@termix-ssh/plugin-sdk 1.0.13 → 1.0.15

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.0.15
+
+Plugin API 1.7.0.
+
+### Added
+
+- `ctx.auth.policy.provide` and the `auth:policy` capability, so a plugin can set an idle timeout, cap session length, turn off remember me and require a second factor
+- `ctx.auth.listSecondFactors` lists the second factors from every running plugin
+- `AuthEnrollmentSections` takes `factorsOnly`
+- `getHttpsSettings` and `updateHttpsSettings` in `@termix-ssh/plugin-sdk/ui`
+
+### Fixed
+
+- Plugin frontend tests against a locally linked SDK failed with a second copy of React
+
+## 1.0.14
+
+Plugin API 1.6.0.
+
+### Added
+
+- `ctx.hosts.locks.provide` and the `hosts:lock` capability, so a plugin can manage hosts that stay read only for everyone else and block adding hosts by hand
+- `ctx.hosts.setShares` to replace every grant on a host in one call
+- `ctx.credentials.list` returns the acting user's credentials by name, without secrets
+- `ctx.hosts.create` and `update` take `password`, `key`, `keyPassword`, `keyType`, `sudoPassword`, `protocolAuth` and `pluginEnable`
+
 ## 1.0.13
 
 Plugin API 1.5.0.

package/PLUGIN-GUIDE.md

@@ -1,6 +1,6 @@
 # Termix plugin guide
 
-SDK 1.0.13 | Plugin API 1.5.0
+SDK 1.0.15 | Plugin API 1.7.0
 
 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
@@ -226,6 +226,7 @@ Bundled as ESM for Node 22+ into `dist/backend.js`. Backend imports of your own
 | `sync`                 | none                             | Sync your tables to a linked desktop                           |
 | `auth`                 | `auth:provide`                   | Login methods, second factors, SSH auth types                  |
 | `auth.issueUserToken`  | `users:impersonate`              | A short-lived session for calling Termix's API as a user       |
+| `auth.policy`          | `auth:policy`                    | Login rules: idle timeout, session length, second factors      |
 | `users.getLocale`      | `users:read`                     | A user's UI language                                           |
 | `system`               | `system:tls`                     | The server's HTTPS certificate                                 |
 | `plugins.list()`       | `plugins:read`                   | Which plugins are installed                                    |
@@ -300,6 +301,11 @@ router.post("/notes", async (req, res) => {
 - `ctx.rbac.require("manage")` on a single route, `await ctx.rbac.has("manage")` in code. A full id like
   `hosts.edit` checks a core permission.
 - Host access: `ctx.hosts.checkAccess(hostId, "connect" | "view" | "edit" | "manage")`.
+- Managed hosts: with `hosts:lock`, `ctx.hosts.locks.provide({ isLocked, note, allowManualCreate })` makes
+  the hosts you manage read only for the UI, the API and other plugins (pins and order still work), and
+  `allowManualCreate: () => false` blocks adding hosts by hand. Your own `ctx.hosts` writes still go
+  through. `ctx.hosts.setShares(hostId, grants)` replaces a host's whole grant list, and
+  `ctx.credentials.list()` finds the acting user's credentials by name.
 
 ### Errors
 
@@ -694,6 +700,13 @@ closely. Declare ids in `contributes.auth` and register them with `ctx.auth.regi
 `registerSecondFactor` or `registerSshAuthProvider`. Connection protocols go in `contributes.protocols`
 and `app.registerHostProtocol`. Read https://docs.termix.site/develop/auth before starting one.
 
+Login rules need `auth:policy`. `ctx.auth.policy.provide({ evaluate, allowRememberDevice })` is asked at
+every login with the user, the method, the device and every second factor (`ctx.auth.listSecondFactors()`
+lists them too). `evaluate` returns `allowRememberDevice`, `maxSessionSeconds`, `idleTimeoutSeconds` and
+`secondFactor` (`"always"` or `"new-device"`). The strictest answer from all plugins wins, and a throw
+refuses the login. A user who must have a second factor but has none gets a session that can only set one
+up, and `/users/me` reports `restriction: "second-factor-setup"`.
+
 ## Testing
 
 ```ts
@@ -890,6 +903,7 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 | `users:impersonate`      | high     | Act as another user, or get a session for them, audited |
 | `db:core-refs`           | high     | Query core users, roles and hosts tables (read only)    |
 | `auth:provide`           | high     | Add login methods, second factors, SSH auth types       |
+| `auth:policy`            | high     | Set login rules: idle timeout, session length, 2FA      |
 | `device:serial`          | high     | Open serial and USB ports on the server                 |
 | `desktop:local`          | high     | Use the user's own computer, desktop app only           |
 | `hosts:export`           | high     | Export hosts with their saved logins                    |
@@ -898,6 +912,7 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 | `hosts:write`            | medium   | Add and edit hosts                                      |
 | `hosts:status-provide`   | medium   | Be the source of host status dots                       |
 | `hosts:activity-provide` | medium   | Be the source of the recent activity list               |
+| `hosts:lock`             | medium   | Make hosts it manages read only for everyone else       |
 | `network:probe`          | medium   | Check that a host answers on a TCP port                 |
 | `credentials:use`        | medium   | Connect with saved credentials without seeing them      |
 | `credentials:write`      | medium   | Save new credentials                                    |

package/dist/backend.d.ts

@@ -591,11 +591,40 @@ export interface PluginHostCreateInput {
     sshOptions?: HostSshOptions | null;
     /** Host settings by plugin id, the shape a Termix export carries. */
     pluginSettings?: Record<string, Record<string, unknown>>;
+    /**
+     * Each plugin's own host switch (its manifest enableKey), by plugin id.
+     * A plugin that is not running is skipped and logged; one with no switch
+     * is refused.
+     */
+    pluginEnable?: Record<string, boolean>;
+    /**
+     * Secrets, stored encrypted with the owner's data key and never returned
+     * in a PluginHostRecord. An empty string or null clears the stored value.
+     */
+    password?: string | null;
+    key?: string | null;
+    keyPassword?: string | null;
+    keyType?: string | null;
+    sudoPassword?: string | null;
+    /**
+     * Logins for plugin protocols (contributes.protocols), keyed by protocol
+     * id. null removes that protocol's login. Unknown protocol ids are skipped.
+     */
+    protocolAuth?: Record<string, PluginHostProtocolAuthInput | null>;
+}
+/** One protocol login on a host write. Absent keys keep what is stored. */
+export interface PluginHostProtocolAuthInput {
+    authType?: "direct" | "credential" | "none";
+    credentialId?: number | null;
+    username?: string | null;
+    password?: string | null;
+    /** The protocol's declared credentialFields, secret ones included. */
+    fields?: Record<string, string>;
 }
 /** Fields a plugin may change on a host the acting user owns. */
 export type PluginHostUpdateInput = Partial<PluginHostCreateInput>;
 /** Every key PluginHostCreateInput and PluginHostUpdateInput accept. */
-export declare const PLUGIN_HOST_INPUT_KEYS: readonly ["name", "ip", "port", "username", "authType", "credentialId", "overrideCredentialUsername", "connectionType", "tags", "folder", "pin", "notes", "jumpHosts", "enableSsh", "sshPort", "statusCheckEnabled", "statusCheckInterval", "forceKeyboardInteractive", "sshOptions", "pluginSettings"];
+export declare const PLUGIN_HOST_INPUT_KEYS: readonly ["name", "ip", "port", "username", "authType", "credentialId", "overrideCredentialUsername", "connectionType", "tags", "folder", "pin", "notes", "jumpHosts", "enableSsh", "sshPort", "statusCheckEnabled", "statusCheckInterval", "forceKeyboardInteractive", "sshOptions", "pluginSettings", "pluginEnable", "password", "key", "keyPassword", "keyType", "sudoPassword", "protocolAuth"];
 /** The same shape canAccessHost returns internally, without secrets. */
 export interface PluginHostAccess {
     hasAccess: boolean;
@@ -624,6 +653,31 @@ export interface PluginShareableRole {
     name: string;
     displayName: string | null;
 }
+/** One grant in ctx.hosts.setShares. */
+export interface PluginHostShareGrant {
+    target: PluginShareTarget;
+    permissionLevel: PluginHostShareLevel;
+    /** Omit for a grant that never expires. */
+    durationHours?: number;
+}
+/**
+ * Hosts a plugin manages itself, for example from a config file. Core refuses
+ * edits, deletes and share changes on a locked host from the UI, the API and
+ * other plugins, and marks it in host reads so a layout can show it read only.
+ * Pins and order stay with the user. Only the plugin that locks a host may
+ * still write it.
+ */
+export interface PluginHostLockProvider {
+    isLocked: (hostId: number) => boolean;
+    /** A short line shown under the managed note, or null. */
+    note: (hostId: number) => string | null;
+    /** False blocks adding hosts by hand (editor, import, other plugins). */
+    allowManualCreate: () => boolean;
+}
+export interface PluginHostLocksApi {
+    /** Registers this plugin's locks. Needs hosts:lock. Removed on deactivate. */
+    provide: (provider: PluginHostLockProvider) => () => void;
+}
 /**
  * Hosts the acting user can see, and the RBAC + sharing operations a plugin
  * needs to build a feature (like fleets) on top of hosts it does not own.
@@ -675,6 +729,12 @@ export interface PluginHosts {
      * Refuses a host the caller does not hold "manage" on.
      */
     share: (hostId: number, targets: PluginShareTarget[], permissionLevel: PluginHostShareLevel, durationHours?: number) => Promise<PluginHostShareResult>;
+    /**
+     * Replaces every grant on a host the acting user owns with this list.
+     * Grants that stay keep their row and counters, missing ones are revoked.
+     * Needs hosts:write.
+     */
+    setShares: (hostId: number, grants: PluginHostShareGrant[]) => Promise<PluginHostShareResult>;
     /** Users the caller may pick as a share target, for building a picker UI. */
     listUsers: () => Promise<PluginShareableUser[]>;
     /** Non-system roles the caller may pick as a share target. */
@@ -736,6 +796,8 @@ export interface PluginHosts {
     registerImportNormalizer: (normalizer: PluginHostImportNormalizer) => () => void;
     /** The recent activity list on the dashboard. */
     activity: PluginHostActivityApi;
+    /** Read only hosts this plugin manages. */
+    locks: PluginHostLocksApi;
 }
 export interface PluginHostImportOptions {
     /** Update a host that matches on ip, port and username instead of skipping it. */
@@ -1416,6 +1478,52 @@ export interface PluginSecondFactor {
     /** Removes the user's enrolment. Called by the admin reset. */
     reset?: (userId: string) => Promise<void>;
 }
+/** A login core is about to turn into a session. */
+export interface PluginAuthPolicyInput {
+    userId: string;
+    /** Login method id, `"proxy"` for a trusted proxy login. */
+    methodId: string;
+    /** The method signs in through an outside identity provider (SSO, LDAP). */
+    external: boolean;
+    deviceType: "web" | "desktop" | "mobile";
+    /** The device passed a second factor before and was remembered. */
+    trustedDevice: boolean;
+    /** The method itself proved a second factor, like a verified passkey. */
+    mfaSatisfied: boolean;
+    /** Every second factor core has, and whether this user set it up. */
+    secondFactors: {
+        id: string;
+        pluginId: string;
+        enrolled: boolean;
+    }[];
+}
+export interface PluginAuthPolicyDecision {
+    /** False turns remember me off and ignores remembered devices. */
+    allowRememberDevice?: boolean;
+    /** Caps how long the session lasts. */
+    maxSessionSeconds?: number;
+    /** Ends the session after this many seconds without a request. */
+    idleTimeoutSeconds?: number;
+    /**
+     * Requires a second factor even for users who have none: they get a
+     * session that can only set one up. `"new-device"` skips it on a
+     * remembered device.
+     */
+    secondFactor?: "always" | "new-device";
+}
+/**
+ * Login rules from a plugin. Core asks every provider and the strictest
+ * answer wins. A provider that throws refuses the login.
+ */
+export interface PluginAuthPolicyProvider {
+    evaluate: (input: PluginAuthPolicyInput) => PluginAuthPolicyDecision | Promise<PluginAuthPolicyDecision>;
+    /** Whether the login page should offer remember me. */
+    allowRememberDevice?: () => boolean;
+}
+export interface PluginAuthPolicyApi {
+    /** Needs auth:policy. Removed on deactivate. */
+    provide: (provider: PluginAuthPolicyProvider) => () => void;
+}
 export interface PluginUserTokenOptions {
     /** Why the token exists, kept in the audit log and on the session. */
     purpose: string;
@@ -1494,6 +1602,13 @@ export interface PluginAuth {
      * never outlive itself.
      */
     issueUserToken: (userId: string, options: PluginUserTokenOptions) => Promise<PluginUserToken>;
+    /** Login rules: idle timeout, session length, remember me, second factors. */
+    policy: PluginAuthPolicyApi;
+    /** Second factors from every running plugin. Needs no capability. */
+    listSecondFactors: () => {
+        id: string;
+        pluginId: string;
+    }[];
 }
 /** What a plugin may learn about a user. Needs users:read. */
 export interface PluginUsers {
@@ -1727,6 +1842,14 @@ export interface PluginSshKeyCredential {
     /** "<type> <base64>", derived from the private key when none was stored. Null when it cannot be. */
     publicKey: string | null;
 }
+/** A saved credential without its secrets. */
+export interface PluginCredentialSummary {
+    id: number;
+    name: string;
+    username: string | null;
+    authType: string;
+    folder: string | null;
+}
 /** A key pair to save as a new credential for the acting user. */
 export interface PluginSshKeyCredentialInput {
     name: string;
@@ -1747,6 +1870,12 @@ export interface PluginCredentials {
      * Needs credentials:use and the core credentials.view permission. Audited.
      */
     listSshKeys: () => Promise<PluginSshKeyCredential[]>;
+    /**
+     * The acting user's own credentials by name, with no secret material, so a
+     * plugin can point a host at one. Needs credentials:use and the core
+     * credentials.view permission. Audited.
+     */
+    list: () => Promise<PluginCredentialSummary[]>;
     /**
      * Saves a key pair as a new encrypted credential owned by the acting user
      * and returns its id. Needs credentials:write, the core credentials.create

package/dist/backend.js

@@ -65,6 +65,13 @@ export const PLUGIN_HOST_INPUT_KEYS = [
     "forceKeyboardInteractive",
     "sshOptions",
     "pluginSettings",
+    "pluginEnable",
+    "password",
+    "key",
+    "keyPassword",
+    "keyType",
+    "sudoPassword",
+    "protocolAuth",
 ];
 /** Thrown by ctx.ssh.startInteraction when no provider can start it. */
 export class PluginSshInteractionError extends Error {

package/dist/capabilities.js

@@ -33,6 +33,7 @@ export const CAPABILITY_CATALOG = [
     entry("users:impersonate", "high"),
     entry("db:core-refs", "high"),
     entry("auth:provide", "high"),
+    entry("auth:policy", "high"),
     entry("device:serial", "high"),
     entry("notify:hub", "high"),
     entry("ui:layout", "high"),
@@ -46,6 +47,7 @@ export const CAPABILITY_CATALOG = [
     entry("network:probe", "medium"),
     entry("hosts:status-provide", "medium"),
     entry("hosts:activity-provide", "medium"),
+    entry("hosts:lock", "medium"),
     entry("users:read", "medium"),
     entry("events:core", "medium"),
     entry("notify:send", "medium"),

package/dist/host/{PluginsTab-OXQQ7M4I.js → PluginsTab-S33WIIGC.js}

@@ -29,7 +29,7 @@ import {
   sortPlugins,
   uploadEntry,
   youtubeEmbedUrl
-} from "./chunk-54KCK6IZ.js";
+} from "./chunk-VFTB2RDP.js";
 import {
   ArrowDownWideNarrow,
   BookOpen,
@@ -107,8 +107,8 @@ import {
   updatePlugin,
   uploadPlugin,
   useConfirm
-} from "./chunk-ERGN4YW6.js";
-import "./chunk-CN5UBTBP.js";
+} from "./chunk-2IV3VX7F.js";
+import "./chunk-3L45NNT5.js";
 import {
   __toESM,
   define_import_meta_env_default,

package/dist/host/{chunk-ERGN4YW6.js → chunk-2IV3VX7F.js}

@@ -4,7 +4,7 @@ import {
   getPluginRecord,
   rbacApi,
   usePluginStore
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import {
   __export,
   init_define_import_meta_env

package/dist/host/{chunk-CN5UBTBP.js → chunk-3L45NNT5.js}

@@ -4932,6 +4932,14 @@ async function bulkUpdateSSHHosts(hostIds, updates) {
     handleApiError(error, "bulk update SSH hosts");
   }
 }
+async function getHostPolicy() {
+  try {
+    const response = await sshHostApi.get("/policy");
+    return response.data;
+  } catch (error) {
+    handleApiError(error, "load host policy");
+  }
+}
 async function reorderSSHHosts(positions) {
   try {
     const response = await sshHostApi.put("/reorder", { positions });
@@ -5588,6 +5596,24 @@ async function updateSessionTimeout(timeoutHours) {
     handleApiError(error, "update session timeout");
   }
 }
+async function getHttpsSettings() {
+  try {
+    const response = await authApi.get("/users/https-settings");
+    return response.data;
+  } catch (error) {
+    handleApiError(error, "fetch HTTPS settings");
+  }
+}
+async function updateHttpsSettings(forceHttps) {
+  try {
+    const response = await authApi.patch("/users/https-settings", {
+      forceHttps
+    });
+    return response.data;
+  } catch (error) {
+    handleApiError(error, "update HTTPS settings");
+  }
+}
 async function getBranding() {
   try {
     const response = await authApi.get("/users/branding");
@@ -6290,7 +6316,7 @@ async function updateRole(roleId, roleData) {
   try {
     const response = await rbacApi.put(`/rbac/roles/${roleId}`, roleData);
     if (roleData.permissions) {
-      const { notifyPermissionsChanged } = await import("./use-permissions-ISEDRY3J.js");
+      const { notifyPermissionsChanged } = await import("./use-permissions-LLN6TLAL.js");
       notifyPermissionsChanged();
     }
     return response.data;
@@ -6872,7 +6898,7 @@ function createRemoteOriginApiInstance(path) {
   });
   instance.interceptors.request.use(
     async (config) => {
-      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-5VFO4XQB.js");
+      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-SCJH7DSL.js");
       const linked = await getLinkedSession2();
       config.baseURL = linked ? `${linked.serverUrl}${path}` : "http://no-server-configured";
       if (config.headers.set) {
@@ -7300,6 +7326,7 @@ export {
   createSSHHost,
   updateSSHHost,
   bulkUpdateSSHHosts,
+  getHostPolicy,
   reorderSSHHosts,
   deleteSSHHost,
   websocketAuthProtocols,
@@ -7328,6 +7355,8 @@ export {
   updateLogLevel,
   getSessionTimeout,
   updateSessionTimeout,
+  getHttpsSettings,
+  updateHttpsSettings,
   getBranding,
   hydrateLocalSharedHostAuth,
   getConnectedRemoteApi,

package/dist/host/{chunk-T2PZWXFJ.js → chunk-57DJU2ZA.js}

@@ -26,7 +26,7 @@ var inFlight = null;
 function load() {
   if (cache) return Promise.resolve(cache);
   if (inFlight) return inFlight;
-  inFlight = import("./rbac-api-5YMBJAO5.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
+  inFlight = import("./rbac-api-KA5IPQQL.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
     cache = {
       permissions: result.permissions ?? [],
       isAdmin: !!result.isAdmin

package/dist/host/{chunk-CALNJCHN.js → chunk-V44FCJBQ.js}

@@ -3,7 +3,7 @@ import {
   hasPermission,
   resetPermissionsCache,
   usePermissions
-} from "./chunk-T2PZWXFJ.js";
+} from "./chunk-57DJU2ZA.js";
 import {
   Button,
   Check,
@@ -80,7 +80,7 @@ import {
   withIconBoundary,
   withPluginContext,
   withPluginScope
-} from "./chunk-ERGN4YW6.js";
+} from "./chunk-2IV3VX7F.js";
 import {
   SYNC_CHANGED_EVENT,
   TRUST_TOKEN_KEY,
@@ -130,7 +130,7 @@ import {
   usePluginStore,
   useTabTypes,
   websocketAuthProtocols
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import {
   define_import_meta_env_default,
   init_define_import_meta_env
@@ -268,6 +268,14 @@ async function getLoginMethods() {
     return [];
   }
 }
+async function getRememberDeviceAllowed() {
+  try {
+    const response = await authApi.get("/users/auth/methods");
+    return response.data?.rememberDevice !== false;
+  } catch {
+    return true;
+  }
+}
 async function submitLoginMethod(methodId, body, instanceId) {
   try {
     const response = await authApi.post(
@@ -1447,6 +1455,9 @@ var en_default = {
     deleteFolderConfirm_one: 'Delete "{{name}}" and its {{count}} host? This cannot be undone.',
     deleteFolderConfirm_other: 'Delete "{{name}}" and its {{count}} hosts? This cannot be undone.',
     failedToMoveHosts: "Failed to move hosts",
+    managedBanner: "This host is managed by {{plugin}}. Change it there. You can still pin and reorder it.",
+    managedTooltip: "Managed by {{plugin}}",
+    addBlocked: "Hosts are managed by {{plugin}}, so new hosts can't be added here.",
     failedToReorder: "Failed to reorder",
     expandAll: "Expand all folders",
     collapseAll: "Collapse all folders",
@@ -2043,6 +2054,10 @@ var en_default = {
         title: "Handle sign in",
         consequence: "It can add a login method, a second factor or an SSH sign-in type."
       },
+      "auth:policy": {
+        title: "Set sign in rules",
+        consequence: "It can sign people out when idle, limit session length, turn off remember me and require a second factor."
+      },
       "system:tls": {
         title: "Manage certificates",
         consequence: "It can replace the certificate Termix serves over HTTPS and answer domain checks from certificate authorities."
@@ -2111,6 +2126,10 @@ var en_default = {
         title: "Store recent activity",
         consequence: "Becomes the store for the recent activity list of every user."
       },
+      "hosts:lock": {
+        title: "Manage hosts as read only",
+        consequence: "Hosts it manages can't be edited, deleted or reshared by anyone else."
+      },
       "desktop:window": {
         title: "Open desktop windows",
         consequence: "Only in the Termix desktop app."
@@ -4103,6 +4122,7 @@ function sshHostToHost(h) {
     connectionOrigin: h.connectionOrigin ?? null,
     localOnly: !!h.localOnly,
     sharedCopy: !!h.sharedCopy,
+    ...h.lock ? { lock: h.lock } : {},
     enableSsh: h.enableSsh != null ? h.enableSsh : isSshHost,
     sshPort: h.sshPort ?? (h.connectionType === "ssh" || !h.connectionType ? h.port : 22),
     protocolAuth: h.protocolAuth ?? {},
@@ -10040,7 +10060,7 @@ function hostToSSHHost(h) {
 // src/ui/shell/tabUtils.tsx
 import { jsx as jsx13, jsxs as jsxs6 } from "react/jsx-runtime";
 var PluginsTab = lazy(
-  () => import("./PluginsTab-OXQQ7M4I.js").then((m) => ({ default: m.PluginsTab }))
+  () => import("./PluginsTab-S33WIIGC.js").then((m) => ({ default: m.PluginsTab }))
 );
 function preloadTabSurface(type) {
   const loader = getTabType(type)?.preload;
@@ -10225,6 +10245,7 @@ export {
   remScale,
   useIsMobile,
   getLoginMethods,
+  getRememberDeviceAllowed,
   submitLoginMethod,
   startLoginRedirect,
   verifySecondFactor,

package/dist/host/{chunk-54KCK6IZ.js → chunk-VFTB2RDP.js}

@@ -7,10 +7,10 @@ import {
   Trash,
   cn,
   useAreaPreferences
-} from "./chunk-ERGN4YW6.js";
+} from "./chunk-2IV3VX7F.js";
 import {
   isElectron
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import {
   __commonJS,
   __toESM,
@@ -2382,6 +2382,7 @@ var CAPABILITY_CATALOG = [
   entry("users:impersonate", "high"),
   entry("db:core-refs", "high"),
   entry("auth:provide", "high"),
+  entry("auth:policy", "high"),
   entry("device:serial", "high"),
   entry("notify:hub", "high"),
   entry("ui:layout", "high"),
@@ -2395,6 +2396,7 @@ var CAPABILITY_CATALOG = [
   entry("network:probe", "medium"),
   entry("hosts:status-provide", "medium"),
   entry("hosts:activity-provide", "medium"),
+  entry("hosts:lock", "medium"),
   entry("users:read", "medium"),
   entry("events:core", "medium"),
   entry("notify:send", "medium"),

package/dist/host/{linked-server-5VFO4XQB.js → linked-server-SCJH7DSL.js}

@@ -3,7 +3,7 @@ import {
   SYNC_CHANGED_EVENT,
   getLinkedSession,
   notifySyncChanged
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   SYNC_CHANGED_EVENT,

package/dist/host/{rbac-api-5YMBJAO5.js → rbac-api-KA5IPQQL.js}

@@ -23,7 +23,7 @@ import {
   shareHost,
   updateHostAccess,
   updateRole
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   assignRoleToUser,

package/dist/host/testing-host.js

@@ -59,10 +59,10 @@ import {
   trackTabHandle,
   useShellController,
   useTabStageStore
-} from "./chunk-CALNJCHN.js";
+} from "./chunk-V44FCJBQ.js";
 import {
   setPermissionsForTesting
-} from "./chunk-T2PZWXFJ.js";
+} from "./chunk-57DJU2ZA.js";
 import {
   SurfaceScope,
   notifyShellReady,
@@ -70,14 +70,14 @@ import {
   setShellCallbacks,
   setShellHosts,
   setShellLayoutProvider
-} from "./chunk-ERGN4YW6.js";
+} from "./chunk-2IV3VX7F.js";
 import {
   getTabType,
   listTabTypes,
   resetPluginStore,
   setFrontendState,
   setPluginSummaries
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import {
   init_define_import_meta_env
 } from "./chunk-YGYBM7SQ.js";

package/dist/host/types/src/types/index.d.ts

@@ -23,6 +23,12 @@ export interface HostProtocolAuthInput {
 export interface JumpHost {
     hostId: number;
 }
+/** The plugin that manages a host, from ctx.hosts.locks. */
+export interface HostLock {
+    pluginId: string;
+    pluginName: string;
+    note: string | null;
+}
 export type Host = {
     id: number;
     name: string;
@@ -91,6 +97,8 @@ export type Host = {
     ownerUsername?: string;
     /** A read-only copy of a host shared with the linked account. */
     sharedCopy?: boolean;
+    /** Set when a plugin manages this host: read only, pins and order still work. */
+    lock?: HostLock;
     /** Desktop only: kept on this device, never synced to the server. */
     localOnly?: boolean;
     /** Enabled plugins' host-scope settings, keyed by plugin id. Secrets redacted. */
@@ -261,6 +269,8 @@ export interface AuthenticatedRequest extends Request {
     sessionId?: string;
     apiKeyId?: string;
     actingAdminUserId?: string;
+    /** Set while the session may only set up a second factor. */
+    sessionRestriction?: string | null;
     user?: {
         id: string;
         username: string;

package/dist/host/types/src/types/ui-types.d.ts

@@ -1,4 +1,4 @@
-import type { HostProtocolAuthSummary, HostSshOptions, HostTerminalConfig, SSHAuthType } from "./index.js";
+import type { HostLock, HostProtocolAuthSummary, HostSshOptions, HostTerminalConfig, SSHAuthType } from "./index.js";
 import type { HostAuthOverrides } from "./auth-protocols.js";
 import type { DefaultOverrides } from "./host-defaults.js";
 import type { QuickConnectLogin } from "@termix-ssh/plugin-sdk/frontend";
@@ -93,6 +93,8 @@ export type Host = {
      * linked to. It arrives through sync and is managed on the server.
      */
     sharedCopy?: boolean;
+    /** Set when a plugin manages this host: read only, pins and order still work. */
+    lock?: HostLock;
     /** Desktop only: kept on this device, never synced to the server. */
     localOnly?: boolean;
 };

package/dist/host/types/src/ui/api/auth-methods-api.d.ts

@@ -23,6 +23,8 @@ export type LoginResponse = AuthResponse & {
 };
 /** Enabled login methods for the login screen. Public. */
 export declare function getLoginMethods(): Promise<PublicLoginMethod[]>;
+/** False when the login policy turned remember me off. Public. */
+export declare function getRememberDeviceAllowed(): Promise<boolean>;
 export declare function submitLoginMethod(methodId: string, body: Record<string, unknown>, instanceId?: string): Promise<LoginResponse>;
 export declare function startLoginRedirect(methodId: string, params: {
     instanceId?: string;

package/dist/host/types/src/ui/api/settings-api.d.ts

@@ -6,6 +6,12 @@ export declare function getSessionTimeout(): Promise<{
     timeoutHours: number;
 }>;
 export declare function updateSessionTimeout(timeoutHours: number): Promise<void>;
+export interface HttpsSettings {
+    forceHttps: boolean;
+    tlsEnabled: boolean;
+}
+export declare function getHttpsSettings(): Promise<HttpsSettings>;
+export declare function updateHttpsSettings(forceHttps: boolean): Promise<HttpsSettings>;
 export interface BrandingSettings {
     appName: string;
     tagline: string;

package/dist/host/types/src/ui/api/ssh-host-management-api.d.ts

@@ -9,6 +9,12 @@ export declare function bulkUpdateSSHHosts(hostIds: number[], updates: Record<st
     failed: number;
     errors: string[];
 }>;
+export interface HostPolicy {
+    manualCreate: boolean;
+    /** The plugin that manages hosts, when hosts can't be added by hand. */
+    blockedBy?: string;
+}
+export declare function getHostPolicy(): Promise<HostPolicy>;
 export declare function reorderSSHHosts(positions: {
     id: number;
     sortOrder: number;

package/dist/host/types/src/ui/main-axios.d.ts

@@ -103,12 +103,12 @@ export declare const appReadyPromise: Promise<void>;
  */
 export declare function isLoginRequestUrl(url: string | undefined): boolean;
 export declare function handleApiError(error: unknown, operation: string): never;
-export { getSSHHosts, createSSHHost, updateSSHHost, bulkUpdateSSHHosts, reorderSSHHosts, deleteSSHHost, getSSHHostById, testProxyConnection, } from "./api/ssh-host-management-api";
+export { getSSHHosts, createSSHHost, updateSSHHost, bulkUpdateSSHHosts, reorderSSHHosts, getHostPolicy, type HostPolicy, deleteSSHHost, getSSHHostById, testProxyConnection, } from "./api/ssh-host-management-api";
 export { getAllServerStatuses, getServerStatusById, refreshServerPolling, getStatusCheckSettings, updateStatusCheckSettings, } from "./api/host-status-api";
 export { getHostSidebarPreferences, saveHostSidebarPreferences, } from "./api/host-sidebar-preferences-api";
 export { getCredentialSidebarPreferences, saveCredentialSidebarPreferences, } from "./api/credential-sidebar-preferences-api";
 export { getUiPreferences, saveUiPreferences } from "./api/ui-preferences-api";
-export { getLogLevel, updateLogLevel, getSessionTimeout, updateSessionTimeout, } from "./api/settings-api";
+export { getLogLevel, updateLogLevel, getSessionTimeout, updateSessionTimeout, getHttpsSettings, updateHttpsSettings, type HttpsSettings, } from "./api/settings-api";
 export declare function registerUser(username: string, password: string): Promise<Record<string, unknown>>;
 export declare function adminCreateUser(username: string, password: string): Promise<Record<string, unknown>>;
 export declare function loginUser(username: string, password: string, rememberMe?: boolean): Promise<AuthResponse>;

package/dist/host/types/src/ui/plugin-host/sdk-ui.d.ts

@@ -107,7 +107,7 @@ export { type AuthOverrideProtocol, SSH_AUTH_PROTOCOL, } from "../../types/auth-
 export { CREDENTIAL_ROW_FIELD_KEYS, type CredentialDensity, type CredentialRowFields, type CredentialSidebarFilterState, type CredentialSidebarPreferences, type CredentialSortKey, type CredentialTrayTrigger, defaultCredentialRowFields, defaultCredentialSidebarPreferences, sanitizeCredentialSidebarPreferences, } from "../../types/credential-sidebar-preferences";
 export { CORE_HOST_DEFAULTS, CORE_NAMESPACE, type DefaultOverrides, defaultValuesEqual, findCoreHostDefault, type HostDefaultsLevel, type ResolvedHostDefault, splitDefaultKey, } from "../../types/host-defaults";
 export { defaultHostRowFields, defaultHostSidebarPreferences, type HostClickBehavior, type HostDensity, type HostGroupKey, type HostRowFields, type HostSidebarFilterState, type HostSidebarPreferences, type HostTrayTrigger, sanitizeHostSidebarPreferences, type SortKey, } from "../../types/host-sidebar-preferences";
-export type { HostData, HostProtocolAuthInput, ProxyNode, SSHHost, SSHHostData, } from "../../types";
+export type { HostData, HostLock, HostProtocolAuthInput, ProxyNode, SSHHost, SSHHostData, } from "../../types";
 export { PRESETS, UI_AREA_KEYS, type UiAreaKey, type UiPreset, } from "../../types/ui-preferences";
 export type { AdminSection, Credential, DashboardCardId, FontSizeId, Host, HostFolder, SharePermissionLevel, Tab, TabType, ThemeId, ToolsTab, UiFontId, } from "../../types/ui-types";
 export { type AuditLog, type AuditLogFilters, getAuditLogActions, getAuditLogs, } from "../api/audit-log-api";
@@ -165,7 +165,7 @@ export { tabJumpHotkeyKeys } from "../lib/tab-jump-hotkey";
 export { ACCENT_PRESET_COLORS, applyAccentColor, applyFontSize, applyUiFont, DASHBOARD_CARDS, FONT_SIZES, UI_FONTS, } from "../lib/theme";
 export { registerLayout } from "../look/layout-registry";
 export { useChooseTheme } from "../look/use-look-theme";
-export { type AccessRecord, type ActiveSessionInfo, adminCreateUser, adminCreateUserCredential, adminCreateUserHost, adminDeleteUserCredential, adminDeleteUserHost, adminExportUserData, adminGetHostPassword, adminGetUserCredentials, adminGetUserHosts, adminResetUserPassword, adminUpdateUserCredential, adminUpdateUserHost, type ApiKey, assignRoleToUser, bulkUpdateSSHHosts, changePassword, createApiKey, createCredential, type CreatedApiKey, createRole, createSSHHost, deleteAccount, deleteAllHostsInFolder, deleteApiKey, deleteCredential, deleteOpenTab, deleteRole, deleteSSHHost, deleteUser, duplicateCredential, getActiveSessions, getApiKeys, getCredentialDetails, getCredentialSidebarPreferences, getExternalAutoProvision, getHostAccess, getHostAuthOverride, getHostPassword, getHostSidebarPreferences, getLogLevel, getPasswordLoginAllowed, getPasswordResetAllowed, getPermissionsCatalog, getRegistrationAllowed, getSecondFactorAfterExternalLogin, getSessions, getSessionTimeout, getSSHFolders, getSSHHosts, getStatusCheckSettings, getUserInfo, getUserList, getUserRoles, type LinkedAccountInfo, linkExternalToPasswordAccount, logoutUser, makeUserAdmin, type OpenTabRecord, type PermissionCatalogEntry, releaseUrlFrom, removeAdminStatus, removeRoleFromUser, renameCredentialFolder, renameFolder, reorderCredentials, reorderFolders, reorderSSHHosts, resetRecentActivity, revokeAllUserSessions, revokeHostAccess, revokeSession, type Role, saveCredentialSidebarPreferences, saveHostSidebarPreferences, setHostAuthOverride, shareFolder, shareHost, type SSHHostWithStatus, unlinkExternalFromPasswordAccount, updateCredential, updateExternalAutoProvision, updateFolderMetadata, updateHostAccess, updateLogLevel, updatePasswordLoginAllowed, updatePasswordResetAllowed, updateRegistrationAllowed, updateRole, updateSecondFactorAfterExternalLogin, updateSessionTimeout, updateSSHHost, updateStatusCheckSettings, type UserPreferences, type UserRole, } from "../main-axios";
+export { type AccessRecord, type ActiveSessionInfo, adminCreateUser, adminCreateUserCredential, adminCreateUserHost, adminDeleteUserCredential, adminDeleteUserHost, adminExportUserData, adminGetHostPassword, adminGetUserCredentials, adminGetUserHosts, adminResetUserPassword, adminUpdateUserCredential, adminUpdateUserHost, type ApiKey, assignRoleToUser, bulkUpdateSSHHosts, changePassword, createApiKey, createCredential, type CreatedApiKey, createRole, createSSHHost, deleteAccount, deleteAllHostsInFolder, deleteApiKey, deleteCredential, deleteOpenTab, deleteRole, deleteSSHHost, deleteUser, duplicateCredential, getActiveSessions, getApiKeys, getCredentialDetails, getCredentialSidebarPreferences, getExternalAutoProvision, getHostAccess, getHostAuthOverride, getHostPassword, getHostPolicy, type HostPolicy, getHostSidebarPreferences, getHttpsSettings, type HttpsSettings, getLogLevel, getPasswordLoginAllowed, getPasswordResetAllowed, getPermissionsCatalog, getRegistrationAllowed, getSecondFactorAfterExternalLogin, getSessions, getSessionTimeout, getSSHFolders, getSSHHosts, getStatusCheckSettings, getUserInfo, getUserList, getUserRoles, type LinkedAccountInfo, linkExternalToPasswordAccount, logoutUser, makeUserAdmin, type OpenTabRecord, type PermissionCatalogEntry, releaseUrlFrom, removeAdminStatus, removeRoleFromUser, renameCredentialFolder, renameFolder, reorderCredentials, reorderFolders, reorderSSHHosts, resetRecentActivity, revokeAllUserSessions, revokeHostAccess, revokeSession, type Role, saveCredentialSidebarPreferences, saveHostSidebarPreferences, setHostAuthOverride, shareFolder, shareHost, type SSHHostWithStatus, unlinkExternalFromPasswordAccount, updateCredential, updateExternalAutoProvision, updateFolderMetadata, updateHostAccess, updateHttpsSettings, updateLogLevel, updatePasswordLoginAllowed, updatePasswordResetAllowed, updateRegistrationAllowed, updateRole, updateSecondFactorAfterExternalLogin, updateSessionTimeout, updateSSHHost, updateStatusCheckSettings, type UserPreferences, type UserRole, } from "../main-axios";
 export { MANAGE_REQUEST_EVENT, type ManageMode, type ManageRequest, requestFromLegacyEvent, requestManage, takePendingManageRequest, } from "../manage/manage-requests";
 export { useSshAuthEditors } from "./auth-registry";
 export { usePluginStore } from "./plugin-store";

package/dist/host/types/src/ui/sidebar/AuthEnrollmentSections.d.ts

@@ -2,4 +2,7 @@
  * Enrolment sections login methods and second factors register, such as
  * adding a passkey or setting up an authenticator app.
  */
-export declare function AuthEnrollmentSections(): import("react").JSX.Element;
+export declare function AuthEnrollmentSections({ factorsOnly, }?: {
+    /** Only second factors, for a login policy that requires one. */
+    factorsOnly?: boolean;
+}): import("react").JSX.Element;

package/dist/host/ui.js

@@ -52,6 +52,7 @@ import {
   getPollingEnvironmentMultiplier,
   getPreferredHostAction,
   getRegisteredDashboardCard,
+  getRememberDeviceAllowed,
   getStatusClasses,
   getSyncConflicts,
   getSyncErrors,
@@ -173,10 +174,10 @@ import {
   useThemes,
   verifySecondFactor,
   withProtocolSettings
-} from "./chunk-CALNJCHN.js";
+} from "./chunk-V44FCJBQ.js";
 import {
   usePermissions
-} from "./chunk-T2PZWXFJ.js";
+} from "./chunk-57DJU2ZA.js";
 import {
   AddButton,
   Card,
@@ -197,7 +198,7 @@ import {
   isPrerelease,
   reportBetaFeedbackUrl,
   reportCoreIssueUrl
-} from "./chunk-54KCK6IZ.js";
+} from "./chunk-VFTB2RDP.js";
 import {
   Action,
   Activity,
@@ -387,7 +388,7 @@ import {
   useSurfaceKind,
   useUiPreference,
   useUiPreferencesContext
-} from "./chunk-ERGN4YW6.js";
+} from "./chunk-2IV3VX7F.js";
 import {
   CREDENTIAL_ROW_FIELD_KEYS,
   PRESETS,
@@ -450,7 +451,9 @@ import {
   getHostAccess,
   getHostAuthOverride,
   getHostPassword,
+  getHostPolicy,
   getHostSidebarPreferences,
+  getHttpsSettings,
   getLogLevel,
   getPasswordLoginAllowed,
   getPasswordResetAllowed,
@@ -531,6 +534,7 @@ import {
   updateExternalAutoProvision,
   updateFolderMetadata,
   updateHostAccess,
+  updateHttpsSettings,
   updateLogLevel,
   updatePasswordLoginAllowed,
   updatePasswordResetAllowed,
@@ -544,7 +548,7 @@ import {
   useTabs,
   useTabsSafe,
   verifyPasswordResetCode
-} from "./chunk-CN5UBTBP.js";
+} from "./chunk-3L45NNT5.js";
 import {
   define_import_meta_env_default,
   init_define_import_meta_env
@@ -4343,6 +4347,7 @@ function Auth({ onLogin }) {
   const [username, setUsername] = useState7("");
   const [password, setPassword] = useState7("");
   const [confirmPassword, setConfirmPassword] = useState7("");
+  const [rememberAllowed, setRememberAllowed] = useState7(true);
   const [rememberMe, setRememberMe] = useState7(() => {
     try {
       return localStorage.getItem("rememberMe") === "true";
@@ -4463,6 +4468,11 @@ function Auth({ onLogin }) {
     getPasswordResetAllowed().then((allowed) => setPasswordResetAllowed(allowed)).catch(() => setPasswordResetAllowed(false));
     void startPreLoginPlugins().catch(() => {
     }).finally(() => setAuthPluginsLoading(false));
+    getRememberDeviceAllowed().then((allowed) => {
+      setRememberAllowed(allowed);
+      if (!allowed) setRememberMe(false);
+    }).catch(() => {
+    });
     getLoginMethods().then((methods) => setAuthMethods(methods)).catch(() => setAuthMethods([])).finally(() => setAuthMethodsLoaded(true));
   }, [localDesktopAuth]);
   useEffect6(() => {
@@ -5358,7 +5368,7 @@ function Auth({ onLogin }) {
           /* @__PURE__ */ jsx28("p", { className: "text-xs text-muted-foreground", children: view === "login" ? t3("auth.loginSubtitle", "") : view === "register" ? t3("auth.registerSubtitle", "") : t3("auth.loginWithExternalDesc") })
         ] }),
         view === "external" && /* @__PURE__ */ jsxs20("div", { className: "flex flex-col gap-4", children: [
-          /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
+          rememberAllowed && /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
             /* @__PURE__ */ jsx28(
               Checkbox,
               {
@@ -5409,7 +5419,7 @@ function Auth({ onLogin }) {
             }
           ) }),
           /* @__PURE__ */ jsxs20("div", { className: "flex items-center justify-between", children: [
-            /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
+            rememberAllowed ? /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
               /* @__PURE__ */ jsx28(
                 Checkbox,
                 {
@@ -5427,7 +5437,7 @@ function Auth({ onLogin }) {
                   children: t3("auth.rememberMe")
                 }
               )
-            ] }),
+            ] }) : /* @__PURE__ */ jsx28("span", {}),
             passwordResetAllowed && /* @__PURE__ */ jsx28(
               "button",
               {
@@ -33898,9 +33908,13 @@ function SplitLayoutMenu({
 init_define_import_meta_env();
 import { useTranslation as useTranslation28 } from "react-i18next";
 import { jsx as jsx57, jsxs as jsxs44 } from "react/jsx-runtime";
-function AuthEnrollmentSections() {
+function AuthEnrollmentSections({
+  factorsOnly = false
+} = {}) {
   const { t: t3 } = useTranslation28();
-  const sections = [...useLoginMethods(), ...useSecondFactors()].filter(
+  const methods = useLoginMethods();
+  const factors = useSecondFactors();
+  const sections = [...factorsOnly ? [] : methods, ...factors].filter(
     (entry) => entry.enrollment
   );
   if (sections.length === 0) return null;
@@ -34205,8 +34219,10 @@ export {
   getHostDefaultsLevel,
   getHostEditorSection,
   getHostPassword,
+  getHostPolicy,
   getHostSidebarPreferences,
   getHostTags,
+  getHttpsSettings,
   getLiveHostStatus,
   getLogLevel,
   getNotificationPrivateEndpoints,
@@ -34364,6 +34380,7 @@ export {
   updateExternalAutoProvision,
   updateFolderMetadata,
   updateHostAccess,
+  updateHttpsSettings,
   updateLogLevel,
   updatePasswordLoginAllowed,
   updatePasswordResetAllowed,

package/dist/host/{use-permissions-ISEDRY3J.js → use-permissions-LLN6TLAL.js}

@@ -7,7 +7,7 @@ import {
   resetPermissionsCache,
   setPermissionsForTesting,
   usePermissions
-} from "./chunk-T2PZWXFJ.js";
+} from "./chunk-57DJU2ZA.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   hasPermission,

package/dist/manifest.d.ts

@@ -20,7 +20,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export declare const PLUGIN_API_VERSION = "1.5.0";
+export declare const PLUGIN_API_VERSION = "1.7.0";
 /** The API major, the default engine.api for a new plugin. */
 export declare const SUPPORTED_PLUGIN_API_VERSION: string;
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/manifest.js

@@ -22,7 +22,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.5.0";
+export const PLUGIN_API_VERSION = "1.7.0";
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(semver.major(PLUGIN_API_VERSION));
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/testing.d.ts

@@ -25,7 +25,7 @@ export interface FakeWsRoute {
 import type { PluginLoginMethod, PluginVerifiedIdentity, PluginSecondFactor, PluginSshAuthProvider, PluginSshConnectOptions, PluginSshHost, PluginHostSummary, PluginShareableUser, PluginShareableRole, PluginSshKeyCredential, PluginSshKeyCredentialInput } from "./backend.js";
 import type { SyncEntityRegistration } from "./backend.js";
 import type { PluginDatabase } from "./backend.js";
-import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
+import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostLockProvider, PluginAuthPolicyProvider, PluginCredentialSummary, PluginHostShareGrant, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
 /** A timer registered through ctx.schedule, run by hand with runScheduled. */
 export interface FakeScheduledJob {
     kind: "every" | "after";
@@ -75,6 +75,8 @@ export interface FakeContextOptions {
     protocolTargets?: Record<string, PluginProtocolTarget>;
     /** What ctx.credentials.listSshKeys answers. */
     sshKeyCredentials?: PluginSshKeyCredential[];
+    /** What ctx.credentials.list answers. */
+    credentialSummaries?: PluginCredentialSummary[];
     /** What ctx.desktop.available() answers. Defaults to false. */
     desktopAvailable?: boolean;
     /** What ctx.desktop.local is. Calls throw when this is not given. */
@@ -122,6 +124,11 @@ export interface FakeContextOptions {
     baseUrl?: string;
     /** What ctx.auth.countLinkedUsers answers, by provider. Defaults to 0. */
     linkedUsers?: Record<string, number>;
+    /** Second factors from other plugins that ctx.auth.listSecondFactors adds. */
+    secondFactors?: {
+        id: string;
+        pluginId: string;
+    }[];
     /** Failures before ctx.auth.loginRateLimit locks a key. Defaults to 5. */
     loginAttemptLimit?: number;
     /** What ctx.users.getLocale answers, by user id. A missing user answers null. */
@@ -167,6 +174,8 @@ export interface FakeAuthRegistrations {
         purpose: string;
         ttlSeconds?: number;
     }>;
+    /** Providers passed to ctx.auth.policy.provide that are still registered. */
+    policies: PluginAuthPolicyProvider[];
 }
 export interface FakePluginContext {
     ctx: PluginContext;
@@ -180,6 +189,8 @@ export interface FakePluginContext {
     hostStatusProviders: PluginHostStatusProvider[];
     /** Every provider passed to ctx.hosts.activity.provide that is still registered. */
     activityProviders: PluginActivityProvider[];
+    /** Every provider passed to ctx.hosts.locks.provide that is still registered. */
+    hostLockProviders: PluginHostLockProvider[];
     /** Topics emitted through ctx.events.emit, in order. */
     emitted: Array<{
         topic: string;
@@ -215,6 +226,11 @@ export interface FakePluginContext {
         permissionLevel: string;
         durationHours?: number;
     }>;
+    /** Every ctx.hosts.setShares call, in order. */
+    hostShareSets: Array<{
+        hostId: number;
+        grants: PluginHostShareGrant[];
+    }>;
     /** Everything registered through ctx.auth. */
     auth: FakeAuthRegistrations;
     /** Every ctx.desktop.openIsolatedWindow call, in order. */
@@ -364,6 +380,8 @@ export interface MockContextOptions {
     protocolTargets?: Record<string, PluginProtocolTarget>;
     /** What ctx.credentials.listSshKeys serves. */
     sshKeyCredentials?: PluginSshKeyCredential[];
+    /** What ctx.credentials.list serves. */
+    credentialSummaries?: PluginCredentialSummary[];
     /** What ctx.desktop.available() answers. */
     desktopAvailable?: boolean;
     /** What ctx.desktop.local is. See FakeContextOptions. */
@@ -402,6 +420,8 @@ export interface MockContextOptions {
     /** See FakeContextOptions. */
     loginAttemptLimit?: number;
     /** See FakeContextOptions. */
+    secondFactors?: FakeContextOptions["secondFactors"];
+    /** See FakeContextOptions. */
     locales?: Record<string, string>;
 }
 export interface MockPluginContext extends FakePluginContext {

package/dist/testing.js

@@ -100,7 +100,7 @@ function emptyHostRecord(id, userId) {
     };
 }
 function applyHostInput(record, input) {
-    const { tags, pluginSettings: _settings, forceKeyboardInteractive: _fki, ...rest } = input;
+    const { tags, pluginSettings: _settings, pluginEnable: _pluginEnable, forceKeyboardInteractive: _fki, password: _password, key: _key, keyPassword: _keyPassword, keyType: _keyType, sudoPassword: _sudoPassword, protocolAuth: _protocolAuth, ...rest } = input;
     const next = { ...record };
     for (const [key, value] of Object.entries(rest)) {
         if (value !== undefined)
@@ -126,6 +126,7 @@ export function createFakeContext(options = {}) {
     const emitted = [];
     const hostStatusProviders = [];
     const activityProviders = [];
+    const hostLockProviders = [];
     const kv = new Map();
     const tables = [];
     const syncEntities = [];
@@ -138,6 +139,7 @@ export function createFakeContext(options = {}) {
     const settingsValidators = new Set();
     const sshConnections = [];
     const hostShares = [];
+    const hostShareSets = [];
     const desktopWindows = [];
     const externalClientLaunches = [];
     const credentialReads = [];
@@ -198,6 +200,7 @@ export function createFakeContext(options = {}) {
         revokedSessions: [],
         loginFailures: new Map(),
         userTokens: [],
+        policies: [],
     };
     const sshClient = options.sshClient ?? {};
     let actor = options.actor;
@@ -526,6 +529,10 @@ export function createFakeContext(options = {}) {
                 hostShares.push({ hostId, targets, permissionLevel, durationHours });
                 return { hostId, shared: true };
             },
+            setShares: async (hostId, grants) => {
+                hostShareSets.push({ hostId, grants: [...grants] });
+                return { hostId, shared: true };
+            },
             listUsers: async () => options.shareableUsers ?? [],
             listRoles: async () => options.shareableRoles ?? [],
             trackSession: (hostId) => {
@@ -555,6 +562,16 @@ export function createFakeContext(options = {}) {
                     };
                 },
             },
+            locks: {
+                provide: (provider) => {
+                    hostLockProviders.push(provider);
+                    return () => {
+                        const at = hostLockProviders.indexOf(provider);
+                        if (at >= 0)
+                            hostLockProviders.splice(at, 1);
+                    };
+                },
+            },
             status: {
                 provide: (provider) => {
                     hostStatusProviders.push(provider);
@@ -761,6 +778,23 @@ export function createFakeContext(options = {}) {
                     expiresAt: new Date(Date.now() + ttl * 1000).toISOString(),
                 };
             },
+            policy: {
+                provide: (provider) => {
+                    auth.policies.push(provider);
+                    return () => {
+                        const at = auth.policies.indexOf(provider);
+                        if (at >= 0)
+                            auth.policies.splice(at, 1);
+                    };
+                },
+            },
+            listSecondFactors: () => [
+                ...auth.secondFactors.map((factor) => ({
+                    id: factor.id,
+                    pluginId,
+                })),
+                ...(options.secondFactors ?? []),
+            ],
         },
         users: {
             getLocale: async (userId) => options.locales?.[userId] ?? null,
@@ -778,6 +812,7 @@ export function createFakeContext(options = {}) {
             local: options.desktopLocal ?? unavailableDesktopLocal(),
         },
         credentials: {
+            list: async () => [...(options.credentialSummaries ?? [])],
             listSshKeys: async () => [
                 ...(options.sshKeyCredentials ?? []),
                 ...createdSshKeys.map((key) => ({
@@ -951,6 +986,7 @@ export function createFakeContext(options = {}) {
         disposals,
         hostStatusProviders,
         activityProviders,
+        hostLockProviders,
         emitted,
         kv,
         tables,
@@ -961,6 +997,7 @@ export function createFakeContext(options = {}) {
         coreSettings,
         sshConnections,
         hostShares,
+        hostShareSets,
         auth,
         desktopWindows,
         externalClientLaunches,
@@ -1085,6 +1122,7 @@ export function createMockCtx(options = {}) {
         services: options.services,
         protocolTargets: options.protocolTargets,
         sshKeyCredentials: options.sshKeyCredentials,
+        credentialSummaries: options.credentialSummaries,
         desktopAvailable: options.desktopAvailable,
         desktopLocal: options.desktopLocal,
         auditEntries: options.auditEntries,
@@ -1102,6 +1140,7 @@ export function createMockCtx(options = {}) {
         baseUrl: options.baseUrl,
         linkedUsers: options.linkedUsers,
         loginAttemptLimit: options.loginAttemptLimit,
+        secondFactors: options.secondFactors,
         locales: options.locales,
         manifest: {
             capabilities: options.capabilities ?? [],
@@ -1268,6 +1307,10 @@ export function createMockCtx(options = {}) {
                 require("hosts:write");
                 return ctx.hosts.share(hostId, targets, permissionLevel, durationHours);
             },
+            setShares: async (hostId, grants) => {
+                require("hosts:write");
+                return ctx.hosts.setShares(hostId, grants);
+            },
             listUsers: async () => {
                 require("hosts:write");
                 return ctx.hosts.listUsers();
@@ -1298,6 +1341,12 @@ export function createMockCtx(options = {}) {
                     return ctx.hosts.activity.provide(provider);
                 },
             },
+            locks: {
+                provide: (provider) => {
+                    require("hosts:lock");
+                    return ctx.hosts.locks.provide(provider);
+                },
+            },
             status: {
                 provide: (provider) => {
                     require("hosts:read");
@@ -1423,6 +1472,13 @@ export function createMockCtx(options = {}) {
                 require("users:impersonate");
                 return ctx.auth.issueUserToken(userId, tokenOptions);
             },
+            policy: {
+                provide: (provider) => {
+                    require("auth:policy");
+                    return ctx.auth.policy.provide(provider);
+                },
+            },
+            listSecondFactors: () => ctx.auth.listSecondFactors(),
         },
         users: {
             getLocale: async (userId) => {
@@ -1458,6 +1514,10 @@ export function createMockCtx(options = {}) {
             local: gateDesktopLocal(ctx.desktop.local, () => require("desktop:local")),
         },
         credentials: {
+            list: async () => {
+                require("credentials:use");
+                return ctx.credentials.list();
+            },
             listSshKeys: async () => {
                 require("credentials:use");
                 return ctx.credentials.listSshKeys();

package/dist/vitest-preset.js

@@ -8,6 +8,7 @@
  *
  * Two projects: tests/backend runs in node, tests/frontend in jsdom.
  */
+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -84,6 +85,28 @@ export function pluginVitestConfig(configUrl, options = {}) {
     // Vite must be allowed to read it, and React must come from the plugin.
     const sdkDir = fs.realpathSync(fileURLToPath(new URL("..", import.meta.url)));
     const server = { fs: { allow: [pluginDir, sdkDir] } };
+    // dedupe alone is not enough: react-dom or the testing library loaded from
+    // the linked SDK's own node_modules pull in a second React, and hooks then
+    // see no renderer.
+    if (!sdkDir.startsWith(pluginDir)) {
+        const pluginRequire = createRequire(path.join(pluginDir, "package.json"));
+        for (const name of [
+            "react",
+            "react-dom",
+            "@testing-library/react",
+            "react-i18next",
+            "i18next",
+        ]) {
+            if (alias[name])
+                continue;
+            try {
+                alias[name] = path.dirname(pluginRequire.resolve(`${name}/package.json`));
+            }
+            catch {
+                // Not installed in the plugin: leave it to normal resolution.
+            }
+        }
+    }
     const resolve = {
         alias,
         dedupe: ["react", "react-dom", "react-i18next", "i18next"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {

package/schema/manifest.schema.json

@@ -151,6 +151,7 @@
           "process:spawn",
           "users:write",
           "auth:provide",
+          "auth:policy",
           "system:tls",
           "device:serial",
           "hosts:write",
@@ -167,6 +168,7 @@
           "network:probe",
           "hosts:status-provide",
           "hosts:activity-provide",
+          "hosts:lock",
           "desktop:window",
           "desktop:local",
           "users:impersonate",