feat: plugin guide for AI tools in the SDK with a lint check

.github/workflows/electron.yml

@@ -117,15 +117,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -146,9 +137,8 @@ jobs:
         run: npm run build && npx electron-builder --win --x64 --ia32 --publish never
 
       # The updater only installs the x64 NSIS build; 32-bit installs get a link.
-      # The combined x64+ia32 installer is never uploaded.
       - name: Fix Windows update files
-        run: node scripts/fix-update-info.cjs --drop ia32 --drop termix_windows_nsis.exe release/latest.yml release/beta.yml
+        run: node scripts/fix-update-info.cjs --drop ia32 release/latest.yml release/beta.yml release/alpha.yml
 
       - name: Upload Windows x64 NSIS Installer
         uses: actions/upload-artifact@v7
@@ -250,15 +240,6 @@ jobs:
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -486,15 +467,6 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       # A beta build has to know it is a beta, or it reports the stable version.
       - name: Stamp beta version
         if: inputs.version_override != ''
@@ -982,15 +954,6 @@ jobs:
           npm install dmg-license
           node scripts/install-macos-sharp.cjs
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Check for Code Signing Certificates
         id: check_certs
         run: |
@@ -1153,49 +1116,6 @@ jobs:
             --locales "en-US"
           echo "metadata_path=$META_DIR" >> "$GITHUB_OUTPUT"
 
-      # Apple won't create a new version while the last one is still in
-      # review. Pull it out so deliver can rename it to this version.
-      - name: Cancel pending App Store review
-        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
-        run: |
-          LANE_DIR="$RUNNER_TEMP/asc_cancel/fastlane"
-          mkdir -p "$LANE_DIR"
-
-          cat > "$LANE_DIR/Fastfile" <<'EOF'
-          default_platform(:mac)
-
-          lane :cancel_pending_review do
-            Spaceship::ConnectAPI.token = Spaceship::ConnectAPI::Token.from_json_file("/tmp/asc_keys/api_key.json")
-            app = Spaceship::ConnectAPI::App.find("com.karmaa.termix")
-            UI.user_error!("App not found") unless app
-
-            app.get_app_store_versions(filter: { platform: "MAC_OS" }, limit: 5).each do |v|
-              UI.message("Version #{v.version_string}: #{v.app_version_state || v.app_store_state}")
-            end
-
-            active = %w[WAITING_FOR_REVIEW IN_REVIEW UNRESOLVED_ISSUES]
-            canceled = false
-            app.get_review_submissions(filter: { platform: "MAC_OS" }).each do |sub|
-              UI.message("Review submission #{sub.id}: #{sub.state}")
-              next unless active.include?(sub.state)
-              sub.cancel_submission
-              canceled = true
-              UI.important("Canceled review submission #{sub.id}")
-            end
-            next unless canceled
-
-            30.times do
-              busy = app.get_review_submissions(filter: { platform: "MAC_OS" }).any? do |sub|
-                (active + %w[CANCELING]).include?(sub.state)
-              end
-              break unless busy
-              sleep(10)
-            end
-          end
-          EOF
-
-          cd "$RUNNER_TEMP/asc_cancel" && fastlane cancel_pending_review
-
       - name: Upload and submit to Mac App Store
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         run: |

.github/workflows/pr-check.yml

@@ -24,15 +24,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Build plugin SDK
         run: npm run build:sdk
 

.github/workflows/release.yml

@@ -228,15 +228,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Bundled plugins are counted as downloads in the plugin store, so a
-      # build only fetches them when the pins change.
-      - name: Cache bundled plugins
-        uses: actions/cache@v6
-        with:
-          path: node_modules/.cache/termix-bundled-plugins
-          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
-          enableCrossOsArchive: true
-
       - name: Build plugin SDK
         run: npm run build:sdk
 

CHANGELOG.md

@@ -1,40 +1,5 @@
 # Changelog
 
-## 26.10.2
-
-### Added
-
-- Hide sidebar after opening, in Customize Sidebar, closes the host list once you open a host
-- Sort the dashboard's Host Status card by name, IP address or status
-
-### Changed
-
-- The side menu now opens over the page when it expands on hover, so open sessions like remote desktop are not resized each time. Turn on Push content when it expands in Settings to get the old behavior back
-
-### Fixed
-
-- Picking a section lower down in the host editor, like Warpgate, stuttered on the way and sometimes stopped before it got there
-- Sorting hosts by IP address put 10.0.0.210 before 10.0.0.3
-- The local terminal failed to start in the universal macOS build
-- Hosts shared with you never showed up on a linked desktop
-- A linked desktop could never turn on an unsigned plugin the server had enabled
-- Creating, cloning or deleting hosts failed with "no such table: main.p_vault_profiles" after the Vault plugin was removed
-- Opening a user in Settings, Users blocked the other admin sections until you went back to the user list
-- A linked desktop could keep showing the same sync conflicts, or delete a local host, when the server could not send its copy
-- Usernames are now unique
-- Importing user data keeps foreign keys on
-- Trusted proxy login checks the address nginx saw, not nginx itself
-- The desktop login frame only trusts the server's own origin
-- External login URLs and callback ports are checked on the desktop app
-- A changed jump host key is no longer accepted without asking
-- Synced plugins signed only by a key the server sent are no longer turned on by themselves
-- Two connects to the same host at once could overwrite each other's connection
-- Indonesian uses the same technical terms everywhere
-- When the server was down or still starting, the login page said it could not connect to the database and stopped trying. It now says the server is not responding and continues on its own once the server is back
-- nginx answered 404 instead of 502 while the backend was down
-- A client tunnel that could not start always said "Endpoint SSH connection closed" on the desktop app instead of the real reason, like the target refusing the connection
-- The Docker server crashed and restarted every few hours in ssh2's native crypto on Node 24
-
 ## 26.10.1
 
 ### Added
@@ -48,23 +13,13 @@
 
 - Every language is now fully translated, in Termix and in every plugin, and stays up to date with each release
 - Languages with more than two plural forms, like Russian, Polish and Arabic, now use the right one
-- The Plugins tab shows how many times each plugin was downloaded, in a Downloads column
-- Plugins, Browse hides plugins you already have. Turn on Show installed to see them
 
 ### Fixed
 
 - Regional browser languages like `es-MX`, `pt` or `zh-HK` showed English instead of the closest translation
 - Counts like "1 keys" or "Moved 1 host(s)" now use the singular
-- Plugin updates on the desktop app, synced or installed from the Plugins tab, failed to start with "Cannot find package"
+- Plugin updates synced to the desktop app failed to start with "Cannot find package"
 - The desktop app showed plugins that only run on the server as not running and out of date
-- Keep the terminal WebSocket open past nginx's 60s default
-- Plugin download counts now show in the Plugins tab without waiting for the background check
-- Clicking into a saved password, key passphrase or sudo password field and saving without typing erased it, which stopped sudo autofill
-- The desktop app now says when its data is from 2.8 or older and needs 2.9 first, instead of only saying the local server could not start
-- Client tunnels on the desktop app stopped with "Endpoint SSH connection closed" when a reverse proxy dropped their idle connection
-- Typing right after opening a host from the sidebar went to the host search instead of the new session
-- SSH config import failed on files that put a tab or `=` between a keyword and its value
-- App icons and the favicon have rounded corners again
 
 ## 26.10.0
 

CONTRIBUTING.md

@@ -25,7 +25,7 @@ Termix is a small core plus plugins. This repo is the core: hosts, credentials,
 npm run dev
 ```
 
-This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
+This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Termix-Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
 
 ## Useful commands
 
@@ -38,21 +38,21 @@ npm run format       # format the code with Prettier
 
 ## Making a change
 
-1. Fork the [repo](https://github.com/Termix-SSH/Termix).
-2. Create a branch:
+1. **Fork the repository**: Click "Fork" at the top right of the [repository page](https://github.com/Termix-SSH/Termix).
+2. **Create a branch**:
    ```sh
    git checkout -b feature/my-new-feature
    ```
-3. Make your changes and add or update tests for them.
-4. Commit your changes:
+3. **Make your changes** and add or update tests for them.
+4. **Commit your changes**:
    ```sh
    git commit -m "feat: add my new feature"
    ```
-5. Push to your fork:
+5. **Push to your fork**:
    ```sh
    git push origin feature/my-new-feature
    ```
-6. Open a pull request against the current `dev-*` branch with a clear description.
+6. **Open a pull request** against the current `dev-*` branch with a clear description.
 
 ## Guidelines
 
@@ -72,4 +72,4 @@ Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Tem
 
 ## Support
 
-Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Add as much detail as you can, in English if possible. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.
+Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Please be as detailed as possible, preferably in English. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.

Casks/termix.rb

@@ -1,6 +1,6 @@
 cask "termix" do
-  version "26.10.1"
-  sha256 "08a8fdc6ce3f29bd9031b050a4f6364f3ca446f17cb272392f1b3b488cea5d30"
+  version "26.10.0"
+  sha256 "66a76a62fbea3306bdf35b0951e9b1200fd1a084a95b4fee9d40edd6e326e11a"
 
   url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
   name "Termix"

README.md

@@ -24,30 +24,30 @@
 
 ## Overview
 
-Termix is a free, open source, self-hosted server management platform built on plugins. The core keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, off or remove.
+Termix is a free, open source, self-hosted platform for managing your servers, built on plugins. The core is small. It keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, turn off or remove.
 
-It runs on web, desktop and mobile. Think of it as a free, self-hosted Termius.
+It runs on web, desktop and mobile, and it is a self-hosted alternative to Termius that stays free forever.
 
 <br />
 
 ## Try the Demo
 
-Try it at [demo.termix.site](https://demo.termix.site/). Any username and password works.
+Want to see it before you install it? Try the demo at [demo.termix.site](https://demo.termix.site/). Any username and password works.
 
 <br />
 
 ## Core
 
-What every install has, with or without plugins:
+What every Termix install has, with or without plugins:
 
-- Hosts: Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
-- Credentials: Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
-- Sharing and Roles: Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
-- Accounts: Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
-- Security: Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
-- Desktop Sync: The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
-- Interface: Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
-- Databases: SQLite by default, with PostgreSQL and MySQL supported too
+- **Hosts:** Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
+- **Credentials:** Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
+- **Sharing and Roles:** Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
+- **Accounts:** Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
+- **Security:** Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
+- **Desktop Sync:** The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
+- **Interface:** Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
+- **Databases:** SQLite by default, with PostgreSQL and MySQL supported too
 
 <br />
 
@@ -133,7 +133,7 @@ Want to build your own? Start from the [plugin template](https://github.com/Term
 
 ## Installation
 
-See the [docs](https://docs.termix.site/install) for install steps on every platform.
+Visit the [Termix Docs](https://docs.termix.site/install) for full install steps on every platform.
 
 Sample Docker Compose file (you can leave out `guacd` and the network if you don't plan to use the Remote Desktop plugin):
 
@@ -178,15 +178,15 @@ networks:
 
 ### Cloud Hosting
 
-If Termix runs on the network it manages, an outage takes it down right when you need it. A VPS keeps it reachable, gives you a static IP and works from anywhere without a VPN or port forward.
+You can run Termix on a VPS instead of inside your own network. If Termix runs on the network it manages, an outage takes Termix down with it, right when you need it to fix things. Running it somewhere else keeps it reachable, gives you a static IP and lets you get in from anywhere without a VPN or port forward.
 
-[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix and the docs have a setup guide for their VPS.
+[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix, and the docs have a step by step guide for their VPS platform.
 
 <br />
 
 ## Donate
 
-Termix has no paid plans. Donations cover servers, domains and development time.
+Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains and development time.
 
 [Donate](https://donate.termix.site/)
 
@@ -194,7 +194,7 @@ Termix has no paid plans. Donations cover servers, domains and development time.
 
 ## Sponsors
 
-For a paid sponsor spot, email [mail@termix.site](mailto:mail@termix.site).
+Interested in a paid placement to support development? Email [mail@termix.site](mailto:mail@termix.site).
 
 <!-- SPONSORS:START -->
 
@@ -242,7 +242,7 @@ Bugs and ideas for Termix itself (login, hosts, credentials, sharing, sync, the
 
 Every plugin has its own repo, so a problem with the terminal, file manager, Docker, remote desktop or any other plugin goes in that plugin's repo (see the table above, or use Report an issue on the plugin's page in the app, which fills in your versions for you). Not sure where it goes? Open it here and it will be moved.
 
-You need a GitHub account. Add as much detail as you can, in English if possible.
+You need to be logged in to GitHub. Please be as detailed as possible, preferably in English.
 
 For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server. Update videos are on [YouTube](https://www.youtube.com/@TermixSSH/videos).
 
@@ -250,4 +250,4 @@ For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf)
 
 ## License
 
-Apache License 2.0. See [LICENSE](LICENSE).
+Distributed under the Apache License Version 2.0. See [LICENSE](LICENSE) for more information.

docker/Dockerfile

@@ -34,9 +34,7 @@ WORKDIR /app
 
 COPY . .
 
-# Bundled plugin downloads show in the plugin store, so keep them between builds.
-RUN --mount=type=cache,target=/app/node_modules/.cache/termix-bundled-plugins \
-    npm run build:backend
+RUN npm run build:backend
 
 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
 FROM node:24-slim AS opkssh-downloader
@@ -74,15 +72,12 @@ COPY vendor ./vendor
 
 COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
-# ssh2's native crypto crashes Node 24 when a cipher is freed, so ssh2 uses
-# OpenSSL instead (chacha20-poly1305 is then left out).
 RUN npm ci --omit=dev --ignore-scripts && \
     node scripts/patch-ssh2-agent.cjs && \
     rm -rf node_modules/better-sqlite3/prebuilds && \
     npm run build-release --prefix node_modules/better-sqlite3 && \
     test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
-    npm rebuild bcryptjs && \
-    rm -rf node_modules/ssh2/lib/protocol/crypto/build && \
+    npm rebuild bcryptjs ssh2 && \
     npm cache clean --force
 
 # Stage 6: Final optimized image

docker/bundled-plugins.json

@@ -3,20 +3,20 @@
     {
       "id": "acme-ssl",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.1/acme-ssl-1.0.1.tmxplug",
-      "sha256": "cb5b7c56a281272cfff229d01a2729a4fa3936de04c0ac487d65bcf8dbd2f38e"
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.0/acme-ssl-1.0.0.tmxplug",
+      "sha256": "34aa172b2f6bc6a773ebdff2ec0f590d411ce258fd43176bdddb4c30d1fe30da"
     },
     {
       "id": "ai",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.1/ai-1.0.1.tmxplug",
-      "sha256": "2558c91e3e6823b3e18873d7b074762c4d76a1a0b96ff38d2dad13e0404b74a7"
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.0.0/ai-1.0.0.tmxplug",
+      "sha256": "ad291a2c6f6f01b72ebd275e8d202b78f55bc13a1e1a40f419d04e71b2fbd06b"
     },
     {
       "id": "alerts",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.1/alerts-1.0.1.tmxplug",
-      "sha256": "f5f233c0ffdeee956e1839a17a323c18ce8eb389a08569c3c6e5e24b698dd72a",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.0/alerts-1.0.0.tmxplug",
+      "sha256": "3fe008f9d2a32e2b7111399054a2264ea5cf5d71264cc31e85cdab3e909cc62f",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -25,14 +25,14 @@
     {
       "id": "automations",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.1/automations-1.0.1.tmxplug",
-      "sha256": "d2bb5298f8afac3f479ded81d5b1a799d9844b3f4990c8aaf2dd8fed7222428d"
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.0/automations-1.0.0.tmxplug",
+      "sha256": "76d4cff6e78d40ec67e899f0c7b2aca43d35a47b9a15071d0a8f5a8d939af9a9"
     },
     {
       "id": "docker",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.1/docker-1.0.1.tmxplug",
-      "sha256": "00e170e61ea9b7952449ea9ce30b09b983433f8d18d29f523cf3c6f98e7286e3",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.0/docker-1.0.0.tmxplug",
+      "sha256": "641e564ba915a72efed4236272d63f6fff43904309833870f3554d3e9bd28dfa",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -41,8 +41,8 @@
     {
       "id": "file-manager",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.2/file-manager-1.0.2.tmxplug",
-      "sha256": "4c735f5b795a8c676590a0dc25db1bcc6036ac250b9817a61867cebdc17931c6",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.0/file-manager-1.0.0.tmxplug",
+      "sha256": "1cafccfe86a29e2f318026ca7bc20629df94331c81209607976dafd7feac0ca4",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -51,20 +51,20 @@
     {
       "id": "fleets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.1/fleets-1.0.1.tmxplug",
-      "sha256": "82ac71e69022c4991570e6fed109a9eec79421f081af0a1dcb6d8b8e4251ee3b"
+      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.0/fleets-1.0.0.tmxplug",
+      "sha256": "1ebeccd6b2a8e9510ab56658374d0b87f652149101d14956752a696ca920f611"
     },
     {
       "id": "homepage",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.1/homepage-1.0.1.tmxplug",
-      "sha256": "573375726f334e37bbf504d9411c4ad2d4bfc4363219ff10dcea6cb2cb00ed32"
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.0/homepage-1.0.0.tmxplug",
+      "sha256": "65cd21802f6a71f3b3c582bc0007bfc91160abc161b2390bce715fd2ed987f99"
     },
     {
       "id": "host-metrics",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.2/host-metrics-1.0.2.tmxplug",
-      "sha256": "433d5297e2fc263f2262b7ea33d7a795c9a970089aea328077861c3f032a23f5",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.0/host-metrics-1.0.0.tmxplug",
+      "sha256": "1afce5489038e5e30b55210e8e43ba93e0446fe087e2952af75a402dbf809ea9",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -73,32 +73,32 @@
     {
       "id": "ldap",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.1/ldap-1.0.1.tmxplug",
-      "sha256": "f5ba13c682d11060f373f85a9c7aaa131e587ec59c0498c0dabb013c2e474f5c"
+      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.0/ldap-1.0.0.tmxplug",
+      "sha256": "1df08a931457043ba500689a73b4b5ab2bfb43630f377557e0fb13280b996334"
     },
     {
       "id": "network-topology",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.1/network-topology-1.0.1.tmxplug",
-      "sha256": "4c8ec1ae0c39b8b72a89e0dce4b20a36df4adc826abe215b8ee9b69b44fe75ca"
+      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.0/network-topology-1.0.0.tmxplug",
+      "sha256": "dc3ad943c1753b352b4d80c09836a293a8767293061ddf2e641575bae97124e9"
     },
     {
       "id": "opkssh",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.1/opkssh-1.0.1.tmxplug",
-      "sha256": "c19eadfe763e4dbecbd9a5e9e753576c577c75296ddc8e0af4cce98c2376b26f"
+      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.0/opkssh-1.0.0.tmxplug",
+      "sha256": "91cc1575aa1ff84632e0b6a4da68df3a7df4b8e18431b9c0378d314b886ed55d"
     },
     {
       "id": "proxmox",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.1/proxmox-1.0.1.tmxplug",
-      "sha256": "4e0989856e061b9ab1ec25cc727051e03ea5e3dc1603e08895bd54e7ce132db7"
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.0/proxmox-1.0.0.tmxplug",
+      "sha256": "09891a3ab67a5b6589d8ab9e0fc88d8c63ff9d4e52ed8e7cbd0801a5e64e593f"
     },
     {
       "id": "remote-desktop",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.2/remote-desktop-1.0.2.tmxplug",
-      "sha256": "70823a3f5161f6722fee22a9d5fe274dd47623960bc2188429c39a1c7e3e2b39",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.0.0/remote-desktop-1.0.0.tmxplug",
+      "sha256": "7b24691953550458ee1609372443eeb5580d20091b02c95011c0427268350efc",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -107,14 +107,14 @@
     {
       "id": "secret-sources",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.1/secret-sources-1.0.1.tmxplug",
-      "sha256": "9f5246325d3128c6376962f4cdbed33e78c487a4837f69235dfdcafeb293229a"
+      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.0/secret-sources-1.0.0.tmxplug",
+      "sha256": "04e9cfca70ffafc41546ddf0f1f6411743a2e0e9835b26ad5c0b91ac11028485"
     },
     {
       "id": "serial",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.1/serial-1.0.1.tmxplug",
-      "sha256": "9908467fc184e40f108ff750bf2fb8044e000a436f84d0a7121109f4fcd5d121",
+      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.0/serial-1.0.0.tmxplug",
+      "sha256": "2470acbd6c4c343c3d89dada972051f1ee7aace88af1e6719b92f19a4a6e46ea",
       "onboarding": {
         "recommended": "desktop",
         "consent": false
@@ -123,20 +123,20 @@
     {
       "id": "session-recording",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.1/session-recording-1.0.1.tmxplug",
-      "sha256": "45a08f950244c862a3774f9a653b3e3645285edb507a49b5c8da123832faf1e7"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.0/session-recording-1.0.0.tmxplug",
+      "sha256": "6b630ca0e08d79be7cb49366c898586ee3416a518f8e200157a6191c2c7c9ab7"
     },
     {
       "id": "session-sharing",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.1/session-sharing-1.0.1.tmxplug",
-      "sha256": "753aa9c0998f194ccf5fc49fd39c133a87f21f21e803014c4bfac6ccc7f9acb1"
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.0/session-sharing-1.0.0.tmxplug",
+      "sha256": "0c0d3f2d63184d4a4b2a90b11a1ee247ddc937abba76af74eb39e27048b412f9"
     },
     {
       "id": "snippets",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.1/snippets-1.0.1.tmxplug",
-      "sha256": "bf643828beba86677220d802c0df74b441d7954538637f37413f78d59c08585f",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.0/snippets-1.0.0.tmxplug",
+      "sha256": "47872d08cdf4a15b50c8f90ca125276a92579147a27cb6b5639a84a01160abe5",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -145,8 +145,8 @@
     {
       "id": "ssh-terminal",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.2/ssh-terminal-1.0.2.tmxplug",
-      "sha256": "e65102a8cd6afdaa890095fa698f3f455a1035729b9fdca800a31cc6e5ed760f",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.0/ssh-terminal-1.0.0.tmxplug",
+      "sha256": "5b5a357bbf9a503c6b68725245712a99fa8ea0eec0baff64319be28950acac79",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -155,8 +155,8 @@
     {
       "id": "sso",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.2/sso-1.0.2.tmxplug",
-      "sha256": "29ab0e4748ee71cb11f9b8dacd630430d284b6ce24561cffae9b4d7fe64e9c3b",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.1/sso-1.0.1.tmxplug",
+      "sha256": "ba7485ba058c784975609f6960bbaf7ec2018bcdce40b47308efc92ca96fdab5",
       "onboarding": {
         "recommended": false,
         "consent": false,
@@ -166,20 +166,20 @@
     {
       "id": "step-ca",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.1/step-ca-1.0.1.tmxplug",
-      "sha256": "ff4df5bae8c48ff61fe659b6ed69a40ac070862bc423972711a194d558d77cc8"
+      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.0/step-ca-1.0.0.tmxplug",
+      "sha256": "05209afbaeb104ff77fecb5cf26a7823b9ed66031eac7557d3216fc3b861f7a6"
     },
     {
       "id": "tailscale",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.1/tailscale-1.0.1.tmxplug",
-      "sha256": "0efe1cbf0f431763611926b6a9e92630ca8c1a89ea57bb796c5d7bd3ce0ab55f"
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.0/tailscale-1.0.0.tmxplug",
+      "sha256": "e9840bddef696b24354b9f04f2c97e164c3879f3fd1b337347de728db522874e"
     },
     {
       "id": "telemetry",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.1/telemetry-1.0.1.tmxplug",
-      "sha256": "c7f70e149c67a570f2b004c2cceeba27ffe8cbd95cd4df4bbffd880cc3451469",
+      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.0/telemetry-1.0.0.tmxplug",
+      "sha256": "b41210d638b93470891ab238e3d1180a0e0d0f0c697b1c2079156416dec05966",
       "onboarding": {
         "recommended": true,
         "consent": true
@@ -188,20 +188,20 @@
     {
       "id": "termix-identity",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.1/termix-identity-1.0.1.tmxplug",
-      "sha256": "dc423ec53f012fdcc2cdccd872ac01353025e4da2ee9fea0d2a2d5988518a5a0"
+      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.0/termix-identity-1.0.0.tmxplug",
+      "sha256": "facd9f1c6036202e7c6b1020408ce49c7ba4bc687a8f8b93ccf60e97f473f897"
     },
     {
       "id": "tmux-monitor",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.2/tmux-monitor-1.0.2.tmxplug",
-      "sha256": "ea41f1f90bdeab6164cfa2a594f359492afa123ed06990afa338be69a9d974c6"
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.0/tmux-monitor-1.0.0.tmxplug",
+      "sha256": "d453e0c5f1bf54160615d5df4e12eac0d97fea3c78c0aad5ebe8552e1f2de42c"
     },
     {
       "id": "totp",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.1/totp-1.0.1.tmxplug",
-      "sha256": "4a083871663c2f6034904bd49bb02c2d4dd4ed4d50fbce1522172dae84991474",
+      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.0/totp-1.0.0.tmxplug",
+      "sha256": "a2d389048d16e31c089cf211fe2fb37fcfb33369497b58ee445e8626e9ec494d",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -210,8 +210,8 @@
     {
       "id": "tunnels",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.2/tunnels-1.0.2.tmxplug",
-      "sha256": "44799c0bdbcc576fb0e1c1ecce96f283d2cc32b44ac5aeeb7253f8ca0b650860",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.0/tunnels-1.0.0.tmxplug",
+      "sha256": "dc6c2942490c07ec1f9a4065850288cbb00c42dae64397937d2551d689314939",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -220,32 +220,32 @@
     {
       "id": "vault",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.1/vault-1.0.1.tmxplug",
-      "sha256": "c828eeebe37bf576020908e16a28e73073fc77178062b323058624f557a8c72a"
+      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.0/vault-1.0.0.tmxplug",
+      "sha256": "bdad88ed576ed30b464c9cbddab4d9bb60696581dc1b815b76e1b4a08500f870"
     },
     {
       "id": "wake-on-lan",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.1/wake-on-lan-1.0.1.tmxplug",
-      "sha256": "5301d26138cb37812e8ef1fc5d3df688415517d545667b365fca2f41166a8402"
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.0/wake-on-lan-1.0.0.tmxplug",
+      "sha256": "3e7d4c8a9a20cde95d8594d4ae8e1fa0469d0751be9f00249f6431b10ada9ea9"
     },
     {
       "id": "warpgate",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.1/warpgate-1.0.1.tmxplug",
-      "sha256": "2f3b3169101ff04d0ea6229b31270ba0b5b8ff2c3d16e3f21a9e6c569d463ea8"
+      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.0/warpgate-1.0.0.tmxplug",
+      "sha256": "18ed1c8238ecf57b5776ad93c6533d7040b988ae765012c5da591b85faa02d2e"
     },
     {
       "id": "web-endpoint",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.1/web-endpoint-1.0.1.tmxplug",
-      "sha256": "88477231ab3c93206c99393c6cc8628c1ff8159af6978d0d09db969c28e1d637"
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.0/web-endpoint-1.0.0.tmxplug",
+      "sha256": "7f69e608eccd8cc6fa2436bffb3e2c3c8aae6cebebf7341913f15e7f9be58e42"
     },
     {
       "id": "webauthn",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.1/webauthn-1.0.1.tmxplug",
-      "sha256": "f9ccd5d6fe110b5c7ad8b90fd95e0a201e03d440462c2c3f6559406222364464",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.0/webauthn-1.0.0.tmxplug",
+      "sha256": "dafcd7bfffc39b60a14333164dfd8ca70986da1390285359669d0293cd050121",
       "onboarding": {
         "recommended": true,
         "consent": false
@@ -254,8 +254,8 @@
     {
       "id": "workspaces",
       "source": "tmxplug",
-      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.1/workspaces-1.0.1.tmxplug",
-      "sha256": "17f53044318d6f53ef1e332d204f6469c7043fd9985c4d1eae16b6a1c3248153",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.0/workspaces-1.0.0.tmxplug",
+      "sha256": "1ee3a07bd8d61b46b6fbe118d2a424f8027575282287622b467e83a4356e6412",
       "onboarding": {
         "recommended": true,
         "consent": false

docker/docker-compose.yml

@@ -28,11 +28,7 @@ services:
       # Trusted reverse-proxy authentication is disabled by default. When
       # enabled, do not expose this container directly to untrusted clients.
       # TRUSTED_PROXY_AUTH_ENABLED: "true"
-      # List the address your authenticating proxy connects from, as this
-      # container sees it (for a proxy container on termix-net, its IP there).
-      # Keep it narrow: published ports can reach the container from the
-      # Docker gateway, so do not trust whole private ranges.
-      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
+      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.16.0.0/12"
       # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
       # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
       # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"

docker/nginx-https.conf

@@ -200,9 +200,6 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
-            # The TCP peer before set_real_ip_from rewrites $remote_addr from
-            # X-Forwarded-For; trusted proxy login checks this address.
-            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -428,16 +425,6 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            # A terminal is quiet most of the time - waiting on a prompt, reading
-            # output, running something long. Every console plugin dials this route
-            # (terminal, serial, remote desktop), and nginx's default
-            # proxy_read_timeout of 60s closed the socket about a minute into any
-            # pause, which reaches the user as the SSH server disconnecting. The
-            # plugin WebSocket routes below already ask for 86400s; this is the same
-            # class of socket, so it asks for the same.
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
         }
 
         location /host/ {
@@ -476,12 +463,9 @@ http {
         }
 
         error_page 500 502 503 504 /50x.html;
-        # Only nginx's own errors land here (the backend is down or too slow).
-        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
+            root /app/html;
             internal;
-            default_type application/json;
-            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

docker/nginx.conf

@@ -169,9 +169,6 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
-            # The TCP peer before set_real_ip_from rewrites $remote_addr from
-            # X-Forwarded-For; trusted proxy login checks this address.
-            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -397,16 +394,6 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            # A terminal is quiet most of the time - waiting on a prompt, reading
-            # output, running something long. Every console plugin dials this route
-            # (terminal, serial, remote desktop), and nginx's default
-            # proxy_read_timeout of 60s closed the socket about a minute into any
-            # pause, which reaches the user as the SSH server disconnecting. The
-            # plugin WebSocket routes below already ask for 86400s; this is the same
-            # class of socket, so it asks for the same.
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
         }
 
         location /host/ {
@@ -445,12 +432,9 @@ http {
         }
 
         error_page 500 502 503 504 /50x.html;
-        # Only nginx's own errors land here (the backend is down or too slow).
-        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
+            root /app/html;
             internal;
-            default_type application/json;
-            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

drizzle/mysql/0071_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/mysql/0072_unique_username.sql

@@ -1,19 +0,0 @@
--- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
-WITH ranked AS (
-  SELECT id, username,
-    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
-    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
-  FROM users
-), candidates AS (
-  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
-), available AS (
-  SELECT MIN(candidate) AS candidate FROM candidates
-  WHERE NOT EXISTS (
-    SELECT 1 FROM ranked WHERE username LIKE CONCAT(CONCAT('termix-recovered-', candidate, '-'), '%')
-  )
-)
-UPDATE users JOIN ranked ON ranked.id = users.id CROSS JOIN available
-SET users.username = CONCAT('termix-recovered-', available.candidate, '-', ranked.sequence)
-WHERE ranked.occurrence > 1;--> statement-breakpoint
-ALTER TABLE `users` MODIFY COLUMN `username` varchar(255) NOT NULL;--> statement-breakpoint
-ALTER TABLE `users` ADD CONSTRAINT `idx_users_username` UNIQUE(`username`);

drizzle/mysql/meta/_journal.json

@@ -498,20 +498,6 @@
       "when": 1791550497926,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 71,
-      "version": "5",
-      "when": 1791755801066,
-      "tag": "0071_drop_install_count_source",
-      "breakpoints": true
-    },
-    {
-      "idx": 72,
-      "version": "5",
-      "when": 1791935283211,
-      "tag": "0072_unique_username",
-      "breakpoints": true
     }
   ]
 }

drizzle/postgres/0071_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE "plugin_install_counts" DROP COLUMN "source";

drizzle/postgres/0072_unique_username.sql

@@ -1,18 +0,0 @@
--- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
-WITH ranked AS MATERIALIZED (
-  SELECT id, username,
-    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
-    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
-  FROM users
-), candidates AS (
-  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
-), available AS (
-  SELECT MIN(candidate) AS candidate FROM candidates
-  WHERE NOT EXISTS (
-    SELECT 1 FROM ranked WHERE username LIKE 'termix-recovered-' || candidate || '-' || '%'
-  )
-)
-UPDATE users SET username = 'termix-recovered-' || (SELECT candidate FROM available) || '-' || ranked.sequence
-FROM ranked WHERE ranked.id = users.id AND ranked.occurrence > 1;--> statement-breakpoint
-ALTER TABLE "users" ALTER COLUMN "username" SET DATA TYPE varchar(255);--> statement-breakpoint
-CREATE UNIQUE INDEX "idx_users_username" ON "users" USING btree ("username");

drizzle/postgres/meta/_journal.json

@@ -498,20 +498,6 @@
       "when": 1791550496661,
       "tag": "0070_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 71,
-      "version": "7",
-      "when": 1791755800419,
-      "tag": "0071_drop_install_count_source",
-      "breakpoints": true
-    },
-    {
-      "idx": 72,
-      "version": "7",
-      "when": 1791935282340,
-      "tag": "0072_unique_username",
-      "breakpoints": true
     }
   ]
 }

drizzle/sqlite/0066_drop_install_count_source.sql

@@ -1 +0,0 @@
-ALTER TABLE `plugin_install_counts` DROP COLUMN `source`;

drizzle/sqlite/0067_unique_username.sql

@@ -1,17 +0,0 @@
--- Choose an unused prefix from N + 1 disjoint prefixes for N existing users.
-WITH ranked AS MATERIALIZED (
-  SELECT id, username,
-    ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
-    ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
-  FROM users
-), candidates AS (
-  SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
-), available AS (
-  SELECT MIN(candidate) AS candidate FROM candidates
-  WHERE NOT EXISTS (
-    SELECT 1 FROM ranked WHERE username LIKE 'termix-recovered-' || candidate || '-' || '%'
-  )
-)
-UPDATE users SET username = 'termix-recovered-' || (SELECT candidate FROM available) || '-' || ranked.sequence
-FROM ranked WHERE ranked.id = users.id AND ranked.occurrence > 1;--> statement-breakpoint
-CREATE UNIQUE INDEX `idx_users_username` ON `users` (`username`);

drizzle/sqlite/meta/_journal.json

@@ -463,20 +463,6 @@
       "when": 1791550495357,
       "tag": "0065_drop_donation_modal",
       "breakpoints": true
-    },
-    {
-      "idx": 66,
-      "version": "6",
-      "when": 1791755799726,
-      "tag": "0066_drop_install_count_source",
-      "breakpoints": true
-    },
-    {
-      "idx": 67,
-      "version": "6",
-      "when": 1791935281343,
-      "tag": "0067_unique_username",
-      "breakpoints": true
     }
   ]
 }

electron-builder.json

@@ -156,6 +156,6 @@
       "NSAppleEventsUsageDescription": "Termix needs access to control other applications for terminal operations."
     }
   },
-  "generateUpdatesFilesForAllChannels": false,
+  "generateUpdatesFilesForAllChannels": true,
   "msiProjectCreated": "packaging/build/msi-shortcuts.cjs"
 }

electron/backend-failure.cjs

@@ -35,13 +35,7 @@ function parseConflictingPort(stderr) {
  * stderr. Always returns a failure -- see the note above on why every exit
  * that reaches this point counts as one.
  */
-// Part of PRE_29_DATABASE_ERROR in src/backend/database/db/upgrade-guard.ts.
-const OLD_DATABASE_MARKER = "This database is from Termix 2.8 or older";
-
 function classifyBackendFailure(stderr = "") {
-  if (stderr.includes(OLD_DATABASE_MARKER)) {
-    return { reason: "old-database", port: null };
-  }
   if (stderr.includes("EADDRINUSE")) {
     return { reason: "port-in-use", port: parseConflictingPort(stderr) };
   }

electron/external-editor.cjs

@@ -1,70 +0,0 @@
-const path = require("path");
-
-// Saved by the file manager after the user picks an editor in a file dialog.
-const EXTERNAL_EDITOR_SETTING = "fileManager.externalEditorPath";
-
-// Extensions the OS would run rather than open in an editor. With no editor
-// configured the temp copy goes to shell.openPath, and its name comes from
-// the remote server.
-const LAUNCHABLE_EXTENSIONS = new Set([
-  // Windows
-  "application",
-  "appref-ms",
-  "bat",
-  "chm",
-  "cmd",
-  "com",
-  "cpl",
-  "exe",
-  "gadget",
-  "hta",
-  "inf",
-  "jar",
-  "js",
-  "jse",
-  "library-ms",
-  "lnk",
-  "msc",
-  "msi",
-  "msp",
-  "mst",
-  "pif",
-  "ps1",
-  "psd1",
-  "psm1",
-  "py",
-  "pyw",
-  "reg",
-  "scf",
-  "scr",
-  "search-ms",
-  "settingcontent-ms",
-  "url",
-  "vbe",
-  "vbs",
-  "ws",
-  "wsf",
-  "wsh",
-  "xll",
-  // macOS
-  "app",
-  "command",
-  "pkg",
-  "terminal",
-  "tool",
-  "workflow",
-  // Linux
-  "appimage",
-  "desktop",
-  "run",
-  "sh",
-]);
-
-function isLaunchableFileName(fileName) {
-  // Windows drops trailing dots and spaces, so "a.exe. " is saved as a.exe.
-  const name = path.basename(String(fileName || "")).replace(/[. ]+$/, "");
-  const extension = path.extname(name).slice(1).toLowerCase();
-  return LAUNCHABLE_EXTENSIONS.has(extension);
-}
-
-module.exports = { EXTERNAL_EDITOR_SETTING, isLaunchableFileName };

electron/external-login.cjs

@@ -1,20 +0,0 @@
-/**
- * The login URL a server hands the desktop app goes to shell.openExternal,
- * so only web pages pass: any other scheme (file:, smb:, ms-msdt:, ...)
- * would launch whatever OS handler is registered for it.
- */
-function isExternalLoginUrl(value) {
-  try {
-    const { protocol } = new URL(value);
-    return protocol === "https:" || protocol === "http:";
-  } catch {
-    return false;
-  }
-}
-
-/** A non-privileged port for the loopback callback listener. */
-function isCallbackPort(value) {
-  return Number.isInteger(value) && value >= 1024 && value <= 65535;
-}
-
-module.exports = { isExternalLoginUrl, isCallbackPort };

electron/local-shell.cjs

@@ -39,11 +39,7 @@ function resolveLocalShell(
  * how many helpers were fixed.
  */
 function repairSpawnHelpers(ptyDir, fsImpl = fs) {
-  // A universal macOS build ships app-arm64.asar and app-x64.asar.
-  const dir = ptyDir.replace(
-    /\b(app(?:-[a-z0-9]+)?)\.asar(?!\.unpacked)/,
-    "$1.asar.unpacked",
-  );
+  const dir = ptyDir.replace(/app\.asar(?!\.unpacked)/, "app.asar.unpacked");
   const candidates = [
     path.join(dir, "build", "Release", "spawn-helper"),
     path.join(

electron/main.cjs

@@ -36,11 +36,6 @@ const { quitApp } = require("./app-quit.cjs");
 const { selectLinuxPasswordStore } = require("./linux-password-store.cjs");
 const { resolveLocalShell, repairSpawnHelpers } = require("./local-shell.cjs");
 const { registerLocalFileHandlers } = require("./local-files.cjs");
-const {
-  EXTERNAL_EDITOR_SETTING,
-  isLaunchableFileName,
-} = require("./external-editor.cjs");
-const { isExternalLoginUrl, isCallbackPort } = require("./external-login.cjs");
 
 const localTerminalSessions = new Map();
 
@@ -705,9 +700,6 @@ let tray = null;
 let isQuitting = false;
 const tempFiles = new Map();
 const externalEditorSessions = new Map();
-// Paths the user picked in an open dialog this session. Only these may be
-// saved as the external editor, so the renderer cannot name an executable.
-const dialogChosenPaths = new Set();
 
 const isDev = process.env.NODE_ENV === "development" || !app.isPackaged;
 const appRoot = isDev ? process.cwd() : path.join(__dirname, "..");
@@ -1671,12 +1663,6 @@ ipcMain.handle("get-embedded-server-status", () => {
 ipcMain.handle(
   "external-browser-login",
   async (_event, authUrl, callbackPort) => {
-    if (!isExternalLoginUrl(authUrl)) {
-      return { success: false, error: "Invalid authentication URL" };
-    }
-    if (!isCallbackPort(callbackPort)) {
-      return { success: false, error: "Invalid callback port" };
-    }
     const http = require("http");
 
     return new Promise((resolve) => {
@@ -1998,16 +1984,6 @@ const C2S_WS_HIGH_WATERMARK = 1024 * 1024;
 const C2S_WS_LOW_WATERMARK = 256 * 1024;
 const C2S_STREAM_WRITE_LIMIT = 8 * 1024 * 1024;
 
-// A proxy in front of the server may drop an idle WebSocket, which stopped
-// the tunnel. Pings count as traffic.
-function keepC2SSocketAlive(ws) {
-  const timer = setInterval(() => {
-    if (ws.readyState === WebSocket.OPEN) ws.ping();
-  }, 25_000);
-  timer.unref?.();
-  ws.once("close", () => clearInterval(timer));
-}
-
 // C2S (client-to-server) tunnels relay through the server this desktop is
 // linked to, not the embedded backend.
 function getC2SRemoteBaseUrl() {
@@ -2276,7 +2252,6 @@ async function openC2SRelay(
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
   const pendingChunks = [];
   let ready = false;
   let closed = false;
@@ -2384,13 +2359,10 @@ async function testC2SRelay(
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
 
   if (runtime) runtime.authSocket = ws;
   return new Promise((resolve) => {
     let settled = false;
-    // The relay sends its reason and then closes; keep the reason.
-    let relayError = null;
     const settle = (result) => {
       if (settled) return;
       settled = true;
@@ -2427,10 +2399,6 @@ async function testC2SRelay(
           settle({ success: true });
         } else if (message.type === "error") {
           clearTimeout(timer);
-          relayError = normalizeC2SErrorMessage(
-            message.error,
-            "Tunnel test failed",
-          );
           settle(createC2SFailure(message.error, "Tunnel test failed"));
         }
       } catch (error) {
@@ -2444,10 +2412,7 @@ async function testC2SRelay(
     });
     ws.on("close", () => {
       if (runtime && c2sTunnelRuntimes.get(tunnel.name) === runtime) {
-        setC2STunnelError(
-          tunnel.name,
-          relayError || "Endpoint SSH connection closed",
-        );
+        setC2STunnelError(tunnel.name, "Endpoint SSH connection closed");
       }
       clearTimeout(timer);
       settle({ success: false, error: "Tunnel test connection closed" });
@@ -2704,7 +2669,6 @@ async function startC2SRemoteTunnel(tunnel, index = 0, authToken) {
     getWebSocketOptions(relayUrl, { headers }),
   );
   attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
-  keepC2SSocketAlive(ws);
   const sockets = new Map();
   let closed = false;
 
@@ -3179,16 +3143,18 @@ ipcMain.handle("get-c2s-tunnel-preset-default-name", () => {
   return `[${date}] ${computerName} (${platform} ${release})`;
 });
 
-function readSetting(key) {
-  const settingsPath = path.join(app.getPath("userData"), "settings.json");
-  if (!fs.existsSync(settingsPath)) return null;
-  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
-  return settings[key] !== undefined ? settings[key] : null;
-}
-
 ipcMain.handle("get-setting", (event, key) => {
   try {
-    return readSetting(key);
+    const userDataPath = app.getPath("userData");
+    const settingsPath = path.join(userDataPath, "settings.json");
+
+    if (!fs.existsSync(settingsPath)) {
+      return null;
+    }
+
+    const settingsData = fs.readFileSync(settingsPath, "utf8");
+    const settings = JSON.parse(settingsData);
+    return settings[key] !== undefined ? settings[key] : null;
   } catch (error) {
     console.error("Error reading setting:", error);
     return null;
@@ -3196,16 +3162,6 @@ ipcMain.handle("get-setting", (event, key) => {
 });
 
 ipcMain.handle("set-setting", (event, key, value) => {
-  if (typeof key !== "string") {
-    return { success: false, error: "Invalid setting key" };
-  }
-  if (
-    key === EXTERNAL_EDITOR_SETTING &&
-    value &&
-    !dialogChosenPaths.has(value)
-  ) {
-    return { success: false, error: "Choose the editor in the file dialog" };
-  }
   try {
     const userDataPath = app.getPath("userData");
     const settingsPath = path.join(userDataPath, "settings.json");
@@ -3229,6 +3185,94 @@ ipcMain.handle("set-setting", (event, key, value) => {
   }
 });
 
+ipcMain.handle("get-session-cookie", async (_event, name, targetUrl) => {
+  try {
+    const ses = mainWindow?.webContents?.session;
+    if (!ses) return null;
+    const cookies = await ses.cookies.get({
+      name,
+      ...(targetUrl ? { url: targetUrl } : {}),
+    });
+    const cookie = cookies.find((candidate) =>
+      cookieMatchesUrl(candidate, targetUrl),
+    );
+    return (
+      cookie?.value ||
+      getRememberedElectronAuthCookie(name, targetUrl)?.value ||
+      null
+    );
+  } catch (error) {
+    console.error("Failed to get session cookie:", error);
+    return getRememberedElectronAuthCookie(name, targetUrl)?.value || null;
+  }
+});
+
+function cookieMatchesUrl(cookie, targetUrl) {
+  if (!targetUrl) return true;
+
+  try {
+    const targetHost = new URL(targetUrl).hostname;
+    const cookieDomain = (cookie.domain || "").replace(/^\./, "");
+
+    return (
+      cookieDomain === targetHost ||
+      targetHost.endsWith(`.${cookieDomain}`) ||
+      (!cookieDomain && targetHost === "localhost")
+    );
+  } catch {
+    return true;
+  }
+}
+
+ipcMain.handle(
+  "wait-session-cookie",
+  async (_event, name, targetUrl, previousValue, timeoutMs = 5000) => {
+    const ses = mainWindow?.webContents?.session;
+    if (!ses) return { success: false, error: "No Electron session" };
+
+    const existingCookies = await ses.cookies.get({
+      name,
+      ...(targetUrl ? { url: targetUrl } : {}),
+    });
+    const existingCookie = existingCookies.find((cookie) =>
+      cookieMatchesUrl(cookie, targetUrl),
+    );
+    if (existingCookie?.value && existingCookie.value !== previousValue) {
+      return { success: true, value: existingCookie.value };
+    }
+
+    const rememberedCookie = getRememberedElectronAuthCookie(name, targetUrl);
+    if (rememberedCookie?.value && rememberedCookie.value !== previousValue) {
+      return { success: true, value: rememberedCookie.value };
+    }
+
+    return new Promise((resolve) => {
+      const timeout = setTimeout(() => {
+        ses.cookies.off("changed", onCookieChanged);
+        resolve({ success: false, error: "Timed out waiting for cookie" });
+      }, timeoutMs);
+
+      function onCookieChanged(_event, cookie, _cause, removed) {
+        if (
+          removed ||
+          cookie.name !== name ||
+          !cookie.value ||
+          cookie.value === previousValue ||
+          !cookieMatchesUrl(cookie, targetUrl)
+        ) {
+          return;
+        }
+
+        clearTimeout(timeout);
+        ses.cookies.off("changed", onCookieChanged);
+        resolve({ success: true, value: cookie.value });
+      }
+
+      ses.cookies.on("changed", onCookieChanged);
+    });
+  },
+);
+
 ipcMain.handle("clear-session-cookies", async () => {
   try {
     clearPersistedElectronAuthCookies();
@@ -3356,9 +3400,7 @@ ipcMain.handle("show-save-dialog", async (_event, options) => {
 });
 
 ipcMain.handle("show-open-dialog", async (_event, options) => {
-  const result = await dialog.showOpenDialog(mainWindow, options || {});
-  for (const filePath of result.filePaths) dialogChosenPaths.add(filePath);
-  return result;
+  return dialog.showOpenDialog(mainWindow, options || {});
 });
 
 function toLocalFileType(stat) {
@@ -3681,15 +3723,6 @@ ipcMain.handle("cleanup-temp-file", (_event, tempId) => {
 
 ipcMain.handle("open-external-editor", async (_event, fileData) => {
   try {
-    // The editor comes from the saved setting, never from the caller.
-    const editorPath = readSetting(EXTERNAL_EDITOR_SETTING) || null;
-    if (!editorPath && isLaunchableFileName(fileData?.fileName)) {
-      return {
-        success: false,
-        error: "Choose an external editor to open this file type",
-      };
-    }
-
     const result = createManagedTempFile(
       fileData?.fileName,
       fileData?.content,
@@ -3711,6 +3744,10 @@ ipcMain.handle("open-external-editor", async (_event, fileData) => {
       lastMtimeMs: stat.mtimeMs,
     });
 
+    const editorPath =
+      typeof fileData?.editorPath === "string" && fileData.editorPath.trim()
+        ? fileData.editorPath.trim()
+        : null;
     const openError = await openPathWithEditor(result.path, editorPath);
     if (openError) {
       closeExternalEditorSession(editId);

electron/preload.js

@@ -87,6 +87,16 @@ contextBridge.exposeInMainWorld("electronAPI", {
   },
 
   clearSessionCookies: () => ipcRenderer.invoke("clear-session-cookies"),
+  getSessionCookie: (name, targetUrl) =>
+    ipcRenderer.invoke("get-session-cookie", name, targetUrl),
+  waitForSessionCookie: (name, targetUrl, previousValue, timeoutMs) =>
+    ipcRenderer.invoke(
+      "wait-session-cookie",
+      name,
+      targetUrl,
+      previousValue,
+      timeoutMs,
+    ),
 
   externalBrowserLogin: (authUrl, callbackPort) =>
     ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),

env.catalog.json

@@ -369,7 +369,7 @@
     {
       "name": "TERMIX_PLUGIN_STATS_URL",
       "group": "plugins",
-      "description": "Where plugin download counts are read from. Defaults to stats.json next to the registry index."
+      "description": "Where install counts are read from. Defaults to stats.json next to the registry index."
     },
     {
       "name": "TERMIX_REQUIRE_SIGNED_PLUGINS",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "termix",
-  "version": "26.10.1",
+  "version": "26.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "termix",
-      "version": "26.10.1",
+      "version": "26.10.0",
       "hasInstallScript": true,
       "workspaces": [
         "packages/*"
@@ -15058,7 +15058,7 @@
     },
     "packages/plugin-sdk": {
       "name": "@termix-ssh/plugin-sdk",
-      "version": "1.0.8",
+      "version": "1.0.6",
       "license": "Apache-2.0",
       "dependencies": {
         "@deadendjs/swagger-jsdoc": "^8.1.2",

package.json

@@ -4,7 +4,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "26.10.1",
+  "version": "26.10.0",
   "description": "Self-hosted, plugin-based server management.",
   "author": "Karmaa",
   "main": "electron/main.cjs",

packages/plugin-sdk/CHANGELOG.md

@@ -1,17 +1,5 @@
 # Changelog
 
-## 1.0.8
-
-### Added
-
-- `publicRateLimit` on `ctx.http.router()`, for a plugin whose public routes serve a proxied page
-
-## 1.0.7
-
-### Fixed
-
-- A migration file, or a part of one, holding only comments made core fail to start the plugin
-
 ## 1.0.6
 
 ### Added

packages/plugin-sdk/PLUGIN-GUIDE.md

@@ -1,6 +1,6 @@
 # Termix plugin guide
 
-SDK 1.0.8 | Plugin API 1.2.0
+SDK 1.0.6 | Plugin API 1.2.0
 
 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
@@ -283,8 +283,7 @@ router.post("/notes", async (req, res) => {
 - The `@openapi` path is the full path, starting with `/plugin-api/<id>/`. `build` turns these into
   `dist/openapi.json` and the docs site renders them.
 - `ctx.http.router({ public: ["/webhook/:token"], bodyLimit: "20mb", rawBody: false })`. Public routes
-  have no actor: check their token yourself. Core allows 120 public requests a minute per address;
-  `publicRateLimit` raises that for a proxied page that loads its own assets.
+  have no actor: check their token yourself and rate limit them.
 - `ctx.http.baseUrl(req)` is the public address, for callback URLs.
 - `ctx.ws.route("/live", (socket, conn) => ...)`. Long lived sockets should check
   `conn.isDataUnlocked()` per message.

packages/plugin-sdk/README.md

@@ -50,7 +50,7 @@ in place of the flags. Reload the page to pick up frontend changes.
 
 ## Support
 
-Bugs and ideas for the SDK or the `termix-plugin` CLI go in the [Termix repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Add as much detail as you can, in English if possible.
+Bugs and ideas for the SDK or the `termix-plugin` CLI go in the [Termix repo](https://github.com/Termix-SSH/Termix/issues/new/choose). You need to be logged in to GitHub. Please be as detailed as possible, preferably in English.
 
 For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server.
 
@@ -58,4 +58,4 @@ For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf)
 
 ## License
 
-Apache License 2.0. See [LICENSE](https://github.com/Termix-SSH/Termix/blob/main/LICENSE).
+Distributed under the Apache License Version 2.0. See [LICENSE](https://github.com/Termix-SSH/Termix/blob/main/LICENSE) for more information.

packages/plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.8",
+  "version": "1.0.6",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {

packages/plugin-sdk/src/backend.ts

@@ -357,13 +357,6 @@ export interface PluginRouterOptions {
    * (multer, a raw body for signature checking, a proxied stream).
    */
   rawBody?: boolean;
-  /**
-   * Requests per minute one address may make to this plugin's public routes.
-   * Defaults to 120, which a proxied page loading its own scripts and images
-   * can pass on its own. Capped at 10000, and an admin's
-   * TERMIX_PLUGIN_PUBLIC_RATE_LIMIT wins over it.
-   */
-  publicRateLimit?: number;
 }
 
 /**

packages/plugin-sdk/src/ddl.ts

@@ -309,27 +309,17 @@ export function splitStatements(source: string): string[] {
       continue;
     }
     if (char === ";") {
-      if (hasSql(current)) statements.push(current.trim());
+      if (current.trim()) statements.push(current.trim());
       current = "";
       continue;
     }
     current += char;
   }
 
-  if (hasSql(current)) statements.push(current.trim());
+  if (current.trim()) statements.push(current.trim());
   return statements;
 }
 
-/** False for a chunk that is only comments, which a driver refuses to run. */
-function hasSql(chunk: string): boolean {
-  return (
-    chunk
-      .replace(/--[^\n]*/g, "")
-      .replace(/\/\*[\s\S]*?\*\//g, "")
-      .trim() !== ""
-  );
-}
-
 /** DROP statement for a definition, for removePluginData. */
 export function dropTableSql(
   dialect: SqlDialect,

scripts/build-plugins.cjs

@@ -7,7 +7,7 @@
  * pinned sha256 and unpacked.
  *
  * For development, `--local <dir>` (or TERMIX_LOCAL_PLUGINS) points at a
- * folder of plugin repos like ../Plugins. A plugin there whose sources
+ * folder of plugin repos like ../Termix-Plugins. A plugin there whose sources
  * changed since its last build is rebuilt first with this checkout's SDK, so
  * SDK edits apply without publishing, then any built one (has
  * dist/) is copied in place of its pin, or added when it has no pin.

scripts/dev.mjs

@@ -3,7 +3,7 @@
  * and options.
  *
  * Every target builds the SDK and stages plugins (local builds from
- * ../Plugins when it exists), then:
+ * ../Termix-Plugins when it exists), then:
  *
  * - web: compiles the backend in watch mode, starts it, then starts Vite. A
  *   backend or SDK change restarts the backend. A plugin change rebuilds that
@@ -652,7 +652,9 @@ async function main() {
   const pluginsDir = options.local
     ? path.resolve(
         root,
-        options.pluginsDir ?? process.env.TERMIX_LOCAL_PLUGINS ?? "../Plugins",
+        options.pluginsDir ??
+          process.env.TERMIX_LOCAL_PLUGINS ??
+          "../Termix-Plugins",
       )
     : null;
   const localPlugins =

scripts/electron-backend-failure.test.ts

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
 import { describe, expect, it } from "vitest";
-import { PRE_29_DATABASE_ERROR } from "../src/backend/database/db/upgrade-guard.js";
 
 const require = createRequire(import.meta.url);
 const { classifyBackendFailure } =
@@ -47,16 +46,6 @@ describe("classifyBackendFailure", () => {
     });
   });
 
-  it("identifies a 2.8 database the backend refused to open", () => {
-    const stderr = `[ERROR] [SYSTEM] Failed to initialize backend services [op:startup_failed]
-Error: ${PRE_29_DATABASE_ERROR}
-    at assertNotPre29Database (upgrade-guard.js:14:11)`;
-    expect(classifyBackendFailure(stderr)).toEqual({
-      reason: "old-database",
-      port: null,
-    });
-  });
-
   it("reports a crash for any other non-zero exit", () => {
     expect(classifyBackendFailure("TypeError: boom")).toEqual({
       reason: "crashed",

scripts/electron-external-editor.test.ts

@@ -1,40 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-
-const require = createRequire(import.meta.url);
-const { isLaunchableFileName } = require("../electron/external-editor.cjs") as {
-  isLaunchableFileName: (fileName: unknown) => boolean;
-};
-
-describe("Electron external editor", () => {
-  it("refuses remote file names the OS would run instead of open", () => {
-    for (const name of [
-      "payload.exe",
-      "run.BAT",
-      "script.ps1",
-      "a.exe. ",
-      "a.cmd...",
-      "../../evil.vbs",
-      "start.command",
-      "launch.desktop",
-      "install.sh",
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(true);
-    }
-  });
-
-  it("opens ordinary text files", () => {
-    for (const name of [
-      "nginx.conf",
-      "README.md",
-      "Dockerfile",
-      ".bashrc",
-      "config.json",
-      "index.ts",
-      "",
-      undefined,
-    ]) {
-      expect(isLaunchableFileName(name)).toBe(false);
-    }
-  });
-});

scripts/electron-external-login.test.ts

@@ -1,41 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-
-const require = createRequire(import.meta.url);
-const { isExternalLoginUrl, isCallbackPort } =
-  require("../electron/external-login.cjs") as {
-    isExternalLoginUrl: (value: unknown) => boolean;
-    isCallbackPort: (value: unknown) => boolean;
-  };
-
-describe("Electron external login", () => {
-  it.each([
-    "https://idp.example.com/authorize?client_id=termix",
-    "http://keycloak.lan:8080/realms/home/protocol/openid-connect/auth",
-  ])("opens web login URLs: %s", (url) => {
-    expect(isExternalLoginUrl(url)).toBe(true);
-  });
-
-  it.each([
-    "file:///C:/Windows/System32/calc.exe",
-    "smb://attacker/share",
-    "ms-msdt:/id PCWDiagnostic",
-    "javascript:alert(1)",
-    "not a url",
-    undefined,
-  ])("refuses other schemes: %s", (url) => {
-    expect(isExternalLoginUrl(url)).toBe(false);
-  });
-
-  it("accepts the ports the login screen picks", () => {
-    expect(isCallbackPort(17832)).toBe(true);
-    expect(isCallbackPort(17931)).toBe(true);
-  });
-
-  it.each([0, 80, 65536, 17832.5, "17832", NaN, undefined])(
-    "refuses callback port %s",
-    (port) => {
-      expect(isCallbackPort(port)).toBe(false);
-    },
-  );
-});

scripts/electron-security-boundary.test.ts

@@ -32,62 +32,9 @@ describe("Electron security boundary", () => {
     }
   });
 
-  it("never hands the session cookie to the renderer over IPC", () => {
-    for (const channel of ["get-session-cookie", "wait-session-cookie"]) {
-      expect(main).not.toContain(`"${channel}"`);
-      expect(preload).not.toContain(`"${channel}"`);
-    }
-  });
-
-  it("launches only the editor saved from a file dialog", () => {
-    expect(main).not.toContain("fileData?.editorPath");
-    expect(main).toContain("readSetting(EXTERNAL_EDITOR_SETTING)");
-    expect(main).toContain("dialogChosenPaths.has(value)");
-  });
-
   it("scopes proxy headers and basic auth to the linked origin", () => {
     expect(main).toContain('"sync-proxy-config"');
     expect(main).toContain("linkedServer.applyLinkHeaders(");
     expect(main).toContain("linkedServer.answerLogin(");
   });
 });
-
-it("rejects setting keys that coerce to the protected editor key", async () => {
-  const { runInNewContext } = await import("node:vm");
-  const { vi } = await import("vitest");
-  const writeFileSync = vi.fn();
-  let handler: (event: unknown, key: unknown, value: unknown) => unknown;
-  runInNewContext(
-    main.slice(
-      main.indexOf('ipcMain.handle("set-setting"'),
-      main.indexOf('ipcMain.handle("clear-session-cookies"'),
-    ),
-    {
-      ipcMain: {
-        handle: (_: string, callback: typeof handler) => {
-          handler = callback;
-        },
-      },
-      EXTERNAL_EDITOR_SETTING: "fileManager.externalEditorPath",
-      dialogChosenPaths: new Set(["/chosen/editor"]),
-      app: { getPath: () => "/settings" },
-      path: { join: (...parts: string[]) => parts.join("/") },
-      fs: { existsSync: () => false, mkdirSync: vi.fn(), writeFileSync },
-      console,
-    },
-  );
-  for (const key of [["fileManager.externalEditorPath"], null, {}, 42]) {
-    expect(handler!({}, key, "/unapproved/editor")).toEqual({
-      success: false,
-      error: "Invalid setting key",
-    });
-  }
-  expect(writeFileSync).not.toHaveBeenCalled();
-  expect(
-    handler!({}, "fileManager.externalEditorPath", "/unapproved/editor"),
-  ).toEqual({ success: false, error: "Choose the editor in the file dialog" });
-  expect(
-    handler!({}, "fileManager.externalEditorPath", "/chosen/editor"),
-  ).toEqual({ success: true });
-  expect(writeFileSync).toHaveBeenCalledOnce();
-});

scripts/fix-update-info.cjs

@@ -4,8 +4,7 @@
  * build, so the desktop updater gets the right download:
  *
  *   --drop <text>       remove entries whose file name contains text
- *                       (the ia32 installer, the combined Windows
- *                       installer, the universal mac zip)
+ *                       (the ia32 installer, the universal mac zip)
  *   --rename <old=new>  follow an artifact the workflow renamed
  *
  * Usage: node scripts/fix-update-info.cjs [--drop x] [--rename a=b] files...
@@ -16,12 +15,9 @@ const yaml = require("js-yaml");
 
 function fixUpdateInfo(info, { drop = [], rename = {} } = {}) {
   const rewrite = (name) => rename[name] ?? name;
-  const seen = new Set();
-  // electron-builder can list the same file more than once.
   const files = (info.files ?? [])
     .filter((file) => !drop.some((text) => file.url.includes(text)))
-    .map((file) => ({ ...file, url: rewrite(file.url) }))
-    .filter((file) => !seen.has(file.url) && seen.add(file.url));
+    .map((file) => ({ ...file, url: rewrite(file.url) }));
   if (files.length === 0) {
     throw new Error("no files left in update info");
   }

scripts/fix-update-info.test.ts

@@ -26,26 +26,6 @@ describe("fixUpdateInfo", () => {
     expect(fixed.version).toBe("26.10.2");
   });
 
-  it("drops the combined Windows installer and duplicate entries", () => {
-    const fixed = fixUpdateInfo(
-      {
-        ...info,
-        files: [
-          { url: "termix_windows_nsis.exe", sha512: "c", size: 3 },
-          { url: "termix_windows_ia32_nsis.exe", sha512: "a", size: 1 },
-          { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-          { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-        ],
-        path: "termix_windows_nsis.exe",
-      },
-      { drop: ["ia32", "termix_windows_nsis.exe"] },
-    );
-    expect(fixed.files).toEqual([
-      { url: "termix_windows_x64_nsis.exe", sha512: "b", size: 2 },
-    ]);
-    expect(fixed.path).toBe("termix_windows_x64_nsis.exe");
-  });
-
   it("follows renamed artifacts", () => {
     const fixed = fixUpdateInfo(
       {

scripts/lib/dev-runner.mjs

@@ -122,7 +122,7 @@ Targets
   docker     Build the production image and run it with your local plugins
 
 Options
-  --plugins <dir>  Plugin repos to build and watch (default ../Plugins)
+  --plugins <dir>  Plugin repos to build and watch (default ../Termix-Plugins)
   --no-local       Use only the plugins pinned in docker/bundled-plugins.json
   --db <engine>    sqlite (default), postgres or mysql. Postgres and MySQL run in Docker
   --guacd          Run guacd in Docker for remote desktop

scripts/patch-node-pty.cjs

@@ -3,45 +3,43 @@ const path = require("node:path");
 
 const nodePtyDir = path.join(__dirname, "..", "node_modules", "node-pty");
 
+if (!fs.existsSync(nodePtyDir)) {
+  console.log("[patch-node-pty] node-pty not found, skipping");
+  process.exit(0);
+}
+
 const unixTerminalPath = path.join(nodePtyDir, "lib", "unixTerminal.js");
 
-// Older installs may still carry the first version of this patch.
-const knownHelperRewrites = [
-  [
-    "helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
-    "helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
-  ].join("\n"),
-  [
-    "if (!helperPath.includes('app.asar.unpacked')) {",
-    "    helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
-    "}",
-    "if (!helperPath.includes('node_modules.asar.unpacked')) {",
-    "    helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
-    "}",
-  ].join("\n"),
-];
+const originalHelperRewrite = [
+  "helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
+  "helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
+].join("\n");
 
-// A universal macOS build ships app-arm64.asar and app-x64.asar, not app.asar.
-const patchedHelperRewrite =
-  "helperPath = helperPath.replace(/\\b(app(?:-[a-z0-9]+)?|node_modules)\\.asar(?!\\.unpacked)/g, '$1.asar.unpacked');";
+const patchedHelperRewrite = [
+  "if (!helperPath.includes('app.asar.unpacked')) {",
+  "    helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
+  "}",
+  "if (!helperPath.includes('node_modules.asar.unpacked')) {",
+  "    helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
+  "}",
+].join("\n");
 
-function patchUnixTerminalHelperRewrite(file = unixTerminalPath) {
-  if (!fs.existsSync(file)) {
+function patchUnixTerminalHelperRewrite() {
+  if (!fs.existsSync(unixTerminalPath)) {
     return false;
   }
 
-  const source = fs.readFileSync(file, "utf8");
+  const source = fs.readFileSync(unixTerminalPath, "utf8");
   if (source.includes(patchedHelperRewrite)) {
     return false;
   }
-  const known = knownHelperRewrites.find((rewrite) => source.includes(rewrite));
-  if (!known) {
+  if (!source.includes(originalHelperRewrite)) {
     return false;
   }
 
   fs.writeFileSync(
-    file,
-    source.replace(known, () => patchedHelperRewrite),
+    unixTerminalPath,
+    source.replace(originalHelperRewrite, patchedHelperRewrite),
   );
   return true;
 }
@@ -69,31 +67,19 @@ function chmodSpawnHelpers(rootDir) {
   return fixed;
 }
 
-// Tests and afterPack require this file; only a direct run patches node_modules.
-function main() {
-  if (!fs.existsSync(nodePtyDir)) {
-    console.log("[patch-node-pty] node-pty not found, skipping");
-    return;
-  }
+const helperRewritePatched = patchUnixTerminalHelperRewrite();
+const helpersChmodded = chmodSpawnHelpers(nodePtyDir);
 
-  const helperRewritePatched = patchUnixTerminalHelperRewrite();
-  const helpersChmodded = chmodSpawnHelpers(nodePtyDir);
-
-  if (helperRewritePatched) {
-    console.log("[patch-node-pty] Patched unixTerminal helper path rewrite");
-  }
-  if (helpersChmodded > 0) {
-    console.log(
-      `[patch-node-pty] Restored execute bit on ${helpersChmodded} spawn-helper binary(ies)`,
-    );
-  }
-  if (!helperRewritePatched && helpersChmodded === 0) {
-    console.log("[patch-node-pty] Already patched or target files not found");
-  }
+if (helperRewritePatched) {
+  console.log("[patch-node-pty] Patched unixTerminal helper path rewrite");
 }
-
-if (require.main === module) {
-  main();
+if (helpersChmodded > 0) {
+  console.log(
+    `[patch-node-pty] Restored execute bit on ${helpersChmodded} spawn-helper binary(ies)`,
+  );
+}
+if (!helperRewritePatched && helpersChmodded === 0) {
+  console.log("[patch-node-pty] Already patched or target files not found");
 }
 
 module.exports = { chmodSpawnHelpers, patchUnixTerminalHelperRewrite };

src/backend/database/database.ts

@@ -79,6 +79,7 @@ import {
   createCurrentSshCredentialUsageRepository,
   createCurrentUserRepository,
 } from "./repositories/factory.js";
+import { withCurrentSqliteForeignKeysDisabled } from "./repositories/sqlite-foreign-keys.js";
 import { applyPluginHostImportSettings } from "./routes/host-plugin-settings.js";
 import {
   selectExportableSettings,
@@ -1234,218 +1235,227 @@ app.post(
       };
 
       try {
-        // The file's credential ids belong to the server that wrote it.
-        const credentialIds = new Map<number, number>();
-        try {
-          const importedCreds = importDb
-            .prepare("SELECT * FROM ssh_credentials")
-            .all();
-          for (const cred of importedCreds) {
-            try {
-              const credentialRepository = createCurrentCredentialRepository();
-              const existingId =
-                await credentialRepository.findIdForImportIdentity(
-                  userId,
-                  cred.name,
-                  cred.username,
-                );
-
-              if (existingId !== null) {
-                credentialIds.set(cred.id, existingId);
-                result.summary.skippedItems++;
-                continue;
-              }
-
-              const credData = {
-                userId: userId,
-                name: cred.name,
-                description: cred.description,
-                folder: cred.folder,
-                tags: cred.tags,
-                authType: cred.auth_type,
-                username: cred.username,
-                password: cred.password,
-                key: cred.key,
-                privateKey: cred.private_key,
-                publicKey: cred.public_key,
-                keyPassword: cred.key_password,
-                keyType: cred.key_type,
-                detectedKeyType: cred.detected_key_type,
-                usageCount: cred.usage_count || 0,
-                lastUsed: cred.last_used,
-                createdAt: cred.created_at || new Date().toISOString(),
-                updatedAt: new Date().toISOString(),
-              };
-
-              const created = await credentialRepository.createEncryptedForUser(
-                userId,
-                credData,
-              );
-              credentialIds.set(cred.id, Number(created.id));
-              result.summary.sshCredentialsImported++;
-            } catch (credError) {
-              result.summary.errors.push(
-                `SSH credential import error: ${credError.message}`,
-              );
-            }
-          }
-        } catch {
-          apiLogger.info(
-            "ssh_credentials table not found in import file, skipping",
-          );
-        }
-
-        try {
-          const importedHosts = importDb
-            .prepare("SELECT * FROM ssh_data")
-            .all();
-          const importedHostIds: number[] = [];
-          for (const host of importedHosts) {
-            try {
-              const hostRepository = createCurrentHostRepository();
-              const exists = await hostRepository.existsForImportIdentity(
-                userId,
-                host.ip,
-                host.port,
-                host.username,
-              );
-
-              if (exists) {
-                result.summary.skippedItems++;
-                continue;
-              }
-
-              const hostData = {
-                userId: userId,
-                name: host.name,
-                ip: host.ip,
-                port: host.port,
-                username: host.username,
-                folder: host.folder,
-                tags: host.tags,
-                pin: Boolean(host.pin),
-                authType: host.auth_type,
-                forceKeyboardInteractive: host.force_keyboard_interactive,
-                password: host.password,
-                key: host.key,
-                keyPassword: host.key_password,
-                keyType: host.key_type,
-                sudoPassword: host.sudo_password,
-                credentialId: credentialIds.get(host.credential_id) ?? null,
-                overrideCredentialUsername: Boolean(
-                  host.override_credential_username,
-                ),
-                jumpHosts: host.jump_hosts,
-                ...legacyStatusCheck(host),
-                // Exports from before 2.9.0 carry these in terminal_config.
-                sshOptions:
-                  host.ssh_options ??
-                  sshOptionsForWrite({
-                    terminalConfig: host.terminal_config,
-                  }) ??
-                  null,
-                notes: host.notes,
-                useSocks5: Boolean(host.use_socks5),
-                socks5Host: host.socks5_host,
-                socks5Port: host.socks5_port,
-                socks5Username: host.socks5_username,
-                socks5Password: host.socks5_password,
-                socks5ProxyChain: host.socks5_proxy_chain,
-                createdAt: host.created_at || new Date().toISOString(),
-                updatedAt: new Date().toISOString(),
-              };
-
-              (hostData as Record<string, unknown>).defaultOverrides =
-                JSON.stringify(
-                  await applyHostDefaultsToWrite({
-                    ownerId: userId,
-                    hostId: null,
-                    columns: hostData as Record<string, unknown>,
-                    body: hostData as Record<string, unknown>,
-                  }),
-                );
-              const created = await hostRepository.createEncryptedForUser(
-                userId,
-                hostData,
-              );
-              await applyPluginHostImportSettings(
-                Number(created.id),
-                importedHostPluginSettings(importDb, host),
-              );
-              importedHostIds.push(Number(created.id));
-              await importHostProtocolLogins(
-                importDb,
-                host,
-                Number(created.id),
-                userId,
-                credentialIds,
-              );
-              result.summary.sshHostsImported++;
-            } catch (hostError) {
-              result.summary.errors.push(
-                `SSH host import error: ${hostError.message}`,
-              );
-            }
-          }
-          await applyDefaultsAfterHostWrites(importedHostIds);
-        } catch {
-          apiLogger.info("ssh_data table not found in import file, skipping");
-        }
-
-        const pluginRows = await importUserPluginRows(importDb, userId);
-        result.summary.pluginItemsImported += pluginRows.imported;
-        result.summary.skippedItems += pluginRows.skipped;
-        result.summary.errors.push(...pluginRows.errors);
-
-        const hostDefaults = await importHostDefaults(importDb, userId);
-        result.summary.skippedItems += hostDefaults.skipped;
-        if (hostDefaults.imported > 0) {
-          await recompute({ userIds: [userId] });
-        }
-
-        const targetUser = await userRepository.findById(userId);
-        if (targetUser?.isAdmin) {
+        await withCurrentSqliteForeignKeysDisabled(async () => {
           try {
-            const importedSettings = readImportedSettings(importDb);
-            for (const setting of importedSettings) {
+            const importedHosts = importDb
+              .prepare("SELECT * FROM ssh_data")
+              .all();
+            const importedHostIds: number[] = [];
+            for (const host of importedHosts) {
               try {
-                await upsertImportedSetting(setting);
-                result.summary.settingsImported++;
-              } catch (settingError) {
+                const hostRepository = createCurrentHostRepository();
+                const exists = await hostRepository.existsForImportIdentity(
+                  userId,
+                  host.ip,
+                  host.port,
+                  host.username,
+                );
+
+                if (exists) {
+                  result.summary.skippedItems++;
+                  continue;
+                }
+
+                const hostData = {
+                  userId: userId,
+                  name: host.name,
+                  ip: host.ip,
+                  port: host.port,
+                  username: host.username,
+                  folder: host.folder,
+                  tags: host.tags,
+                  pin: Boolean(host.pin),
+                  authType: host.auth_type,
+                  forceKeyboardInteractive: host.force_keyboard_interactive,
+                  password: host.password,
+                  key: host.key,
+                  keyPassword: host.key_password,
+                  keyType: host.key_type,
+                  sudoPassword: host.sudo_password,
+                  credentialId: host.credential_id || null,
+                  overrideCredentialUsername: Boolean(
+                    host.override_credential_username,
+                  ),
+                  jumpHosts: host.jump_hosts,
+                  ...legacyStatusCheck(host),
+                  // Exports from before 2.9.0 carry these in terminal_config.
+                  sshOptions:
+                    host.ssh_options ??
+                    sshOptionsForWrite({
+                      terminalConfig: host.terminal_config,
+                    }) ??
+                    null,
+                  notes: host.notes,
+                  useSocks5: Boolean(host.use_socks5),
+                  socks5Host: host.socks5_host,
+                  socks5Port: host.socks5_port,
+                  socks5Username: host.socks5_username,
+                  socks5Password: host.socks5_password,
+                  socks5ProxyChain: host.socks5_proxy_chain,
+                  createdAt: host.created_at || new Date().toISOString(),
+                  updatedAt: new Date().toISOString(),
+                };
+
+                (hostData as Record<string, unknown>).defaultOverrides =
+                  JSON.stringify(
+                    await applyHostDefaultsToWrite({
+                      ownerId: userId,
+                      hostId: null,
+                      columns: hostData as Record<string, unknown>,
+                      body: hostData as Record<string, unknown>,
+                    }),
+                  );
+                const created = await hostRepository.createEncryptedForUser(
+                  userId,
+                  hostData,
+                );
+                await applyPluginHostImportSettings(
+                  Number(created.id),
+                  importedHostPluginSettings(importDb, host),
+                );
+                importedHostIds.push(Number(created.id));
+                await importHostProtocolLogins(
+                  importDb,
+                  host,
+                  Number(created.id),
+                  userId,
+                );
+                result.summary.sshHostsImported++;
+              } catch (hostError) {
                 result.summary.errors.push(
-                  `Setting import error (${setting.key}): ${settingError.message}`,
+                  `SSH host import error: ${hostError.message}`,
+                );
+              }
+            }
+            await applyDefaultsAfterHostWrites(importedHostIds);
+          } catch {
+            apiLogger.info("ssh_data table not found in import file, skipping");
+          }
+
+          try {
+            const importedCreds = importDb
+              .prepare("SELECT * FROM ssh_credentials")
+              .all();
+            for (const cred of importedCreds) {
+              try {
+                const credentialRepository =
+                  createCurrentCredentialRepository();
+                const exists =
+                  await credentialRepository.existsForImportIdentity(
+                    userId,
+                    cred.name,
+                    cred.username,
+                  );
+
+                if (exists) {
+                  result.summary.skippedItems++;
+                  continue;
+                }
+
+                const credData = {
+                  userId: userId,
+                  name: cred.name,
+                  description: cred.description,
+                  folder: cred.folder,
+                  tags: cred.tags,
+                  authType: cred.auth_type,
+                  username: cred.username,
+                  password: cred.password,
+                  key: cred.key,
+                  privateKey: cred.private_key,
+                  publicKey: cred.public_key,
+                  keyPassword: cred.key_password,
+                  keyType: cred.key_type,
+                  detectedKeyType: cred.detected_key_type,
+                  usageCount: cred.usage_count || 0,
+                  lastUsed: cred.last_used,
+                  createdAt: cred.created_at || new Date().toISOString(),
+                  updatedAt: new Date().toISOString(),
+                };
+
+                await credentialRepository.createEncryptedForUser(
+                  userId,
+                  credData,
+                );
+                result.summary.sshCredentialsImported++;
+              } catch (credError) {
+                result.summary.errors.push(
+                  `SSH credential import error: ${credError.message}`,
                 );
               }
             }
           } catch {
-            apiLogger.info("settings table not found in import file, skipping");
+            apiLogger.info(
+              "ssh_credentials table not found in import file, skipping",
+            );
           }
-        } else {
-          apiLogger.info(
-            "Settings import skipped - only admin users can import settings",
-          );
-        }
 
-        result.success = true;
+          const pluginRows = await importUserPluginRows(importDb, userId);
+          result.summary.pluginItemsImported += pluginRows.imported;
+          result.summary.skippedItems += pluginRows.skipped;
+          result.summary.errors.push(...pluginRows.errors);
 
-        try {
-          await DatabaseSaveTrigger.forceSave("database_import");
-        } catch (saveError) {
-          apiLogger.error(
-            "Failed to persist imported data to disk",
-            saveError,
-            {
-              operation: "import_force_save_failed",
-              userId,
-            },
-          );
-        }
+          const hostDefaults = await importHostDefaults(importDb, userId);
+          result.summary.skippedItems += hostDefaults.skipped;
+          if (hostDefaults.imported > 0) {
+            await recompute({ userIds: [userId] });
+          }
+
+          const targetUser = await userRepository.findById(userId);
+          if (targetUser?.isAdmin) {
+            try {
+              const importedSettings = readImportedSettings(importDb);
+              for (const setting of importedSettings) {
+                try {
+                  await upsertImportedSetting(setting);
+                  result.summary.settingsImported++;
+                } catch (settingError) {
+                  result.summary.errors.push(
+                    `Setting import error (${setting.key}): ${settingError.message}`,
+                  );
+                }
+              }
+            } catch {
+              apiLogger.info(
+                "settings table not found in import file, skipping",
+              );
+            }
+          } else {
+            apiLogger.info(
+              "Settings import skipped - only admin users can import settings",
+            );
+          }
+
+          result.success = true;
+
+          try {
+            await DatabaseSaveTrigger.forceSave("database_import");
+          } catch (saveError) {
+            apiLogger.error(
+              "Failed to persist imported data to disk",
+              saveError,
+              {
+                operation: "import_force_save_failed",
+                userId,
+              },
+            );
+          }
+        });
       } finally {
         if (importDb) {
           importDb.close();
         }
       }
 
+      try {
+        fs.unlinkSync(req.file.path);
+      } catch {
+        apiLogger.warn("Failed to clean up uploaded file", {
+          operation: "file_cleanup_warning",
+          filePath: req.file.path,
+        });
+      }
+
       res.json({
         success: result.success,
         message: result.success
@@ -1462,6 +1472,17 @@ app.post(
         });
       }
     } catch (error) {
+      if (req.file?.path && fs.existsSync(req.file.path)) {
+        try {
+          fs.unlinkSync(req.file.path);
+        } catch {
+          apiLogger.warn("Failed to clean up uploaded file after error", {
+            operation: "file_cleanup_error",
+            filePath: req.file.path,
+          });
+        }
+      }
+
       apiLogger.error("SQLite import failed", error, {
         operation: "sqlite_import_api_failed",
         userId: (req as AuthenticatedRequest).userId,
@@ -1470,17 +1491,6 @@ app.post(
         error: "Failed to import SQLite data",
         details: getErrorMessage(error),
       });
-    } finally {
-      if (req.file) {
-        try {
-          fs.rmSync(req.file.path, { force: true });
-        } catch {
-          apiLogger.warn("Failed to clean up uploaded file", {
-            operation: "file_cleanup_warning",
-            filePath: req.file.path,
-          });
-        }
-      }
     }
   }),
 );
@@ -2002,15 +2012,14 @@ function legacyStatusCheck(row: Record<string, unknown>): {
 
 /**
  * A host's plugin protocol logins from an export. The file's credential ids
- * belong to the server that wrote it, so a login keeps one only when it maps
- * to a credential imported alongside it.
+ * belong to the server that wrote it, so a login keeps one only when it is
+ * a credential the importing user can use.
  */
 async function importHostProtocolLogins(
   importDb: Database.Database,
   host: Record<string, unknown>,
   hostId: number,
   userId: string,
-  credentialIds: Map<number, number>,
 ): Promise<void> {
   let rows: Array<Record<string, unknown>>;
   try {
@@ -2031,7 +2040,7 @@ async function importHostProtocolLogins(
     }
     protocolAuth[String(row.protocol)] = {
       authType: row.auth_type,
-      credentialId: credentialIds.get(row.credential_id as number) ?? null,
+      credentialId: row.credential_id,
       username: row.username,
       password: row.password,
       fields,

src/backend/database/db/index.ts

@@ -542,6 +542,7 @@ async function initializeCompleteDatabase(): Promise<void> {
         plugin_id TEXT NOT NULL,
         registry_id TEXT NOT NULL,
         count INTEGER NOT NULL DEFAULT 0,
+        source TEXT NOT NULL DEFAULT 'aggregate-telemetry',
         updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
         UNIQUE (plugin_id, registry_id)
     );
@@ -925,38 +926,6 @@ const dropRetiredColumns = () => {
   }
 };
 
-// Registration checked for a taken username and then inserted with nothing
-// enforcing it, so concurrent sign-ups could create two accounts with one
-// name, and every lookup by username picked between them arbitrarily. Later
-// duplicates are renamed rather than deleted, so no account is lost.
-const enforceUniqueUsernames = () => {
-  try {
-    sqlite.exec(`
-      WITH ranked AS MATERIALIZED (
-        SELECT id, username,
-          ROW_NUMBER() OVER (ORDER BY registered_at, id) AS sequence,
-          ROW_NUMBER() OVER (PARTITION BY username ORDER BY registered_at, id) AS occurrence
-        FROM users
-      ), candidates AS (
-        SELECT 0 AS candidate UNION ALL SELECT sequence FROM ranked
-      ), available AS (
-        SELECT MIN(candidate) AS candidate FROM candidates
-        WHERE NOT EXISTS (
-          SELECT 1 FROM ranked WHERE username LIKE 'termix-recovered-' || candidate || '-' || '%'
-        )
-      )
-      UPDATE users SET username = 'termix-recovered-' || (SELECT candidate FROM available) || '-' || ranked.sequence
-      FROM ranked WHERE ranked.id = users.id AND ranked.occurrence > 1;
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users (username);
-    `);
-  } catch (error) {
-    databaseLogger.warn("Failed to enforce unique usernames", {
-      operation: "schema_migration",
-      error: getErrorMessage(error),
-    });
-  }
-};
-
 const migrateSchema = () => {
   repairSnippetsColumns(sqlite);
   addColumnIfNotExists("user_preferences", "theme", "TEXT");
@@ -1028,7 +997,6 @@ const migrateSchema = () => {
       );
     }
   }
-  enforceUniqueUsernames();
   addColumnIfNotExists("sessions", "external_session_ref", "TEXT");
 
   addColumnIfNotExists("ssh_data", "name", "TEXT");
@@ -1926,23 +1894,6 @@ async function moveRemoteLegacySudoPasswords(remote: {
   }
 }
 
-async function dropMysqlForeignKeys(
-  remote: { execute: (query: SQL) => Promise<unknown> },
-  table: string,
-  column: string,
-): Promise<void> {
-  const keys = resultRows<{ name: string }>(
-    await remote.execute(
-      sql`SELECT CONSTRAINT_NAME AS name FROM information_schema.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ${table} AND COLUMN_NAME = ${column} AND REFERENCED_TABLE_NAME IS NOT NULL`,
-    ),
-  );
-  for (const key of keys) {
-    await remote.execute(
-      sql`ALTER TABLE ${sql.identifier(table)} DROP FOREIGN KEY ${sql.identifier(key.name)}`,
-    );
-  }
-}
-
 /**
  * The columns 2.9.0 left in place without a drizzle migration, so drizzle no
  * longer knows them. Dropped by hand, only where they still exist.
@@ -1978,10 +1929,6 @@ async function dropRemoteRetired(
     for (const column of columns) {
       if (!existing.has(`${table}.${column}`)) continue;
       try {
-        // Postgres drops a column's foreign keys with it; MySQL refuses.
-        if (dialect === "mysql") {
-          await dropMysqlForeignKeys(remote, table, column);
-        }
         await remote.execute(
           sql`ALTER TABLE ${sql.identifier(table)} DROP COLUMN ${sql.identifier(column)}`,
         );

src/backend/database/db/retired-columns.ts

@@ -5,11 +5,8 @@
  *
  * Kept on purpose: columns a move only reads once the owner's data key opens
  * at a password login (users.totp_*, the rdp, vnc and telnet logins and
- * domain), so a user who never signed in to 2.9 still gets them.
- *
- * ssh_data.vault_profile_id goes because its foreign key follows the vault
- * plugin's rename of vault_profiles: once the plugin is uninstalled, SQLite
- * refuses every write to ssh_data and the other engines refuse the uninstall.
+ * domain), so a user who never signed in to 2.9 still gets them, and
+ * ssh_data.vault_profile_id, whose foreign key SQLite cannot drop in place.
  */
 
 /** Columns drizzle never knew were removed, dropped by hand on every engine. */
@@ -55,7 +52,6 @@ export const REMOTE_RETIRED_COLUMNS: Record<string, string[]> = {
     "telnet_port",
     "tunnel_connections",
     "use_warpgate",
-    "vault_profile_id",
     "vnc_port",
     "web_ui_config",
     "wol_broadcast_address",
@@ -84,8 +80,6 @@ export const RETIRED_COLUMNS: Record<string, string[]> = {
     "donation_modal_dismissed",
   ],
   sessions: ["oidc_sub", "oidc_sid", "sso_provider_id"],
-  // 26.10.1 shows downloads only.
-  plugin_install_counts: ["source"],
   user_preferences: [
     "command_autocomplete",
     "terminal_defaults",

src/backend/database/db/schema.mysql.ts

@@ -21,19 +21,13 @@ import {
 } from "drizzle-orm/mysql-core";
 import { sql } from "drizzle-orm";
 
-export const users = mysqlTable(
-  "users",
-  {
-    id: varchar("id", { length: 255 }).primaryKey(),
-    username: varchar("username", { length: 255 }).notNull(),
-    passwordHash: text("password_hash").notNull(),
-    isAdmin: boolean("is_admin").notNull().default(false),
-    registeredAt: text("registered_at")
-      .notNull()
-      .default(sql`(CURRENT_TIMESTAMP)`),
-  },
-  (table) => [uniqueIndex("idx_users_username").on(table.username)],
-);
+export const users = mysqlTable("users", {
+  id: varchar("id", { length: 255 }).primaryKey(),
+  username: text("username").notNull(),
+  passwordHash: text("password_hash").notNull(),
+  isAdmin: boolean("is_admin").notNull().default(false),
+  registeredAt: text("registered_at").notNull().default(sql`(CURRENT_TIMESTAMP)`),
+});
 
 export const settings = mysqlTable("settings", {
   key: varchar("key", { length: 255 }).primaryKey(),
@@ -1061,9 +1055,10 @@ export const pluginRegistries = mysqlTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = mysqlTable(
   "plugin_install_counts",
@@ -1072,6 +1067,7 @@ export const pluginInstallCounts = mysqlTable(
     pluginId: varchar("plugin_id", { length: 255 }).notNull(),
     registryId: varchar("registry_id", { length: 255 }).notNull(),
     count: int("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`(CURRENT_TIMESTAMP)`),

src/backend/database/db/schema.pg.ts

@@ -21,19 +21,13 @@ import {
 } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 
-export const users = pgTable(
-  "users",
-  {
-    id: varchar("id", { length: 255 }).primaryKey(),
-    username: varchar("username", { length: 255 }).notNull(),
-    passwordHash: text("password_hash").notNull(),
-    isAdmin: boolean("is_admin").notNull().default(false),
-    registeredAt: text("registered_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  (table) => [uniqueIndex("idx_users_username").on(table.username)],
-);
+export const users = pgTable("users", {
+  id: varchar("id", { length: 255 }).primaryKey(),
+  username: text("username").notNull(),
+  passwordHash: text("password_hash").notNull(),
+  isAdmin: boolean("is_admin").notNull().default(false),
+  registeredAt: text("registered_at").notNull().default(sql`CURRENT_TIMESTAMP`),
+});
 
 export const settings = pgTable("settings", {
   key: varchar("key", { length: 255 }).primaryKey(),
@@ -1061,9 +1055,10 @@ export const pluginRegistries = pgTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = pgTable(
   "plugin_install_counts",
@@ -1072,6 +1067,7 @@ export const pluginInstallCounts = pgTable(
     pluginId: varchar("plugin_id", { length: 255 }).notNull(),
     registryId: varchar("registry_id", { length: 255 }).notNull(),
     count: integer("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`CURRENT_TIMESTAMP`),

src/backend/database/db/schema.ts

@@ -9,19 +9,13 @@ import {
 } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";
 
-export const users = sqliteTable(
-  "users",
-  {
-    id: text("id").primaryKey(),
-    username: text("username").notNull(),
-    passwordHash: text("password_hash").notNull(),
-    isAdmin: integer("is_admin", { mode: "boolean" }).notNull().default(false),
-    registeredAt: text("registered_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  (table) => [uniqueIndex("idx_users_username").on(table.username)],
-);
+export const users = sqliteTable("users", {
+  id: text("id").primaryKey(),
+  username: text("username").notNull(),
+  passwordHash: text("password_hash").notNull(),
+  isAdmin: integer("is_admin", { mode: "boolean" }).notNull().default(false),
+  registeredAt: text("registered_at").notNull().default(sql`CURRENT_TIMESTAMP`),
+});
 
 export const settings = sqliteTable("settings", {
   key: text("key").primaryKey(),
@@ -1057,9 +1051,10 @@ export const pluginRegistries = sqliteTable("plugin_registries", {
 });
 
 /**
- * Download counts from each registry's stats.json, written by a background
- * job rather than by installs, kept separate from `plugins` so that job can
- * overwrite counts without touching install state.
+ * Install counts populated by a background job (GitHub release download
+ * counts, aggregated telemetry, or a manual override) rather than by the
+ * install/uninstall actions themselves, kept separate from `plugins` so
+ * that job can overwrite counts without touching install state.
  */
 export const pluginInstallCounts = sqliteTable(
   "plugin_install_counts",
@@ -1068,6 +1063,7 @@ export const pluginInstallCounts = sqliteTable(
     pluginId: text("plugin_id").notNull(),
     registryId: text("registry_id").notNull(),
     count: integer("count").notNull().default(0),
+    source: text("source").notNull().default("aggregate-telemetry"),
     updatedAt: text("updated_at")
       .notNull()
       .default(sql`CURRENT_TIMESTAMP`),

src/backend/database/repositories/credential-repository.ts

@@ -103,11 +103,11 @@ export class CredentialRepository {
       .orderBy(desc(sshCredentials.updatedAt));
   }
 
-  async findIdForImportIdentity(
+  async existsForImportIdentity(
     userId: string,
     name: string,
     username: string | null,
-  ): Promise<number | null> {
+  ): Promise<boolean> {
     const rows = await this.context.drizzle
       .select({ id: sshCredentials.id })
       .from(sshCredentials)
@@ -120,7 +120,7 @@ export class CredentialRepository {
       )
       .limit(1);
 
-    return rows[0]?.id ?? null;
+    return rows.length > 0;
   }
 
   async findDecryptedByIdForUser(

src/backend/database/repositories/plugin-install-count-repository.ts

@@ -7,9 +7,10 @@ export type PluginInstallCountRecord = typeof pluginInstallCounts.$inferSelect;
 export interface PluginInstallCountInput {
   pluginId: string;
   count: number;
+  source: string;
 }
 
-/** Download counts for the store, one row per plugin and registry. */
+/** Popularity numbers for the store, one row per plugin and registry. */
 export class PluginInstallCountRepository {
   constructor(
     private readonly context: DatabaseContext,
@@ -37,11 +38,13 @@ export class PluginInstallCountRepository {
     let written = 0;
     for (const entry of entries) {
       const row = existing.get(entry.pluginId);
-      if (row && row.count === entry.count) continue;
+      if (row && row.count === entry.count && row.source === entry.source) {
+        continue;
+      }
       if (row) {
         await this.context.drizzle
           .update(pluginInstallCounts)
-          .set({ count: entry.count, updatedAt: now })
+          .set({ count: entry.count, source: entry.source, updatedAt: now })
           .where(
             and(
               eq(pluginInstallCounts.pluginId, entry.pluginId),
@@ -53,6 +56,7 @@ export class PluginInstallCountRepository {
           pluginId: entry.pluginId,
           registryId,
           count: entry.count,
+          source: entry.source,
           updatedAt: now,
         });
       }

src/backend/database/repositories/sqlite-foreign-keys.ts

@@ -0,0 +1,40 @@
+import { getCurrentRepositorySqlite } from "./factory.js";
+import { needsExplicitPersist, resolveDatabaseDialect } from "../db/dialect.js";
+
+export interface SqliteForeignKeyClient {
+  exec(sql: string): unknown;
+}
+
+export async function withSqliteForeignKeysDisabled<T>(
+  sqlite: SqliteForeignKeyClient,
+  operation: () => Promise<T>,
+): Promise<T> {
+  sqlite.exec("PRAGMA foreign_keys = OFF");
+  try {
+    return await operation();
+  } finally {
+    sqlite.exec("PRAGMA foreign_keys = ON");
+  }
+}
+
+/**
+ * Runs a bulk import with foreign keys relaxed.
+ *
+ * Backup restore writes tables in an order that is not dependency-safe, so the
+ * constraints have to stand down for the duration.
+ *
+ * Postgres and MySQL keep their constraints enabled. The portable importer
+ * writes through repositories and handles individual row failures, so it must
+ * still be allowed to run there; only SQLite needs this connection-local
+ * relaxation for legacy backups whose rows are not dependency ordered.
+ */
+export async function withCurrentSqliteForeignKeysDisabled<T>(
+  operation: () => Promise<T>,
+): Promise<T> {
+  const dialect = resolveDatabaseDialect();
+  if (!needsExplicitPersist(dialect)) {
+    return operation();
+  }
+
+  return withSqliteForeignKeysDisabled(getCurrentRepositorySqlite(), operation);
+}

src/backend/database/repositories/user-repository.ts

@@ -24,27 +24,6 @@ const userColumns = {
     ),
 };
 
-// The unique-violation codes of better-sqlite3, node-postgres and mysql2.
-const UNIQUE_VIOLATION_CODES = new Set([
-  "SQLITE_CONSTRAINT_UNIQUE",
-  "23505",
-  "ER_DUP_ENTRY",
-]);
-
-/**
- * Whether creating a user failed because the username is taken. The id is
- * generated, so the username index is the only one a new row can collide on.
- * drizzle wraps driver errors, so the code may sit on a cause.
- */
-export function isUsernameTaken(error: unknown): boolean {
-  for (let e = error; e instanceof Error; e = e.cause) {
-    if (UNIQUE_VIOLATION_CODES.has((e as { code?: string }).code ?? "")) {
-      return true;
-    }
-  }
-  return false;
-}
-
 export class UserRepository {
   constructor(
     private readonly context: DatabaseContext,

src/backend/database/routes/host-bulk-routes.ts

@@ -91,11 +91,11 @@ export function parseSSHConfig(content: string): SSHConfigHost[] {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) continue;
 
-    const match = /^(\S+?)(?:\s*=\s*|\s+)(.+)$/.exec(line);
-    if (!match) continue;
+    const spaceIdx = line.indexOf(" ");
+    if (spaceIdx === -1) continue;
 
-    const key = match[1].toLowerCase();
-    const value = match[2];
+    const key = line.slice(0, spaceIdx).toLowerCase();
+    const value = line.slice(spaceIdx + 1).trim();
 
     if (key === "host") {
       if (current && current.hostname) results.push(current);

src/backend/database/routes/plugins.ts

@@ -243,9 +243,7 @@ export async function listPreLoginPlugins(): Promise<
  *       frontends in the same order the server does.
  *
  *       On a desktop linked to a server, `runsOnServer` marks plugins that
- *       only run on that server and stay off here on purpose, and, for
- *       admins, `managedByServer` marks plugins whose on/off state the server
- *       decides.
+ *       only run on that server and stay off here on purpose.
  *     tags:
  *       - Plugins
  *     responses:
@@ -372,7 +370,6 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
           features,
           env,
           signedBy: loaded?.signedBy ?? null,
-          managedByServer: linked && (await isManagedByLinkedServer(record.id)),
           capabilities,
           grantedCapabilities: grantsByPlugin.get(record.id) ?? [],
           lastError: loaded?.lastError ?? record.lastError ?? null,
@@ -396,7 +393,9 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
 });
 
 async function isManagedByLinkedServer(pluginId: string): Promise<boolean> {
-  if (!(await isLinkedDesktop())) return false;
+  if (process.env.ELECTRON_EMBEDDED !== "true") return false;
+  const { getLink } = await import("../../sync/client/link-store.js");
+  if (!(await getLink())) return false;
   const { isServerManaged } = await import("../../sync/client/plugins.js");
   return isServerManaged(pluginId);
 }
@@ -501,7 +500,7 @@ router.get(
  * /plugins/onboarding/apply:
  *   post:
  *     summary: Apply the onboarding plugin picker
- *     description: Sets every listed plugin to enabled, disabled or removed in one pass. Choices are first raised so that every kept plugin still has its hard dependencies (the adjustments list says which and why). Enabling runs dependencies first, disabling and removing run dependents first, and one plugin failing does not stop the rest. Removing a bundled plugin deletes it and its data; it can be reinstalled from the registry later. Clears the fresh-install pending flag. With dryRun nothing changes and the response lists what would. On a linked desktop, locally managed plugins require version and capabilities matching the reviewed manifest when enabling.
+ *     description: Sets every listed plugin to enabled, disabled or removed in one pass. Choices are first raised so that every kept plugin still has its hard dependencies (the adjustments list says which and why). Enabling runs dependencies first, disabling and removing run dependents first, and one plugin failing does not stop the rest. Removing a bundled plugin deletes it and its data; it can be reinstalled from the registry later. Clears the fresh-install pending flag. With dryRun nothing changes and the response lists what would.
  *     tags:
  *       - Plugins
  *     requestBody:
@@ -888,7 +887,7 @@ router.delete(
  * /plugins/{id}/state:
  *   patch:
  *     summary: Enable or disable a plugin
- *     description: Persists the new state and starts or stops the plugin immediately. Disabling releases everything the plugin owns, including any port it was listening on. Enabling also starts any installed hard dependency that is off, and disabling also stops the running plugins that depend on it. With dryRun nothing changes and the response lists what would. On a linked desktop, locally managed plugins require version and capabilities matching the reviewed manifest when enabling.
+ *     description: Persists the new state and starts or stops the plugin immediately. Disabling releases everything the plugin owns, including any port it was listening on. Enabling also starts any installed hard dependency that is off, and disabling also stops the running plugins that depend on it. With dryRun nothing changes and the response lists what would.
  *     tags:
  *       - Plugins
  *     parameters:
@@ -910,12 +909,6 @@ router.delete(
  *             properties:
  *               enabled:
  *                 type: boolean
- *               version:
- *                 type: string
- *               capabilities:
- *                 type: array
- *                 items:
- *                   type: string
  *     responses:
  *       200:
  *         description: The plugin's new state.
@@ -969,26 +962,7 @@ router.patch(
         return;
       }
 
-      let result;
-      if (enabled && (await isLinkedDesktop())) {
-        const version = readVersion(req.body);
-        const capabilities = readCapabilities(req.body);
-        if (version === null || capabilities === null) {
-          res
-            .status(400)
-            .json({ error: "Invalid plugin version or capabilities" });
-          return;
-        }
-        const { enablePluginWithConsent } =
-          await import("../../plugins/manage.js");
-        result = await enablePluginWithConsent(pluginId, {
-          version,
-          capabilities,
-          userId: (req as AuthenticatedRequest).userId as string,
-        });
-      } else {
-        result = await setPluginState(pluginId, enabled);
-      }
+      const result = await setPluginState(pluginId, enabled);
       await auditPluginAction(
         req,
         enabled ? "enable_plugin" : "disable_plugin",

src/backend/database/routes/user-admin-routes.ts

@@ -17,10 +17,9 @@ import {
   listUserSecondFactors,
   resetUserSecondFactors,
 } from "../../auth/second-factor-admin.js";
-import {
-  isUsernameTaken,
-  type UserRecord,
-  type UserRepository,
+import type {
+  UserRecord,
+  UserRepository,
 } from "../repositories/user-repository.js";
 
 function isNonEmptyString(val: unknown): val is string {
@@ -542,9 +541,6 @@ export function registerUserAdminRoutes(
         toast: { type: "success", message: `User created: ${username}` },
       });
     } catch (err) {
-      if (isUsernameTaken(err)) {
-        return res.status(409).json({ error: "Username already exists" });
-      }
       authLogger.error("Failed to admin-create user", err);
       res.status(500).json({ error: "Failed to create user" });
     }

src/backend/database/routes/users.ts

@@ -41,13 +41,9 @@ import {
   createCurrentUserAuthRepository,
   createCurrentUserRepository,
 } from "../repositories/factory.js";
-import {
-  isUsernameTaken,
-  type UserRecord,
-} from "../repositories/user-repository.js";
+import type { UserRecord } from "../repositories/user-repository.js";
 import {
   getTrustedProxyAuthConfig,
-  getTrustedProxySourceAddress,
   isTrustedProxyAddress,
   isTrustedProxyAuthEnabled,
   resolveTrustedProxyRoles,
@@ -268,10 +264,6 @@ router.post("/create", async (req, res) => {
       toast: { type: "success", message: `User created: ${username}` },
     });
   } catch (err) {
-    // Lost a race with a concurrent sign-up for the same name.
-    if (isUsernameTaken(err)) {
-      return res.status(409).json({ error: "Username already exists" });
-    }
     authLogger.error("Failed to create user", err);
     res.status(500).json({ error: "Failed to create user" });
   }
@@ -312,7 +304,7 @@ router.post("/proxy-login", async (req, res) => {
   }
   if (!config.enabled) return res.json({ enabled: false });
 
-  const sourceAddress = getTrustedProxySourceAddress(req);
+  const sourceAddress = req.socket.remoteAddress;
   try {
     if (!isTrustedProxyAddress(sourceAddress, config.trustedProxies)) {
       authLogger.warn(

src/backend/hosts/host-key-verifier.ts

@@ -263,6 +263,28 @@ export class SSHHostKeyVerifier {
             changeCount: host.hostKeyChangedCount || 0,
           });
 
+          if (isJumpHost) {
+            await this.updateHostKey(
+              hostId,
+              fingerprint,
+              keyType,
+              algorithm,
+              host.hostKeyChangedCount || 0,
+            );
+            sshLogger.warn("Jump host key changed - auto-accepted", {
+              operation: "host_key_updated",
+              hostId,
+              ip,
+              port,
+              fingerprint,
+              keyType,
+              userId,
+              isJumpHost: true,
+            });
+            verify(true);
+            return;
+          }
+
           if (!ws) {
             sshLogger.error(
               "Host key changed - please connect via Terminal to verify the new key",

src/backend/hosts/ssh-connection-pool.ts

@@ -86,6 +86,7 @@ export class SSHConnectionPool {
   private async createPooledClient(
     key: string,
     factory: () => Promise<Client>,
+    existing: PooledConnection[],
   ): Promise<Client> {
     const generation = this.generations.get(key) || 0;
     this.pendingConnections.set(
@@ -108,11 +109,8 @@ export class SSHConnectionPool {
         inUse: true,
         hostKey: key,
       };
-      // Re-read after the await: concurrent connects and removals may have
-      // replaced this key's array in the meantime.
-      const connections = this.connections.get(key) ?? [];
-      connections.push(pooled);
-      this.connections.set(key, connections);
+      existing.push(pooled);
+      this.connections.set(key, existing);
 
       client.on("end", () => {
         this.removeConnection(key, client);
@@ -189,7 +187,7 @@ export class SSHConnectionPool {
       if (queue.length === 0) this.waiters.delete(key);
       else this.waiters.set(key, queue);
       clearTimeout(waiter.timer);
-      this.createPooledClient(key, waiter.factory)
+      this.createPooledClient(key, waiter.factory, connections)
         .then(waiter.resolve)
         .catch(waiter.reject);
       return;
@@ -227,7 +225,7 @@ export class SSHConnectionPool {
     }
 
     if (this.hasCapacity(key, connections)) {
-      return this.createPooledClient(key, factory);
+      return this.createPooledClient(key, factory, connections);
     }
 
     return this.enqueueWaiter(key, factory);

src/backend/plugins/artifact-manifest.ts

@@ -1,59 +1,50 @@
-import path from "node:path";
 import zlib from "node:zlib";
-import * as tar from "tar";
 
 const MAX_UNPACKED_BYTES = 512 * 1024 * 1024;
 
 /**
- * Reads every copy of one file out of a .tmxplug (a gzipped tar) without
- * unpacking it to disk. Uses the same tar parser as the loader's unpack, so
- * pax and long-name headers resolve the same way, and only plain files count
- * because they are the only kind the unpack writes. Names compare
- * case-insensitively since a case-insensitive disk folds them together.
+ * Reads one file out of a .tmxplug (a gzipped tar) without unpacking it to
+ * disk. Returns null when the archive has no such file.
  */
-export function readArtifactFiles(buffer: Buffer, wanted: string): Buffer[] {
-  const archive = zlib.gunzipSync(buffer, {
-    maxOutputLength: MAX_UNPACKED_BYTES,
-  });
-  const key = wanted.toLowerCase();
-  const found: Buffer[] = [];
-  const parser = new tar.Parser({
-    strict: true,
-    onReadEntry: (entry) => {
-      const name = path.posix.normalize(entry.path.replace(/\\/g, "/"));
-      if (entry.type !== "File" || name.toLowerCase() !== key) {
-        entry.resume();
-        return;
-      }
-      const chunks: Buffer[] = [];
-      entry.on("data", (chunk: Buffer) => chunks.push(chunk));
-      entry.on("end", () => found.push(Buffer.concat(chunks)));
-    },
-  });
-  // The parser runs synchronously on an in-memory buffer.
-  parser.end(archive);
-  return found;
+export function readArtifactFile(
+  buffer: Buffer,
+  wanted: string,
+): Buffer | null {
+  const tar = zlib.gunzipSync(buffer, { maxOutputLength: MAX_UNPACKED_BYTES });
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) break;
+    const field = (start: number, length: number) =>
+      header
+        .subarray(start, start + length)
+        .toString("utf8")
+        .replace(/\0.*$/s, "");
+    const prefix = field(345, 155);
+    const name = (
+      prefix ? `${prefix}/${field(0, 100)}` : field(0, 100)
+    ).replace(/^\.\//, "");
+    const size = Number.parseInt(field(124, 12).trim() || "0", 8);
+    if (!Number.isFinite(size) || size < 0) break;
+    const start = offset + 512;
+    if (name === wanted) return tar.subarray(start, start + size);
+    offset = start + Math.ceil(size / 512) * 512;
+  }
+  return null;
 }
 
-/**
- * The manifest.json packed in a .tmxplug, parsed but not validated. An
- * archive with more than one is refused: the unpack keeps the last copy, so
- * whichever one this read the other could carry different capabilities.
- */
+/** The manifest.json packed in a .tmxplug, parsed but not validated. */
 export function readArtifactManifest(buffer: Buffer): Record<string, unknown> {
-  let copies: Buffer[];
+  let raw: Buffer | null;
   try {
-    copies = readArtifactFiles(buffer, "manifest.json");
+    raw = readArtifactFile(buffer, "manifest.json");
   } catch {
     throw new Error("the file is not a valid .tmxplug archive");
   }
-  if (copies.length === 0) throw new Error("the archive has no manifest.json");
-  if (copies.length > 1) {
-    throw new Error("the archive has more than one manifest.json");
-  }
+  if (!raw) throw new Error("the archive has no manifest.json");
   let parsed: unknown;
   try {
-    parsed = JSON.parse(copies[0].toString("utf8"));
+    parsed = JSON.parse(raw.toString("utf8"));
   } catch {
     throw new Error("manifest.json is not valid JSON");
   }

src/backend/plugins/auto-update.ts

@@ -1,5 +1,5 @@
 /**
- * The registry timer: refreshes the store's download counts and applies
+ * The registry timer: refreshes the store's install counts and applies
  * plugin updates for plugins with auto-update on. An update that asks for a
  * new capability is never applied here; admins get an alert and review it in
  * the Plugins tab. Nothing is ever installed from here.
@@ -13,8 +13,8 @@ const CHECK_EVERY_MS = 6 * 60 * 60_000;
 let timer: NodeJS.Timeout | null = null;
 
 export async function runPluginAutoUpdate(): Promise<void> {
-  const { syncDownloadCounts } = await import("./download-counts.js");
-  await syncDownloadCounts();
+  const { syncInstallCounts } = await import("./install-counts.js");
+  await syncInstallCounts();
 
   const { isLinkedDesktop, updateAllPlugins } = await import("./manage.js");
   if (await isLinkedDesktop()) return;

src/backend/plugins/download-counts.ts

@@ -1,103 +0,0 @@
-/**
- * Download counts for the plugin store, copied from the registry's
- * stats.json into plugin_install_counts.
- *
- * A count is how often the plugin's .tmxplug release files were downloaded.
- * An instance that updates three times counts three times, and copies bundled
- * into Docker images or the desktop app never count. Treat it as a ranking,
- * never as a user count.
- */
-
-import { pluginLogger } from "../utils/logger.js";
-import {
-  OFFICIAL_REGISTRY_ID,
-  fetchRegistryStats,
-  officialSource,
-  type RegistrySource,
-} from "./registry-index.js";
-
-async function repository() {
-  const { createCurrentPluginInstallCountRepository } =
-    await import("../database/repositories/factory.js");
-  return createCurrentPluginInstallCountRepository();
-}
-
-const STALE_MS = 6 * 60 * 60_000;
-const FORCED_MS = 60_000;
-const WAIT_MS = 3_000;
-
-let lastSyncAt = 0;
-let running: Promise<number> | null = null;
-
-/**
- * Syncs when the counts are older than the registry timer's interval, or
- * older than a minute with force (the Refresh button). Waits a few seconds
- * at most so a slow registry never holds up the store; a sync that runs
- * longer still finishes in the background.
- */
-export async function refreshDownloadCounts(force = false): Promise<void> {
-  const age = Date.now() - lastSyncAt;
-  if (!running && age >= (force ? FORCED_MS : STALE_MS)) {
-    running = syncDownloadCounts().finally(() => {
-      running = null;
-    });
-  }
-  if (!running) return;
-  let timeout: NodeJS.Timeout | undefined;
-  await Promise.race([
-    running,
-    new Promise((resolve) => {
-      timeout = setTimeout(resolve, WAIT_MS);
-    }),
-  ]);
-  clearTimeout(timeout);
-}
-
-/** Test seam. */
-export function resetDownloadCountRefresh(): void {
-  lastSyncAt = 0;
-  running = null;
-}
-
-/** Returns how many rows changed. Never throws; a failed sync keeps the old numbers. */
-export async function syncDownloadCounts(): Promise<number> {
-  lastSyncAt = Date.now();
-  let changed = 0;
-  let sources: RegistrySource[] = [officialSource()];
-  try {
-    const { listSources } = await import("./registries.js");
-    sources = await listSources();
-  } catch {
-    // Official only when the registry choices cannot be read.
-  }
-  for (const source of sources) {
-    try {
-      const stats = await fetchRegistryStats(source);
-      if (!stats) continue;
-      const entries = [...stats.plugins].map(([pluginId, downloads]) => ({
-        pluginId,
-        count: downloads,
-      }));
-      changed += await (await repository()).upsertMany(source.id, entries);
-    } catch (error) {
-      pluginLogger.warn(
-        `Could not sync plugin download counts from ${source.id}: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-        { operation: "plugin_registry" },
-      );
-    }
-  }
-  return changed;
-}
-
-export async function readDownloadCounts(
-  registryId: string = OFFICIAL_REGISTRY_ID,
-): Promise<Map<string, number>> {
-  try {
-    const rows = await (await repository()).listByRegistry(registryId);
-    return new Map(rows.map((row) => [row.pluginId, row.count]));
-  } catch {
-    return new Map();
-  }
-}

src/backend/plugins/http.ts

@@ -42,16 +42,9 @@ const routers = new Map<string, Router>();
  * Requests per minute one address may make to one plugin's public routes.
  * They run without a login, so they are the cheap way to hammer a plugin.
  */
-const MAX_PLUGIN_PUBLIC_RATE_LIMIT = 10_000;
-
-/** The admin's limit when set, else the plugin's own, else 120. */
-function publicRateLimit(pluginLimit?: number): number {
+function publicRateLimit(): number {
   const parsed = Number(process.env.TERMIX_PLUGIN_PUBLIC_RATE_LIMIT);
-  if (Number.isFinite(parsed) && parsed > 0) return parsed;
-  if (Number.isFinite(pluginLimit) && (pluginLimit as number) > 0) {
-    return Math.min(pluginLimit as number, MAX_PLUGIN_PUBLIC_RATE_LIMIT);
-  }
-  return 120;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 120;
 }
 const PUBLIC_RATE_WINDOW_MS = 60_000;
 const publicHits = new Map<string, { count: number; resetAt: number }>();
@@ -61,7 +54,6 @@ export function overPublicRateLimit(
   pluginId: string,
   ip: string,
   now = Date.now(),
-  pluginLimit?: number,
 ): boolean {
   if (publicHits.size > 10_000) {
     for (const [hitKey, entry] of publicHits) {
@@ -75,7 +67,7 @@ export function overPublicRateLimit(
     return false;
   }
   entry.count++;
-  return entry.count > publicRateLimit(pluginLimit);
+  return entry.count > publicRateLimit();
 }
 
 /** Test seam. */
@@ -327,9 +319,7 @@ export function createPluginRouter({
   outer.use((req: Request, res: Response, next: NextFunction) => {
     if (isPublicRequest(req, publicPaths, inner)) {
       const ip = req.ip || req.socket?.remoteAddress || "unknown";
-      if (
-        overPublicRateLimit(pluginId, ip, Date.now(), options?.publicRateLimit)
-      ) {
+      if (overPublicRateLimit(pluginId, ip)) {
         res.status(429).json({ error: "Too many requests" });
         return;
       }

src/backend/plugins/install-counts.ts

@@ -0,0 +1,94 @@
+/**
+ * Popularity numbers for the plugin store, copied from the registry's
+ * stats.json into plugin_install_counts.
+ *
+ * Two sources, and the store prefers the first:
+ * - "aggregate-telemetry": instances that reported the plugin enabled in the
+ *   last 7 days through the Usage Statistics plugin. It undercounts by every
+ *   instance that turned the report off or never installed that plugin.
+ * - "github-releases": downloads of the plugin's .tmxplug release assets.
+ *   This counts downloads, not active installs: an instance that updates
+ *   three times counts three times, and Docker images that bundle the plugin
+ *   count once per build, not once per install.
+ *
+ * Treat both as a rough ranking, never as a user count.
+ */
+
+import { pluginLogger } from "../utils/logger.js";
+import {
+  OFFICIAL_REGISTRY_ID,
+  fetchRegistryStats,
+  officialSource,
+  type RegistrySource,
+} from "./registry-index.js";
+
+export const TELEMETRY_SOURCE = "aggregate-telemetry";
+export const DOWNLOADS_SOURCE = "github-releases";
+
+export interface InstallCount {
+  count: number;
+  source: string;
+}
+
+async function repository() {
+  const { createCurrentPluginInstallCountRepository } =
+    await import("../database/repositories/factory.js");
+  return createCurrentPluginInstallCountRepository();
+}
+
+/** Picks the number to show: active installs when known, downloads otherwise. */
+export function preferredCount(entry: {
+  downloads: number;
+  activeInstalls: number | null;
+}): InstallCount {
+  return entry.activeInstalls !== null && entry.activeInstalls > 0
+    ? { count: entry.activeInstalls, source: TELEMETRY_SOURCE }
+    : { count: entry.downloads, source: DOWNLOADS_SOURCE };
+}
+
+/** Returns how many rows changed. Never throws; a failed sync keeps the old numbers. */
+export async function syncInstallCounts(): Promise<number> {
+  let changed = 0;
+  let sources: RegistrySource[] = [officialSource()];
+  try {
+    const { listSources } = await import("./registries.js");
+    sources = await listSources();
+  } catch {
+    // Official only when the registry choices cannot be read.
+  }
+  for (const source of sources) {
+    try {
+      const stats = await fetchRegistryStats(source);
+      if (!stats) continue;
+      const entries = [...stats.plugins].map(([pluginId, entry]) => ({
+        pluginId,
+        ...preferredCount(entry),
+      }));
+      changed += await (await repository()).upsertMany(source.id, entries);
+    } catch (error) {
+      pluginLogger.warn(
+        `Could not sync plugin install counts from ${source.id}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+        { operation: "plugin_registry" },
+      );
+    }
+  }
+  return changed;
+}
+
+export async function readInstallCounts(
+  registryId: string = OFFICIAL_REGISTRY_ID,
+): Promise<Map<string, InstallCount>> {
+  try {
+    const rows = await (await repository()).listByRegistry(registryId);
+    return new Map(
+      rows.map((row) => [
+        row.pluginId,
+        { count: row.count, source: row.source },
+      ]),
+    );
+  } catch {
+    return new Map();
+  }
+}

src/backend/plugins/manage.ts

@@ -56,10 +56,7 @@ import {
 } from "./registries.js";
 import { invalidatePluginPermissionCache } from "./permissions.js";
 import { moveWithRetry } from "./fs-retry.js";
-import {
-  readDownloadCounts,
-  refreshDownloadCounts,
-} from "./download-counts.js";
+import { readInstallCounts } from "./install-counts.js";
 import { readArtifactManifest, sameCapabilities } from "./artifact-manifest.js";
 import {
   parseManifest,
@@ -276,8 +273,9 @@ export interface RegistryListing {
     pinnedVersion: string | null;
     autoUpdate: boolean;
     bundled: boolean;
-    /** See download-counts.ts for what this number does and does not mean. */
-    downloads: number | null;
+    /** See install-counts.ts for what this number does and does not mean. */
+    installCount: number | null;
+    installCountSource: string | null;
   }>;
 }
 
@@ -317,14 +315,13 @@ export async function listRegistry(
   const records = new Map(
     (await createCurrentPluginRepository().listAll()).map((r) => [r.id, r]),
   );
-  await refreshDownloadCounts(options.force);
   const counts = new Map(
     await Promise.all(
       sources
         .filter((source) => source.tier !== "custom")
         .map(
           async (source) =>
-            [source.id, await readDownloadCounts(source.id)] as const,
+            [source.id, await readInstallCounts(source.id)] as const,
         ),
     ),
   );
@@ -442,7 +439,9 @@ export async function listRegistry(
         pinnedVersion: record?.pinnedVersion ?? null,
         autoUpdate: Boolean(record?.autoUpdate),
         bundled: shipped.has(plugin.id),
-        downloads: counts.get(source.id)?.get(plugin.id) ?? null,
+        installCount: counts.get(source.id)?.get(plugin.id)?.count ?? null,
+        installCountSource:
+          counts.get(source.id)?.get(plugin.id)?.source ?? null,
       };
     }),
   };
@@ -715,28 +714,6 @@ export async function planStateChange(
   };
 }
 
-/** A local admin consents to the exact mirrored version before granting it access. */
-export function enablePluginWithConsent(
-  pluginId: string,
-  options: { version?: string; capabilities?: string[]; userId: string },
-): Promise<StateChangePlan & { state: string }> {
-  return serialized(async () => {
-    const plugin = getPluginRuntime().loader.get(pluginId);
-    if (!plugin)
-      throw new PluginManageError("Plugin not found", 404, "NOT_FOUND");
-    if (options.version !== plugin.manifest.version) {
-      throw new PluginManageError(
-        "The plugin version changed; review it again",
-        409,
-        "CONSENT_MISMATCH",
-      );
-    }
-    assertConsent(options.capabilities, plugin.manifest.capabilities);
-    await grantDeclared(plugin, options.userId);
-    return setPluginStateUnlocked(pluginId, true);
-  });
-}
-
 export function setPluginState(
   pluginId: string,
   enabled: boolean,

src/backend/plugins/registries.ts

@@ -19,9 +19,6 @@ import {
   type RegistrySource,
 } from "./registry-index.js";
 import {
-  COMMUNITY_PLUGIN_KEYS,
-  TRUSTED_PLUGIN_KEYS,
-  getCustomPluginKeys,
   isPluginPublicKey,
   pluginKeyId,
   setCustomPluginKeys,
@@ -31,8 +28,6 @@ import {
 const CONFIG_KEY = "plugin_registries";
 /** Keys a linked desktop copied from its server, so mirrored plugins load. */
 const SYNCED_KEYS_KEY = "plugin_registry_synced_keys";
-/** `addedIn` of a key only the linked server vouches for. */
-const SYNCED = "synced";
 const ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const MAX_ID_LENGTH = 40;
 const MAX_NAME_LENGTH = 80;
@@ -122,8 +117,8 @@ async function writeRegistriesConfig(config: RegistriesConfig): Promise<void> {
   await applyCustomKeys(config);
 }
 
-function toKey(publicKey: string, addedIn = "admin"): TrustedPluginKey {
-  return { id: pluginKeyId(publicKey), publicKey, addedIn };
+function toKey(publicKey: string): TrustedPluginKey {
+  return { id: pluginKeyId(publicKey), publicKey, addedIn: "admin" };
 }
 
 async function readSyncedKeys(): Promise<string[]> {
@@ -139,32 +134,19 @@ async function readSyncedKeys(): Promise<string[]> {
 
 /**
  * Trusts the key of every custom registry, on or off: a plugin installed
- * from a registry that was later turned off still has to load. A key added
- * here wins over the same key synced from a server.
+ * from a registry that was later turned off still has to load.
  */
 async function applyCustomKeys(config: RegistriesConfig): Promise<void> {
   const keys = new Map<string, TrustedPluginKey>();
-  for (const publicKey of await readSyncedKeys()) {
-    keys.set(pluginKeyId(publicKey), toKey(publicKey, SYNCED));
-  }
   for (const entry of config.custom) {
     keys.set(entry.keyId, toKey(entry.publicKey));
   }
+  for (const publicKey of await readSyncedKeys()) {
+    keys.set(pluginKeyId(publicKey), toKey(publicKey));
+  }
   setCustomPluginKeys([...keys.values()]);
 }
 
-/** Whether this app trusts the key independently of its linked server. */
-export function isLocallyTrustedPluginKey(keyId: string): boolean {
-  return (
-    [...TRUSTED_PLUGIN_KEYS, ...COMMUNITY_PLUGIN_KEYS].some(
-      (key) => key.id === keyId,
-    ) ||
-    getCustomPluginKeys().some(
-      (key) => key.id === keyId && key.addedIn !== SYNCED,
-    )
-  );
-}
-
 /** Called before the boot scan so plugins from custom registries load. */
 export async function loadCustomRegistryKeys(): Promise<void> {
   try {

src/backend/plugins/registry-index.ts

@@ -356,8 +356,7 @@ export async function fetchRegistryIndex(
 }
 
 export interface RegistryStats {
-  /** Downloads per plugin id. */
-  plugins: Map<string, number>;
+  plugins: Map<string, { downloads: number; activeInstalls: number | null }>;
 }
 
 /** stats.json sits next to index.json and is rebuilt daily by the registry. */
@@ -381,14 +380,21 @@ function asCount(value: unknown): number | null {
 }
 
 export function parseRegistryStats(raw: unknown): RegistryStats {
-  const plugins = new Map<string, number>();
+  const plugins = new Map<
+    string,
+    { downloads: number; activeInstalls: number | null }
+  >();
   const entries = (raw as { plugins?: unknown } | null)?.plugins;
   if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
     return { plugins };
   }
   for (const [id, value] of Object.entries(entries)) {
     if (!ID_PATTERN.test(id) || !value || typeof value !== "object") continue;
-    plugins.set(id, asCount((value as Record<string, unknown>).downloads) ?? 0);
+    const entry = value as Record<string, unknown>;
+    plugins.set(id, {
+      downloads: asCount(entry.downloads) ?? 0,
+      activeInstalls: asCount(entry.activeInstalls),
+    });
   }
   return { plugins };
 }

src/backend/sync/client/engine.ts

@@ -351,10 +351,7 @@ export class SyncEngine {
         const key = recordKey(entity.type, row.syncId);
         const record = records.get(key);
         if (record && !record.deleted && record.hash === row.hash) continue;
-        // Unavailable server rows can recover without another local edit.
-        if (record?.errorHash === row.hash && record.error !== "unavailable") {
-          continue;
-        }
+        if (record?.errorHash === row.hash) continue;
         ops.push({
           entityType: entity.type,
           syncId: row.syncId,
@@ -370,12 +367,7 @@ export class SyncEngine {
         if (record.revision === 0) continue;
         if (rows.has(record.syncId) || failed.has(record.syncId)) continue;
         if (entity.covers && !entity.covers(record.syncId)) continue;
-        if (
-          record.errorHash === DELETED_HASH &&
-          record.error !== "unavailable"
-        ) {
-          continue;
-        }
+        if (record.errorHash === DELETED_HASH) continue;
         ops.push({
           entityType: entity.type,
           syncId: record.syncId,
@@ -441,9 +433,6 @@ export class SyncEngine {
       return;
     }
 
-    // A live row the server could not send says nothing; keep ours to retry.
-    if (!result.deleted && !result.row) return;
-
     // Conflict: the server moved on since this device last saw the row. Its
     // version wins here, and a local edit it replaced is kept for the user.
     if (op.op === "upsert" && op.row) {
@@ -456,7 +445,7 @@ export class SyncEngine {
       );
     }
     const resolvers = createResolvers(userId);
-    if (result.deleted) {
+    if (result.deleted || !result.row) {
       await deleteStoredRow(entity, userId, op.syncId);
       await putRecord(userId, op.entityType, op.syncId, {
         revision: result.revision,

src/backend/sync/client/plugins.ts

@@ -4,8 +4,7 @@
  * For every plugin in "mirror" mode, the server decides: a plugin installed
  * there is installed here, on or off to match, with the capabilities an
  * admin granted it there. Plugins marked "local" are left to the desktop and
- * "server" ones never run on a linked desktop. A user plugin no key trusted
- * here signed is only ever switched off; the desktop's admin turns it on.
+ * "server" ones never run on a linked desktop.
  */
 
 import fs from "fs";
@@ -22,10 +21,7 @@ import {
   unloadPlugin,
 } from "../../plugins/index.js";
 import { getPluginsDir } from "../../plugins/paths.js";
-import {
-  isLocallyTrustedPluginKey,
-  setSyncedRegistryKeys,
-} from "../../plugins/registries.js";
+import { setSyncedRegistryKeys } from "../../plugins/registries.js";
 import type { LoadedPlugin } from "../../plugins/loader.js";
 import {
   createCurrentPluginPermissionGrantRepository,
@@ -61,14 +57,6 @@ async function isEnabledLocally(pluginId: string): Promise<boolean> {
   return record?.state === "enabled";
 }
 
-/**
- * Signed by a key this desktop trusts on its own. A key the server sent
- * would let the server's admin sign anything, so it does not count.
- */
-function vouchedHere(local: LoadedPlugin): boolean {
-  return !!local.signedBy && isLocallyTrustedPluginKey(local.signedBy);
-}
-
 const PLUGIN_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 
 /** Downloads next to the installed copy, which stays until the swap. */
@@ -124,10 +112,6 @@ async function replaceWithDownload(
   if (previous) await unloadPlugin(pluginId);
   try {
     const installed = await installPluginArtifact(file);
-    // Approval belongs to the reviewed version, regardless of remote metadata.
-    if (wasEnabled && installed.source === "user" && !vouchedHere(installed)) {
-      await setPluginEnabled(pluginId, false);
-    }
     await fs.promises.rm(backup, { force: true });
     await fs.promises.rm(`${backup}.sig`, { force: true });
     return installed;
@@ -171,7 +155,7 @@ async function matchGrants(plugin: RemotePlugin): Promise<void> {
   if (!local || local.source !== "user") return;
   // Grants are only copied for code a trusted key signed. Anything else the
   // desktop's own admin has to review, as with any plugin dropped on disk.
-  if (!vouchedHere(local)) return;
+  if (!local.signedBy) return;
   const declared = new Set(local.manifest.capabilities);
   const wanted = new Set(plugin.granted.filter((cap) => declared.has(cap)));
   const existing = await repository.listByPlugin(plugin.id);
@@ -212,7 +196,7 @@ async function alertUnsigned(plugin: RemotePlugin): Promise<void> {
   alertedVersions.add(key);
   await sendCoreAlert({
     title: "Review a feature from your server",
-    body: `${plugin.name} (${plugin.version}) was copied from your server but is not signed by a key this app trusts, so it stays off here until you turn it on.`,
+    body: `${plugin.name} (${plugin.version}) was copied from your server but is not signed, so it stays off here until you turn it on.`,
     severity: "warning",
     category: "termix.sync.unsigned_plugin",
     dedupeKey: `sync:${key}`,
@@ -255,9 +239,7 @@ async function mirrorOne(link: SyncLink, plugin: RemotePlugin): Promise<void> {
         await alertOlderDesktop(plugin);
         throw error;
       }
-      if (wasEnabled && local.source === "bundled") {
-        await setPluginEnabled(plugin.id, true);
-      }
+      if (wasEnabled) await setPluginEnabled(plugin.id, true);
     } else if (newer) {
       await alertOlderDesktop(plugin);
     }
@@ -281,19 +263,19 @@ async function mirrorOne(link: SyncLink, plugin: RemotePlugin): Promise<void> {
       }
     }
     await matchGrants(plugin);
+    // Unsigned code is only ever switched off from here, never on.
+    if (!local.signedBy) {
+      const enabledHere = await isEnabledLocally(plugin.id);
+      if (!plugin.enabled && enabledHere) {
+        await setPluginEnabled(plugin.id, false);
+      } else if (plugin.enabled && !enabledHere) {
+        await alertUnsigned(plugin);
+      }
+      return;
+    }
   }
 
   if (!local) return;
-  // Remote metadata cannot confer bundled trust on a locally loaded user plugin.
-  if (local.source === "user" && !vouchedHere(local)) {
-    const enabledHere = await isEnabledLocally(plugin.id);
-    if (!plugin.enabled && enabledHere) {
-      await setPluginEnabled(plugin.id, false);
-    } else if (plugin.enabled && !enabledHere) {
-      await alertUnsigned(plugin);
-    }
-    return;
-  }
   if (plugin.enabled !== (await isEnabledLocally(plugin.id))) {
     await setPluginEnabled(plugin.id, plugin.enabled);
   } else if (plugin.enabled && local.state !== "active") {
@@ -302,7 +284,6 @@ async function mirrorOne(link: SyncLink, plugin: RemotePlugin): Promise<void> {
 }
 
 export async function mirrorPlugins(link: SyncLink): Promise<void> {
-  const { serialized } = await import("../../plugins/manage.js");
   const { plugins, registryKeys } = await remoteJson<{
     plugins: RemotePlugin[];
     registryKeys?: unknown[];
@@ -314,8 +295,7 @@ export async function mirrorPlugins(link: SyncLink): Promise<void> {
 
   for (const plugin of plugins) {
     try {
-      // Share the consent/enable lock so an update cannot swap code mid-approval.
-      await serialized(() => mirrorOne(link, plugin));
+      await mirrorOne(link, plugin);
     } catch (error) {
       syncLogger.warn("Could not match a feature to the server", {
         operation: "sync_plugin_mirror",
@@ -335,13 +315,8 @@ export async function mirrorPlugins(link: SyncLink): Promise<void> {
   }
 }
 
-/**
- * Whether a plugin's on/off state belongs to the linked server. Code no key
- * trusted here vouches for is the desktop's own admin's call to turn on.
- */
+/** Whether a plugin's on/off state belongs to the linked server. */
 export function isServerManaged(pluginId: string): boolean {
   const local = getPluginRuntime().loader.get(pluginId);
-  const mode = local?.manifest.desktop ?? "mirror";
-  if (mode !== "mirror") return mode === "server";
-  return local?.source !== "user" || vouchedHere(local);
+  return (local?.manifest.desktop ?? "mirror") !== "local";
 }

src/backend/sync/entities.ts

@@ -5,7 +5,7 @@
  * an entity in without renumbering; anything referenced syncs first.
  */
 
-import { and, eq, getTableColumns } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import type { SyncRow } from "@termix-ssh/plugin-sdk/backend";
 import type { PluginManifest } from "@termix-ssh/plugin-sdk/manifest";
 import {
@@ -493,25 +493,6 @@ const SHARED_HOST_DROP = [
   ...HOST_LOCAL_FIELDS,
 ];
 
-const HOST_TEXT_COLUMNS = new Set(
-  Object.entries(getTableColumns(hosts))
-    .filter(([, column]) => column.dataType === "string")
-    .map(([field]) => field),
-);
-
-/**
- * A resolved host field back in the form its column stores, as an owned host
- * sends it: the resolver parses JSON columns and turns the "true"/"false" of
- * forceKeyboardInteractive into a boolean, which a text column cannot bind.
- */
-function storedForm(field: string, value: unknown): unknown {
-  if (value !== null && typeof value === "object") return JSON.stringify(value);
-  if (typeof value === "boolean" && HOST_TEXT_COLUMNS.has(field)) {
-    return String(value);
-  }
-  return value;
-}
-
 async function loadSharedHosts(userId: string): Promise<SyncRow[]> {
   const {
     createCurrentRbacAccessRepository,
@@ -559,7 +540,10 @@ async function loadSharedHosts(userId: string): Promise<SyncRow[]> {
       const wire: SyncRow = {};
       for (const [field, value] of Object.entries(host)) {
         if (SHARED_HOST_DROP.includes(field)) continue;
-        wire[field] = storedForm(field, value);
+        wire[field] =
+          value !== null && typeof value === "object"
+            ? JSON.stringify(value)
+            : value;
       }
       wire.jumpHosts = await jumpHostsToSyncIds(host.jumpHosts);
       wire.pluginSettings = await exportHostPluginSettings(hostId, {

src/backend/sync/server/push.ts

@@ -134,23 +134,12 @@ export async function applyPush(
     const record = await getRecord(userId, op.entityType, op.syncId);
     const currentRevision = record?.revision ?? 0;
     if (op.baseRevision !== currentRevision) {
-      const row = record?.deleted ? null : (wire.get(key) ?? null);
-      // A live record with no row failed to serialize; a conflict without a
-      // row would read as a delete on the desktop.
-      if (record && !record.deleted && !row) {
-        results.set(key, {
-          ...base,
-          status: "rejected",
-          reason: "unavailable",
-        });
-        continue;
-      }
       results.set(key, {
         ...base,
         status: "conflict",
         revision: currentRevision,
         deleted: !!record?.deleted,
-        row,
+        row: record?.deleted ? null : (wire.get(key) ?? null),
       });
       continue;
     }

src/backend/sync/store.ts

@@ -13,7 +13,6 @@ import { createCurrentRepositoryContext } from "../database/repositories/factory
 import { DataCrypto } from "../utils/data-crypto.js";
 import { SystemCrypto } from "../utils/system-crypto.js";
 import { DatabaseSaveTrigger } from "../utils/database-save-trigger.js";
-import { syncLogger } from "../utils/logger.js";
 import {
   getEntity,
   type RegisteredSyncEntity,
@@ -230,13 +229,7 @@ export async function loadWireRows(
       );
       const wire = toWire(entity, serialized, syncId);
       rows.set(syncId, { syncId, wire, hash: hashWire(entity, wire, key) });
-    } catch (error) {
-      syncLogger.warn("Could not serialize a sync row", {
-        operation: "sync_serialize",
-        entityType: entity.type,
-        syncId,
-        error: error instanceof Error ? error.message : String(error),
-      });
+    } catch {
       failed.add(syncId);
     }
   }

src/backend/tests/database/db/unique-username.test.ts

@@ -1,109 +0,0 @@
-import fs from "fs";
-import os from "os";
-import path from "path";
-import Database from "better-sqlite3";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-/**
- * Registration checked for a taken username before inserting, with nothing in
- * the schema to back it up, so two concurrent sign-ups could both get the same
- * name. Startup renames the later duplicates instead of deleting anyone, then
- * makes the name unique.
- */
-describe("users.username uniqueness", () => {
-  let dataDir: string;
-
-  beforeEach(() => {
-    dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "termix-unique-user-"));
-    vi.resetModules();
-    process.env.DATA_DIR = dataDir;
-    process.env.DB_FILE_ENCRYPTION = "false";
-    process.env.ALLOW_EMPTY_DATA_DIR = "true";
-  });
-
-  afterEach(() => {
-    delete process.env.DATA_DIR;
-    delete process.env.DB_FILE_ENCRYPTION;
-    delete process.env.ALLOW_EMPTY_DATA_DIR;
-    fs.rmSync(dataDir, { recursive: true, force: true });
-  });
-
-  function writeDatabaseWithDuplicates(): void {
-    const seed = new Database(":memory:");
-    seed.exec(`
-      CREATE TABLE users (
-        id TEXT PRIMARY KEY,
-        username TEXT NOT NULL,
-        password_hash TEXT NOT NULL,
-        is_admin INTEGER NOT NULL DEFAULT 0,
-        registered_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
-      );
-
-      INSERT INTO users (id, username, password_hash, registered_at) VALUES
-        ('late', 'alice', 'hash', '2025-03-01 00:00:00'),
-        ('first', 'alice', 'hash', '2025-01-01 00:00:00'),
-        ('tie-b', 'bob', 'hash', '2025-01-01 00:00:00'),
-        ('tie-a', 'bob', 'hash', '2025-01-01 00:00:00'),
-        ('only', 'Alice', 'hash', '2025-02-01 00:00:00');
-    `);
-    fs.writeFileSync(path.join(dataDir, "db.sqlite"), seed.serialize());
-    seed.close();
-  }
-
-  async function bootAndGetSqlite(): Promise<Database.Database> {
-    const db = await import("../../../database/db/index.js");
-    await db.initializeDatabase();
-    return db.getSqlite();
-  }
-
-  it("keeps the oldest holder of a name and renames the rest", async () => {
-    writeDatabaseWithDuplicates();
-
-    const sqlite = await bootAndGetSqlite();
-
-    const names = Object.fromEntries(
-      sqlite
-        .prepare("SELECT id, username FROM users")
-        .raw()
-        .all() as [string, string][],
-    );
-    expect(names).toEqual({
-      first: "alice",
-      late: "termix-recovered-0-5",
-      "tie-a": "bob",
-      "tie-b": "termix-recovered-0-3",
-      only: "Alice",
-    });
-  });
-
-  it("rejects a second user with a taken name", async () => {
-    const sqlite = await bootAndGetSqlite();
-
-    const insert = sqlite.prepare(
-      "INSERT INTO users (id, username, password_hash) VALUES (?, ?, ?)",
-    );
-    insert.run("u1", "alice", "hash");
-
-    expect(() => insert.run("u2", "alice", "hash")).toThrow(/UNIQUE/i);
-  });
-});
-
-// Run the checked-in migration itself, including occupied recovery prefixes.
-it("migrates duplicate names without colliding with existing names", () => {
-  const db = new Database(":memory:");
-  try {
-    db.exec(`CREATE TABLE users (id TEXT PRIMARY KEY, username TEXT NOT NULL, registered_at TEXT NOT NULL);
-      INSERT INTO users VALUES
-        ('first', 'alice', '2025-01-01'),
-        ('late', 'alice', '2025-02-01'),
-        ('other', 'alice-late', '2025-01-01'),
-        ('occupied', 'termix-recovered-0-1', '2025-01-01');`);
-    db.exec(fs.readFileSync("drizzle/sqlite/0067_unique_username.sql", "utf8"));
-    const rows = db.prepare("SELECT username FROM users").pluck().all();
-    expect(new Set(rows).size).toBe(4);
-    expect(rows).toContain("alice");
-    expect(rows).toContain("alice-late");
-    expect(rows).toContain("termix-recovered-0-1");
-    expect(() => db.exec("INSERT INTO users VALUES ('new', 'alice', '2026-01-01')")).toThrow(/UNIQUE/i);
-  } finally { db.close(); }
-});

src/backend/tests/database/db/vault-profile-foreign-key.test.ts

@@ -1,89 +0,0 @@
-import fs from "fs";
-import os from "os";
-import path from "path";
-import Database from "better-sqlite3";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// ssh_data.vault_profile_id points at vault_profiles. The vault plugin renames
-// that table to p_vault_profiles, which SQLite follows into ssh_data's foreign
-// key, so uninstalling the plugin used to leave every host write failing with
-// "no such table: main.p_vault_profiles".
-describe("ssh_data and the vault plugin's tables", () => {
-  let dataDir: string;
-
-  beforeEach(() => {
-    dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "termix-vault-fk-"));
-    vi.resetModules();
-    vi.stubEnv("DATA_DIR", dataDir);
-    vi.stubEnv("DB_FILE_ENCRYPTION", "false");
-    vi.stubEnv("ALLOW_EMPTY_DATA_DIR", "true");
-  });
-
-  afterEach(() => {
-    vi.unstubAllEnvs();
-    fs.rmSync(dataDir, { recursive: true, force: true });
-  });
-
-  function seed(afterAdoption: string): void {
-    const seed = new Database(":memory:");
-    seed.exec(
-      fs.readFileSync(
-        new URL("../../fixtures/sqlite-2.8-schema.sql", import.meta.url),
-        "utf8",
-      ),
-    );
-    seed.exec(`
-      CREATE TABLE plugin_migrations (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        plugin_id TEXT NOT NULL,
-        migration_id TEXT NOT NULL,
-        checksum TEXT NOT NULL,
-        applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        UNIQUE (plugin_id, migration_id),
-        FOREIGN KEY (plugin_id) REFERENCES plugins (id) ON DELETE CASCADE
-      );
-      INSERT INTO users (id, username, password_hash)
-        VALUES ('owner', 'alice', 'hash');
-      INSERT INTO ssh_data (id, user_id, ip, port, username, auth_type)
-        VALUES (1, 'owner', '192.0.2.1', 22, 'root', 'password');
-      ALTER TABLE vault_profiles RENAME TO p_vault_profiles;
-      ALTER TABLE vault_tokens RENAME TO p_vault_tokens;
-      ${afterAdoption}
-    `);
-    fs.writeFileSync(path.join(dataDir, "db.sqlite"), seed.serialize());
-    seed.close();
-  }
-
-  async function boot() {
-    const db = await import("../../../database/db/index.js");
-    await db.initializeDatabase();
-    return db.getSqlite();
-  }
-
-  function writeHosts(sqlite: Database.Database): void {
-    sqlite
-      .prepare(
-        "INSERT INTO ssh_data (user_id, ip, port, username, auth_type) VALUES ('owner', '192.0.2.2', 22, 'root', 'password')",
-      )
-      .run();
-    sqlite.prepare("DELETE FROM ssh_data WHERE id = 1").run();
-  }
-
-  it("repairs a database the plugin was already uninstalled from", async () => {
-    seed("DROP TABLE p_vault_tokens; DROP TABLE p_vault_profiles;");
-    const sqlite = await boot();
-
-    expect(() => writeHosts(sqlite)).not.toThrow();
-  });
-
-  it("leaves nothing in ssh_data pointing at the plugin", async () => {
-    seed("");
-    const sqlite = await boot();
-
-    expect(
-      sqlite.prepare("PRAGMA foreign_key_list(ssh_data)").all(),
-    ).not.toContainEqual(expect.objectContaining({ table: "p_vault_profiles" }));
-    sqlite.exec("DROP TABLE p_vault_tokens; DROP TABLE p_vault_profiles;");
-    expect(() => writeHosts(sqlite)).not.toThrow();
-  });
-});

src/backend/tests/database/import-route.test.ts

@@ -1,147 +0,0 @@
-import * as fs from "node:fs";
-import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { runInNewContext } from "node:vm";
-import Database from "better-sqlite3";
-import ts from "typescript";
-import { expect, it, vi } from "vitest";
-
-const source = readFileSync(
-  new URL("../../database/database.ts", import.meta.url),
-  "utf8",
-);
-const ast = ts.createSourceFile(
-  "database.ts",
-  source,
-  ts.ScriptTarget.Latest,
-  true,
-);
-const route = ast.statements.find(
-  (s) =>
-    ts.isExpressionStatement(s) &&
-    ts.isCallExpression(s.expression) &&
-    s.expression.arguments[0]?.getText(ast) === '"/database/import"',
-) as ts.ExpressionStatement;
-const batched = (route.expression as ts.CallExpression)
-  .arguments[3] as ts.CallExpression;
-const callback = batched.arguments[0];
-
-const dir = mkdtempSync(join(tmpdir(), "termix-import-route-"));
-
-function exportFile(): string {
-  const path = join(dir, `export-${Math.random()}.db`);
-  const db = new Database(path);
-  db.exec(`
-    CREATE TABLE ssh_credentials (id INTEGER, name TEXT, username TEXT);
-    CREATE TABLE ssh_data (id INTEGER, ip TEXT, port INTEGER, username TEXT, credential_id INTEGER);
-    INSERT INTO ssh_credentials VALUES (7, 'fresh', 'root'), (8, 'kept', 'admin');
-    INSERT INTO ssh_data VALUES
-      (1, '10.0.0.1', 22, 'root', 7),
-      (2, '10.0.0.2', 22, 'root', 8),
-      (3, '10.0.0.3', 22, 'root', 99),
-      (4, '10.0.0.4', 22, 'root', NULL);
-  `);
-  db.close();
-  return path;
-}
-
-async function invoke(path: string, user: unknown = { isExternal: false }) {
-  const writes: string[] = [];
-  const hosts: Array<Record<string, unknown>> = [];
-  const importHostProtocolLogins = vi.fn();
-  const handler = runInNewContext(
-    ts.transpileModule(`(${callback.getText(ast)})`, {
-      compilerOptions: { target: ts.ScriptTarget.ES2022 },
-    }).outputText,
-    {
-      fs,
-      Buffer,
-      Database,
-      parseUserAgent: () => ({ type: "web" }),
-      createCurrentUserRepository: () => ({ findById: async () => user }),
-      DataCrypto: { getUserDataKey: () => Buffer.from("key") },
-      apiLogger: {
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-        success: vi.fn(),
-      },
-      createCurrentCredentialRepository: () => ({
-        findIdForImportIdentity: async (_: string, name: string) =>
-          name === "kept" ? 42 : null,
-        createEncryptedForUser: async () => {
-          writes.push("credential");
-          return { id: 100 };
-        },
-      }),
-      createCurrentHostRepository: () => ({
-        existsForImportIdentity: async () => false,
-        createEncryptedForUser: async (_: string, host: never) => {
-          writes.push("host");
-          hosts.push(host);
-          return { id: 500 + hosts.length };
-        },
-      }),
-      legacyStatusCheck: () => ({}),
-      sshOptionsForWrite: () => null,
-      applyHostDefaultsToWrite: async () => ({}),
-      applyPluginHostImportSettings: async () => {},
-      importedHostPluginSettings: () => ({}),
-      importHostProtocolLogins,
-      applyDefaultsAfterHostWrites: async () => {},
-      importUserPluginRows: async () => ({
-        imported: 0,
-        skipped: 0,
-        errors: [],
-      }),
-      importHostDefaults: async () => ({ imported: 0, skipped: 0 }),
-      DatabaseSaveTrigger: { forceSave: async () => {} },
-      getErrorMessage: (error: Error) => error.message,
-    },
-  );
-  const res = { json: vi.fn(), status: vi.fn() };
-  res.status.mockReturnValue(res);
-  await handler(
-    { userId: "user-1", file: { path, originalname: "export.db" } },
-    res,
-  );
-  return { res, writes, hosts, importHostProtocolLogins };
-}
-
-it("points imported hosts at the credentials imported with them", async () => {
-  const { res, writes, hosts, importHostProtocolLogins } =
-    await invoke(exportFile());
-
-  expect(res.status).not.toHaveBeenCalled();
-  expect(writes).toEqual(["credential", "host", "host", "host", "host"]);
-  expect(hosts.map((host) => host.credentialId)).toEqual([100, 42, null, null]);
-  expect([...importHostProtocolLogins.mock.calls[0][4]]).toEqual([
-    [7, 100],
-    [8, 42],
-  ]);
-});
-
-it("removes the uploaded file when the user is gone", async () => {
-  const path = exportFile();
-  const { res } = await invoke(path, null);
-
-  expect(res.status).toHaveBeenCalledWith(404);
-  expect(existsSync(path)).toBe(false);
-});
-
-it("removes the uploaded file when it is not a SQLite database", async () => {
-  const path = join(dir, "not-sqlite.db");
-  writeFileSync(path, "definitely not a database");
-  const { res } = await invoke(path);
-
-  expect(res.status).toHaveBeenCalledWith(400);
-  expect(existsSync(path)).toBe(false);
-});
-
-it("removes the uploaded file after a successful import", async () => {
-  const path = exportFile();
-  await invoke(path);
-
-  expect(existsSync(path)).toBe(false);
-});

src/backend/tests/database/repositories/host-credential-repositories.test.ts

@@ -213,7 +213,7 @@ describe("HostRepository and CredentialRepository", () => {
   it("checks credential import identity", async () => {
     const repo = await createRepositories();
 
-    const created = await repo.credentials.create({
+    await repo.credentials.create({
       userId: "user-1",
       name: "primary",
       authType: "password",
@@ -221,11 +221,11 @@ describe("HostRepository and CredentialRepository", () => {
     });
 
     await expect(
-      repo.credentials.findIdForImportIdentity("user-1", "primary", "root"),
-    ).resolves.toBe(created.id);
+      repo.credentials.existsForImportIdentity("user-1", "primary", "root"),
+    ).resolves.toBe(true);
     await expect(
-      repo.credentials.findIdForImportIdentity("user-1", "primary", "admin"),
-    ).resolves.toBeNull();
+      repo.credentials.existsForImportIdentity("user-1", "primary", "admin"),
+    ).resolves.toBe(false);
   });
 
   it("renames credential folders through the write boundary", async () => {

src/backend/tests/database/repositories/sqlite-foreign-keys.test.ts

@@ -0,0 +1,51 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const factory = vi.hoisted(() => ({
+  getCurrentRepositorySqlite: vi.fn(),
+}));
+
+vi.mock("../../../database/repositories/factory.js", () => factory);
+
+import {
+  withCurrentSqliteForeignKeysDisabled,
+  withSqliteForeignKeysDisabled,
+} from "../../../database/repositories/sqlite-foreign-keys.js";
+
+const previousDatabaseDialect = process.env.DATABASE_DIALECT;
+
+afterEach(() => {
+  if (previousDatabaseDialect === undefined)
+    delete process.env.DATABASE_DIALECT;
+  else process.env.DATABASE_DIALECT = previousDatabaseDialect;
+  vi.clearAllMocks();
+});
+
+describe("withSqliteForeignKeysDisabled", () => {
+  it("restores foreign keys after an import", async () => {
+    const sqlite = { exec: vi.fn() };
+
+    await expect(
+      withSqliteForeignKeysDisabled(sqlite, async () => "imported"),
+    ).resolves.toBe("imported");
+    expect(sqlite.exec.mock.calls).toEqual([
+      ["PRAGMA foreign_keys = OFF"],
+      ["PRAGMA foreign_keys = ON"],
+    ]);
+  });
+});
+
+describe("withCurrentSqliteForeignKeysDisabled", () => {
+  it.each(["postgres", "mysql"])(
+    "runs portable imports with constraints enabled on %s",
+    async (dialect) => {
+      process.env.DATABASE_DIALECT = dialect;
+      const operation = vi.fn().mockResolvedValue("imported");
+
+      await expect(
+        withCurrentSqliteForeignKeysDisabled(operation),
+      ).resolves.toBe("imported");
+      expect(operation).toHaveBeenCalledOnce();
+      expect(factory.getCurrentRepositorySqlite).not.toHaveBeenCalled();
+    },
+  );
+});

src/backend/tests/database/repositories/unique-username-migration.test.ts

@@ -1,44 +0,0 @@
-import fs from "node:fs";
-import { sql } from "drizzle-orm";
-import { expect, it } from "vitest";
-import { TestSqliteDatabase, testDialect } from "./test-support.js";
-
-it("migrates duplicate usernames without colliding with occupied recovery names", async () => {
-  const adapter = new TestSqliteDatabase();
-  await adapter.connect();
-  try {
-    await adapter.exec(`CREATE TABLE username_migration_fixture (
-      id varchar(255) PRIMARY KEY, username TEXT NOT NULL, registered_at varchar(255) NOT NULL
-    );
-    INSERT INTO username_migration_fixture VALUES
-      ('first', 'alice', '2025-01-01'),
-      ('late', 'alice', '2025-02-01'),
-      ('other', 'alice-late', '2025-01-01'),
-      ('occupied', 'termix-recovered-0-1', '2025-01-01');`);
-    const dialect = testDialect();
-    const number = dialect === "sqlite" ? "0067" : "0072";
-    const migration = fs
-      .readFileSync(`drizzle/${dialect}/${number}_unique_username.sql`, "utf8")
-      .replace(/\busers\b/g, "username_migration_fixture")
-      .replaceAll("idx_users_username", "idx_fixture_username");
-    for (const statement of migration.split("--> statement-breakpoint")) {
-      if (statement.trim()) await adapter.run(sql.raw(statement));
-    }
-    const rows = await adapter.query<{ username: string }>(
-      sql`SELECT username FROM username_migration_fixture`,
-    );
-    const names = rows.map((row) => row.username);
-    expect(new Set(names).size).toBe(4);
-    expect(names).toEqual(
-      expect.arrayContaining(["alice", "alice-late", "termix-recovered-0-1"]),
-    );
-    await expect(async () => {
-      await adapter.run(
-        sql`INSERT INTO username_migration_fixture VALUES ('new', 'alice', '2026-01-01')`,
-      );
-    }).rejects.toThrow();
-  } finally {
-    await adapter.exec("DROP TABLE IF EXISTS username_migration_fixture");
-    await adapter.close();
-  }
-});

src/backend/tests/database/repositories/user-repository.test.ts

@@ -1,9 +1,6 @@
 import { afterEach, describe, expect, it } from "vitest";
 import { TestSqliteDatabase } from "./test-support.js";
-import {
-  UserRepository,
-  isUsernameTaken,
-} from "../../../database/repositories/user-repository.js";
+import { UserRepository } from "../../../database/repositories/user-repository.js";
 
 describe("UserRepository.listPage", () => {
   let adapter: TestSqliteDatabase | null = null;
@@ -96,27 +93,3 @@ describe("UserRepository.listPage", () => {
     expect(page.total).toBe(5);
   });
 });
-
-describe("UserRepository.create", () => {
-  let adapter: TestSqliteDatabase | null = null;
-
-  afterEach(async () => {
-    if (adapter) {
-      await adapter.close();
-      adapter = null;
-    }
-  });
-
-  it("rejects a taken username in a way callers can recognise", async () => {
-    adapter = new TestSqliteDatabase();
-    const repo = new UserRepository(await adapter.connect());
-    await repo.create({ id: "u1", username: "alice", passwordHash: "hash" });
-
-    const error = await repo
-      .create({ id: "u2", username: "alice", passwordHash: "hash" })
-      .catch((e: unknown) => e);
-
-    expect(isUsernameTaken(error)).toBe(true);
-    expect(isUsernameTaken(new Error("unrelated"))).toBe(false);
-  });
-});

src/backend/tests/database/routes/host-bulk-routes.test.ts

@@ -92,13 +92,6 @@ Host alias-only
     expect(result).toHaveLength(0);
   });
 
-  it("accepts tabs and = between keywords and values", () => {
-    const config = "Host\tweb\n\tHostName=10.0.0.5\n\tUser = deploy\n";
-    expect(parseSSHConfig(config)).toEqual([
-      { name: "web", hostname: "10.0.0.5", user: "deploy" },
-    ]);
-  });
-
   it("defaults port to undefined when not specified", () => {
     const config = `
 Host server

src/backend/tests/database/routes/plugins.test.ts

@@ -176,7 +176,6 @@ const manageMock = vi.hoisted(() => ({
   deletePluginData: vi.fn(),
   planStateChange: vi.fn(),
   setPluginState: vi.fn(),
-  enablePluginWithConsent: vi.fn(),
   getDeveloperMode: vi.fn(),
   setDeveloperMode: vi.fn(),
   stageUpload: vi.fn(),
@@ -216,12 +215,6 @@ const onboardingMock = vi.hoisted(() => ({
 
 vi.mock("../../../plugins/onboarding.js", () => onboardingMock);
 
-const syncPluginsMock = vi.hoisted(() => ({
-  isServerManaged: vi.fn((_id: string) => true),
-}));
-
-vi.mock("../../../sync/client/plugins.js", () => syncPluginsMock);
-
 const pluginRoutes = (await import("../../../database/routes/plugins.js"))
   .default;
 
@@ -1146,65 +1139,6 @@ describe("plugins route", () => {
       expect(manageMock.installPlugin).not.toHaveBeenCalled();
     });
 
-    describe("on a linked desktop", () => {
-      const switchOn = (id: string) =>
-        fetch(`${baseUrl}/plugins/${id}/state`, {
-          method: "PATCH",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            enabled: true,
-            version: "1.0.0",
-            capabilities: ["kv:own"],
-          }),
-        });
-
-      beforeEach(() => {
-        manageMock.isLinkedDesktop.mockResolvedValue(true);
-        state.plugins.set("sample-plugin", makePlugin({ state: "disabled" }));
-      });
-
-      afterEach(() => {
-        syncPluginsMock.isServerManaged.mockImplementation(() => true);
-      });
-
-      it("refuses to switch a plugin the server decides", async () => {
-        const res = await switchOn("sample-plugin");
-        expect(res.status).toBe(409);
-        expect((await res.json()).code).toBe("MANAGED_BY_SERVER");
-        expect(manageMock.setPluginState).not.toHaveBeenCalled();
-      });
-
-      it("lets the desktop's admin switch one the server does not", async () => {
-        syncPluginsMock.isServerManaged.mockImplementation(() => false);
-        manageMock.enablePluginWithConsent.mockResolvedValue({
-          enable: [],
-          disable: [],
-        });
-        const res = await switchOn("sample-plugin");
-        expect(res.status).toBe(200);
-        expect(manageMock.enablePluginWithConsent).toHaveBeenCalledWith(
-          "sample-plugin",
-          expect.objectContaining({
-            version: "1.0.0",
-            capabilities: ["kv:own"],
-          }),
-        );
-      });
-
-      it("says per plugin whether the server decides it", async () => {
-        state.plugins.set("other", makePlugin({ id: "other" }));
-        syncPluginsMock.isServerManaged.mockImplementation(
-          (id) => id === "other",
-        );
-        const listed = (await (
-          await fetch(`${baseUrl}/plugins`)
-        ).json()) as Array<{ id: string; managedByServer: boolean }>;
-        expect(
-          Object.fromEntries(listed.map((p) => [p.id, p.managedByServer])),
-        ).toEqual({ "sample-plugin": false, other: true });
-      });
-    });
-
     it("previews a state change without making it", async () => {
       state.plugins.set("sample-plugin", makePlugin());
       manageMock.planStateChange.mockResolvedValue({

src/backend/tests/electron/c2s-runtime.test.ts

@@ -61,7 +61,6 @@ function setup() {
     getC2SRelayHeaders: headers,
     getWebSocketOptions: (_url: string, options: unknown) => options,
     attachC2SAuth: vi.fn(),
-    keepC2SSocketAlive: vi.fn(),
     logToFile: vi.fn(),
     emitC2STunnelStatuses: vi.fn(),
     checkLocalPortAvailable: async () => ({ available: true }),
@@ -145,35 +144,6 @@ describe("client tunnel runtime authentication", () => {
     expect(sockets).toHaveLength(1);
   });
 
-  it("keeps the relay's reason when it closes after an error", async () => {
-    const { context, runtimes, sockets } = setup();
-    const runtime = { status: { connected: true } };
-    runtimes.set("web", runtime);
-    const test = context.testC2SRelay(
-      { name: "web" },
-      "127.0.0.1",
-      8443,
-      null,
-      runtime,
-    );
-    await vi.waitFor(() => expect(sockets).toHaveLength(1));
-    sockets[0].emit(
-      "message",
-      Buffer.from(
-        JSON.stringify({
-          type: "error",
-          error: "Target 127.0.0.1:8443 refused",
-        }),
-      ),
-      false,
-    );
-    sockets[0].close();
-    expect(await test).toMatchObject({ success: false });
-    expect(runtimes.get("web").status.reason).toBe(
-      "Target 127.0.0.1:8443 refused",
-    );
-  });
-
   it("keeps the tunnel connected when one of its connections fails", async () => {
     const { context, runtimes, sockets } = setup();
     runtimes.set("web", { status: { connected: true, status: "CONNECTED" } });
@@ -207,32 +177,3 @@ describe("client tunnel runtime authentication", () => {
     });
   });
 });
-
-describe("client tunnel socket keepalive", () => {
-  it("pings an open socket until it closes", () => {
-    vi.useFakeTimers();
-    try {
-      const context = vm.createContext({
-        setInterval,
-        clearInterval,
-        WebSocket: { OPEN: 1 },
-      });
-      vm.runInContext(
-        section("function keepC2SSocketAlive(", "// C2S (client-to-server)"),
-        context,
-      );
-      const ws = Object.assign(new EventEmitter(), {
-        readyState: 1,
-        ping: vi.fn(),
-      });
-      context.keepC2SSocketAlive(ws);
-      vi.advanceTimersByTime(50_000);
-      expect(ws.ping).toHaveBeenCalledTimes(2);
-      ws.emit("close");
-      vi.advanceTimersByTime(50_000);
-      expect(ws.ping).toHaveBeenCalledTimes(2);
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-});

src/backend/tests/electron/local-shell.test.ts

@@ -80,20 +80,4 @@ describe("repairSpawnHelpers", () => {
     expect(chmods[0][1] & 0o111).not.toBe(0);
     expect(chmods[0][0]).toContain("app.asar.unpacked");
   });
-
-  it.each(["app-arm64.asar", "app-x64.asar"])(
-    "repairs the helper in the unpacked copy of a universal build's %s",
-    (asar) => {
-      const chmods: string[] = [];
-      const fsImpl = {
-        statSync: () => ({ mode: 0o644 }),
-        chmodSync: (file: string) => {
-          chmods.push(file.split(require("node:path").sep).join("/"));
-        },
-      };
-      const dir = `/Applications/Termix.app/Contents/Resources/${asar}/node_modules/node-pty`;
-      repairSpawnHelpers(dir, fsImpl);
-      expect(chmods[0]).toContain(`/${asar}.unpacked/node_modules/node-pty/`);
-    },
-  );
 });

src/backend/tests/electron/patch-node-pty.test.ts

@@ -11,48 +11,7 @@ import { tmpdir } from "node:os";
 import { describe, expect, it } from "vitest";
 
 const require = createRequire(import.meta.url);
-const {
-  chmodSpawnHelpers,
-  patchUnixTerminalHelperRewrite,
-} = require("../../../../scripts/patch-node-pty.cjs");
-
-const upstreamRewrite = [
-  "helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
-  "helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
-].join("\n");
-
-const previouslyPatchedRewrite = [
-  "if (!helperPath.includes('app.asar.unpacked')) {",
-  "    helperPath = helperPath.replace('app.asar', 'app.asar.unpacked');",
-  "}",
-  "if (!helperPath.includes('node_modules.asar.unpacked')) {",
-  "    helperPath = helperPath.replace('node_modules.asar', 'node_modules.asar.unpacked');",
-  "}",
-].join("\n");
-
-const resources = "/Applications/Termix.app/Contents/Resources";
-const helperPaths = [
-  ["app.asar", "app.asar.unpacked"],
-  ["app-arm64.asar", "app-arm64.asar.unpacked"],
-  ["app-x64.asar", "app-x64.asar.unpacked"],
-  ["app.asar.unpacked", "app.asar.unpacked"],
-  ["app-arm64.asar.unpacked", "app-arm64.asar.unpacked"],
-].map(([from, to]) => [
-  `${resources}/${from}/node_modules/node-pty/build/Release/spawn-helper`,
-  `${resources}/${to}/node_modules/node-pty/build/Release/spawn-helper`,
-]);
-
-function writeUnixTerminal(rewrite: string) {
-  const file = join(
-    tmpdir(),
-    `termix-unix-terminal-${Date.now()}-${Math.random()}.cjs`,
-  );
-  writeFileSync(
-    file,
-    `module.exports = function (helperPath) {\n${rewrite}\nreturn helperPath;\n};\n`,
-  );
-  return file;
-}
+const { chmodSpawnHelpers } = require("../../../../scripts/patch-node-pty.cjs");
 
 // chmod's execute bit is a POSIX concept; Windows/NTFS has no equivalent mode bit.
 const itPosix = process.platform === "win32" ? it.skip : it;
@@ -71,22 +30,4 @@ describe("patch-node-pty", () => {
     expect(chmodSpawnHelpers(root)).toBe(0);
     expect(existsSync(helper)).toBe(true);
   });
-
-  it.each([
-    ["upstream", upstreamRewrite],
-    ["previously patched", previouslyPatchedRewrite],
-  ])(
-    "points the %s helper path at the unpacked copy of any app asar",
-    (_, rewrite) => {
-      const file = writeUnixTerminal(rewrite);
-
-      expect(patchUnixTerminalHelperRewrite(file)).toBe(true);
-      expect(patchUnixTerminalHelperRewrite(file)).toBe(false);
-
-      const rewriteHelperPath = require(file);
-      for (const [from, to] of helperPaths) {
-        expect(rewriteHelperPath(from)).toBe(to);
-      }
-    },
-  );
 });

src/backend/tests/hosts/defaults/write-rules.test.ts

@@ -106,31 +106,6 @@ describe("applyHostDefaultsToWrite", () => {
     expect(overrides.core).toEqual(["statusCheckEnabled", "username"]);
   });
 
-  it("keeps a changed auth type on an update without a list", async () => {
-    userDefault("auth", { authType: "credential", credentialId: 3 });
-    const stored = {
-      id: 5,
-      userId: "u1",
-      authType: "credential",
-      credentialId: 3,
-      defaultOverrides: JSON.stringify({ core: ["username"] }),
-    };
-    const columns: Record<string, unknown> = {
-      authType: "vault",
-      credentialId: null,
-      overrideCredentialUsername: 0,
-    };
-    const overrides = await applyHostDefaultsToWrite({
-      ownerId: "u1",
-      hostId: 5,
-      columns,
-      body: { authType: "vault", credentialId: 0 },
-      stored: stored as never,
-    });
-    expect(columns.authType).toBe("vault");
-    expect(overrides.core).toContain("auth");
-  });
-
   it("keeps a locked key's state for a shared editor", async () => {
     const overrides = await applyHostDefaultsToWrite({
       ownerId: "u1",

src/backend/tests/hosts/host-key-verifier.test.ts

@@ -1,16 +1,10 @@
 import { EventEmitter } from "node:events";
 import type { WebSocket } from "ws";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { SSHHostKeyVerifier } from "../../hosts/host-key-verifier.js";
 
-const repo = vi.hoisted(() => ({
-  updateHostKey: vi.fn(async () => {}),
-  storeHostKey: vi.fn(async () => {}),
-  touchHostKeyLastVerified: vi.fn(async () => {}),
-}));
-
 vi.mock("../../database/repositories/factory.js", () => ({
-  createCurrentHostResolutionRepository: () => repo,
+  createCurrentHostResolutionRepository: () => ({}),
 }));
 vi.mock("../../utils/logger.js", () => ({
   sshLogger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
@@ -63,50 +57,3 @@ describe("quick connect host keys", () => {
     expect(await verifyUnsaved(null)).toBe(true);
   });
 });
-
-const pinned = {
-  hostKeyFingerprint: Buffer.from("old-key").toString("hex"),
-  hostKeyType: "ssh-ed25519",
-  hostKeyAlgorithm: "sha256",
-  hostKeyChangedCount: 0,
-  name: "bastion",
-};
-
-async function verifyJumpHop(socket: WebSocket | null, key: string) {
-  const verifier = await SSHHostKeyVerifier.createHostVerifier(
-    7,
-    "10.0.0.1",
-    22,
-    socket,
-    "user",
-    true,
-    pinned,
-  );
-  return new Promise<boolean>((resolve) => verifier(Buffer.from(key), resolve));
-}
-
-describe("jump host key changes", () => {
-  beforeEach(() => {
-    repo.updateHostKey.mockClear();
-  });
-
-  it("refuses a changed key and keeps the pin when nobody can be asked", async () => {
-    expect(await verifyJumpHop(null, "new-key")).toBe(false);
-    expect(repo.updateHostKey).not.toHaveBeenCalled();
-  });
-
-  it("asks the user and only replaces the pin when they accept", async () => {
-    const no = socketAnswering("reject");
-    expect(await verifyJumpHop(no.socket, "new-key")).toBe(false);
-    expect(no.sent[0]).toContain("host_key_changed");
-    expect(repo.updateHostKey).not.toHaveBeenCalled();
-
-    const yes = socketAnswering("accept");
-    expect(await verifyJumpHop(yes.socket, "new-key")).toBe(true);
-    expect(repo.updateHostKey).toHaveBeenCalledTimes(1);
-  });
-
-  it("still accepts the pinned key without asking", async () => {
-    expect(await verifyJumpHop(null, "old-key")).toBe(true);
-  });
-});

src/backend/tests/hosts/ssh-connection-pool.test.ts

@@ -42,52 +42,6 @@ describe("SSHConnectionPool", () => {
     pool.destroy();
   });
 
-  it("tracks every client from concurrent connects to a new host", async () => {
-    const pool = new SSHConnectionPool();
-    const clients = Array.from({ length: 3 }, deferredClient);
-    let factoryCalls = 0;
-    const factory = vi.fn(() => clients[factoryCalls++].promise);
-
-    const requests = Array.from({ length: 3 }, () =>
-      pool.getConnection("new-host", factory),
-    );
-    for (const pending of clients) pending.resolve(pending.client);
-    const connected = await Promise.all(requests);
-
-    for (const client of connected) pool.releaseConnection("new-host", client);
-    const reused = await Promise.all(
-      Array.from({ length: 3 }, () => pool.getConnection("new-host", factory)),
-    );
-    expect(new Set(reused)).toEqual(new Set(connected));
-    expect(factory).toHaveBeenCalledTimes(3);
-
-    pool.clearKeyConnections("new-host");
-    for (const pending of clients) {
-      expect(pending.client.end).toHaveBeenCalledOnce();
-    }
-    pool.destroy();
-  });
-
-  it("does not resurrect a connection removed while another connects", async () => {
-    const pool = new SSHConnectionPool();
-    const first = deferredClient();
-    const second = deferredClient();
-    first.resolve(first.client);
-    await pool.getConnection("host", () => first.promise);
-
-    const request = pool.getConnection("host", () => second.promise);
-    first.client.emit("close");
-    second.resolve(second.client);
-    await expect(request).resolves.toBe(second.client);
-
-    pool.releaseConnection("host", first.client);
-    pool.releaseConnection("host", second.client);
-    await expect(
-      pool.getConnection("host", () => deferredClient().promise),
-    ).resolves.toBe(second.client);
-    pool.destroy();
-  });
-
   it("discards a pending connection when its host pool is cleared", async () => {
     const pool = new SSHConnectionPool();
     const pending = deferredClient();

src/backend/tests/plugins/artifact-manifest.test.ts

@@ -2,10 +2,9 @@ import { describe, expect, it } from "vitest";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import zlib from "node:zlib";
 import * as tar from "tar";
 import {
-  readArtifactFiles,
+  readArtifactFile,
   readArtifactManifest,
   sameCapabilities,
 } from "../../plugins/artifact-manifest.js";
@@ -28,42 +27,20 @@ function pack(files: Record<string, string>, prefix = ""): Buffer {
   }
 }
 
-/** Two archives' entries back to back, so a name can appear twice. */
-function concat(first: Buffer, second: Buffer): Buffer {
-  const entries = (buffer: Buffer) => {
-    const raw = zlib.gunzipSync(buffer);
-    // Drop the two zero blocks that end every tar.
-    return raw.subarray(0, raw.length - 1024);
-  };
-  return zlib.gzipSync(
-    Buffer.concat([entries(first), entries(second), Buffer.alloc(1024)]),
-  );
-}
-
-describe("readArtifactFiles", () => {
+describe("readArtifactFile", () => {
   it("finds a file by name, with or without a ./ prefix", () => {
     const plain = pack({ "manifest.json": "{}", "dist/a.js": "x" });
-    expect(
-      readArtifactFiles(plain, "dist/a.js").map((b) => b.toString()),
-    ).toEqual(["x"]);
+    expect(readArtifactFile(plain, "dist/a.js")?.toString()).toBe("x");
     const dotted = pack({ "manifest.json": '{"id":"a"}' }, "./");
-    expect(
-      readArtifactFiles(dotted, "manifest.json").map((b) => b.toString()),
-    ).toEqual(['{"id":"a"}']);
-  });
-
-  it("returns nothing for a missing file", () => {
-    expect(readArtifactFiles(pack({ "a.txt": "a" }), "manifest.json")).toEqual(
-      [],
+    expect(readArtifactFile(dotted, "manifest.json")?.toString()).toBe(
+      '{"id":"a"}',
     );
   });
 
-  it("resolves names that need a pax header", () => {
-    const long = `dist/${"x".repeat(150)}.js`;
-    const archive = pack({ "manifest.json": "{}", [long]: "x" });
-    expect(readArtifactFiles(archive, long).map((b) => b.toString())).toEqual([
-      "x",
-    ]);
+  it("returns null for a missing file", () => {
+    expect(readArtifactFile(pack({ "a.txt": "a" }), "manifest.json")).toBe(
+      null,
+    );
   });
 });
 
@@ -91,18 +68,6 @@ describe("readArtifactManifest", () => {
       readArtifactManifest(pack({ "manifest.json": "[1]" })),
     ).toThrow(/not an object/);
   });
-
-  it("refuses an archive with two manifests", () => {
-    const first = pack({ "manifest.json": '{"capabilities":[]}' });
-    const second = pack({ "manifest.json": '{"capabilities":["ssh"]}' });
-    expect(() => readArtifactManifest(concat(first, second))).toThrow(
-      /more than one manifest.json/,
-    );
-    const upper = pack({ "MANIFEST.JSON": '{"capabilities":["ssh"]}' });
-    expect(() => readArtifactManifest(concat(first, upper))).toThrow(
-      /more than one manifest.json/,
-    );
-  });
 });
 
 describe("sameCapabilities", () => {

src/backend/tests/plugins/http.test.ts

@@ -461,19 +461,6 @@ describe("public route rate limit", () => {
     expect(http.overPublicRateLimit("other", "1.2.3.4", now)).toBe(false);
   });
 
-  it("lets a plugin raise its own limit, capped, unless the admin set one", () => {
-    const hits = (limit: number, count: number) =>
-      Array.from({ length: count }, () =>
-        http.overPublicRateLimit("proxy", "ip", 0, limit),
-      ).filter(Boolean).length;
-    expect(hits(500, 500)).toBe(0);
-    http.resetPublicRateLimits();
-    expect(hits(50_000, 10_001)).toBe(1);
-    http.resetPublicRateLimits();
-    process.env.TERMIX_PLUGIN_PUBLIC_RATE_LIMIT = "2";
-    expect(hits(500, 3)).toBe(1);
-  });
-
   it("starts a new window after a minute", () => {
     process.env.TERMIX_PLUGIN_PUBLIC_RATE_LIMIT = "1";
     expect(http.overPublicRateLimit("demo", "ip", 0)).toBe(false);

src/backend/tests/plugins/install-counts.test.ts

@@ -1,15 +1,25 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const state = vi.hoisted(() => ({
-  stats: null as null | { plugins: Map<string, number> },
+  stats: null as null | {
+    plugins: Map<string, { downloads: number; activeInstalls: number | null }>;
+  },
   fail: false,
   sources: [{ id: "official", tier: "official" }] as Array<{
     id: string;
     tier: string;
   }>,
-  statsBySource: {} as Record<string, { plugins: Map<string, number> } | null>,
+  statsBySource: {} as Record<
+    string,
+    {
+      plugins: Map<
+        string,
+        { downloads: number; activeInstalls: number | null }
+      >;
+    } | null
+  >,
   upserted: [] as Array<{ registryId: string; entries: unknown[] }>,
-  rows: [] as Array<{ pluginId: string; count: number }>,
+  rows: [] as Array<{ pluginId: string; count: number; source: string }>,
 }));
 
 vi.mock("../../plugins/registry-index.js", () => ({
@@ -36,11 +46,12 @@ vi.mock("../../database/repositories/factory.js", () => ({
 }));
 
 const {
-  readDownloadCounts,
-  refreshDownloadCounts,
-  resetDownloadCountRefresh,
-  syncDownloadCounts,
-} = await import("../../plugins/download-counts.js");
+  DOWNLOADS_SOURCE,
+  TELEMETRY_SOURCE,
+  preferredCount,
+  readInstallCounts,
+  syncInstallCounts,
+} = await import("../../plugins/install-counts.js");
 
 beforeEach(() => {
   state.stats = null;
@@ -49,62 +60,9 @@ beforeEach(() => {
   state.statsBySource = {};
   state.upserted = [];
   state.rows = [];
-  resetDownloadCountRefresh();
 });
 
-describe("refreshDownloadCounts", () => {
-  const docker = () => ({ plugins: new Map([["docker", 5]]) });
-
-  it("syncs on the first look and not again while fresh", async () => {
-    state.stats = docker();
-    await refreshDownloadCounts();
-    await refreshDownloadCounts();
-    expect(state.upserted).toHaveLength(1);
-  });
-
-  it("does not sync again right away even when forced", async () => {
-    state.stats = docker();
-    await refreshDownloadCounts();
-    await refreshDownloadCounts(true);
-    expect(state.upserted).toHaveLength(1);
-  });
-
-  it("syncs again when forced after a minute", async () => {
-    vi.useFakeTimers({ toFake: ["Date"] });
-    try {
-      state.stats = docker();
-      await refreshDownloadCounts();
-      vi.setSystemTime(Date.now() + 61_000);
-      await refreshDownloadCounts();
-      expect(state.upserted).toHaveLength(1);
-      await refreshDownloadCounts(true);
-      expect(state.upserted).toHaveLength(2);
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-});
-
-describe("syncDownloadCounts", () => {
-  it("writes one row per plugin", async () => {
-    state.stats = {
-      plugins: new Map([
-        ["docker", 50],
-        ["tunnels", 8],
-      ]),
-    };
-    expect(await syncDownloadCounts()).toBe(2);
-    expect(state.upserted).toEqual([
-      {
-        registryId: "official",
-        entries: [
-          { pluginId: "docker", count: 50 },
-          { pluginId: "tunnels", count: 8 },
-        ],
-      },
-    ]);
-  });
-
+describe("syncInstallCounts with more registries", () => {
   it("stores counts per registry and skips custom ones", async () => {
     state.sources = [
       { id: "official", tier: "official" },
@@ -112,33 +70,78 @@ describe("syncDownloadCounts", () => {
       { id: "mine", tier: "custom" },
     ];
     state.statsBySource = {
-      official: { plugins: new Map([["docker", 5]]) },
-      community: { plugins: new Map([["neat", 3]]) },
+      official: {
+        plugins: new Map([["docker", { downloads: 5, activeInstalls: null }]]),
+      },
+      community: {
+        plugins: new Map([["neat", { downloads: 3, activeInstalls: 2 }]]),
+      },
       mine: null,
     };
-    expect(await syncDownloadCounts()).toBe(2);
+    expect(await syncInstallCounts()).toBe(2);
     expect(state.upserted.map((entry) => entry.registryId)).toEqual([
       "official",
       "community",
     ]);
   });
+});
+
+describe("preferredCount", () => {
+  it("prefers active installs and falls back to downloads", () => {
+    expect(preferredCount({ downloads: 90, activeInstalls: 12 })).toEqual({
+      count: 12,
+      source: TELEMETRY_SOURCE,
+    });
+    expect(preferredCount({ downloads: 90, activeInstalls: null })).toEqual({
+      count: 90,
+      source: DOWNLOADS_SOURCE,
+    });
+    expect(preferredCount({ downloads: 90, activeInstalls: 0 })).toEqual({
+      count: 90,
+      source: DOWNLOADS_SOURCE,
+    });
+  });
+});
+
+describe("syncInstallCounts", () => {
+  it("writes one row per plugin with its preferred source", async () => {
+    state.stats = {
+      plugins: new Map([
+        ["docker", { downloads: 50, activeInstalls: 20 }],
+        ["tunnels", { downloads: 8, activeInstalls: null }],
+      ]),
+    };
+    expect(await syncInstallCounts()).toBe(2);
+    expect(state.upserted).toEqual([
+      {
+        registryId: "official",
+        entries: [
+          { pluginId: "docker", count: 20, source: TELEMETRY_SOURCE },
+          { pluginId: "tunnels", count: 8, source: DOWNLOADS_SOURCE },
+        ],
+      },
+    ]);
+  });
 
   it("keeps the old numbers when the registry is unreachable", async () => {
     state.fail = true;
-    expect(await syncDownloadCounts()).toBe(0);
+    expect(await syncInstallCounts()).toBe(0);
     expect(state.upserted).toEqual([]);
   });
 
   it("does nothing for a registry with no stats file", async () => {
-    expect(await syncDownloadCounts()).toBe(0);
+    expect(await syncInstallCounts()).toBe(0);
     expect(state.upserted).toEqual([]);
   });
 });
 
-describe("readDownloadCounts", () => {
+describe("readInstallCounts", () => {
   it("maps the stored rows by plugin id", async () => {
-    state.rows = [{ pluginId: "docker", count: 20 }];
-    const counts = await readDownloadCounts();
-    expect(counts.get("docker")).toBe(20);
+    state.rows = [{ pluginId: "docker", count: 20, source: TELEMETRY_SOURCE }];
+    const counts = await readInstallCounts();
+    expect(counts.get("docker")).toEqual({
+      count: 20,
+      source: TELEMETRY_SOURCE,
+    });
   });
 });