@termix-ssh/plugin-sdk 1.0.12 → 1.0.13

package/dist/host/ui.js

@@ -61,8 +61,10 @@ import {
   hostActionsFor,
   hostBadgesFor,
   hostEditorSectionList,
+  hostEditorToolbarItemsFor,
   hostMenuItemsFor,
   hostProtocolFlags,
+  hostStatusIndicatorsFor,
   i18n_default,
   installPluginHostBridge,
   isCoreRailView,
@@ -139,8 +141,10 @@ import {
   useHostBadges,
   useHostContextMenuItems,
   useHostEditorSections,
+  useHostEditorToolbarItems,
   useHostProtocols,
   useHostStatus,
+  useHostStatusIndicators,
   useInstalledPlugins,
   useIsMobile,
   useKeybindingActions,
@@ -169,10 +173,10 @@ import {
   useThemes,
   verifySecondFactor,
   withProtocolSettings
-} from "./chunk-XKA3DBB2.js";
+} from "./chunk-CALNJCHN.js";
 import {
   usePermissions
-} from "./chunk-VEWOYAMZ.js";
+} from "./chunk-T2PZWXFJ.js";
 import {
   AddButton,
   Card,
@@ -193,7 +197,7 @@ import {
   isPrerelease,
   reportBetaFeedbackUrl,
   reportCoreIssueUrl
-} from "./chunk-X4QZKO5G.js";
+} from "./chunk-54KCK6IZ.js";
 import {
   Action,
   Activity,
@@ -383,7 +387,7 @@ import {
   useSurfaceKind,
   useUiPreference,
   useUiPreferencesContext
-} from "./chunk-AWR6FYDO.js";
+} from "./chunk-ERGN4YW6.js";
 import {
   CREDENTIAL_ROW_FIELD_KEYS,
   PRESETS,
@@ -404,7 +408,6 @@ import {
   assignRoleToUser,
   authApi,
   buildOriginWsUrl,
-  bulkImportSSHHosts,
   bulkUpdateSSHHosts,
   changePassword,
   completePasswordReset,
@@ -426,11 +429,7 @@ import {
   deleteRole,
   deleteSSHHost,
   deleteUser,
-  deployCredentialToHost,
   duplicateCredential,
-  exportAllSSHHosts,
-  generateKeyPair,
-  generatePublicKeyFromPrivate,
   getActiveSessions,
   getApiKeys,
   getBackendUrl,
@@ -480,7 +479,6 @@ import {
   handleApiError,
   hostApi,
   hydrateLocalSharedHostAuth,
-  importSSHConfigHosts,
   initiatePasswordReset,
   invalidateHostsAndStatusCaches,
   invalidateServerStatusCache,
@@ -529,7 +527,6 @@ import {
   sshHostApi,
   tabTypeForActivity,
   unlinkExternalFromPasswordAccount,
-  updateBranding,
   updateCredential,
   updateExternalAutoProvision,
   updateFolderMetadata,
@@ -547,7 +544,7 @@ import {
   useTabs,
   useTabsSafe,
   verifyPasswordResetCode
-} from "./chunk-RUPLD6RF.js";
+} from "./chunk-CN5UBTBP.js";
 import {
   define_import_meta_env_default,
   init_define_import_meta_env
@@ -32199,167 +32196,6 @@ function B2({ asChild: r, children: o }, n) {
 }
 var Te = { position: "absolute", width: "1px", height: "1px", padding: "0", margin: "-1px", overflow: "hidden", clip: "rect(0, 0, 0, 0)", whiteSpace: "nowrap", borderWidth: "0" };
 
-// src/ui/sidebar/host-export-payload.ts
-init_define_import_meta_env();
-var FIELD_GROUP_KEYS = {
-  connection: [
-    "connectionType",
-    "name",
-    "ip",
-    "port",
-    "username",
-    "folder",
-    "domain",
-    "security",
-    "ignoreCert"
-  ],
-  notes: ["notes"],
-  tags: ["tags", "pin"],
-  proxy: [
-    "useSocks5",
-    "socks5Host",
-    "socks5Port",
-    "socks5Username",
-    "socks5ProxyChain"
-  ],
-  jumpHosts: ["jumpHosts"],
-  // Every plugin's host settings, enable switches included.
-  featureFlags: ["pluginSettings", "forceKeyboardInteractive"],
-  advanced: [
-    "statusCheckEnabled",
-    "statusCheckInterval",
-    "terminalConfig",
-    "sshOptions"
-  ]
-};
-var SECRET_KEYS = [
-  "password",
-  "key",
-  "keyPassword",
-  "sudoPassword",
-  "socks5Password"
-];
-var CREDENTIAL_KEYS = [
-  ...SECRET_KEYS,
-  "authType",
-  "keyType",
-  "credentialAlias",
-  "credentialId",
-  "overrideCredentialUsername"
-];
-var TUPLE_KEYS = ["name", "ip", "port", "username", "connectionType"];
-function pluginSecretKeys(summaries) {
-  const result = {};
-  for (const summary of summaries) {
-    for (const field of summary.contributes?.settings?.host?.fields ?? []) {
-      if (!field.secretKeys?.length) continue;
-      (result[summary.id] ??= {})[field.key] = field.secretKeys;
-    }
-  }
-  return result;
-}
-var NESTED_SECRET_ARRAYS = [
-  { container: "socks5ProxyChain", field: "password" }
-];
-function mapPluginSecrets(pluginSettings, secrets, replace2) {
-  if (!pluginSettings || typeof pluginSettings !== "object") {
-    return pluginSettings;
-  }
-  const perPlugin = {};
-  for (const [pluginId, values] of Object.entries(
-    pluginSettings
-  )) {
-    const copy = { ...values };
-    for (const [field, keys2] of Object.entries(secrets[pluginId] ?? {})) {
-      const blob = copy[field];
-      if (!blob || typeof blob !== "object") continue;
-      const record = { ...blob };
-      for (const key of keys2) {
-        if (key in record) record[key] = replace2(record[key]);
-      }
-      copy[field] = record;
-    }
-    perPlugin[pluginId] = copy;
-  }
-  return perPlugin;
-}
-function hostKey(host) {
-  return JSON.stringify(TUPLE_KEYS.map((k3) => String(host[k3] ?? "")));
-}
-function buildExportPayload(raw, selected, groups, withCredentials, pluginSecrets = {}) {
-  const allowed = /* @__PURE__ */ new Set([
-    "exportId",
-    ...CREDENTIAL_KEYS,
-    ...FIELD_GROUP_KEYS.connection
-  ]);
-  for (const group of groups) {
-    for (const key of FIELD_GROUP_KEYS[group]) allowed.add(key);
-  }
-  const hosts = (raw.hosts ?? []).filter((host) => selected === null || selected.has(hostKey(host))).map((host) => {
-    const shaped = {};
-    for (const [key, value] of Object.entries(host)) {
-      if (allowed.has(key)) shaped[key] = value;
-    }
-    if (!withCredentials) {
-      shaped.pluginSettings = mapPluginSecrets(
-        shaped.pluginSettings,
-        pluginSecrets,
-        () => null
-      );
-      for (const { container, field } of NESTED_SECRET_ARRAYS) {
-        const arr = shaped[container];
-        if (Array.isArray(arr)) {
-          shaped[container] = arr.map(
-            (entry) => entry && typeof entry === "object" ? { ...entry, [field]: null } : entry
-          );
-        }
-      }
-    }
-    return shaped;
-  });
-  const result = { ...raw, hosts };
-  if (raw.credentials) {
-    const used = new Set(
-      hosts.map((host) => host.credentialAlias).filter(Boolean)
-    );
-    result.credentials = raw.credentials.filter(
-      (entry) => used.has(entry.alias)
-    );
-  }
-  return result;
-}
-function maskSecrets(payload, pluginSecrets = {}) {
-  return {
-    ...payload,
-    hosts: payload.hosts.map((host) => {
-      const masked = { ...host };
-      for (const key of SECRET_KEYS) {
-        if (masked[key] !== void 0 && masked[key] !== null && masked[key] !== "") {
-          masked[key] = "<included>";
-        }
-      }
-      masked.pluginSettings = mapPluginSecrets(
-        masked.pluginSettings,
-        pluginSecrets,
-        (value) => value ? "<included>" : value
-      );
-      for (const { container, field } of NESTED_SECRET_ARRAYS) {
-        const arr = masked[container];
-        if (Array.isArray(arr)) {
-          masked[container] = arr.map((entry) => {
-            if (entry && typeof entry === "object") {
-              const record = entry;
-              if (record[field]) return { ...record, [field]: "<included>" };
-            }
-            return entry;
-          });
-        }
-      }
-      return masked;
-    })
-  };
-}
-
 // src/types/auth-protocols.ts
 init_define_import_meta_env();
 var SSH_AUTH_PROTOCOL = "ssh";
@@ -32428,25 +32264,6 @@ async function getAuditLogActions() {
     handleApiError(error, "fetch audit log actions");
   }
 }
-async function getAuditForwarding() {
-  try {
-    const response = await authApi.get("/users/audit-forwarding");
-    return response.data;
-  } catch (error) {
-    throw handleApiError(error, "get audit forwarding settings");
-  }
-}
-async function updateAuditForwarding(url, token) {
-  try {
-    const response = await authApi.patch("/users/audit-forwarding", {
-      url,
-      token
-    });
-    return response.data;
-  } catch (error) {
-    throw handleApiError(error, "update audit forwarding settings");
-  }
-}
 
 // src/ui/api/host-defaults-api.ts
 init_define_import_meta_env();
@@ -34226,6 +34043,7 @@ export {
   NumberField,
   OPEN_PLUGINS_EVENT,
   PANEL,
+  PRESETS,
   PROMPT_BUTTON,
   PROMPT_DESTRUCTIVE_BUTTON,
   PROMPT_PRIMARY_BUTTON,
@@ -34323,9 +34141,7 @@ export {
   applyUiFont,
   assignRoleToUser,
   beginSplitDrag,
-  buildExportPayload,
   buildOriginWsUrl,
-  bulkImportSSHHosts,
   bulkUpdateSSHHosts,
   canConfigureUpdates,
   canJoinSplit,
@@ -34354,22 +34170,17 @@ export {
   deleteRole,
   deleteSSHHost,
   deleteUser,
-  deployCredentialToHost,
   desktopUpdates,
   docsUrl,
   duplicateCredential,
   enabledHostProtocols,
   endSplitDrag,
-  exportAllSSHHosts,
   filterPaletteItems,
   findCoreHostDefault,
   findMatchingKeybinding,
-  generateKeyPair,
-  generatePublicKeyFromPrivate,
   getActiveSessions,
   getAdaptiveResourceBudget,
   getApiKeys,
-  getAuditForwarding,
   getAuditLogActions,
   getAuditLogs,
   getBasePath,
@@ -34438,11 +34249,11 @@ export {
   hasVisibleFields,
   hostActionsFor,
   hostBadgesFor,
-  hostKey,
+  hostEditorToolbarItemsFor,
   hostMenuItemsFor,
   hostProtocolFlags,
+  hostStatusIndicatorsFor,
   hydrateLocalSharedHostAuth,
-  importSSHConfigHosts,
   invalidateHostsAndStatusCaches,
   invalidateServerStatusCache,
   isCoreRailView,
@@ -34467,7 +34278,6 @@ export {
   mapCredentials,
   markAdaptiveResourceUsed,
   markTabSurfaceUsed,
-  maskSecrets,
   moveRailItem,
   moveSplitDrag,
   normalizeLanguageCode,
@@ -34478,7 +34288,6 @@ export {
   parseServerTime,
   pluginKey,
   pluginName,
-  pluginSecretKeys,
   pluginWsUrl,
   preloadTabSurface,
   previewHostDefaultsLevel,
@@ -34551,8 +34360,6 @@ export {
   takePendingManageRequest,
   unlinkExternalFromPasswordAccount,
   unlinkServer,
-  updateAuditForwarding,
-  updateBranding,
   updateCredential,
   updateExternalAutoProvision,
   updateFolderMetadata,
@@ -34588,8 +34395,10 @@ export {
   useHostBadges,
   useHostContextMenuItems,
   useHostEditorSections,
+  useHostEditorToolbarItems,
   useHostProtocols,
   useHostStatus,
+  useHostStatusIndicators,
   useInstalledPlugins,
   useIsDefaultsEditor,
   useIsMobile,

package/dist/host/{use-permissions-6VSHHUMB.js → use-permissions-ISEDRY3J.js}

@@ -7,7 +7,7 @@ import {
   resetPermissionsCache,
   setPermissionsForTesting,
   usePermissions
-} from "./chunk-VEWOYAMZ.js";
+} from "./chunk-T2PZWXFJ.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   hasPermission,

package/dist/manifest.d.ts

@@ -20,7 +20,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export declare const PLUGIN_API_VERSION = "1.4.0";
+export declare const PLUGIN_API_VERSION = "1.5.0";
 /** The API major, the default engine.api for a new plugin. */
 export declare const SUPPORTED_PLUGIN_API_VERSION: string;
 /** Whether this build's plugin API satisfies a manifest's engine.api. */
@@ -500,7 +500,16 @@ export interface PluginManifest {
     nativeDependencies?: string[];
     /** How a linked desktop treats this plugin. Defaults to "mirror". */
     desktop?: PluginDesktopMode;
+    /**
+     * "desktop": the plugin only loads on a desktop app's own embedded backend,
+     * never on a server. It implies desktop "local" and may declare desktop:local.
+     */
+    runtime?: PluginRuntime;
 }
+export type PluginRuntime = "desktop";
+export declare const PLUGIN_RUNTIMES: readonly PluginRuntime[];
+/** The desktop mode a manifest resolves to. */
+export declare function resolvePluginDesktopMode(m: Pick<PluginManifest, "desktop" | "runtime">): PluginDesktopMode;
 export declare const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
 export declare const DEFAULT_FRONTEND_ENTRY = "dist/frontend.js";
 export declare const DEFAULT_LOCALES_DIR = "locales";

package/dist/manifest.js

@@ -22,7 +22,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.4.0";
+export const PLUGIN_API_VERSION = "1.5.0";
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(semver.major(PLUGIN_API_VERSION));
 /** Whether this build's plugin API satisfies a manifest's engine.api. */
@@ -192,6 +192,11 @@ export const PLUGIN_DESKTOP_MODES = [
     "local",
     "server",
 ];
+export const PLUGIN_RUNTIMES = ["desktop"];
+/** The desktop mode a manifest resolves to. */
+export function resolvePluginDesktopMode(m) {
+    return m.desktop ?? (m.runtime === "desktop" ? "local" : "mirror");
+}
 export const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
 export const DEFAULT_FRONTEND_ENTRY = "dist/frontend.js";
 export const DEFAULT_LOCALES_DIR = "locales";
@@ -227,6 +232,7 @@ const ALLOWED_TOP_LEVEL = new Set([
     "platforms",
     "nativeDependencies",
     "desktop",
+    "runtime",
 ]);
 const ALLOWED_CONTRIBUTES = new Set([
     "tabs",
@@ -365,6 +371,15 @@ export function validateManifest(manifest) {
         !PLUGIN_DESKTOP_MODES.includes(m.desktop)) {
         errors.push(`Field "desktop" must be one of: ${PLUGIN_DESKTOP_MODES.join(", ")}`);
     }
+    if (m.runtime !== undefined &&
+        !PLUGIN_RUNTIMES.includes(m.runtime)) {
+        errors.push(`Field "runtime" must be one of: ${PLUGIN_RUNTIMES.join(", ")}`);
+    }
+    if (m.runtime === "desktop" &&
+        m.desktop !== undefined &&
+        m.desktop !== "local") {
+        errors.push(`A "desktop" runtime plugin must use desktop "local"`);
+    }
     validateDependencyMap(m.dependencies, "dependencies", errors);
     validateDependencyMap(m.optionalDependencies, "optionalDependencies", errors);
     validateProvides(m.provides, errors);

package/dist/ssh-keys.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SSH key helpers for plugins that make, check or deploy keys: generate a key
+ * pair, tell what a key is, derive a public key and check a pair belongs
+ * together. Pure functions over ssh2, which the host supplies. Core keeps its
+ * own copy for the connect pipeline.
+ */
+export type SshKeyKind = "ssh-ed25519" | "ssh-rsa" | "ecdsa-sha2-nistp256";
+export interface GeneratedSshKeyPair {
+    privateKey: string;
+    publicKey: string;
+    keyType: SshKeyKind;
+}
+export interface GenerateSshKeyPairOptions {
+    /** RSA only. 2048 to 8192, default 4096. */
+    bits?: number;
+    passphrase?: string;
+    comment?: string;
+}
+/** Makes a new key pair; the public half is one authorized_keys line. */
+export declare function generateSshKeyPair(type: SshKeyKind, options?: GenerateSshKeyPairOptions): GeneratedSshKeyPair;
+/** The key's algorithm, like "ssh-ed25519", or null when it cannot be read. */
+export declare function detectSshKeyType(key: string, passphrase?: string): string | null;
+/** The authorized_keys line for a private key, or null. */
+export declare function publicKeyFromPrivate(privateKey: string, passphrase?: string): string | null;
+/** Whether a public key line belongs to the private key. */
+export declare function validateSshKeyPair(privateKey: string, publicKey: string, passphrase?: string): {
+    isValid: boolean;
+    error?: string;
+};

package/dist/ssh-keys.js

@@ -0,0 +1,85 @@
+/**
+ * SSH key helpers for plugins that make, check or deploy keys: generate a key
+ * pair, tell what a key is, derive a public key and check a pair belongs
+ * together. Pure functions over ssh2, which the host supplies. Core keeps its
+ * own copy for the connect pipeline.
+ */
+import ssh2 from "ssh2";
+/** Makes a new key pair; the public half is one authorized_keys line. */
+export function generateSshKeyPair(type, options = {}) {
+    const algorithm = type === "ssh-rsa" ? "rsa" : type === "ssh-ed25519" ? "ed25519" : "ecdsa";
+    if (type !== "ssh-rsa" &&
+        type !== "ssh-ed25519" &&
+        type !== "ecdsa-sha2-nistp256") {
+        throw new Error(`Unsupported key type: ${String(type)}`);
+    }
+    const generateOptions = {
+        comment: options.comment ?? "",
+    };
+    if (options.passphrase) {
+        generateOptions.passphrase = options.passphrase;
+        generateOptions.cipher = "aes256-ctr";
+    }
+    if (type === "ssh-rsa") {
+        const bits = options.bits ?? 4096;
+        if (!Number.isInteger(bits) || bits < 2048 || bits > 8192) {
+            throw new Error("RSA keys need 2048 to 8192 bits");
+        }
+        generateOptions.bits = bits;
+    }
+    if (type === "ecdsa-sha2-nistp256")
+        generateOptions.bits = 256;
+    const pair = ssh2.utils.generateKeyPairSync(algorithm, generateOptions);
+    return {
+        privateKey: pair.private,
+        publicKey: pair.public.trim(),
+        keyType: type,
+    };
+}
+function parse(key, passphrase) {
+    const parsed = ssh2.utils.parseKey(key.trim(), passphrase || undefined);
+    const first = Array.isArray(parsed) ? parsed[0] : parsed;
+    if (!first || first instanceof Error) {
+        throw first instanceof Error ? first : new Error("Not a readable SSH key");
+    }
+    return first;
+}
+/** The key's algorithm, like "ssh-ed25519", or null when it cannot be read. */
+export function detectSshKeyType(key, passphrase) {
+    try {
+        return parse(key, passphrase).type;
+    }
+    catch {
+        return null;
+    }
+}
+/** The authorized_keys line for a private key, or null. */
+export function publicKeyFromPrivate(privateKey, passphrase) {
+    try {
+        const parsed = parse(privateKey, passphrase);
+        return `${parsed.type} ${parsed.getPublicSSH().toString("base64")}`;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether a public key line belongs to the private key. */
+export function validateSshKeyPair(privateKey, publicKey, passphrase) {
+    try {
+        const priv = parse(privateKey, passphrase);
+        const pub = parse(publicKey);
+        const same = priv.getPublicSSH().equals(pub.getPublicSSH());
+        return same
+            ? { isValid: true }
+            : {
+                isValid: false,
+                error: "The public key does not match the private key",
+            };
+    }
+    catch (error) {
+        return {
+            isValid: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/dist/testing.d.ts

@@ -7,7 +7,7 @@
  *
  * The vitest config these run under comes from @termix-ssh/plugin-sdk/vitest-preset.
  */
-import type { PluginContext } from "./backend.js";
+import type { PluginAuditEntry, PluginContext, PluginDesktopLocal } from "./backend.js";
 import type { HostActionContribution, TermixApp } from "./frontend.js";
 import type { PluginManifest } from "./manifest.js";
 import type { PluginTableDefinition } from "./db.js";
@@ -25,7 +25,7 @@ export interface FakeWsRoute {
 import type { PluginLoginMethod, PluginVerifiedIdentity, PluginSecondFactor, PluginSshAuthProvider, PluginSshConnectOptions, PluginSshHost, PluginHostSummary, PluginShareableUser, PluginShareableRole, PluginSshKeyCredential, PluginSshKeyCredentialInput } from "./backend.js";
 import type { SyncEntityRegistration } from "./backend.js";
 import type { PluginDatabase } from "./backend.js";
-import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostStatusEntry, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
+import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
 /** A timer registered through ctx.schedule, run by hand with runScheduled. */
 export interface FakeScheduledJob {
     kind: "every" | "after";
@@ -42,6 +42,8 @@ export interface FakeContextOptions {
     settings?: Record<string, unknown>;
     /** Seed for the core settings ctx.settings.readCore can reach. */
     coreSettings?: Record<string, string>;
+    /** What ctx.files.dataDir() answers. Defaults to /tmp/<pluginId>. */
+    dataDir?: string;
     /** What ctx.ssh.connect and withConnection hand back as the client. */
     sshClient?: unknown;
     /** A real database behind ctx.db, usually createTestDb().database. */
@@ -75,8 +77,18 @@ export interface FakeContextOptions {
     sshKeyCredentials?: PluginSshKeyCredential[];
     /** What ctx.desktop.available() answers. Defaults to false. */
     desktopAvailable?: boolean;
+    /** What ctx.desktop.local is. Calls throw when this is not given. */
+    desktopLocal?: PluginDesktopLocal;
+    /** The stored audit lines ctx.audit.list and exportBatches serve. */
+    auditEntries?: PluginAuditEntry[];
     /** What ctx.hosts.status.get and check answer, by host id. */
     hostStatuses?: Record<number, PluginHostStatusEntry>;
+    /** What ctx.hosts.probeTargets answers. */
+    probeTargets?: PluginHostProbeTarget[];
+    /** Host ids ctx.hosts.sessionActive answers true for. */
+    activeSessions?: number[];
+    /** What ctx.network.tcpProbe and ctx.ssh.probe answer. Defaults to false. */
+    reachable?: (target: string | number, port?: number) => boolean;
     /** The acting user's channels, what ctx.notify.channels answers. */
     notificationChannels?: PluginNotificationChannel[];
     /**
@@ -164,6 +176,10 @@ export interface FakePluginContext {
     }) => Promise<Record<string, string>>;
     /** Everything the plugin registered through ctx.disposables. */
     disposals: Array<() => void | Promise<void>>;
+    /** Providers registered through ctx.hosts.status.provide. */
+    hostStatusProviders: PluginHostStatusProvider[];
+    /** Every provider passed to ctx.hosts.activity.provide that is still registered. */
+    activityProviders: PluginActivityProvider[];
     /** Topics emitted through ctx.events.emit, in order. */
     emitted: Array<{
         topic: string;
@@ -255,6 +271,8 @@ export interface FakePluginContext {
         challenges: Map<string, string>;
         renewers: number;
     };
+    /** Calls every ctx.audit.subscribe handler, like a line core just accepted. */
+    emitAudit: (entry: PluginAuditEntry) => void;
     /** Every ctx.audit.record entry, in order. */
     audits: Array<{
         action: string;
@@ -321,6 +339,8 @@ export interface MockContextOptions {
     settings?: Record<string, unknown>;
     /** Seed for the core settings readCore can reach. */
     coreSettings?: Record<string, string>;
+    /** What ctx.files.dataDir() answers. */
+    dataDir?: string;
     /** Acting user returned by currentActor and used by asUser. */
     actor?: string;
     /** What ctx.ssh.connect and withConnection hand back as the client. */
@@ -346,8 +366,18 @@ export interface MockContextOptions {
     sshKeyCredentials?: PluginSshKeyCredential[];
     /** What ctx.desktop.available() answers. */
     desktopAvailable?: boolean;
+    /** What ctx.desktop.local is. See FakeContextOptions. */
+    desktopLocal?: PluginDesktopLocal;
+    /** See FakeContextOptions. */
+    auditEntries?: PluginAuditEntry[];
     /** What ctx.hosts.status answers. See FakeContextOptions. */
     hostStatuses?: Record<number, PluginHostStatusEntry>;
+    /** What ctx.hosts.probeTargets answers. */
+    probeTargets?: PluginHostProbeTarget[];
+    /** Host ids ctx.hosts.sessionActive answers true for. */
+    activeSessions?: number[];
+    /** What ctx.network.tcpProbe and ctx.ssh.probe answer. */
+    reachable?: (target: string | number, port?: number) => boolean;
     /** The acting user's channels, what ctx.notify.channels answers. */
     notificationChannels?: PluginNotificationChannel[];
     /**
@@ -378,19 +408,6 @@ export interface MockPluginContext extends FakePluginContext {
     /** Capability ids checked during the test, in order, denied ones included. */
     checked: string[];
 }
-/**
- * A context double that gates on capabilities the way src/backend/plugins/ctx.ts
- * does, so a test can prove a plugin fails closed without a running server.
- *
- * The gates on today's ctx surface: kv:own on every ctx.kv call, db:own on
- * ctx.db, network:serve on ctx.http and ctx.ws, events:core on emitting a
- * topic outside the plugin's own namespace, settings:read-core on
- * ctx.settings.readCore, ssh:connect plus credentials:use on ctx.ssh,
- * notify:send on ctx.notify (notify:hub on serve), network:outbound on ctx.fetch, process:spawn on
- * ctx.process, system:tls on ctx.system, plugins:read on ctx.plugins, auth:provide on ctx.auth
- * (users:impersonate on issueUserToken), and users:read on ctx.users. Reading a plugin's own settings is deliberately
- * ungated. As the SDK grows a member, add its gate here in the same shape.
- */
 export declare function createMockCtx(options?: MockContextOptions): MockPluginContext;
 /** A sqlite handle as createTestDb exposes it. Structural, like better-sqlite3's. */
 export interface TestSqlite {