } })).toBe(
-      "manual",
-    );
-    expect(
-      updates.getInstallKind({
-        ...linux,
-        exists: (target: string) => target === "/.flatpak-info",
-      }),
-    ).toBe("manual");
-    expect(
-      updates.getInstallKind({ ...linux, env: { APPIMAGE: "/tmp/a" } }),
-    ).toBe("auto");
-    const dpkgOwned = (target: string) =>
-      target === "/var/lib/dpkg/info/termix.list";
-    expect(
-      updates.getInstallKind({
-        ...linux,
-        exists: dpkgOwned,
-        readFile: () => "deb\n",
-      }),
-    ).toBe("auto");
-    // The AUR package ships the deb's files without dpkg.
-    expect(updates.getInstallKind({ ...linux, readFile: () => "deb\n" })).toBe(
-      "manual",
-    );
-    expect(updates.getInstallKind(linux)).toBe("manual");
-  });
-});
-
-describe("createUpdater", () => {
-  afterEach(() => vi.useRealTimers());
-
-  function fakeAutoUpdater() {
-    const emitter = new EventEmitter() as EventEmitter &
-      Record<string, unknown>;
-    emitter.setFeedURL = vi.fn();
-    emitter.checkForUpdates = vi.fn(async () => {
-      emitter.emit("update-available", { version: "26.10.2" });
-    });
-    emitter.downloadUpdate = vi.fn(async () => {
-      emitter.emit("update-downloaded", { version: "26.10.2" });
-    });
-    emitter.quitAndInstall = vi.fn();
-    return emitter;
-  }
-
-  function setup(kind = "auto", mode = "prompt") {
-    const auto = fakeAutoUpdater();
-    const saved: string[] = [];
-    const sent: Array<Record<string, unknown>> = [];
-    const beforeInstall = vi.fn();
-    const updater = updates.createUpdater({
-      currentVersion: "26.10.1",
-      ...win,
-      kind,
-      getMode: () => mode,
-      saveMode: (next: string) => saved.push(next),
-      fetchReleases: async () => [release("v26.10.2", ALL)],
-      loadAutoUpdater: () => auto,
-      send: (state: Record<string, unknown>) => sent.push(state),
-      log: () => {},
-      beforeInstall,
-    });
-    return { auto, updater, saved, sent, beforeInstall };
-  }
-
-  it("asks before downloading in prompt mode", async () => {
-    const { auto, updater } = setup();
-    const state = await updater.check();
-    expect(auto.setFeedURL).toHaveBeenCalledWith({
-      provider: "generic",
-      url: "https://github.com/Termix-SSH/Termix/releases/download/v26.10.2",
-    });
-    expect(auto.autoDownload).toBe(false);
-    expect(auto.allowDowngrade).toBe(false);
-    expect(state).toMatchObject({ status: "available", version: "26.10.2" });
-
-    expect((await updater.download()).status).toBe("downloaded");
-    expect(updater.install()).toBe(true);
-  });
-
-  it("downloads on its own in automatic mode", async () => {
-    const { auto, updater } = setup("auto", "automatic");
-    await updater.check();
-    expect(auto.autoDownload).toBe(true);
-    expect(updater.getState().status).toBe("downloading");
-  });
-
-  it("marks the quit before installing so the tray lets go", async () => {
-    vi.useFakeTimers();
-    const { auto, updater, beforeInstall } = setup();
-    await updater.check();
-    await updater.download();
-    updater.install();
-    expect(beforeInstall).toHaveBeenCalled();
-    vi.runAllTimers();
-    expect(auto.quitAndInstall).toHaveBeenCalled();
-  });
-
-  it("only links the release for installs that can not update", async () => {
-    const { auto, updater } = setup("manual");
-    const state = await updater.check();
-    expect(auto.setFeedURL).not.toHaveBeenCalled();
-    expect(state).toMatchObject({
-      status: "available",
-      releaseUrl: "https://github.com/Termix-SSH/Termix/releases/tag/v26.10.2",
-    });
-    expect(updater.install()).toBe(false);
-  });
-
-  it("does nothing for store and dev builds", async () => {
-    for (const kind of ["store", "disabled"]) {
-      const { auto, updater } = setup(kind);
-      expect((await updater.check()).status).toBe("idle");
-      expect(auto.setFeedURL).not.toHaveBeenCalled();
-    }
-  });
-
-  it("saves valid modes only and falls back to prompt", () => {
-    const { updater, saved } = setup("auto", "bogus");
-    expect(updater.getState().mode).toBe("prompt");
-    updater.setMode("never");
-    updater.setMode("sometimes");
-    expect(saved).toEqual(["never"]);
-    expect(updater.getState().mode).toBe("never");
-  });
-
-  it("reports a failed lookup instead of throwing", async () => {
-    const updater = updates.createUpdater({
-      currentVersion: "26.10.1",
-      ...win,
-      kind: "auto",
-      getMode: () => "prompt",
-      saveMode: () => {},
-      fetchReleases: async () => {
-        throw new Error("offline");
-      },
-      loadAutoUpdater: () => fakeAutoUpdater(),
-      send: () => {},
-      log: () => {},
-    });
-    expect(await updater.check()).toMatchObject({
-      status: "error",
-      error: "offline",
-    });
-  });
-});

scripts/electron-backend-failure.test.ts

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
 import { describe, expect, it } from "vitest";
-import { PRE_29_DATABASE_ERROR } from "../src/backend/database/db/upgrade-guard.js";
 
 const require = createRequire(import.meta.url);
 const { classifyBackendFailure } =
@@ -47,16 +46,6 @@ describe("classifyBackendFailure", () => {
     });
   });
 
-  it("identifies a 2.8 database the backend refused to open", () => {
-    const stderr = `[ERROR] [SYSTEM] Failed to initialize backend services [op:startup_failed]
-Error: ${PRE_29_DATABASE_ERROR}
-    at assertNotPre29Database (upgrade-guard.js:14:11)`;
-    expect(classifyBackendFailure(stderr)).toEqual({
-      reason: "old-database",
-      port: null,
-    });
-  });
-
   it("reports a crash for any other non-zero exit", () => {
     expect(classifyBackendFailure("TypeError: boom")).toEqual({
       reason: "crashed",

scripts/fix-update-info.cjs

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-/**
- * Fixes electron-builder's update files (latest.yml and friends) after the
- * build, so the desktop updater gets the right download:
- *
- *   --drop <text>       remove entries whose file name contains text
- *                       (the ia32 installer, the combined Windows
- *                       installer, the universal mac zip)
- *   --rename <old=new>  follow an artifact the workflow renamed
- *
- * Usage: node scripts/fix-update-info.cjs [--drop x] [--rename a=b] files...
- */
-
-const fs = require("node:fs");
-const yaml = require("js-yaml");
-
-function fixUpdateInfo(info, { drop = [], rename = {} } = {}) {
-  const rewrite = (name) => rename[name] ?? name;
-  const seen = new Set();
-  // electron-builder can list the same file more than once.
-  const files = (info.files ?? [])
-    .filter((file) => !drop.some((text) => file.url.includes(text)))
-    .map((file) => ({ ...file, url: rewrite(file.url) }))
-    .filter((file) => !seen.has(file.url) && seen.add(file.url));
-  if (files.length === 0) {
-    throw new Error("no files left in update info");
-  }
-  return { ...info, files, path: files[0].url, sha512: files[0].sha512 };
-}
-
-function parseArgs(argv) {
-  const options = { drop: [], rename: {}, files: [] };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--drop") options.drop.push(argv[++i]);
-    else if (arg === "--rename") {
-      const [from, to] = String(argv[++i]).split("=");
-      if (!from || !to) throw new Error(`bad --rename ${argv[i]}`);
-      options.rename[from] = to;
-    } else options.files.push(arg);
-  }
-  return options;
-}
-
-function main() {
-  const options = parseArgs(process.argv.slice(2));
-  for (const file of options.files) {
-    if (!fs.existsSync(file)) continue;
-    const info = yaml.load(fs.readFileSync(file, "utf8"));
-    fs.writeFileSync(file, yaml.dump(fixUpdateInfo(info, options)));
-    console.log(`Fixed ${file}`);
-  }
-}
-
-if (require.main === module) {
-  try {
-    main();
-  } catch (error) {
-    console.error(error.message);
-    process.exit(1);
-  }
-}
-
-module.exports = { fixUpdateInfo, parseArgs };

scripts/fix-update-info.test.ts

@@ -1,87 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-
-const require = createRequire(import.meta.url);
-const { fixUpdateInfo, parseArgs } = require("./fix-update-info.cjs");
-
-const info = {
-  version: "26.10.2",
-  files: [
-    { url: "termix_windows_ia32_nsis.exe", sha512: "a", size: 1 },
-    { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-  ],
-  path: "termix_windows_ia32_nsis.exe",
-  sha512: "a",
-  releaseDate: "2026-10-11T00:00:00.000Z",
-};
-
-describe("fixUpdateInfo", () => {
-  it("drops entries and points path at what is left", () => {
-    const fixed = fixUpdateInfo(info, { drop: ["ia32"] });
-    expect(fixed.files.map((f: { url: string }) => f.url)).toEqual([
-      "termix_windows_x64_nsis.exe",
-    ]);
-    expect(fixed.path).toBe("termix_windows_x64_nsis.exe");
-    expect(fixed.sha512).toBe("b");
-    expect(fixed.version).toBe("26.10.2");
-  });
-
-  it("drops the combined Windows installer and duplicate entries", () => {
-    const fixed = fixUpdateInfo(
-      {
-        ...info,
-        files: [
-          { url: "termix_windows_nsis.exe", sha512: "c", size: 3 },
-          { url: "termix_windows_ia32_nsis.exe", sha512: "a", size: 1 },
-          { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-          { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-        ],
-        path: "termix_windows_nsis.exe",
-      },
-      { drop: ["ia32", "termix_windows_nsis.exe"] },
-    );
-    expect(fixed.files).toEqual([
-      { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-    ]);
-    expect(fixed.path).toBe("termix_windows_x64_nsis.exe");
-  });
-
-  it("follows renamed artifacts", () => {
-    const fixed = fixUpdateInfo(
-      {
-        ...info,
-        files: [{ url: "termix_linux_x86_64_appimage.AppImage", sha512: "c" }],
-      },
-      {
-        rename: {
-          "termix_linux_x86_64_appimage.AppImage":
-            "termix_linux_x64_appimage.AppImage",
-        },
-      },
-    );
-    expect(fixed.path).toBe("termix_linux_x64_appimage.AppImage");
-  });
-
-  it("refuses to leave nothing to download", () => {
-    expect(() => fixUpdateInfo(info, { drop: ["nsis"] })).toThrow();
-  });
-});
-
-describe("parseArgs", () => {
-  it("reads drops, renames and files", () => {
-    expect(
-      parseArgs([
-        "--drop",
-        "ia32",
-        "--rename",
-        "a=b",
-        "latest.yml",
-        "beta.yml",
-      ]),
-    ).toEqual({
-      drop: ["ia32"],
-      rename: { a: "b" },
-      files: ["latest.yml", "beta.yml"],
-    });
-  });
-});

scripts/generate-icons.mjs

@@ -1,5 +1,5 @@
 import sharp from "sharp";
-import { readFileSync, writeFileSync, mkdirSync, copyFileSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -10,98 +10,124 @@ const iconsDir = join(publicDir, "icons");
 
 mkdirSync(iconsDir, { recursive: true });
 
-const svgBuffer = readFileSync(join(publicDir, "icon-square.svg"));
-const render = (size) =>
-  sharp(svgBuffer, { density: 72 * Math.max(1, size / 1024) })
-    .resize(size, size)
-    .png({ compressionLevel: 9 })
-    .toBuffer();
+const svgBuffer = readFileSync(join(publicDir, "icon.svg"));
 
 const pngSizes = [16, 24, 32, 48, 64, 128, 256, 512, 1024];
-const png = Object.fromEntries(
-  await Promise.all(pngSizes.map(async (s) => [s, await render(s)])),
-);
 
-for (const size of pngSizes) {
-  writeFileSync(join(iconsDir, `${size}x${size}.png`), png[size]);
-}
-writeFileSync(join(publicDir, "icon.png"), png[1024]);
-writeFileSync(join(publicDir, "full-icon.png"), png[1024]);
-writeFileSync(join(publicDir, "icon-mac.png"), png[512]);
-
-writeFileSync(
-  join(publicDir, "favicon.ico"),
-  buildIco(
-    [16, 32, 48].map((s) => png[s]),
-    [16, 32, 48],
+console.log("Generating PNG icons...");
+await Promise.all(
+  pngSizes.map((size) =>
+    sharp(svgBuffer)
+      .resize(size, size)
+      .png()
+      .toFile(join(iconsDir, `${size}x${size}.png`))
+      .then(() => console.log(`  ✓ icons/${size}x${size}.png`)),
   ),
 );
-const winSizes = [16, 24, 32, 48, 64, 128, 256];
-writeFileSync(
-  join(publicDir, "icon.ico"),
-  buildIco(
-    winSizes.map((s) => png[s]),
-    winSizes,
-  ),
+
+// icon.png (1024x1024) for Linux electron-builder
+await sharp(svgBuffer)
+  .resize(1024, 1024)
+  .png()
+  .toFile(join(publicDir, "icon.png"));
+console.log("  ✓ icon.png");
+
+// icon-mac.png (512x512) for macOS
+await sharp(svgBuffer)
+  .resize(512, 512)
+  .png()
+  .toFile(join(publicDir, "icon-mac.png"));
+console.log("  ✓ icon-mac.png");
+
+// full-icon.png (1024x1024) used in app UI
+await sharp(svgBuffer)
+  .resize(1024, 1024)
+  .png()
+  .toFile(join(publicDir, "full-icon.png"));
+console.log("  ✓ full-icon.png");
+
+// favicon.ico: embed 16, 32, 48 px layers
+console.log("Generating favicon.ico...");
+const icoSizes = [16, 32, 48];
+const icoBuffers = await Promise.all(
+  icoSizes.map((size) => sharp(svgBuffer).resize(size, size).png().toBuffer()),
 );
-writeFileSync(
-  join(publicDir, "icon.icns"),
-  buildIcns([
-    ["icp4", png[16]],
-    ["icp5", png[32]],
-    ["icp6", png[64]],
-    ["ic07", png[128]],
-    ["ic08", png[256]],
-    ["ic09", png[512]],
-    ["ic10", png[1024]],
-    ["ic11", png[32]],
-    ["ic12", png[64]],
-    ["ic13", png[256]],
-    ["ic14", png[512]],
-  ]),
+writeFileSync(join(publicDir, "favicon.ico"), buildIco(icoBuffers, icoSizes));
+console.log("  ✓ favicon.ico");
+
+// icon.ico: embed 16, 32, 48, 64, 128, 256 px layers
+console.log("Generating icon.ico...");
+const winSizes = [16, 32, 48, 64, 128, 256];
+const winBuffers = await Promise.all(
+  winSizes.map((size) => sharp(svgBuffer).resize(size, size).png().toBuffer()),
 );
+writeFileSync(join(publicDir, "icon.ico"), buildIco(winBuffers, winSizes));
+console.log("  ✓ icon.ico");
+
+// icons/icon.ico and icons/icon.icns placeholders (stubs pointing to source)
+// electron-builder generates .icns; copy the 1024 PNG as icons/icon.png for reference
+await sharp(svgBuffer)
+  .resize(1024, 1024)
+  .png()
+  .toFile(join(iconsDir, "icon.ico").replace("icon.ico", "1024x1024.png"));
+// Copy icon.ico and icon.icns into icons/ as well
+import { copyFileSync } from "fs";
 copyFileSync(join(publicDir, "icon.ico"), join(iconsDir, "icon.ico"));
-copyFileSync(join(publicDir, "icon.icns"), join(iconsDir, "icon.icns"));
+console.log("  ✓ icons/icon.ico");
 
-console.log("Icons generated from public/icon-square.svg");
+console.log(
+  "\nDone! Note: icon.icns requires macOS tools (iconutil). Use electron-builder on macOS to generate it.",
+);
 
+/**
+ * Builds a minimal ICO file from PNG buffers.
+ * @param {Buffer[]} pngBuffers
+ * @param {number[]} sizes
+ * @returns {Buffer}
+ */
 function buildIco(pngBuffers, sizes) {
+  const count = pngBuffers.length;
   const headerSize = 6;
   const dirEntrySize = 16;
-  let offset = headerSize + pngBuffers.length * dirEntrySize;
+  const dirSize = headerSize + count * dirEntrySize;
+
+  let offset = dirSize;
   const entries = pngBuffers.map((buf, i) => {
-    const entry = { size: sizes[i], buf, offset };
+    const size = sizes[i];
+    const entry = {
+      size,
+      width: size > 255 ? 0 : size,
+      height: size > 255 ? 0 : size,
+      buf,
+      offset,
+    };
     offset += buf.length;
     return entry;
   });
 
-  const ico = Buffer.alloc(offset);
-  ico.writeUInt16LE(0, 0);
-  ico.writeUInt16LE(1, 2);
-  ico.writeUInt16LE(entries.length, 4);
+  const totalSize = offset;
+  const ico = Buffer.alloc(totalSize);
+
+  // ICO header
+  ico.writeUInt16LE(0, 0); // reserved
+  ico.writeUInt16LE(1, 2); // type: 1 = ICO
+  ico.writeUInt16LE(count, 4); // image count
+
+  // Directory entries
   entries.forEach((e, i) => {
     const base = headerSize + i * dirEntrySize;
-    ico.writeUInt8(e.size > 255 ? 0 : e.size, base);
-    ico.writeUInt8(e.size > 255 ? 0 : e.size, base + 1);
-    ico.writeUInt16LE(1, base + 4);
-    ico.writeUInt16LE(32, base + 6);
-    ico.writeUInt32LE(e.buf.length, base + 8);
-    ico.writeUInt32LE(e.offset, base + 12);
-    e.buf.copy(ico, e.offset);
+    ico.writeUInt8(e.width, base); // width (0 = 256)
+    ico.writeUInt8(e.height, base + 1); // height (0 = 256)
+    ico.writeUInt8(0, base + 2); // color count
+    ico.writeUInt8(0, base + 3); // reserved
+    ico.writeUInt16LE(1, base + 4); // planes
+    ico.writeUInt16LE(32, base + 6); // bit count
+    ico.writeUInt32LE(e.buf.length, base + 8); // size of image data
+    ico.writeUInt32LE(e.offset, base + 12); // offset of image data
   });
+
+  // Image data
+  entries.forEach((e) => e.buf.copy(ico, e.offset));
+
   return ico;
 }
-
-function buildIcns(chunks) {
-  const parts = chunks.map(([type, data]) => {
-    const head = Buffer.alloc(8);
-    head.write(type, 0, "ascii");
-    head.writeUInt32BE(data.length + 8, 4);
-    return Buffer.concat([head, data]);
-  });
-  const body = Buffer.concat(parts);
-  const head = Buffer.alloc(8);
-  head.write("icns", 0, "ascii");
-  head.writeUInt32BE(body.length + 8, 4);
-  return Buffer.concat([head, body]);
-}

scripts/generate-settings-search-index.cjs

@@ -20,30 +20,9 @@ const OUT = path.join(
   "settings-search-index.ts",
 );
 
-function flatKeys(obj, prefix = "") {
-  return Object.entries(obj).flatMap(([key, value]) =>
-    typeof value === "object"
-      ? flatKeys(value, `${prefix}${key}.`)
-      : [`${prefix}${key}`],
-  );
-}
-
-const EN_KEYS = new Set(
-  flatKeys(require(path.join(ROOT, "src", "ui", "locales", "en.json"))),
-);
-
-// t("x", { count }) reads x_one or x_other, so index the plural key.
-function realKey(key) {
-  return EN_KEYS.has(key) || !EN_KEYS.has(`${key}_other`)
-    ? key
-    : `${key}_other`;
-}
-
 function keysIn(text) {
   return [
-    ...new Set(
-      [...text.matchAll(/\bt\(\s*"([\w.-]+)"/g)].map((m) => realKey(m[1])),
-    ),
+    ...new Set([...text.matchAll(/\bt\(\s*"([\w.-]+)"/g)].map((m) => m[1])),
   ];
 }
 
@@ -131,18 +110,12 @@ function adminSections() {
     "admin-ssl": keysIn(functionBody(settings, "AdminSSLSection")),
     "admin-api-keys": keysIn(read("AdminApiKeysSection.tsx")),
     "admin-audit-log": keysIn(read("AdminAuditLogSection.tsx")),
-    updates: [
-      ...new Set(
-        ["UpdatesSettings.tsx", "DesktopUpdatesCard.tsx"].flatMap((file) =>
-          keysIn(
-            fs.readFileSync(
-              path.join(ROOT, "src", "ui", "settings", file),
-              "utf8",
-            ),
-          ),
-        ),
+    updates: keysIn(
+      fs.readFileSync(
+        path.join(ROOT, "src", "ui", "settings", "UpdatesSettings.tsx"),
+        "utf8",
       ),
-    ],
+    ),
   };
 }
 

src/backend/auth/provisioning.ts

@@ -275,7 +275,7 @@ export async function findOrProvisionExternalUser(
           provider: identity.provider,
         });
         throw new LoginMethodError(
-          "You have no Termix account yet. Ask an admin to turn on Auto-create external accounts.",
+          "Registration is disabled",
           403,
           "registration_disabled",
         );

src/backend/database/db/index.ts

@@ -542,6 +542,7 @@ async function initializeCompleteDatabase(): Promise<void> {
         plugin_id TEXT NOT NULL,
         registry_id TEXT NOT NULL,
         count INTEGER NOT NULL DEFAULT 0,
+        source TEXT NOT NULL DEFAULT 'aggregate-telemetry',
         updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
         UNIQUE (plugin_id, registry_id)
     );

src/backend/database/db/retired-columns.ts

@@ -80,8 +80,6 @@ export const RETIRED_COLUMNS: Record<string, string[]> = {
     "donation_modal_dismissed",
   ],
   sessions: ["oidc_sub", "oidc_sid", "sso_provider_id"],
-  // 26.10.1 shows downloads only.
-  plugin_install_counts: ["source"],
   user_preferences: [
     "command_autocomplete",
     "terminal_defaults",

src/backend/database/db/schema.mysql.ts

@@ -1055,9 +1055,10 @@ export const pluginRegistries = mysqlTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = mysqlTable(
   "plugin_install_counts",
@@ -1066,6 +1067,7 @@ export const pluginInstallCounts = mysqlTable(
     pluginId: varchar("plugin_id", { length: 255 }).notNull(),
     registryId: varchar("registry_id", { length: 255 }).notNull(),
     count: int("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`(CURRENT_TIMESTAMP)`),

src/backend/database/db/schema.pg.ts

@@ -1055,9 +1055,10 @@ export const pluginRegistries = pgTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = pgTable(
   "plugin_install_counts",
@@ -1066,6 +1067,7 @@ export const pluginInstallCounts = pgTable(
     pluginId: varchar("plugin_id", { length: 255 }).notNull(),
     registryId: varchar("registry_id", { length: 255 }).notNull(),
     count: integer("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`CURRENT_TIMESTAMP`),

src/backend/database/db/schema.ts

@@ -1051,9 +1051,10 @@ export const pluginRegistries = sqliteTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = sqliteTable(
   "plugin_install_counts",
@@ -1062,6 +1063,7 @@ export const pluginInstallCounts = sqliteTable(
     pluginId: text("plugin_id").notNull(),
     registryId: text("registry_id").notNull(),
     count: integer("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`CURRENT_TIMESTAMP`),

src/backend/database/db/upgrade-guard.ts

@@ -3,8 +3,7 @@
  * one-time 2.8 moves that copied them into plugins went with them. A 2.8
  * database has to pass through 2.9 first, or that data is lost.
  *
- * 2.8 already had a plugins table, so the marker is plugin_migrations, which
- * 2.9.0 added on every dialect. A 2.8 database has hosts but not that.
+ * A 2.9 database has the plugins table; a 2.8 one has hosts but no plugins.
  */
 export const PRE_29_DATABASE_ERROR =
   "This database is from Termix 2.8 or older. Upgrade to Termix 2.9.1 and start it once so it can move your data, then upgrade to this version.";
@@ -12,7 +11,7 @@ export const PRE_29_DATABASE_ERROR =
 export async function assertNotPre29Database(
   hasTable: (name: string) => boolean | Promise<boolean>,
 ): Promise<void> {
-  if ((await hasTable("ssh_data")) && !(await hasTable("plugin_migrations"))) {
+  if ((await hasTable("ssh_data")) && !(await hasTable("plugins"))) {
     throw new Error(PRE_29_DATABASE_ERROR);
   }
 }

src/backend/database/repositories/credential-access-repository.ts

@@ -152,15 +152,6 @@ export class CredentialAccessRepository {
     return rows[0] ?? null;
   }
 
-  /** Credentials holding a share this user handed out. */
-  async listCredentialIdsGrantedBy(userId: string): Promise<number[]> {
-    const rows = await this.context.drizzle
-      .selectDistinct({ credentialId: credentialAccess.credentialId })
-      .from(credentialAccess)
-      .where(eq(credentialAccess.grantedBy, userId));
-    return rows.map((row) => row.credentialId);
-  }
-
   async revoke(accessId: number, credentialId: number): Promise<void> {
     await this.context.drizzle
       .delete(credentialAccess)

src/backend/database/repositories/plugin-install-count-repository.ts

@@ -7,9 +7,10 @@ export type PluginInstallCountRecord = typeof pluginInstallCounts.$inferSelect;
 export interface PluginInstallCountInput {
   pluginId: string;
   count: number;
+  source: string;
 }
 
-/** Download counts for the store, one row per plugin and registry. */
+/** Popularity numbers for the store, one row per plugin and registry. */
 export class PluginInstallCountRepository {
   constructor(
     private readonly context: DatabaseContext,
@@ -37,11 +38,13 @@ export class PluginInstallCountRepository {
     let written = 0;
     for (const entry of entries) {
       const row = existing.get(entry.pluginId);
-      if (row && row.count === entry.count) continue;
+      if (row && row.count === entry.count && row.source === entry.source) {
+        continue;
+      }
       if (row) {
         await this.context.drizzle
           .update(pluginInstallCounts)
-          .set({ count: entry.count, updatedAt: now })
+          .set({ count: entry.count, source: entry.source, updatedAt: now })
           .where(
             and(
               eq(pluginInstallCounts.pluginId, entry.pluginId),
@@ -53,6 +56,7 @@ export class PluginInstallCountRepository {
           pluginId: entry.pluginId,
           registryId,
           count: entry.count,
+          source: entry.source,
           updatedAt: now,
         });
       }

src/backend/database/repositories/rbac-access-repository.ts

@@ -173,15 +173,6 @@ export class RbacAccessRepository {
     return rowsAffected(result);
   }
 
-  /** Hosts holding a share this user handed out. */
-  async listHostIdsGrantedBy(userId: string): Promise<number[]> {
-    const rows = await this.context.drizzle
-      .selectDistinct({ hostId: hostAccess.hostId })
-      .from(hostAccess)
-      .where(eq(hostAccess.grantedBy, userId));
-    return rows.map((row) => row.hostId);
-  }
-
   /** Grants the departing user handed out now count as the successor's. */
   async reassignHostAccessGrantedBy(
     fromUserId: string,

src/backend/database/routes/host-bulk-routes.ts

@@ -23,7 +23,6 @@ import type { AuthenticatedRequest } from "../../../types/index.js";
 import type { Request, RequestHandler, Response, Router } from "express";
 import { sshLogger } from "../../utils/logger.js";
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
-import { pluginEvents, TOPICS } from "../../plugins/events.js";
 import {
   createCurrentCredentialRepository,
   createCurrentHostRepository,
@@ -91,11 +90,11 @@ export function parseSSHConfig(content: string): SSHConfigHost[] {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) continue;
 
-    const match = /^(\S+?)(?:\s*=\s*|\s+)(.+)$/.exec(line);
-    if (!match) continue;
+    const spaceIdx = line.indexOf(" ");
+    if (spaceIdx === -1) continue;
 
-    const key = match[1].toLowerCase();
-    const value = match[2];
+    const key = line.slice(0, spaceIdx).toLowerCase();
+    const value = line.slice(spaceIdx + 1).trim();
 
     if (key === "host") {
       if (current && current.hostname) results.push(current);
@@ -136,16 +135,6 @@ export function parseSSHConfig(content: string): SSHConfigHost[] {
   return results;
 }
 
-/**
- * Tells status checks and other pollers about hosts an import wrote, the way
- * a single host create or update does.
- */
-export function notifyImportedHosts(userId: string, hostIds: number[]): void {
-  for (const hostId of hostIds) {
-    pluginEvents.emit(TOPICS.hostUpdated, { hostId, userId });
-  }
-}
-
 export function importedHostUsername(
   connectionType: string,
   authType: unknown,
@@ -828,7 +817,6 @@ export function registerHostBulkRoutes(
       }
 
       await applyDefaultsAfterHostWrites(writtenHostIds);
-      notifyImportedHosts(userId, writtenHostIds);
 
       res.json({
         message: `Import completed: ${results.success} created, ${results.updated} updated, ${results.failed} failed`,
@@ -1034,7 +1022,6 @@ export function registerHostBulkRoutes(
       }
 
       await applyDefaultsAfterHostWrites(writtenHostIds);
-      notifyImportedHosts(userId, writtenHostIds);
 
       res.json({
         message: `Import completed: ${results.success} created, ${results.updated} updated, ${results.failed} failed`,

src/backend/database/routes/host-normalizers.ts

@@ -80,14 +80,6 @@ export function containsOwnerPrivateAuthUpdate(
   );
 }
 
-/**
- * An update that names no auth type leaves the stored password and key
- * alone. Clearing them would leave a password host with no password.
- */
-export function keepsStoredSshAuth(authType: unknown): boolean {
-  return authType === undefined || authType === null;
-}
-
 const FOLDER_PATH_SEPARATOR = " / ";
 
 /**

src/backend/database/routes/host.ts

@@ -31,7 +31,6 @@ import {
 import {
   applyHostKeyTypeUpdate,
   containsOwnerPrivateAuthUpdate,
-  keepsStoredSshAuth,
   isNonEmptyString,
   isOptionalBoolean,
   isValidPort,
@@ -922,8 +921,6 @@ router.put(
       sshDataObj.key = null;
       sshDataObj.keyPassword = null;
       sshDataObj.keyType = null;
-    } else if (keepsStoredSshAuth(effectiveAuthType)) {
-      // The update says nothing about authentication.
     } else if (effectiveAuthType === "password") {
       if (password) {
         sshDataObj.password = password;

src/backend/database/routes/plugins.ts

@@ -17,13 +17,8 @@ import { describePluginFrontend } from "../../plugins/assets.js";
 import { invalidatePluginPermissionCache } from "../../plugins/permissions.js";
 import { getPluginPublicHttpRoutes } from "../../plugins/http.js";
 import { getPluginPublicWsRoutes } from "../../plugins/ws.js";
-import {
-  isLinkedDesktop,
-  MAX_UPLOAD_BYTES,
-  PluginManageError,
-} from "../../plugins/manage.js";
+import { MAX_UPLOAD_BYTES, PluginManageError } from "../../plugins/manage.js";
 import { parsePluginChannel } from "../../plugins/registry-index.js";
-import { RegistryError } from "../../plugins/registries.js";
 import {
   pluginDocsUrl,
   pluginEnvVars,
@@ -87,55 +82,37 @@ router.get("/public", async (_req: Request, res: Response) => {
   try {
     const records = await createCurrentPluginRepository().listAll();
     const { loader } = getPluginRuntime();
-    type GuestManifest = {
-      contributes?: {
-        guest?: boolean;
-        guestViews?: string[];
-        tabs?: unknown[];
-        panels?: unknown[];
-      };
-      dependencies?: Record<string, string>;
-      optionalDependencies?: Record<string, string>;
-    };
-    const guests = records.flatMap((record) => {
+    const plugins = records.flatMap((record) => {
       if (record.state !== "enabled") return [];
+      const loaded = loader.get(record.id);
+      let manifest: {
+        contributes?: { guest?: boolean; guestViews?: string[] };
+        dependencies?: Record<string, string>;
+        optionalDependencies?: Record<string, string>;
+      };
       try {
-        const manifest = JSON.parse(record.manifestJson) as GuestManifest;
-        return manifest?.contributes?.guest === true
-          ? [{ record, manifest }]
-          : [];
+        manifest = JSON.parse(record.manifestJson);
       } catch {
         return [];
       }
-    });
-    // Only guest plugins load on a guest page, so a dependency that is not
-    // one would block the plugin there for nothing.
-    const guestIds = new Set(guests.map(({ record }) => record.id));
-    const onlyGuests = (deps: Record<string, string> = {}) =>
-      Object.fromEntries(
-        Object.entries(deps).filter(([id]) => guestIds.has(id)),
-      );
-    const plugins = guests.map(({ record, manifest }) => {
-      const loaded = loader.get(record.id);
-      return {
-        id: record.id,
-        name: record.name,
-        // Not before login: it tells a scanner which known bugs apply.
-        version: "",
-        enabled: true,
-        state: loaded?.state ?? record.state,
-        // The tab and panel ids a guest page may register, which the
-        // browser checks against the manifest.
-        contributes: {
-          guest: true,
-          guestViews: manifest.contributes?.guestViews ?? [],
-          tabs: manifest.contributes?.tabs ?? [],
-          panels: manifest.contributes?.panels ?? [],
+      if (manifest?.contributes?.guest !== true) return [];
+      return [
+        {
+          id: record.id,
+          name: record.name,
+          // Not before login: it tells a scanner which known bugs apply.
+          version: "",
+          enabled: true,
+          state: loaded?.state ?? record.state,
+          contributes: {
+            guest: true,
+            guestViews: manifest.contributes.guestViews ?? [],
+          },
+          dependencies: manifest.dependencies ?? {},
+          optionalDependencies: manifest.optionalDependencies ?? {},
+          ...describePluginFrontend(loaded),
         },
-        dependencies: onlyGuests(manifest.dependencies),
-        optionalDependencies: onlyGuests(manifest.optionalDependencies),
-        ...describePluginFrontend(loaded),
-      };
+      ];
     });
     res.json(plugins);
   } catch (error) {
@@ -241,9 +218,6 @@ export async function listPreLoginPlugins(): Promise<
  *       it, and `locales` lists the languages it ships ("en" and xx_YY).
  *       `dependencies` and `optionalDependencies` let the loader activate
  *       frontends in the same order the server does.
- *
- *       On a desktop linked to a server, `runsOnServer` marks plugins that
- *       only run on that server and stay off here on purpose.
  *     tags:
  *       - Plugins
  *     responses:
@@ -261,7 +235,6 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
       userId,
       "admin.plugins.manage",
     );
-    const linked = await isLinkedDesktop();
 
     // One query for every plugin rather than one per plugin.
     const grantsByPlugin = new Map<string, string[]>();
@@ -294,7 +267,6 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
         let features: string[] = [];
         let docs: string | undefined;
         let env: PluginEnvVar[] = [];
-        let desktopMode: unknown = loaded?.manifest.desktop;
         try {
           const manifest = JSON.parse(record.manifestJson) as {
             contributes?: unknown;
@@ -309,9 +281,7 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
             env?: unknown;
             dependencies?: Record<string, string>;
             optionalDependencies?: Record<string, string>;
-            desktop?: unknown;
           };
-          desktopMode = loaded?.manifest.desktop ?? manifest?.desktop;
           contributes = manifest?.contributes ?? null;
           capabilities = Array.isArray(manifest?.capabilities)
             ? (manifest.capabilities as string[])
@@ -344,7 +314,6 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
           version: record.version,
           enabled: record.state === "enabled",
           state: loaded?.state ?? record.state,
-          runsOnServer: linked && desktopMode === "server",
           contributes,
           icon,
           dependencies,
@@ -405,7 +374,6 @@ async function auditPluginAction(
   action: string,
   pluginId: string,
   details: Record<string, unknown> = {},
-  resourceType = "plugin",
 ): Promise<void> {
   const userId = (req as AuthenticatedRequest).userId as string;
   const { ipAddress, userAgent } = getRequestMeta(req);
@@ -414,7 +382,7 @@ async function auditPluginAction(
       userId,
       username: await getAuditUsername(userId),
       action,
-      resourceType,
+      resourceType: "plugin",
       resourceId: pluginId,
       resourceName: pluginId,
       details: JSON.stringify(details),
@@ -433,7 +401,7 @@ function sendManageError(
   fallback: string,
   operation: string,
 ): void {
-  if (error instanceof PluginManageError || error instanceof RegistryError) {
+  if (error instanceof PluginManageError) {
     res.status(error.status).json({
       error: error.message,
       code: error.code,
@@ -584,304 +552,6 @@ router.post(
   },
 );
 
-/**
- * @openapi
- * /plugins/registries:
- *   get:
- *     summary: List the plugin registries
- *     description: The official registry, which is always on, the community registry and whether it is on, and every custom registry an admin added with its pinned key fingerprint.
- *     tags:
- *       - Plugins
- *     responses:
- *       200:
- *         description: The registries.
- *       403:
- *         description: The caller lacks admin.plugins.manage.
- */
-router.get(
-  "/registries",
-  authenticateJWT,
-  requireManagePlugins,
-  async (_req: Request, res: Response) => {
-    try {
-      const { readRegistriesConfig } =
-        await import("../../plugins/registries.js");
-      const { officialSource, communitySource } =
-        await import("../../plugins/registry-index.js");
-      const config = await readRegistriesConfig();
-      res.json({
-        managedByServer: await isLinkedDesktop(),
-        official: { id: "official", url: officialSource().url },
-        community: {
-          id: "community",
-          url: communitySource().url,
-          enabled: config.community.enabled,
-        },
-        custom: config.custom.map((entry) => ({
-          id: entry.id,
-          name: entry.name,
-          url: entry.url,
-          keyId: entry.keyId,
-          enabled: entry.enabled,
-          addedAt: entry.addedAt,
-        })),
-      });
-    } catch (error) {
-      sendManageError(
-        res,
-        error,
-        "Failed to read plugin registries",
-        "plugin_registry",
-      );
-    }
-  },
-);
-
-/**
- * @openapi
- * /plugins/registries/preview:
- *   post:
- *     summary: Read a registry index before adding it
- *     description: Fetches the index at url and returns its name, the id it would get, how many plugins it lists and the fingerprint of the key it signs with. Nothing is saved. The index must list a publicKey.
- *     tags:
- *       - Plugins
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - url
- *             properties:
- *               url:
- *                 type: string
- *     responses:
- *       200:
- *         description: What the registry would be added as.
- *       400:
- *         description: Not an https URL, or the index has no publicKey.
- *       403:
- *         description: The caller lacks admin.plugins.manage.
- *       409:
- *         description: The registry is already added.
- *       502:
- *         description: The index could not be read.
- */
-router.post(
-  "/registries/preview",
-  authenticateJWT,
-  requireManagePlugins,
-  async (req: Request, res: Response) => {
-    if (await refuseOnLinkedDesktop(res)) return;
-    try {
-      const { previewRegistry } = await import("../../plugins/registries.js");
-      res.json(await previewRegistry(req.body?.url));
-    } catch (error) {
-      sendManageError(
-        res,
-        error,
-        "Failed to read the registry",
-        "plugin_registry",
-      );
-    }
-  },
-);
-
-/**
- * @openapi
- * /plugins/registries:
- *   post:
- *     summary: Add a custom plugin registry
- *     description: Reads the index again and pins the key it names. keyId must be the fingerprint the preview showed, otherwise the answer is 409 KEY_MISMATCH and nothing is saved. Every plugin installed from it must be signed by that key.
- *     tags:
- *       - Plugins
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - url
- *               - keyId
- *             properties:
- *               url:
- *                 type: string
- *               keyId:
- *                 type: string
- *     responses:
- *       200:
- *         description: The added registry.
- *       400:
- *         description: Not an https URL, no publicKey, or too many registries.
- *       403:
- *         description: The caller lacks admin.plugins.manage.
- *       409:
- *         description: Already added, or the key changed since the preview.
- *       502:
- *         description: The index could not be read.
- */
-router.post(
-  "/registries",
-  authenticateJWT,
-  requireManagePlugins,
-  async (req: Request, res: Response) => {
-    if (await refuseOnLinkedDesktop(res)) return;
-    try {
-      const { addRegistry } = await import("../../plugins/registries.js");
-      const entry = await addRegistry(req.body?.url, req.body?.keyId);
-      await auditPluginAction(
-        req,
-        "add_plugin_registry",
-        entry.id,
-        { url: entry.url, keyId: entry.keyId },
-        "plugin_registry",
-      );
-      res.json({
-        id: entry.id,
-        name: entry.name,
-        url: entry.url,
-        keyId: entry.keyId,
-        enabled: entry.enabled,
-        addedAt: entry.addedAt,
-      });
-    } catch (error) {
-      sendManageError(
-        res,
-        error,
-        "Failed to add the registry",
-        "plugin_registry",
-      );
-    }
-  },
-);
-
-/**
- * @openapi
- * /plugins/registries/{id}:
- *   patch:
- *     summary: Turn a plugin registry on or off
- *     description: Works for community and custom registries. Plugins already installed from a registry that is off keep running but get no updates.
- *     tags:
- *       - Plugins
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: string
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - enabled
- *             properties:
- *               enabled:
- *                 type: boolean
- *     responses:
- *       200:
- *         description: The registry was changed.
- *       400:
- *         description: Invalid body, or the official registry.
- *       403:
- *         description: The caller lacks admin.plugins.manage.
- *       404:
- *         description: No such registry.
- */
-router.patch(
-  "/registries/:id",
-  authenticateJWT,
-  requireManagePlugins,
-  async (req: Request, res: Response) => {
-    const id = String(req.params.id);
-    const enabled = req.body?.enabled;
-    if (typeof enabled !== "boolean") {
-      res.status(400).json({ error: "enabled must be a boolean" });
-      return;
-    }
-    if (await refuseOnLinkedDesktop(res)) return;
-    try {
-      const { setRegistryEnabled } =
-        await import("../../plugins/registries.js");
-      await setRegistryEnabled(id, enabled);
-      await auditPluginAction(
-        req,
-        enabled ? "enable_plugin_registry" : "disable_plugin_registry",
-        id,
-        {},
-        "plugin_registry",
-      );
-      res.json({ id, enabled });
-    } catch (error) {
-      sendManageError(
-        res,
-        error,
-        "Failed to change the registry",
-        "plugin_registry",
-      );
-    }
-  },
-);
-
-/**
- * @openapi
- * /plugins/registries/{id}:
- *   delete:
- *     summary: Remove a custom plugin registry
- *     description: Refused with 409 REGISTRY_IN_USE while plugins installed from it remain, since its key has to stay trusted for them to load.
- *     tags:
- *       - Plugins
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: The registry was removed.
- *       400:
- *         description: Official and community can only be turned off.
- *       403:
- *         description: The caller lacks admin.plugins.manage.
- *       404:
- *         description: No such registry.
- *       409:
- *         description: Plugins from it are still installed.
- */
-router.delete(
-  "/registries/:id",
-  authenticateJWT,
-  requireManagePlugins,
-  async (req: Request, res: Response) => {
-    const id = String(req.params.id);
-    if (await refuseOnLinkedDesktop(res)) return;
-    try {
-      const { removeRegistry } = await import("../../plugins/registries.js");
-      await removeRegistry(id);
-      await auditPluginAction(
-        req,
-        "remove_plugin_registry",
-        id,
-        {},
-        "plugin_registry",
-      );
-      res.json({ id });
-    } catch (error) {
-      sendManageError(
-        res,
-        error,
-        "Failed to remove the registry",
-        "plugin_registry",
-      );
-    }
-  },
-);
-
 /**
  * @openapi
  * /plugins/{id}/state:
@@ -1909,11 +1579,10 @@ function readVersion(body: unknown): string | undefined | null {
  * @openapi
  * /plugins/registry:
  *   get:
- *     summary: List the plugins in every registry that is on
+ *     summary: List the plugins in the official registry
  *     description: >
- *       Fetches the index of every registry that is on (each cached for 15
- *       minutes unless refresh is set), with each one's status under
- *       registries, and merges them with what is installed here: the
+ *       Fetches the official registry index (cached for 15 minutes unless
+ *       refresh is set) and merges it with what is installed here: the
  *       installed version, the newest release this build can run, whether an
  *       update asks for new capabilities, and the pin and auto-update choices.
  *     tags:
@@ -2054,10 +1723,10 @@ router.post(
  * @openapi
  * /plugins/{id}/install:
  *   post:
- *     summary: Install a plugin from a registry
+ *     summary: Install a plugin from the official registry
  *     description: >
- *       Downloads the release, checks its sha256 and signature against the keys of
- *       the registry it comes from, loads it, grants the capabilities it declares and
+ *       Downloads the release, checks its sha256 and signature against a key
+ *       this build trusts, loads it, grants the capabilities it declares and
  *       starts it along with any installed dependency that is off. Without a
  *       version the newest compatible release is used; naming an older one
  *       pins the plugin there. A bundled plugin at its shipped version needs
@@ -2087,9 +1756,6 @@ router.post(
  *                 type: string
  *                 enum: [stable, beta]
  *                 description: The channel to follow. beta installs the newest beta when it is newer than stable.
- *               registryId:
- *                 type: string
- *                 description: The registry to install from, official when unset. It must be turned on, and only the official registry can offer an official plugin id.
  *               capabilities:
  *                 type: array
  *                 items:
@@ -2102,9 +1768,9 @@ router.post(
  *       403:
  *         description: The caller lacks admin.plugins.manage.
  *       404:
- *         description: Not in that registry.
+ *         description: Not in the official registry.
  *       409:
- *         description: Already installed, incompatible, the consent does not match, the registry is off, the id belongs to an official plugin, or managed by a linked server.
+ *         description: Already installed, incompatible, the consent does not match, or managed by a linked server.
  *       502:
  *         description: The registry could not be reached.
  */
@@ -2120,19 +1786,15 @@ router.post(
       req.body?.channel === undefined
         ? "stable"
         : parsePluginChannel(req.body.channel);
-    const registryId =
-      req.body?.registryId === undefined ? undefined : req.body.registryId;
     if (
       !ID_PATTERN.test(pluginId) ||
       version === null ||
       capabilities === null ||
-      channel === null ||
-      (registryId !== undefined &&
-        (typeof registryId !== "string" || !ID_PATTERN.test(registryId)))
+      channel === null
     ) {
-      res.status(400).json({
-        error: "Invalid plugin id, version, channel, registry or capabilities",
-      });
+      res
+        .status(400)
+        .json({ error: "Invalid plugin id, version, channel or capabilities" });
       return;
     }
     if (await refuseOnLinkedDesktop(res)) return;
@@ -2142,13 +1804,11 @@ router.post(
       const result = await installPlugin(pluginId, {
         version,
         channel,
-        registryId,
         userId,
         capabilities,
       });
       await auditPluginAction(req, "install_plugin", pluginId, {
         version: result.version,
-        registryId: registryId ?? "official",
         capabilities,
       });
       res.json(result);
@@ -2169,7 +1829,7 @@ router.post(
  *   post:
  *     summary: Update or change the installed version of a plugin
  *     description: >
- *       Swaps in another release from the registry the plugin came from, newer or older.
+ *       Swaps in another release from the official registry, newer or older.
  *       If the release declares capabilities the installed one does not, the
  *       request must set acceptCapabilities and list exactly those added
  *       capabilities in capabilities, otherwise it answers 409 with code

src/backend/database/routes/rbac.ts

@@ -75,74 +75,6 @@ async function canManageHostSharing(
   return { allowed: access.hasAccess, isOwner: access.isOwner };
 }
 
-/**
- * Drops shares handed out by someone who can no longer manage sharing on the
- * host, then repeats so shares they passed on further go too.
- */
-export async function pruneHostGrants(hostId: number): Promise<number> {
-  const repository = createCurrentRbacAccessRepository();
-  const ownerId =
-    await createCurrentHostResolutionRepository().findHostOwnerId(hostId);
-  let removed = 0;
-  for (let changed = true; changed;) {
-    changed = false;
-    for (const grant of await repository.listHostAccess(hostId)) {
-      if (!grant.grantedBy || grant.grantedBy === ownerId) continue;
-      if ((await canManageHostSharing(grant.grantedBy, hostId)).allowed) {
-        continue;
-      }
-      await repository.revokeHostAccess(grant.id, hostId);
-      removed++;
-      changed = true;
-    }
-  }
-  return removed;
-}
-
-/** pruneHostGrants for credential shares. */
-export async function pruneCredentialGrants(
-  credentialId: number,
-): Promise<number> {
-  const repository = createCurrentCredentialAccessRepository();
-  const owner =
-    await createCurrentCredentialRepository().findById(credentialId);
-  if (!owner) return 0;
-  let removed = 0;
-  for (let changed = true; changed;) {
-    changed = false;
-    for (const grant of await repository.listForCredential(credentialId)) {
-      if (!grant.grantedBy || grant.grantedBy === owner.userId) continue;
-      if (
-        (await canManageCredentialSharing(grant.grantedBy, credentialId))
-          .allowed
-      ) {
-        continue;
-      }
-      await repository.revoke(grant.id, credentialId);
-      removed++;
-      changed = true;
-    }
-  }
-  return removed;
-}
-
-/** Prunes everything these users shared, after they lost a role. */
-export async function pruneGrantsBy(userIds: string[]): Promise<void> {
-  for (const userId of userIds) {
-    permissionManager.invalidateUserPermissionCache(userId);
-    for (const hostId of await createCurrentRbacAccessRepository().listHostIdsGrantedBy(
-      userId,
-    )) {
-      await pruneHostGrants(hostId);
-    }
-    for (const credentialId of await createCurrentCredentialAccessRepository().listCredentialIdsGrantedBy(
-      userId,
-    )) {
-      await pruneCredentialGrants(credentialId);
-    }
-  }
-}
-
 export interface ShareTarget {
   type: "user" | "role";
   id: string | number;
@@ -368,7 +300,6 @@ router.post(
         });
       }
 
-      await pruneHostGrants(hostId);
       databaseLogger.success("Host shared successfully", {
         operation: "rbac_host_share_success",
         userId,
@@ -849,7 +780,6 @@ router.patch(
         hostId,
         update,
       );
-      await pruneHostGrants(hostId);
 
       databaseLogger.info("Host access grant updated", {
         operation: "rbac_host_access_update",
@@ -933,7 +863,6 @@ router.delete(
         accessId,
         hostId,
       );
-      await pruneHostGrants(hostId);
       databaseLogger.info("Permission revoked", {
         operation: "rbac_permission_revoke",
         adminId: userId,
@@ -1454,7 +1383,6 @@ router.delete(
       for (const userId of deletedUserIds) {
         permissionManager.invalidateUserPermissionCache(userId);
       }
-      await pruneGrantsBy(deletedUserIds);
 
       res.json({
         success: true,
@@ -1747,7 +1675,6 @@ router.delete(
       }
 
       permissionManager.invalidateUserPermissionCache(targetUserId);
-      await pruneGrantsBy([targetUserId]);
       databaseLogger.info("Role removed from user", {
         operation: "rbac_role_remove",
         adminId: req.userId!,
@@ -1961,7 +1888,6 @@ router.post(
         success: true,
       });
 
-      await pruneCredentialGrants(credentialId);
       res.json({ success: true, permissionLevel, expiresAt });
     } catch (error) {
       databaseLogger.error("Failed to share credential", error, {
@@ -2045,7 +1971,6 @@ router.delete(
         return res.status(404).json({ error: "Access grant not found" });
       }
       await repository.revoke(accessId, credentialId);
-      await pruneCredentialGrants(credentialId);
       res.json({ success: true });
     } catch (error) {
       databaseLogger.error("Failed to revoke credential access", error, {

src/backend/database/routes/user-socket-ticket-routes.ts

@@ -1,64 +0,0 @@
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import type { RequestHandler, Router } from "express";
-import type { AuthManager } from "../../utils/auth-manager.js";
-import { authLogger } from "../../utils/logger.js";
-import { isCookieOriginAllowed } from "../../utils/ws-auth.js";
-
-type UserSocketTicketRoutesDeps = {
-  authenticateJWT: RequestHandler;
-  authManager: AuthManager;
-};
-
-export function registerUserSocketTicketRoutes(
-  router: Router,
-  { authenticateJWT, authManager }: UserSocketTicketRoutesDeps,
-): void {
-  /**
-   * @openapi
-   * /users/ws-ticket:
-   *   post:
-   *     summary: Get a WebSocket ticket
-   *     description: Returns a token that is valid for one minute and only opens plugin WebSockets. The web app sends it as a subprotocol, so sockets work behind a proxy that rewrites the Host header. Only a page on this server can get one.
-   *     tags:
-   *       - Users
-   *     responses:
-   *       200:
-   *         description: The ticket.
-   *         content:
-   *           application/json:
-   *             schema:
-   *               type: object
-   *               properties:
-   *                 ticket:
-   *                   type: string
-   *       401:
-   *         description: Not authenticated, or not a login session.
-   *       403:
-   *         description: The request came from a page on another site.
-   *       500:
-   *         description: Failed to issue the ticket.
-   */
-  router.post("/ws-ticket", authenticateJWT, async (req, res) => {
-    const authReq = req as AuthenticatedRequest;
-    const sessionId = authReq.sessionId;
-    if (!sessionId || authReq.apiKeyId) {
-      return res.status(401).json({ error: "A login session is required" });
-    }
-    // The cookie rides along from sibling subdomains too, so the ticket only
-    // goes to a page the browser says is this server.
-    if (req.cookies?.jwt && !isCookieOriginAllowed(req)) {
-      return res.status(403).json({ error: "Not allowed from this origin" });
-    }
-    try {
-      const ticket = await authManager.issueSocketTicket(
-        authReq.userId,
-        sessionId,
-      );
-      res.setHeader("Cache-Control", "no-store");
-      res.json({ ticket });
-    } catch (err) {
-      authLogger.error("Failed to issue a socket ticket", err);
-      res.status(500).json({ error: "Failed to issue a socket ticket" });
-    }
-  });
-}

src/backend/database/routes/users.ts

@@ -26,7 +26,6 @@ import { registerBrandingRoutes } from "./branding-routes.js";
 import { registerUserSettingsRoutes } from "./user-settings-routes.js";
 import { registerTlsRoutes } from "./tls-routes.js";
 import { registerUserSessionRoutes } from "./user-session-routes.js";
-import { registerUserSocketTicketRoutes } from "./user-socket-ticket-routes.js";
 import { registerUserExternalAccountRoutes } from "./user-external-account-routes.js";
 import { registerUserPasswordResetRoutes } from "./user-password-reset-routes.js";
 import { registerUserAdminRoutes } from "./user-admin-routes.js";
@@ -1531,7 +1530,6 @@ registerUserExternalAccountRoutes(router, {
 });
 
 registerUserSettingsRoutes(router, authenticateJWT);
-registerUserSocketTicketRoutes(router, { authenticateJWT, authManager });
 registerTlsRoutes(router, authenticateJWT);
 
 registerUserApiKeyRoutes(router, requireAdmin);

src/backend/hosts/host-key-verifier.ts

@@ -61,34 +61,6 @@ export class SSHHostKeyVerifier {
           const keyType = this.getKeyType(hostkey);
           const algorithm = "sha256";
 
-          // An unsaved host (Quick Connect) has nowhere to keep the key, so the
-          // user checks it for this session when there is a socket to ask on.
-          if (!hostId && ws) {
-            const accepted = await this.promptUserForNewKey(
-              ws,
-              ip,
-              port,
-              undefined,
-              fingerprint,
-              keyType,
-              algorithm,
-            );
-            sshLogger.info(
-              accepted
-                ? "Quick connect host key accepted for this session"
-                : "Quick connect host key rejected",
-              {
-                operation: "host_key_quick_connect",
-                ip,
-                port,
-                fingerprint,
-                userId,
-              },
-            );
-            verify(accepted);
-            return;
-          }
-
           if (!hostId) {
             sshLogger.info(
               "Host key verification skipped (no hostId - quick connect)",

src/backend/hosts/protocol-auth/protocol-auth.ts

@@ -495,30 +495,6 @@ function withDeclaredFields(
   return out;
 }
 
-/**
- * The credential a host inherits from its folder or the user's defaults, for
- * a protocol login set to "credential" with none picked.
- */
-async function inheritedCredentialId(
-  ownerId: string,
-  hostId: number,
-): Promise<number | null> {
-  try {
-    const { resolveForEditor } = await import("../defaults/service.js");
-    const resolved = await resolveForEditor({ ownerId, hostId });
-    const auth = resolved["core.auth"]?.value as {
-      authType?: string;
-      credentialId?: unknown;
-    } | null;
-    return auth?.authType === "credential" &&
-      typeof auth.credentialId === "number"
-      ? auth.credentialId
-      : null;
-  } catch {
-    return null;
-  }
-}
-
 /** The owner's own login: the stored one, or the credential it points at. */
 export async function resolveOwnerProtocolLogin(
   host: Record<string, unknown>,
@@ -536,12 +512,8 @@ export async function resolveOwnerProtocolLogin(
   const authType = login?.authType || "direct";
   let username = login?.username ?? "";
   let password = login?.password ?? "";
-  const credentialId =
-    authType === "credential"
-      ? (login?.credentialId ?? (await inheritedCredentialId(ownerId, hostId)))
-      : null;
-  if (credentialId) {
-    const credential = await findUsableCredential(credentialId, ownerId);
+  if (authType === "credential" && login?.credentialId) {
+    const credential = await findUsableCredential(login.credentialId, ownerId);
     // Only the login itself comes from a stored credential, never the fields.
     if (credential?.username) username = credential.username;
     if (credential?.password) password = credential.password;

src/backend/plugins/auto-update.ts

@@ -1,5 +1,5 @@
 /**
- * The registry timer: refreshes the store's download counts and applies
+ * The registry timer: refreshes the store's install counts and applies
  * plugin updates for plugins with auto-update on. An update that asks for a
  * new capability is never applied here; admins get an alert and review it in
  * the Plugins tab. Nothing is ever installed from here.
@@ -13,8 +13,8 @@ const CHECK_EVERY_MS = 6 * 60 * 60_000;
 let timer: NodeJS.Timeout | null = null;
 
 export async function runPluginAutoUpdate(): Promise<void> {
-  const { syncDownloadCounts } = await import("./download-counts.js");
-  await syncDownloadCounts();
+  const { syncInstallCounts } = await import("./install-counts.js");
+  await syncInstallCounts();
 
   const { isLinkedDesktop, updateAllPlugins } = await import("./manage.js");
   if (await isLinkedDesktop()) return;

src/backend/plugins/download-counts.ts

@@ -1,103 +0,0 @@
-/**
- * Download counts for the plugin store, copied from the registry's
- * stats.json into plugin_install_counts.
- *
- * A count is how often the plugin's .tmxplug release files were downloaded.
- * An instance that updates three times counts three times, and copies bundled
- * into Docker images or the desktop app never count. Treat it as a ranking,
- * never as a user count.
- */
-
-import { pluginLogger } from "../utils/logger.js";
-import {
-  OFFICIAL_REGISTRY_ID,
-  fetchRegistryStats,
-  officialSource,
-  type RegistrySource,
-} from "./registry-index.js";
-
-async function repository() {
-  const { createCurrentPluginInstallCountRepository } =
-    await import("../database/repositories/factory.js");
-  return createCurrentPluginInstallCountRepository();
-}
-
-const STALE_MS = 6 * 60 * 60_000;
-const FORCED_MS = 60_000;
-const WAIT_MS = 3_000;
-
-let lastSyncAt = 0;
-let running: Promise<number> | null = null;
-
-/**
- * Syncs when the counts are older than the registry timer's interval, or
- * older than a minute with force (the Refresh button). Waits a few seconds
- * at most so a slow registry never holds up the store; a sync that runs
- * longer still finishes in the background.
- */
-export async function refreshDownloadCounts(force = false): Promise<void> {
-  const age = Date.now() - lastSyncAt;
-  if (!running && age >= (force ? FORCED_MS : STALE_MS)) {
-    running = syncDownloadCounts().finally(() => {
-      running = null;
-    });
-  }
-  if (!running) return;
-  let timeout: NodeJS.Timeout | undefined;
-  await Promise.race([
-    running,
-    new Promise((resolve) => {
-      timeout = setTimeout(resolve, WAIT_MS);
-    }),
-  ]);
-  clearTimeout(timeout);
-}
-
-/** Test seam. */
-export function resetDownloadCountRefresh(): void {
-  lastSyncAt = 0;
-  running = null;
-}
-
-/** Returns how many rows changed. Never throws; a failed sync keeps the old numbers. */
-export async function syncDownloadCounts(): Promise<number> {
-  lastSyncAt = Date.now();
-  let changed = 0;
-  let sources: RegistrySource[] = [officialSource()];
-  try {
-    const { listSources } = await import("./registries.js");
-    sources = await listSources();
-  } catch {
-    // Official only when the registry choices cannot be read.
-  }
-  for (const source of sources) {
-    try {
-      const stats = await fetchRegistryStats(source);
-      if (!stats) continue;
-      const entries = [...stats.plugins].map(([pluginId, downloads]) => ({
-        pluginId,
-        count: downloads,
-      }));
-      changed += await (await repository()).upsertMany(source.id, entries);
-    } catch (error) {
-      pluginLogger.warn(
-        `Could not sync plugin download counts from ${source.id}: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-        { operation: "plugin_registry" },
-      );
-    }
-  }
-  return changed;
-}
-
-export async function readDownloadCounts(
-  registryId: string = OFFICIAL_REGISTRY_ID,
-): Promise<Map<string, number>> {
-  try {
-    const rows = await (await repository()).listByRegistry(registryId);
-    return new Map(rows.map((row) => [row.pluginId, row.count]));
-  } catch {
-    return new Map();
-  }
-}

src/backend/plugins/host-modules.ts

@@ -1,65 +0,0 @@
-import module from "node:module";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { getPluginsDir } from "./paths.js";
-
-/**
- * A plugin build leaves host packages (drizzle-orm, express, ssh2, ...) for
- * core to supply, and Node finds them by walking up from the importing file.
- * That works for bundled plugins inside the app, but a .tmxplug unpacked into
- * a data dir outside it (the desktop app keeps it in AppData) finds nothing.
- * Those imports fall back to core's own copy, the one bundled plugins get.
- */
-
-let installed = false;
-
-export function isBareSpecifier(specifier: string): boolean {
-  if (specifier.startsWith(".") || specifier.startsWith("/")) return false;
-  if (specifier.startsWith("#")) return false;
-  // file:, node:, data:, and a Windows drive letter
-  return !/^[a-zA-Z][a-zA-Z\d+.-]*:/.test(specifier);
-}
-
-/** Whether an import from parentURL may fall back to core's packages. */
-export function isUserPluginFile(
-  parentURL: string | undefined,
-  pluginsDir: string,
-): boolean {
-  if (!parentURL?.startsWith("file:")) return false;
-  let file: string;
-  try {
-    file = fileURLToPath(new URL(parentURL));
-  } catch {
-    return false;
-  }
-  const relative = path.relative(path.resolve(pluginsDir), file);
-  return (
-    relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative)
-  );
-}
-
-export function installHostModuleFallback(): void {
-  if (installed) return;
-  installed = true;
-  // Node 22.15+. Older runtimes keep plain resolution.
-  if (typeof module.registerHooks !== "function") return;
-  module.registerHooks({
-    resolve(specifier, context, nextResolve) {
-      try {
-        return nextResolve(specifier, context);
-      } catch (error) {
-        if (
-          (error as { code?: string })?.code !== "ERR_MODULE_NOT_FOUND" ||
-          !isBareSpecifier(specifier) ||
-          !isUserPluginFile(context.parentURL, getPluginsDir())
-        ) {
-          throw error;
-        }
-        return nextResolve(specifier, {
-          ...context,
-          parentURL: import.meta.url,
-        });
-      }
-    },
-  });
-}

src/backend/plugins/install-counts.ts

@@ -0,0 +1,79 @@
+/**
+ * Popularity numbers for the plugin store, copied from the registry's
+ * stats.json into plugin_install_counts.
+ *
+ * Two sources, and the store prefers the first:
+ * - "aggregate-telemetry": instances that reported the plugin enabled in the
+ *   last 7 days through the Usage Statistics plugin. It undercounts by every
+ *   instance that turned the report off or never installed that plugin.
+ * - "github-releases": downloads of the plugin's .tmxplug release assets.
+ *   This counts downloads, not active installs: an instance that updates
+ *   three times counts three times, and Docker images that bundle the plugin
+ *   count once per build, not once per install.
+ *
+ * Treat both as a rough ranking, never as a user count.
+ */
+
+import { pluginLogger } from "../utils/logger.js";
+import { OFFICIAL_REGISTRY_ID, fetchRegistryStats } from "./registry-index.js";
+
+export const TELEMETRY_SOURCE = "aggregate-telemetry";
+export const DOWNLOADS_SOURCE = "github-releases";
+
+export interface InstallCount {
+  count: number;
+  source: string;
+}
+
+async function repository() {
+  const { createCurrentPluginInstallCountRepository } =
+    await import("../database/repositories/factory.js");
+  return createCurrentPluginInstallCountRepository();
+}
+
+/** Picks the number to show: active installs when known, downloads otherwise. */
+export function preferredCount(entry: {
+  downloads: number;
+  activeInstalls: number | null;
+}): InstallCount {
+  return entry.activeInstalls !== null && entry.activeInstalls > 0
+    ? { count: entry.activeInstalls, source: TELEMETRY_SOURCE }
+    : { count: entry.downloads, source: DOWNLOADS_SOURCE };
+}
+
+/** Returns how many rows changed. Never throws; a failed sync keeps the old numbers. */
+export async function syncInstallCounts(): Promise<number> {
+  try {
+    const stats = await fetchRegistryStats();
+    if (!stats) return 0;
+    const entries = [...stats.plugins].map(([pluginId, entry]) => ({
+      pluginId,
+      ...preferredCount(entry),
+    }));
+    return await (await repository()).upsertMany(OFFICIAL_REGISTRY_ID, entries);
+  } catch (error) {
+    pluginLogger.warn(
+      `Could not sync plugin install counts: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+      { operation: "plugin_registry" },
+    );
+    return 0;
+  }
+}
+
+export async function readInstallCounts(
+  registryId: string = OFFICIAL_REGISTRY_ID,
+): Promise<Map<string, InstallCount>> {
+  try {
+    const rows = await (await repository()).listByRegistry(registryId);
+    return new Map(
+      rows.map((row) => [
+        row.pluginId,
+        { count: row.count, source: row.source },
+      ]),
+    );
+  } catch {
+    return new Map();
+  }
+}

src/backend/plugins/loader.ts

@@ -28,11 +28,7 @@ import {
   getPluginsDir,
   getUnpackedPluginsDir,
 } from "./paths.js";
-import {
-  requireSignedPlugins,
-  verifyAnyTrusted,
-  type KeyTier,
-} from "./trust.js";
+import { requireSignedPlugins, verifyPluginArtifact } from "./trust.js";
 import { moveWithRetry } from "./fs-retry.js";
 import {
   createPluginContext,
@@ -44,7 +40,6 @@ import {
 import { resolveRequirements } from "./service-registry.js";
 import { resolveSecretRequirements } from "./secret-registry.js";
 import { recordConflict } from "./conflicts.js";
-import { installHostModuleFallback } from "./host-modules.js";
 import { tablePrefix } from "@termix-ssh/plugin-sdk/db";
 
 export type PluginState =
@@ -81,8 +76,6 @@ export interface LoadedPlugin {
   artifact?: string;
   /** Key id that signed the artifact, when a trusted key signed it. */
   signedBy?: string;
-  /** Which set of keys that key belongs to. */
-  signedTier?: KeyTier;
 }
 
 export interface PluginLoaderOptions {
@@ -258,7 +251,6 @@ export class PluginLoader {
   async loadAll(): Promise<LoadedPlugin[]> {
     this.plugins.clear();
     this.bundledVersions.clear();
-    await removeStaleStaging();
     const loaded: LoadedPlugin[] = [];
     // Every bundled folder name, loaded or not: a bundled plugin that fails
     // to load must not leave its id free for a user plugin to take.
@@ -351,11 +343,10 @@ export class PluginLoader {
     const buffer = await fs.promises.readFile(file);
     const sigFile = `${file}.sig`;
     let signedBy: string | undefined;
-    let signedTier: KeyTier | undefined;
 
     if (fs.existsSync(sigFile)) {
       const sha256 = crypto.createHash("sha256").update(buffer).digest("hex");
-      const result = verifyAnyTrusted(
+      const result = verifyPluginArtifact(
         buffer,
         sha256,
         await fs.promises.readFile(sigFile, "utf8"),
@@ -364,20 +355,12 @@ export class PluginLoader {
         throw new Error(`signature check failed: ${result.reason}`);
       }
       signedBy = result.keyId;
-      signedTier = result.tier;
     } else if (requireSignedPlugins()) {
       throw new Error(
         `TERMIX_REQUIRE_SIGNED_PLUGINS is on and ${path.basename(file)} has no .sig next to it`,
       );
     }
 
-    const unsafe = await unsafeArchivePath(file);
-    if (unsafe) {
-      throw new Error(
-        `${path.basename(file)} has a file outside the plugin folder: ${unsafe}`,
-      );
-    }
-
     const unpackedRoot = getUnpackedPluginsDir();
     const staging = path.join(
       unpackedRoot,
@@ -410,7 +393,7 @@ export class PluginLoader {
         assertBundledUpdate(
           id,
           raw?.version,
-          signedTier === "official" ? signedBy : undefined,
+          signedBy,
           this.bundledVersions.get(id) ?? replaced?.manifest.version,
           this.pinned.get(id),
         );
@@ -435,7 +418,6 @@ export class PluginLoader {
         const plugin = await this.load(target, isUpdate ? "bundled" : "user");
         plugin.artifact = file;
         plugin.signedBy = signedBy;
-        plugin.signedTier = signedTier;
         if (replaced) {
           pluginLogger.info(
             `Plugin ${id} updated from ${replaced.manifest.version} to ${plugin.manifest.version}`,
@@ -448,15 +430,7 @@ export class PluginLoader {
         throw error;
       }
     } finally {
-      // Never let a failed cleanup hide the error that got us here.
-      await fs.promises
-        .rm(staging, { recursive: true, force: true, maxRetries: 5 })
-        .catch((error) =>
-          pluginLogger.warn(`Could not remove ${staging}`, {
-            operation: "plugin_load",
-            error: error instanceof Error ? error.message : String(error),
-          }),
-        );
+      await fs.promises.rm(staging, { recursive: true, force: true });
     }
   }
 
@@ -577,7 +551,6 @@ export class PluginLoader {
     )}`;
 
     try {
-      installHostModuleFallback();
       const imported = (await import(entry)) as {
         activate?: PluginModule["activate"];
         deactivate?: PluginModule["deactivate"];
@@ -626,8 +599,7 @@ export class PluginLoader {
       // A release signed by a trusted key is official whether it shipped in
       // the image or was downloaded, so it may adopt its 2.8 tables too.
       const applied = await migratePlugin(plugin.id, plugin.dir, {
-        bundled:
-          plugin.source === "bundled" || plugin.signedTier === "official",
+        bundled: plugin.source === "bundled" || Boolean(plugin.signedBy),
       });
       // A new table may be where core data is waiting to move.
       if (applied.length > 0) {
@@ -859,7 +831,7 @@ export function assertBundledUpdate(
 ): void {
   if (!signedBy) {
     throw new Error(
-      `a bundled plugin already uses the id "${id}"; only an official signed update can replace it`,
+      `a bundled plugin already uses the id "${id}"; only a signed update can replace it`,
     );
   }
   if (typeof version !== "string" || !semver.valid(version)) {
@@ -912,44 +884,3 @@ export function isRealPathInside(root: string, target: string): boolean {
     return false;
   }
 }
-
-/**
- * The first entry that would land outside the folder it is unpacked into,
- * or null. tar skips these on its own, but its stream keeps writing after
- * it rejects, so they are refused before anything is unpacked.
- */
-export async function unsafeArchivePath(file: string): Promise<string | null> {
-  let unsafe: string | null = null;
-  await tar.t({
-    file,
-    onReadEntry: (entry) => {
-      const name = entry.path.replace(/\\/g, "/");
-      if (
-        !unsafe &&
-        (name.startsWith("/") ||
-          /^[a-zA-Z]:/.test(name) ||
-          name.split("/").includes(".."))
-      ) {
-        unsafe = entry.path;
-      }
-    },
-  });
-  return unsafe;
-}
-
-/** Clears unpack folders an install left behind when the process died. */
-export async function removeStaleStaging(): Promise<void> {
-  const root = getUnpackedPluginsDir();
-  let entries: fs.Dirent[];
-  try {
-    entries = await fs.promises.readdir(root, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory() || !entry.name.startsWith(".staging-")) continue;
-    await fs.promises
-      .rm(path.join(root, entry.name), { recursive: true, force: true })
-      .catch(() => {});
-  }
-}

src/backend/plugins/manage.ts

@@ -1,9 +1,8 @@
 /**
  * Installing, updating, uninstalling and switching plugins at runtime.
  *
- * Plugins come from the official registry, plus the community and custom
- * registries an admin turned on (see registries.ts). With developer mode on,
- * an admin can also install a .tmxplug from a file; that skips the download,
+ * The official registry is the one real source. With developer mode on, an
+ * admin can also install a .tmxplug from a file; that skips the download,
  * sha256 and signature checks and stays marked unverified. Bundled plugins ship in the
  * image and can still be uninstalled: their files are deleted and the id is
  * recorded in the settings table, so the shipped copy is ignored from then
@@ -39,27 +38,14 @@ import {
   getRegistryStatus,
   isApiCompatible,
   latestOnChannel,
-  officialSource,
   parsePluginChannel,
   type PluginChannel,
   type RegistryIndex,
-  type RegistryPlugin,
-  type RegistrySource,
-  type RegistryTier,
   type RegistryVersion,
 } from "./registry-index.js";
-import {
-  findSource,
-  listSources,
-  loadCustomRegistryKeys,
-  pinnedKeyOf,
-} from "./registries.js";
 import { invalidatePluginPermissionCache } from "./permissions.js";
 import { moveWithRetry } from "./fs-retry.js";
-import {
-  readDownloadCounts,
-  refreshDownloadCounts,
-} from "./download-counts.js";
+import { readInstallCounts } from "./install-counts.js";
 import { readArtifactManifest, sameCapabilities } from "./artifact-manifest.js";
 import {
   parseManifest,
@@ -141,7 +127,6 @@ async function readPins(): Promise<Map<string, string>> {
 export async function applyStoredPluginChoices(
   loader: PluginLoader,
 ): Promise<void> {
-  await loadCustomRegistryKeys();
   try {
     loader.setUninstalled(await readUninstalled());
     loader.setPinned(await readPins());
@@ -223,28 +208,12 @@ function addedCapabilities(
   return next.filter((capability) => !have.has(capability));
 }
 
-export interface RegistryListingSource {
-  id: string;
-  name: string;
-  tier: RegistryTier;
-  url: string;
-  lastCheckedAt: string | null;
-  error: string | null;
-  plugins: number;
-}
-
 export interface RegistryListing {
-  /** The official registry, kept for older clients. */
   registry: ReturnType<typeof getRegistryStatus> & { id: string };
-  /** Every registry read for this listing, official first. */
-  registries: RegistryListingSource[];
   /** A linked desktop runs what its server runs, so nothing here can change. */
   managedByServer: boolean;
   plugins: Array<{
     id: string;
-    registryId: string;
-    registryName: string;
-    tier: RegistryTier;
     name: string;
     description: string;
     author: string;
@@ -276,118 +245,28 @@ export interface RegistryListing {
     pinnedVersion: string | null;
     autoUpdate: boolean;
     bundled: boolean;
-    /** See download-counts.ts for what this number does and does not mean. */
-    downloads: number | null;
+    /** See install-counts.ts for what this number does and does not mean. */
+    installCount: number | null;
+    installCountSource: string | null;
   }>;
 }
 
-/** A custom registry whose index now names another key than the pinned one. */
-async function keyChanged(
-  source: RegistrySource,
-  index: RegistryIndex,
-): Promise<boolean> {
-  if (source.tier !== "custom" || !index.publicKey) return false;
-  return index.publicKey !== (await pinnedKeyOf(source.id));
-}
-
-const KEY_CHANGED_MESSAGE =
-  "the registry now names a different signing key; add it again to trust the new key";
-
-/**
- * Ids only the official registry may offer: what ships in the image and what
- * the official index lists. Other registries can never take them over.
- */
-function reservedIds(official: RegistryIndex | null): Set<string> {
-  const ids = new Set(getPluginRuntime().loader.bundledIds());
-  for (const plugin of official?.plugins ?? []) ids.add(plugin.id);
-  return ids;
-}
-
 export async function listRegistry(
   options: { force?: boolean } = {},
 ): Promise<RegistryListing> {
-  const sources = await listSources();
-  const results = await Promise.allSettled(
-    sources.map((source) => fetchRegistryIndex(source, options)),
-  );
-  const official = results[0];
-  if (official.status === "rejected") throw official.reason;
-
+  const index = await fetchRegistryIndex(options);
   const { createCurrentPluginRepository } = await repos();
   const records = new Map(
     (await createCurrentPluginRepository().listAll()).map((r) => [r.id, r]),
   );
-  await refreshDownloadCounts(options.force);
-  const counts = new Map(
-    await Promise.all(
-      sources
-        .filter((source) => source.tier !== "custom")
-        .map(
-          async (source) =>
-            [source.id, await readDownloadCounts(source.id)] as const,
-        ),
-    ),
-  );
+  const counts = await readInstallCounts();
   const { loader } = getPluginRuntime();
   const shipped = loader.bundledIds();
-  const reserved = reservedIds(official.value);
-
-  const registries: RegistryListingSource[] = [];
-  // Per id, every registry that lists it, in source order.
-  const offers = new Map<
-    string,
-    Array<{ source: RegistrySource; plugin: RegistryPlugin }>
-  >();
-  for (let i = 0; i < sources.length; i++) {
-    const source = sources[i];
-    const result = results[i];
-    const status = getRegistryStatus(source);
-    let error = status.error;
-    let listed = 0;
-    if (result.status === "fulfilled") {
-      if (await keyChanged(source, result.value)) {
-        error = KEY_CHANGED_MESSAGE;
-      } else {
-        for (const plugin of result.value.plugins) {
-          if (source.tier !== "official" && reserved.has(plugin.id)) continue;
-          const list = offers.get(plugin.id) ?? [];
-          list.push({ source, plugin });
-          offers.set(plugin.id, list);
-          listed++;
-        }
-      }
-    } else {
-      error =
-        result.reason instanceof Error
-          ? result.reason.message
-          : String(result.reason);
-    }
-    registries.push({
-      id: source.id,
-      name:
-        result.status === "fulfilled" && result.value.name
-          ? result.value.name
-          : source.name,
-      tier: source.tier,
-      url: source.url,
-      lastCheckedAt: status.lastCheckedAt,
-      error,
-      plugins: listed,
-    });
-  }
-
-  const chosen: Array<{ source: RegistrySource; plugin: RegistryPlugin }> = [];
-  for (const [id, list] of offers) {
-    // An installed plugin is always shown from the registry it came from.
-    const from = records.get(id)?.registryId;
-    chosen.push(list.find((offer) => offer.source.id === from) ?? list[0]);
-  }
 
   return {
     registry: { id: OFFICIAL_REGISTRY_ID, ...getRegistryStatus() },
-    registries,
     managedByServer: await isLinkedDesktop(),
-    plugins: chosen.map(({ source, plugin }) => {
+    plugins: index.plugins.map((plugin) => {
       const record = records.get(plugin.id);
       const live = loader.get(plugin.id);
       const channel = channelOf(record);
@@ -404,9 +283,6 @@ export async function listRegistry(
       );
       return {
         id: plugin.id,
-        registryId: source.id,
-        registryName: registries.find((entry) => entry.id === source.id)!.name,
-        tier: source.tier,
         name: plugin.name,
         description: plugin.description,
         author: plugin.author,
@@ -442,7 +318,8 @@ export async function listRegistry(
         pinnedVersion: record?.pinnedVersion ?? null,
         autoUpdate: Boolean(record?.autoUpdate),
         bundled: shipped.has(plugin.id),
-        downloads: counts.get(source.id)?.get(plugin.id) ?? null,
+        installCount: counts.get(plugin.id)?.count ?? null,
+        installCountSource: counts.get(plugin.id)?.source ?? null,
       };
     }),
   };
@@ -485,8 +362,7 @@ async function grantDeclared(
   invalidatePluginPermissionCache(plugin.id);
 }
 
-type SwapSource =
-  { release: RegistryVersion; source: RegistrySource } | { upload: string };
+type SwapSource = { release: RegistryVersion } | { upload: string };
 
 /**
  * Puts a registry release, or an uploaded file, in place of whatever copy of
@@ -501,7 +377,6 @@ async function swapIn(
   const bundledVersion = loader.bundledVersion(pluginId);
   const useBundled =
     "release" in source &&
-    source.source.tier === "official" &&
     bundledVersion !== undefined &&
     bundledVersion === source.release.version &&
     isBundledOnDisk(pluginId);
@@ -510,7 +385,7 @@ async function swapIn(
   const staged = useBundled
     ? null
     : "release" in source
-      ? await downloadRelease(pluginId, source.release, source.source.keys)
+      ? await downloadRelease(pluginId, source.release)
       : { file: source.upload, signatureFile: `${source.upload}.sig` };
 
   const finalFile = path.join(getPluginsDir(), `${pluginId}.tmxplug`);
@@ -676,19 +551,6 @@ function dependentChain(pluginId: string, enabled: Set<string>): string[] {
   return result;
 }
 
-/** Marks a plugin that was turned off only because a dependency was. */
-const STOPPED_WITH = "stopped with ";
-
-async function stoppedWith(pluginId: string): Promise<string[]> {
-  const { createCurrentPluginRepository } = await repos();
-  const marker = STOPPED_WITH + pluginId;
-  return (await createCurrentPluginRepository().listAll())
-    .filter(
-      (record) => record.state === "disabled" && record.lastError === marker,
-    )
-    .map((record) => record.id);
-}
-
 export interface StateChangePlan {
   enable: string[];
   disable: string[];
@@ -752,26 +614,13 @@ export async function setPluginStateUnlocked(
         return { ...plan, state: "blocked" };
       }
     }
-    const state = await startAndRecord(pluginId);
-    if (state === "active") {
-      // Bring back what turning this plugin off also turned off.
-      for (const id of await stoppedWith(pluginId)) {
-        const restore = await planStateChange(id, true);
-        if (restore.missing.length > 0) continue;
-        for (const dependency of restore.enable)
-          await startAndRecord(dependency);
-        await startAndRecord(id);
-      }
-    }
-    return { ...plan, state };
+    return { ...plan, state: await startAndRecord(pluginId) };
   }
 
-  for (const id of plan.disable) {
-    await recordState(id, "disabled", STOPPED_WITH + pluginId);
+  for (const id of [...plan.disable, pluginId]) {
+    await recordState(id, "disabled", null);
     await deactivatePlugin(id);
   }
-  await recordState(pluginId, "disabled", null);
-  await deactivatePlugin(pluginId);
   return { ...plan, state: "stopped" };
 }
 
@@ -779,8 +628,6 @@ export interface InstallOptions {
   version?: string;
   /** Install only: the channel to follow from the start. */
   channel?: PluginChannel;
-  /** Install only: the registry to install from. Official when unset. */
-  registryId?: string;
   userId: string | null;
   acceptCapabilities?: boolean;
   /**
@@ -811,68 +658,33 @@ function assertConsent(
   }
 }
 
-function unreachable(error: unknown): PluginManageError {
-  return new PluginManageError(
-    `Could not reach the plugin registry: ${
-      error instanceof Error ? error.message : String(error)
-    }`,
-    502,
-    "REGISTRY_UNREACHABLE",
-  );
-}
-
 async function requireRelease(
   pluginId: string,
   version: string | undefined,
   channel: PluginChannel,
-  registryId: string = OFFICIAL_REGISTRY_ID,
 ): Promise<{
-  source: RegistrySource;
+  index: RegistryIndex;
   release: RegistryVersion;
   latest: RegistryVersion | null;
 }> {
-  const source = await findSource(registryId);
-  if (!source) {
-    throw new PluginManageError(
-      `The registry "${registryId}" is turned off or was removed`,
-      409,
-      "REGISTRY_OFF",
-    );
-  }
   let index: RegistryIndex;
   try {
-    index = await fetchRegistryIndex(source);
+    index = await fetchRegistryIndex();
   } catch (error) {
-    throw unreachable(error);
-  }
-  if (await keyChanged(source, index)) {
     throw new PluginManageError(
-      `${source.name}: ${KEY_CHANGED_MESSAGE}`,
-      409,
-      "KEY_CHANGED",
+      `Could not reach the plugin registry: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+      502,
+      "REGISTRY_UNREACHABLE",
     );
   }
-  if (source.tier !== "official") {
-    let official: RegistryIndex;
-    try {
-      official = await fetchRegistryIndex(officialSource());
-    } catch (error) {
-      throw unreachable(error);
-    }
-    if (reservedIds(official).has(pluginId)) {
-      throw new PluginManageError(
-        `${pluginId} is an official plugin and can only come from the official registry`,
-        409,
-        "RESERVED_ID",
-      );
-    }
-  }
   const found = findRelease(index, pluginId, version, channel);
   if (!found) {
     throw new PluginManageError(
       version
-        ? `${pluginId} ${version} is not in ${source.name}`
-        : `${pluginId} is not in ${source.name}`,
+        ? `${pluginId} ${version} is not in the official registry`
+        : `${pluginId} is not in the official registry`,
       404,
       "NOT_IN_REGISTRY",
     );
@@ -885,20 +697,12 @@ async function requireRelease(
     );
   }
   return {
-    source,
+    index,
     release: found.release,
     latest: latestOnChannel(found.plugin, channel),
   };
 }
 
-/** What a registry install is recorded as. */
-function tierFor(plugin: LoadedPlugin, source: RegistrySource): string {
-  if (source.tier === "official" && plugin.source === "bundled") {
-    return "bundled";
-  }
-  return source.tier;
-}
-
 /** The version to hold at: an explicit pick that is not the newest. */
 function pinFor(
   release: RegistryVersion,
@@ -933,11 +737,10 @@ export function installPlugin(
     }
 
     const channel = options.channel ?? "stable";
-    const { source, release, latest } = await requireRelease(
+    const { release, latest } = await requireRelease(
       pluginId,
       options.version,
       channel,
-      options.registryId,
     );
     assertConsent(options.capabilities, release.capabilities);
     const pin = pinFor(release, latest, options.version);
@@ -945,7 +748,7 @@ export function installPlugin(
 
     let plugin: LoadedPlugin;
     try {
-      plugin = await swapIn(pluginId, { release, source });
+      plugin = await swapIn(pluginId, { release });
     } catch (error) {
       await applyPin(pluginId, null);
       throw new PluginManageError(
@@ -956,8 +759,8 @@ export function installPlugin(
     }
 
     await repository.update(pluginId, {
-      registryId: source.id,
-      tier: tierFor(plugin, source),
+      registryId: OFFICIAL_REGISTRY_ID,
+      tier: plugin.source === "bundled" ? "bundled" : "official",
       pinnedVersion: pin,
       channel,
     });
@@ -1003,11 +806,10 @@ async function updateUnlocked(
     throw new PluginManageError("Plugin not found", 404, "NOT_FOUND");
   }
 
-  const { source, release, latest } = await requireRelease(
+  const { release, latest } = await requireRelease(
     pluginId,
     options.version,
     channelOf(record),
-    record.registryId ?? OFFICIAL_REGISTRY_ID,
   );
   if (release.version === live.manifest.version) {
     throw new PluginManageError(
@@ -1039,7 +841,7 @@ async function updateUnlocked(
 
   let plugin: LoadedPlugin;
   try {
-    plugin = await swapIn(pluginId, { release, source });
+    plugin = await swapIn(pluginId, { release });
   } catch (error) {
     await applyPin(pluginId, record.pinnedVersion ?? null);
     if (wasEnabled && loader.get(pluginId)) await startAndRecord(pluginId);
@@ -1051,8 +853,8 @@ async function updateUnlocked(
   }
 
   await repository.update(pluginId, {
-    registryId: source.id,
-    tier: tierFor(plugin, source),
+    registryId: OFFICIAL_REGISTRY_ID,
+    tier: plugin.source === "bundled" ? "bundled" : "official",
     pinnedVersion: pin,
   });
   await grantDeclared(plugin, options.userId);

src/backend/plugins/registries.ts

@@ -1,414 +0,0 @@
-/**
- * Which registries this server reads plugins from.
- *
- * Official is always on. Community is off until an admin turns it on. Custom
- * registries are added by URL: their index names the key they sign with, the
- * admin confirms its fingerprint, and that key is pinned. A later key change
- * in the index is never followed, the admin has to add the registry again.
- *
- * Stored as one JSON value in the settings table.
- */
-
-import { pluginLogger } from "../utils/logger.js";
-import {
-  OFFICIAL_REGISTRY_ID,
-  COMMUNITY_REGISTRY_ID,
-  communitySource,
-  fetchIndexAt,
-  officialSource,
-  type RegistrySource,
-} from "./registry-index.js";
-import {
-  isPluginPublicKey,
-  pluginKeyId,
-  setCustomPluginKeys,
-  type TrustedPluginKey,
-} from "./trust.js";
-
-const CONFIG_KEY = "plugin_registries";
-/** Keys a linked desktop copied from its server, so mirrored plugins load. */
-const SYNCED_KEYS_KEY = "plugin_registry_synced_keys";
-const ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
-const MAX_ID_LENGTH = 40;
-const MAX_NAME_LENGTH = 80;
-const MAX_CUSTOM = 20;
-
-export interface CustomRegistry {
-  id: string;
-  name: string;
-  url: string;
-  publicKey: string;
-  keyId: string;
-  enabled: boolean;
-  addedAt: string;
-}
-
-export interface RegistriesConfig {
-  community: { enabled: boolean };
-  custom: CustomRegistry[];
-}
-
-export class RegistryError extends Error {
-  constructor(
-    message: string,
-    readonly status: number,
-    readonly code: string,
-    readonly details?: Record<string, unknown>,
-  ) {
-    super(message);
-  }
-}
-
-async function settings() {
-  const { createCurrentSettingsRepository } =
-    await import("../database/repositories/factory.js");
-  return createCurrentSettingsRepository();
-}
-
-function parseCustom(raw: unknown): CustomRegistry | null {
-  if (!raw || typeof raw !== "object") return null;
-  const entry = raw as Record<string, unknown>;
-  if (
-    typeof entry.id !== "string" ||
-    !ID_PATTERN.test(entry.id) ||
-    typeof entry.url !== "string" ||
-    !isPluginPublicKey(entry.publicKey)
-  ) {
-    return null;
-  }
-  return {
-    id: entry.id,
-    name: typeof entry.name === "string" ? entry.name : entry.id,
-    url: entry.url,
-    publicKey: entry.publicKey,
-    keyId: pluginKeyId(entry.publicKey),
-    enabled: entry.enabled !== false,
-    addedAt: typeof entry.addedAt === "string" ? entry.addedAt : "",
-  };
-}
-
-export function parseRegistriesConfig(raw: string | null): RegistriesConfig {
-  const config: RegistriesConfig = {
-    community: { enabled: false },
-    custom: [],
-  };
-  if (!raw) return config;
-  try {
-    const parsed = JSON.parse(raw) as Record<string, unknown>;
-    const community = parsed?.community as Record<string, unknown> | undefined;
-    config.community.enabled = community?.enabled === true;
-    if (Array.isArray(parsed?.custom)) {
-      config.custom = parsed.custom
-        .map(parseCustom)
-        .filter((entry): entry is CustomRegistry => entry !== null);
-    }
-  } catch {
-    // A broken value falls back to official only.
-  }
-  return config;
-}
-
-export async function readRegistriesConfig(): Promise<RegistriesConfig> {
-  return parseRegistriesConfig(await (await settings()).get(CONFIG_KEY));
-}
-
-async function writeRegistriesConfig(config: RegistriesConfig): Promise<void> {
-  await (await settings()).set(CONFIG_KEY, JSON.stringify(config));
-  await applyCustomKeys(config);
-}
-
-function toKey(publicKey: string): TrustedPluginKey {
-  return { id: pluginKeyId(publicKey), publicKey, addedIn: "admin" };
-}
-
-async function readSyncedKeys(): Promise<string[]> {
-  const raw = await (await settings()).get(SYNCED_KEYS_KEY);
-  if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed.filter(isPluginPublicKey) : [];
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Trusts the key of every custom registry, on or off: a plugin installed
- * from a registry that was later turned off still has to load.
- */
-async function applyCustomKeys(config: RegistriesConfig): Promise<void> {
-  const keys = new Map<string, TrustedPluginKey>();
-  for (const entry of config.custom) {
-    keys.set(entry.keyId, toKey(entry.publicKey));
-  }
-  for (const publicKey of await readSyncedKeys()) {
-    keys.set(pluginKeyId(publicKey), toKey(publicKey));
-  }
-  setCustomPluginKeys([...keys.values()]);
-}
-
-/** Called before the boot scan so plugins from custom registries load. */
-export async function loadCustomRegistryKeys(): Promise<void> {
-  try {
-    await applyCustomKeys(await readRegistriesConfig());
-  } catch (error) {
-    pluginLogger.warn(
-      `Could not read plugin registries: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-      { operation: "plugin_init" },
-    );
-  }
-}
-
-/** A linked desktop trusts the keys of its server's custom registries. */
-export async function setSyncedRegistryKeys(
-  publicKeys: readonly unknown[],
-): Promise<void> {
-  const valid = [...new Set(publicKeys.filter(isPluginPublicKey))].sort();
-  const current = (await readSyncedKeys()).sort();
-  if (valid.join() !== current.join()) {
-    await (await settings()).set(SYNCED_KEYS_KEY, JSON.stringify(valid));
-  }
-  await applyCustomKeys(await readRegistriesConfig());
-}
-
-export function customSource(entry: CustomRegistry): RegistrySource {
-  return {
-    id: entry.id,
-    name: entry.name,
-    url: entry.url,
-    tier: "custom",
-    keys: [toKey(entry.publicKey)],
-  };
-}
-
-/** Every registry plugins can come from right now, official first. */
-export async function listSources(): Promise<RegistrySource[]> {
-  const config = await readRegistriesConfig();
-  const sources = [officialSource()];
-  if (config.community.enabled) sources.push(communitySource());
-  for (const entry of config.custom) {
-    if (entry.enabled) sources.push(customSource(entry));
-  }
-  return sources;
-}
-
-export async function findSource(id: string): Promise<RegistrySource | null> {
-  return (await listSources()).find((source) => source.id === id) ?? null;
-}
-
-/** The pinned key of a custom registry, for spotting a changed index key. */
-export async function pinnedKeyOf(id: string): Promise<string | null> {
-  const config = await readRegistriesConfig();
-  return config.custom.find((entry) => entry.id === id)?.publicKey ?? null;
-}
-
-export interface RegistryPreview {
-  id: string;
-  name: string;
-  url: string;
-  keyId: string;
-  plugins: number;
-}
-
-function normalizeUrl(input: unknown): string {
-  if (typeof input !== "string" || !input.trim()) {
-    throw new RegistryError("Enter the index URL", 400, "INVALID_URL");
-  }
-  let url: URL;
-  try {
-    url = new URL(input.trim());
-  } catch {
-    throw new RegistryError("That is not a valid URL", 400, "INVALID_URL");
-  }
-  if (url.protocol !== "https:") {
-    throw new RegistryError("The index must use https", 400, "INVALID_URL");
-  }
-  url.hash = "";
-  return url.toString();
-}
-
-function baseId(raw: string): string {
-  const cleaned = raw
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, MAX_ID_LENGTH);
-  return ID_PATTERN.test(cleaned) ? cleaned : "custom";
-}
-
-function uniqueId(raw: string, config: RegistriesConfig): string {
-  const taken = new Set<string>([
-    OFFICIAL_REGISTRY_ID,
-    COMMUNITY_REGISTRY_ID,
-    ...config.custom.map((entry) => entry.id),
-  ]);
-  const base = baseId(raw);
-  if (!taken.has(base)) return base;
-  for (let n = 2; ; n++) {
-    const candidate = `${base}-${n}`;
-    if (!taken.has(candidate)) return candidate;
-  }
-}
-
-async function inspect(
-  input: unknown,
-  config: RegistriesConfig,
-): Promise<RegistryPreview & { publicKey: string }> {
-  const url = normalizeUrl(input);
-  if (
-    url === officialSource().url ||
-    url === communitySource().url ||
-    config.custom.some((entry) => entry.url === url)
-  ) {
-    throw new RegistryError(
-      "This registry is already added",
-      409,
-      "ALREADY_ADDED",
-    );
-  }
-  let index;
-  try {
-    index = await fetchIndexAt(url);
-  } catch (error) {
-    throw new RegistryError(
-      `Could not read the registry: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-      502,
-      "REGISTRY_UNREACHABLE",
-    );
-  }
-  if (!index.publicKey) {
-    throw new RegistryError(
-      "The index has no publicKey, so its plugins cannot be checked",
-      400,
-      "NO_PUBLIC_KEY",
-    );
-  }
-  return {
-    id: uniqueId(index.registry || "custom", config),
-    name: (index.name || index.registry || url).slice(0, MAX_NAME_LENGTH),
-    url,
-    keyId: pluginKeyId(index.publicKey),
-    publicKey: index.publicKey,
-    plugins: index.plugins.length,
-  };
-}
-
-/** Reads an index so the admin can check its name and key before adding. */
-export async function previewRegistry(url: unknown): Promise<RegistryPreview> {
-  const { publicKey: _publicKey, ...preview } = await inspect(
-    url,
-    await readRegistriesConfig(),
-  );
-  return preview;
-}
-
-/**
- * Adds a custom registry. `keyId` is the fingerprint the admin saw in the
- * preview; the index is read again and must still name that key.
- */
-export async function addRegistry(
-  url: unknown,
-  keyId: unknown,
-): Promise<CustomRegistry> {
-  const config = await readRegistriesConfig();
-  if (config.custom.length >= MAX_CUSTOM) {
-    throw new RegistryError(
-      `At most ${MAX_CUSTOM} custom registries can be added`,
-      400,
-      "TOO_MANY",
-    );
-  }
-  const preview = await inspect(url, config);
-  if (typeof keyId !== "string" || keyId !== preview.keyId) {
-    throw new RegistryError(
-      "The registry key changed since the preview. Check it again",
-      409,
-      "KEY_MISMATCH",
-      { keyId: preview.keyId },
-    );
-  }
-  const entry: CustomRegistry = {
-    id: preview.id,
-    name: preview.name,
-    url: preview.url,
-    publicKey: preview.publicKey,
-    keyId: preview.keyId,
-    enabled: true,
-    addedAt: new Date().toISOString(),
-  };
-  config.custom.push(entry);
-  await writeRegistriesConfig(config);
-  pluginLogger.info(`Added plugin registry ${entry.id} (${entry.url})`, {
-    operation: "plugin_registry",
-  });
-  return entry;
-}
-
-export async function setRegistryEnabled(
-  id: string,
-  enabled: boolean,
-): Promise<void> {
-  const config = await readRegistriesConfig();
-  if (id === OFFICIAL_REGISTRY_ID) {
-    throw new RegistryError(
-      "The official registry is always on",
-      400,
-      "OFFICIAL",
-    );
-  }
-  if (id === COMMUNITY_REGISTRY_ID) {
-    config.community.enabled = enabled;
-  } else {
-    const entry = config.custom.find((candidate) => candidate.id === id);
-    if (!entry) {
-      throw new RegistryError("Registry not found", 404, "NOT_FOUND");
-    }
-    entry.enabled = enabled;
-  }
-  await writeRegistriesConfig(config);
-}
-
-/**
- * Removes a custom registry. Refused while plugins from it are installed:
- * its key has to stay trusted for them to load.
- */
-export async function removeRegistry(id: string): Promise<void> {
-  if (id === OFFICIAL_REGISTRY_ID || id === COMMUNITY_REGISTRY_ID) {
-    throw new RegistryError(
-      "Built in registries can only be turned off",
-      400,
-      "BUILT_IN",
-    );
-  }
-  const config = await readRegistriesConfig();
-  if (!config.custom.some((candidate) => candidate.id === id)) {
-    throw new RegistryError("Registry not found", 404, "NOT_FOUND");
-  }
-  const { createCurrentPluginRepository } =
-    await import("../database/repositories/factory.js");
-  const using = (await createCurrentPluginRepository().listAll())
-    .filter((record) => record.registryId === id)
-    .map((record) => record.id);
-  if (using.length > 0) {
-    throw new RegistryError(
-      "Uninstall the plugins from this registry first",
-      409,
-      "REGISTRY_IN_USE",
-      { plugins: using },
-    );
-  }
-  config.custom = config.custom.filter((candidate) => candidate.id !== id);
-  await writeRegistriesConfig(config);
-  pluginLogger.info(`Removed plugin registry ${id}`, {
-    operation: "plugin_registry",
-  });
-}
-
-/** Public keys of the custom registries, for a linked desktop. */
-export async function customRegistryKeys(): Promise<string[]> {
-  return (await readRegistriesConfig()).custom.map((entry) => entry.publicKey);
-}

src/backend/plugins/registry-index.ts

@@ -1,13 +1,11 @@
 /**
- * Plugin registries: fetching an index and downloading a release.
+ * The official plugin registry: fetching its index and downloading a release.
  *
- * An index is a plain JSON file. Official and community live in
- * Termix-SSH/Termix-Registry, custom ones anywhere an admin points to.
- * Nothing in an index is trusted on its own: every download is checked
- * against the sha256 and Ed25519 signature listed for it, and the signature
- * must come from that registry's keys (built in for official and community,
- * pinned when an admin added a custom one). A tampered index can at most
- * point at a file that then fails the check.
+ * The index is a plain JSON file in Termix-SSH/Termix-Registry. Nothing in it
+ * is trusted on its own: every download is checked against the sha256 and
+ * Ed25519 signature listed for it, and the signature must come from a key
+ * pinned in trust.ts. A tampered index can at most point at a file that then
+ * fails the check.
  */
 
 import crypto from "node:crypto";
@@ -22,33 +20,13 @@ import {
 } from "@termix-ssh/plugin-sdk/manifest";
 import { safeOutboundFetch } from "../utils/safe-outbound-fetch.js";
 import { pluginLogger } from "../utils/logger.js";
-import {
-  COMMUNITY_PLUGIN_KEYS,
-  TRUSTED_PLUGIN_KEYS,
-  isPluginPublicKey,
-  verifyPluginArtifact,
-  type TrustedPluginKey,
-} from "./trust.js";
+import { verifyPluginArtifact } from "./trust.js";
 import { readArtifactManifest, sameCapabilities } from "./artifact-manifest.js";
 import { getPluginsDir } from "./paths.js";
 
 export const OFFICIAL_REGISTRY_ID = "official";
 export const OFFICIAL_REGISTRY_URL =
   "https://raw.githubusercontent.com/Termix-SSH/Termix-Registry/main/official/index.json";
-export const COMMUNITY_REGISTRY_ID = "community";
-export const COMMUNITY_REGISTRY_URL =
-  "https://raw.githubusercontent.com/Termix-SSH/Termix-Registry/main/community/index.json";
-
-export type RegistryTier = "official" | "community" | "custom";
-
-/** Where an index lives and which keys may sign what it lists. */
-export interface RegistrySource {
-  id: string;
-  name: string;
-  url: string;
-  tier: RegistryTier;
-  keys: readonly TrustedPluginKey[];
-}
 
 const CACHE_MS = 15 * 60_000;
 const MAX_INDEX_BYTES = 5 * 1024 * 1024;
@@ -105,8 +83,6 @@ export interface RegistryIndex {
   registry: string;
   name: string;
   updatedAt?: string;
-  /** The key the registry signs with, base64. Only read when adding one. */
-  publicKey?: string;
   plugins: RegistryPlugin[];
 }
 
@@ -114,26 +90,6 @@ export function getRegistryUrl(): string {
   return process.env.TERMIX_PLUGIN_REGISTRY_URL || OFFICIAL_REGISTRY_URL;
 }
 
-export function officialSource(): RegistrySource {
-  return {
-    id: OFFICIAL_REGISTRY_ID,
-    name: "Termix Official Plugins",
-    url: getRegistryUrl(),
-    tier: "official",
-    keys: TRUSTED_PLUGIN_KEYS,
-  };
-}
-
-export function communitySource(): RegistrySource {
-  return {
-    id: COMMUNITY_REGISTRY_ID,
-    name: "Termix Community Plugins",
-    url: process.env.TERMIX_COMMUNITY_REGISTRY_URL || COMMUNITY_REGISTRY_URL,
-    tier: "community",
-    keys: COMMUNITY_PLUGIN_KEYS,
-  };
-}
-
 function asString(value: unknown): string | undefined {
   return typeof value === "string" ? value : undefined;
 }
@@ -218,7 +174,6 @@ export function parseRegistryIndex(raw: unknown): RegistryIndex {
     registry: asString(index.registry) ?? OFFICIAL_REGISTRY_ID,
     name: asString(index.name) ?? "",
     updatedAt: asString(index.updatedAt),
-    publicKey: isPluginPublicKey(index.publicKey) ? index.publicKey : undefined,
     plugins,
   };
 }
@@ -273,18 +228,8 @@ async function readLimited(response: Response, limit: number): Promise<Buffer> {
   return Buffer.concat(chunks);
 }
 
-interface CacheEntry {
-  index: RegistryIndex;
-  at: number;
-}
-
-const caches = new Map<string, CacheEntry>();
-const inflight = new Map<string, Promise<RegistryIndex>>();
-const lastErrors = new Map<string, string>();
-
-function cacheKey(source: RegistrySource): string {
-  return `${source.id} ${source.url}`;
-}
+let cache: { index: RegistryIndex; at: number; hash: string } | null = null;
+let inflight: Promise<RegistryIndex> | null = null;
 
 export interface RegistryStatus {
   url: string;
@@ -292,83 +237,63 @@ export interface RegistryStatus {
   error: string | null;
 }
 
-export function getRegistryStatus(
-  source: RegistrySource = officialSource(),
-): RegistryStatus {
-  const cache = caches.get(cacheKey(source));
+let lastError: string | null = null;
+
+export function getRegistryStatus(): RegistryStatus {
   return {
-    url: source.url,
+    url: getRegistryUrl(),
     lastCheckedAt: cache ? new Date(cache.at).toISOString() : null,
-    error: lastErrors.get(cacheKey(source)) ?? null,
+    error: lastError,
   };
 }
 
-/** Fetches and parses an index with no caching, for previewing a new one. */
-export async function fetchIndexAt(url: string): Promise<RegistryIndex> {
-  const response = await fetchFollowing(url);
-  const body = await readLimited(response, MAX_INDEX_BYTES);
-  let raw: unknown;
-  try {
-    raw = JSON.parse(body.toString("utf8"));
-  } catch {
-    throw new Error("the registry index is not valid JSON");
-  }
-  return parseRegistryIndex(raw);
-}
-
 export async function fetchRegistryIndex(
-  source: RegistrySource = officialSource(),
   options: { force?: boolean } = {},
 ): Promise<RegistryIndex> {
-  const key = cacheKey(source);
-  const cache = caches.get(key);
   if (!options.force && cache && Date.now() - cache.at < CACHE_MS) {
     return cache.index;
   }
-  const running = inflight.get(key);
-  if (running) return running;
+  if (inflight) return inflight;
 
-  const request = (async () => {
+  inflight = (async () => {
     try {
-      const index = await fetchIndexAt(source.url);
-      caches.set(key, { index, at: Date.now() });
-      lastErrors.delete(key);
+      const response = await fetchFollowing(getRegistryUrl());
+      const body = await readLimited(response, MAX_INDEX_BYTES);
+      const index = parseRegistryIndex(JSON.parse(body.toString("utf8")));
+      cache = {
+        index,
+        at: Date.now(),
+        hash: crypto.createHash("sha256").update(body).digest("hex"),
+      };
+      lastError = null;
       return index;
     } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      lastErrors.set(key, message);
+      lastError = error instanceof Error ? error.message : String(error);
       // A stale index beats none when the registry is briefly unreachable.
-      const stale = caches.get(key);
-      if (stale) {
-        pluginLogger.warn(
-          `Plugin registry ${source.id} check failed: ${message}`,
-          { operation: "plugin_registry" },
-        );
-        return stale.index;
+      if (cache) {
+        pluginLogger.warn(`Plugin registry check failed: ${lastError}`, {
+          operation: "plugin_registry",
+        });
+        return cache.index;
       }
       throw error;
     } finally {
-      inflight.delete(key);
+      inflight = null;
     }
   })();
-  inflight.set(key, request);
-  return request;
+  return inflight;
 }
 
 export interface RegistryStats {
-  /** Downloads per plugin id. */
-  plugins: Map<string, number>;
+  plugins: Map<string, { downloads: number; activeInstalls: number | null }>;
 }
 
 /** stats.json sits next to index.json and is rebuilt daily by the registry. */
-export function getStatsUrl(
-  source: RegistrySource = officialSource(),
-): string | null {
-  if (source.tier === "custom") return null;
-  if (source.tier === "official" && process.env.TERMIX_PLUGIN_STATS_URL) {
+export function getStatsUrl(): string | null {
+  if (process.env.TERMIX_PLUGIN_STATS_URL) {
     return process.env.TERMIX_PLUGIN_STATS_URL;
   }
-  const url = source.url;
+  const url = getRegistryUrl();
   return /\/index\.json$/.test(url)
     ? url.replace(/\/index\.json$/, "/stats.json")
     : null;
@@ -381,22 +306,27 @@ function asCount(value: unknown): number | null {
 }
 
 export function parseRegistryStats(raw: unknown): RegistryStats {
-  const plugins = new Map<string, number>();
+  const plugins = new Map<
+    string,
+    { downloads: number; activeInstalls: number | null }
+  >();
   const entries = (raw as { plugins?: unknown } | null)?.plugins;
   if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
     return { plugins };
   }
   for (const [id, value] of Object.entries(entries)) {
     if (!ID_PATTERN.test(id) || !value || typeof value !== "object") continue;
-    plugins.set(id, asCount((value as Record<string, unknown>).downloads) ?? 0);
+    const entry = value as Record<string, unknown>;
+    plugins.set(id, {
+      downloads: asCount(entry.downloads) ?? 0,
+      activeInstalls: asCount(entry.activeInstalls),
+    });
   }
   return { plugins };
 }
 
-export async function fetchRegistryStats(
-  source: RegistrySource = officialSource(),
-): Promise<RegistryStats | null> {
-  const url = getStatsUrl(source);
+export async function fetchRegistryStats(): Promise<RegistryStats | null> {
+  const url = getStatsUrl();
   if (!url) return null;
   const response = await fetchFollowing(url);
   const body = await readLimited(response, MAX_INDEX_BYTES);
@@ -405,9 +335,9 @@ export async function fetchRegistryStats(
 
 /** Test seam. */
 export function resetRegistryCache(): void {
-  caches.clear();
-  inflight.clear();
-  lastErrors.clear();
+  cache = null;
+  inflight = null;
+  lastError = null;
 }
 
 /** Every release a channel may install, newest first. */
@@ -484,7 +414,6 @@ export function assertArtifactMatches(
 export async function downloadRelease(
   pluginId: string,
   release: RegistryVersion,
-  keys: readonly TrustedPluginKey[] = TRUSTED_PLUGIN_KEYS,
 ): Promise<{ file: string; signatureFile: string }> {
   if (!isApiCompatible(release.api)) {
     throw new Error(
@@ -504,7 +433,6 @@ export async function downloadRelease(
     buffer,
     release.sha256,
     release.signature,
-    keys,
   );
   if (verified.ok === false) {
     throw new Error(`${pluginId} ${release.version}: ${verified.reason}`);

src/backend/plugins/trust.ts

@@ -28,49 +28,6 @@ export const TRUSTED_PLUGIN_KEYS: readonly TrustedPluginKey[] = [
   },
 ];
 
-/**
- * Signs community plugins after a person reviewed them. Its own tier on
- * purpose: it can never replace a bundled plugin or count as official.
- */
-export const COMMUNITY_PLUGIN_KEYS: readonly TrustedPluginKey[] = [
-  {
-    id: "be5b24ea07b36624",
-    publicKey: "LYdHHGJeinCZ7UA8R/o5i1P5W3+dzktTDn5bxp4nPpI=",
-    addedIn: "26.10.1",
-  },
-];
-
-export type KeyTier = "official" | "community" | "custom";
-
-/** Keys of registries an admin added, pinned when they were added. */
-let customKeys: readonly TrustedPluginKey[] = [];
-
-export function setCustomPluginKeys(keys: readonly TrustedPluginKey[]): void {
-  customKeys = keys.filter((key) => toPublicKey(key.publicKey) !== null);
-}
-
-export function getCustomPluginKeys(): readonly TrustedPluginKey[] {
-  return customKeys;
-}
-
-/** First 16 hex chars of the sha256 of a raw base64 public key. */
-export function pluginKeyId(publicKey: string): string {
-  return crypto
-    .createHash("sha256")
-    .update(Buffer.from(publicKey, "base64"))
-    .digest("hex")
-    .slice(0, 16);
-}
-
-/** Whether a string is a raw base64 Ed25519 public key. */
-export function isPluginPublicKey(value: unknown): value is string {
-  return (
-    typeof value === "string" &&
-    /^[A-Za-z0-9+/]{43}=$/.test(value) &&
-    toPublicKey(value) !== null
-  );
-}
-
 export type ArtifactVerification =
   { ok: true; keyId: string } | { ok: false; reason: string };
 
@@ -129,31 +86,6 @@ export function verifyPluginArtifact(
   return { ok: false, reason: "signature does not match a trusted key" };
 }
 
-/**
- * Checks a file against every key this build trusts, official first, and
- * says which tier signed it.
- */
-export function verifyAnyTrusted(
-  buffer: Buffer,
-  sha256: string,
-  signature: string,
-): { ok: true; keyId: string; tier: KeyTier } | { ok: false; reason: string } {
-  const tiers: Array<[KeyTier, readonly TrustedPluginKey[]]> = [
-    ["official", TRUSTED_PLUGIN_KEYS],
-    ["community", COMMUNITY_PLUGIN_KEYS],
-    ["custom", customKeys],
-  ];
-  let reason = "signature does not match a trusted key";
-  for (const [tier, keys] of tiers) {
-    if (keys.length === 0) continue;
-    const result = verifyPluginArtifact(buffer, sha256, signature, keys);
-    if (result.ok === true) return { ok: true, keyId: result.keyId, tier };
-    reason = result.reason;
-    if (reason !== "signature does not match a trusted key") break;
-  }
-  return { ok: false, reason };
-}
-
 /** TERMIX_REQUIRE_SIGNED_PLUGINS=true blocks unsigned user plugins. */
 export function requireSignedPlugins(): boolean {
   return process.env.TERMIX_REQUIRE_SIGNED_PLUGINS === "true";

src/backend/plugins/user-data.ts

@@ -29,8 +29,6 @@ export interface UserOwnedTable {
   hostColumns: string[];
   /** Columns that travel, as SQL names. The primary key and secrets do not. */
   columns: string[];
-  /** The owner column is the primary key: one row per user. */
-  userIsKey: boolean;
   definition: PluginTableDefinition;
 }
 
@@ -52,17 +50,14 @@ export function listUserOwnedTables(): UserOwnedTable[] {
       hostColumns: entries
         .filter(([, column]) => column.type === "refHost")
         .map(([property, column]) => columnName(property, column)),
-      // The owner column always travels, even as the key; import rewrites it.
       columns: entries
         .filter(
           ([, column]) =>
-            column === user[1] ||
-            (column.type !== "id" &&
-              !column.primaryKey &&
-              column.type !== "encryptedText"),
+            column.type !== "id" &&
+            !column.primaryKey &&
+            column.type !== "encryptedText",
         )
         .map(([property, column]) => columnName(property, column)),
-      userIsKey: !!user[1].primaryKey,
       definition,
     });
   }
@@ -244,15 +239,13 @@ export async function importUserPluginRows(
           summary.skipped++;
           continue;
         }
-        const matchOn = owned.userIsKey ? [owned.userColumn] : columns;
         const existing = await selectRows(
           sql`SELECT 1 FROM ${sql.identifier(owned.table)} WHERE ${sql.join(
-            matchOn.map((column) => {
-              const value = values[columns.indexOf(column)];
-              return value === null
+            columns.map((column, index) =>
+              values[index] === null
                 ? sql`${sql.identifier(column)} IS NULL`
-                : sql`${sql.identifier(column)} = ${value}`;
-            }),
+                : sql`${sql.identifier(column)} = ${values[index]}`,
+            ),
             sql` AND `,
           )} LIMIT 1`,
         );

src/backend/plugins/ws.ts

@@ -113,9 +113,7 @@ async function verifyToken(request: IncomingMessage): Promise<string | null> {
   if (!token) return null;
   try {
     const { AuthManager } = await import("../utils/auth-manager.js");
-    const payload = await AuthManager.getInstance().verifyJWTToken(token, {
-      allowSocketTicket: true,
-    });
+    const payload = await AuthManager.getInstance().verifyJWTToken(token);
     if (!payload || payload.pendingTOTP) return null;
     return payload.userId ?? null;
   } catch {

src/backend/sync/client/plugins.ts

@@ -21,7 +21,6 @@ import {
   unloadPlugin,
 } from "../../plugins/index.js";
 import { getPluginsDir } from "../../plugins/paths.js";
-import { setSyncedRegistryKeys } from "../../plugins/registries.js";
 import type { LoadedPlugin } from "../../plugins/loader.js";
 import {
   createCurrentPluginPermissionGrantRepository,
@@ -284,12 +283,10 @@ async function mirrorOne(link: SyncLink, plugin: RemotePlugin): Promise<void> {
 }
 
 export async function mirrorPlugins(link: SyncLink): Promise<void> {
-  const { plugins, registryKeys } = await remoteJson<{
-    plugins: RemotePlugin[];
-    registryKeys?: unknown[];
-  }>(link, "/sync/v2/plugins");
-  // Before any download: a plugin from a custom registry needs its key.
-  await setSyncedRegistryKeys(Array.isArray(registryKeys) ? registryKeys : []);
+  const { plugins } = await remoteJson<{ plugins: RemotePlugin[] }>(
+    link,
+    "/sync/v2/plugins",
+  );
   lastRemote = plugins;
   const remoteIds = new Set(plugins.map((plugin) => plugin.id));
 

src/backend/sync/server/routes.ts

@@ -472,7 +472,7 @@ async function listPluginsForDesktop() {
  * /sync/v2/plugins:
  *   get:
  *     summary: The features this server runs, for a linked desktop to mirror
- *     description: Every installed plugin with its version, where it came from, whether it is on, how a desktop should treat it and which sync entities it owns. registryKeys lists the signing keys of the custom registries an admin added, so plugins from them load on the desktop.
+ *     description: Every installed plugin with its version, where it came from, whether it is on, how a desktop should treat it and which sync entities it owns.
  *     tags:
  *       - Sync
  *     responses:
@@ -509,9 +509,7 @@ router.get(
           ),
         });
       }
-      const { customRegistryKeys } =
-        await import("../../plugins/registries.js");
-      res.json({ plugins, registryKeys: await customRegistryKeys() });
+      res.json({ plugins });
     } catch (error) {
       syncLogger.error("Failed to list plugins for sync", error, {
         operation: "sync_plugins",

src/backend/tests/database/db/rdp-domain-backfill.test.ts

@@ -37,18 +37,6 @@ describe("RDP domain across database boots", () => {
         "utf8",
       ),
     );
-    // 2.9 has opened it, so it has the table 2.9 added.
-    seed.exec(`
-      CREATE TABLE plugin_migrations (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        plugin_id TEXT NOT NULL,
-        migration_id TEXT NOT NULL,
-        checksum TEXT NOT NULL,
-        applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        UNIQUE (plugin_id, migration_id),
-        FOREIGN KEY (plugin_id) REFERENCES plugins (id) ON DELETE CASCADE
-      );
-    `);
     seed.exec(`
       INSERT INTO users (id, username, password_hash)
         VALUES ('owner', 'alice', 'hash');