@termix-ssh/plugin-sdk 1.0.13 → 1.0.17

package/dist/host/{use-permissions-ISEDRY3J.js → use-permissions-BYCDS5PD.js}

@@ -7,7 +7,7 @@ import {
   resetPermissionsCache,
   setPermissionsForTesting,
   usePermissions
-} from "./chunk-T2PZWXFJ.js";
+} from "./chunk-2MU6WNSX.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   hasPermission,

package/dist/manifest.d.ts

@@ -20,7 +20,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export declare const PLUGIN_API_VERSION = "1.5.0";
+export declare const PLUGIN_API_VERSION = "1.9.0";
 /** The API major, the default engine.api for a new plugin. */
 export declare const SUPPORTED_PLUGIN_API_VERSION: string;
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/manifest.js

@@ -22,7 +22,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.5.0";
+export const PLUGIN_API_VERSION = "1.9.0";
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(semver.major(PLUGIN_API_VERSION));
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/testing.d.ts

@@ -23,9 +23,9 @@ export interface FakeWsRoute {
     options?: PluginWebSocketOptions;
 }
 import type { PluginLoginMethod, PluginVerifiedIdentity, PluginSecondFactor, PluginSshAuthProvider, PluginSshConnectOptions, PluginSshHost, PluginHostSummary, PluginShareableUser, PluginShareableRole, PluginSshKeyCredential, PluginSshKeyCredentialInput } from "./backend.js";
-import type { SyncEntityRegistration } from "./backend.js";
+import type { PluginSyncHost, SyncEntityRegistration } from "./backend.js";
 import type { PluginDatabase } from "./backend.js";
-import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
+import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostLockProvider, PluginAuthPolicyProvider, PluginCredentialSummary, PluginHostShareGrant, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
 /** A timer registered through ctx.schedule, run by hand with runScheduled. */
 export interface FakeScheduledJob {
     kind: "every" | "after";
@@ -35,6 +35,8 @@ export interface FakeScheduledJob {
 }
 export interface FakeContextOptions {
     pluginId?: string;
+    /** What ctx.sync.host answers, for a sync provider's tests. */
+    syncHost?: Partial<PluginSyncHost>;
     manifest?: Partial<PluginManifest>;
     /** Acting user returned by currentActor and used by asUser. */
     actor?: string;
@@ -75,6 +77,8 @@ export interface FakeContextOptions {
     protocolTargets?: Record<string, PluginProtocolTarget>;
     /** What ctx.credentials.listSshKeys answers. */
     sshKeyCredentials?: PluginSshKeyCredential[];
+    /** What ctx.credentials.list answers. */
+    credentialSummaries?: PluginCredentialSummary[];
     /** What ctx.desktop.available() answers. Defaults to false. */
     desktopAvailable?: boolean;
     /** What ctx.desktop.local is. Calls throw when this is not given. */
@@ -122,6 +126,11 @@ export interface FakeContextOptions {
     baseUrl?: string;
     /** What ctx.auth.countLinkedUsers answers, by provider. Defaults to 0. */
     linkedUsers?: Record<string, number>;
+    /** Second factors from other plugins that ctx.auth.listSecondFactors adds. */
+    secondFactors?: {
+        id: string;
+        pluginId: string;
+    }[];
     /** Failures before ctx.auth.loginRateLimit locks a key. Defaults to 5. */
     loginAttemptLimit?: number;
     /** What ctx.users.getLocale answers, by user id. A missing user answers null. */
@@ -167,6 +176,8 @@ export interface FakeAuthRegistrations {
         purpose: string;
         ttlSeconds?: number;
     }>;
+    /** Providers passed to ctx.auth.policy.provide that are still registered. */
+    policies: PluginAuthPolicyProvider[];
 }
 export interface FakePluginContext {
     ctx: PluginContext;
@@ -180,6 +191,8 @@ export interface FakePluginContext {
     hostStatusProviders: PluginHostStatusProvider[];
     /** Every provider passed to ctx.hosts.activity.provide that is still registered. */
     activityProviders: PluginActivityProvider[];
+    /** Every provider passed to ctx.hosts.locks.provide that is still registered. */
+    hostLockProviders: PluginHostLockProvider[];
     /** Topics emitted through ctx.events.emit, in order. */
     emitted: Array<{
         topic: string;
@@ -215,6 +228,11 @@ export interface FakePluginContext {
         permissionLevel: string;
         durationHours?: number;
     }>;
+    /** Every ctx.hosts.setShares call, in order. */
+    hostShareSets: Array<{
+        hostId: number;
+        grants: PluginHostShareGrant[];
+    }>;
     /** Everything registered through ctx.auth. */
     auth: FakeAuthRegistrations;
     /** Every ctx.desktop.openIsolatedWindow call, in order. */
@@ -330,6 +348,8 @@ export interface FakePluginContext {
 export declare function createFakeContext(options?: FakeContextOptions): FakePluginContext;
 export interface MockContextOptions {
     pluginId?: string;
+    /** What ctx.sync.host answers, for a sync provider's tests. */
+    syncHost?: Partial<PluginSyncHost>;
     manifest?: Partial<PluginManifest>;
     /** Capabilities the plugin is granted. Anything else throws. */
     capabilities?: string[];
@@ -364,6 +384,8 @@ export interface MockContextOptions {
     protocolTargets?: Record<string, PluginProtocolTarget>;
     /** What ctx.credentials.listSshKeys serves. */
     sshKeyCredentials?: PluginSshKeyCredential[];
+    /** What ctx.credentials.list serves. */
+    credentialSummaries?: PluginCredentialSummary[];
     /** What ctx.desktop.available() answers. */
     desktopAvailable?: boolean;
     /** What ctx.desktop.local is. See FakeContextOptions. */
@@ -402,6 +424,8 @@ export interface MockContextOptions {
     /** See FakeContextOptions. */
     loginAttemptLimit?: number;
     /** See FakeContextOptions. */
+    secondFactors?: FakeContextOptions["secondFactors"];
+    /** See FakeContextOptions. */
     locales?: Record<string, string>;
 }
 export interface MockPluginContext extends FakePluginContext {

package/dist/testing.js

@@ -100,7 +100,7 @@ function emptyHostRecord(id, userId) {
     };
 }
 function applyHostInput(record, input) {
-    const { tags, pluginSettings: _settings, forceKeyboardInteractive: _fki, ...rest } = input;
+    const { tags, pluginSettings: _settings, pluginEnable: _pluginEnable, forceKeyboardInteractive: _fki, password: _password, key: _key, keyPassword: _keyPassword, keyType: _keyType, sudoPassword: _sudoPassword, protocolAuth: _protocolAuth, ...rest } = input;
     const next = { ...record };
     for (const [key, value] of Object.entries(rest)) {
         if (value !== undefined)
@@ -126,6 +126,7 @@ export function createFakeContext(options = {}) {
     const emitted = [];
     const hostStatusProviders = [];
     const activityProviders = [];
+    const hostLockProviders = [];
     const kv = new Map();
     const tables = [];
     const syncEntities = [];
@@ -138,6 +139,7 @@ export function createFakeContext(options = {}) {
     const settingsValidators = new Set();
     const sshConnections = [];
     const hostShares = [];
+    const hostShareSets = [];
     const desktopWindows = [];
     const externalClientLaunches = [];
     const credentialReads = [];
@@ -198,6 +200,7 @@ export function createFakeContext(options = {}) {
         revokedSessions: [],
         loginFailures: new Map(),
         userTokens: [],
+        policies: [],
     };
     const sshClient = options.sshClient ?? {};
     let actor = options.actor;
@@ -298,6 +301,12 @@ export function createFakeContext(options = {}) {
             registerEntity: (entity) => {
                 syncEntities.push(entity);
             },
+            provide: () => () => { },
+            get host() {
+                if (!options.syncHost)
+                    throw new Error("Pass syncHost to use ctx.sync.host");
+                return options.syncHost;
+            },
         },
         registry: {
             provide: (key, value) => {
@@ -526,6 +535,10 @@ export function createFakeContext(options = {}) {
                 hostShares.push({ hostId, targets, permissionLevel, durationHours });
                 return { hostId, shared: true };
             },
+            setShares: async (hostId, grants) => {
+                hostShareSets.push({ hostId, grants: [...grants] });
+                return { hostId, shared: true };
+            },
             listUsers: async () => options.shareableUsers ?? [],
             listRoles: async () => options.shareableRoles ?? [],
             trackSession: (hostId) => {
@@ -555,6 +568,20 @@ export function createFakeContext(options = {}) {
                     };
                 },
             },
+            folders: {
+                ensure: async () => { },
+                removeEmpty: async () => true,
+            },
+            locks: {
+                provide: (provider) => {
+                    hostLockProviders.push(provider);
+                    return () => {
+                        const at = hostLockProviders.indexOf(provider);
+                        if (at >= 0)
+                            hostLockProviders.splice(at, 1);
+                    };
+                },
+            },
             status: {
                 provide: (provider) => {
                     hostStatusProviders.push(provider);
@@ -616,6 +643,7 @@ export function createFakeContext(options = {}) {
             tcpProbe: async (host, port) => options.reachable?.(host, port) ?? false,
         },
         ssh: {
+            transports: { provide: () => () => { } },
             probe: async (hostId, probeOptions) => options.reachable?.(hostId, probeOptions?.port) ?? false,
             connect: async (host, connectOptions) => {
                 sshConnections.push({ host, options: connectOptions });
@@ -761,6 +789,23 @@ export function createFakeContext(options = {}) {
                     expiresAt: new Date(Date.now() + ttl * 1000).toISOString(),
                 };
             },
+            policy: {
+                provide: (provider) => {
+                    auth.policies.push(provider);
+                    return () => {
+                        const at = auth.policies.indexOf(provider);
+                        if (at >= 0)
+                            auth.policies.splice(at, 1);
+                    };
+                },
+            },
+            listSecondFactors: () => [
+                ...auth.secondFactors.map((factor) => ({
+                    id: factor.id,
+                    pluginId,
+                })),
+                ...(options.secondFactors ?? []),
+            ],
         },
         users: {
             getLocale: async (userId) => options.locales?.[userId] ?? null,
@@ -778,6 +823,7 @@ export function createFakeContext(options = {}) {
             local: options.desktopLocal ?? unavailableDesktopLocal(),
         },
         credentials: {
+            list: async () => [...(options.credentialSummaries ?? [])],
             listSshKeys: async () => [
                 ...(options.sshKeyCredentials ?? []),
                 ...createdSshKeys.map((key) => ({
@@ -951,6 +997,7 @@ export function createFakeContext(options = {}) {
         disposals,
         hostStatusProviders,
         activityProviders,
+        hostLockProviders,
         emitted,
         kv,
         tables,
@@ -961,6 +1008,7 @@ export function createFakeContext(options = {}) {
         coreSettings,
         sshConnections,
         hostShares,
+        hostShareSets,
         auth,
         desktopWindows,
         externalClientLaunches,
@@ -1070,6 +1118,7 @@ export function createMockCtx(options = {}) {
     const checked = [];
     const base = createFakeContext({
         pluginId: options.pluginId,
+        syncHost: options.syncHost,
         actor: options.actor,
         settings: options.settings,
         coreSettings: options.coreSettings,
@@ -1085,6 +1134,7 @@ export function createMockCtx(options = {}) {
         services: options.services,
         protocolTargets: options.protocolTargets,
         sshKeyCredentials: options.sshKeyCredentials,
+        credentialSummaries: options.credentialSummaries,
         desktopAvailable: options.desktopAvailable,
         desktopLocal: options.desktopLocal,
         auditEntries: options.auditEntries,
@@ -1102,6 +1152,7 @@ export function createMockCtx(options = {}) {
         baseUrl: options.baseUrl,
         linkedUsers: options.linkedUsers,
         loginAttemptLimit: options.loginAttemptLimit,
+        secondFactors: options.secondFactors,
         locales: options.locales,
         manifest: {
             capabilities: options.capabilities ?? [],
@@ -1268,6 +1319,10 @@ export function createMockCtx(options = {}) {
                 require("hosts:write");
                 return ctx.hosts.share(hostId, targets, permissionLevel, durationHours);
             },
+            setShares: async (hostId, grants) => {
+                require("hosts:write");
+                return ctx.hosts.setShares(hostId, grants);
+            },
             listUsers: async () => {
                 require("hosts:write");
                 return ctx.hosts.listUsers();
@@ -1298,6 +1353,22 @@ export function createMockCtx(options = {}) {
                     return ctx.hosts.activity.provide(provider);
                 },
             },
+            folders: {
+                ensure: async (name, style) => {
+                    require("hosts:write");
+                    return ctx.hosts.folders.ensure(name, style);
+                },
+                removeEmpty: async (name) => {
+                    require("hosts:write");
+                    return ctx.hosts.folders.removeEmpty(name);
+                },
+            },
+            locks: {
+                provide: (provider) => {
+                    require("hosts:lock");
+                    return ctx.hosts.locks.provide(provider);
+                },
+            },
             status: {
                 provide: (provider) => {
                     require("hosts:read");
@@ -1324,6 +1395,12 @@ export function createMockCtx(options = {}) {
         },
         ssh: {
             ...ctx.ssh,
+            transports: {
+                provide: (provider) => {
+                    require("ssh:transport");
+                    return ctx.ssh.transports.provide(provider);
+                },
+            },
             probe: async (hostId, probeOptions) => {
                 require("ssh:connect");
                 return ctx.ssh.probe(hostId, probeOptions);
@@ -1423,6 +1500,13 @@ export function createMockCtx(options = {}) {
                 require("users:impersonate");
                 return ctx.auth.issueUserToken(userId, tokenOptions);
             },
+            policy: {
+                provide: (provider) => {
+                    require("auth:policy");
+                    return ctx.auth.policy.provide(provider);
+                },
+            },
+            listSecondFactors: () => ctx.auth.listSecondFactors(),
         },
         users: {
             getLocale: async (userId) => {
@@ -1458,6 +1542,10 @@ export function createMockCtx(options = {}) {
             local: gateDesktopLocal(ctx.desktop.local, () => require("desktop:local")),
         },
         credentials: {
+            list: async () => {
+                require("credentials:use");
+                return ctx.credentials.list();
+            },
             listSshKeys: async () => {
                 require("credentials:use");
                 return ctx.credentials.listSshKeys();

package/dist/vitest-preset.js

@@ -8,6 +8,7 @@
  *
  * Two projects: tests/backend runs in node, tests/frontend in jsdom.
  */
+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -84,6 +85,28 @@ export function pluginVitestConfig(configUrl, options = {}) {
     // Vite must be allowed to read it, and React must come from the plugin.
     const sdkDir = fs.realpathSync(fileURLToPath(new URL("..", import.meta.url)));
     const server = { fs: { allow: [pluginDir, sdkDir] } };
+    // dedupe alone is not enough: react-dom or the testing library loaded from
+    // the linked SDK's own node_modules pull in a second React, and hooks then
+    // see no renderer.
+    if (!sdkDir.startsWith(pluginDir)) {
+        const pluginRequire = createRequire(path.join(pluginDir, "package.json"));
+        for (const name of [
+            "react",
+            "react-dom",
+            "@testing-library/react",
+            "react-i18next",
+            "i18next",
+        ]) {
+            if (alias[name])
+                continue;
+            try {
+                alias[name] = path.dirname(pluginRequire.resolve(`${name}/package.json`));
+            }
+            catch {
+                // Not installed in the plugin: leave it to normal resolution.
+            }
+        }
+    }
     const resolve = {
         alias,
         dedupe: ["react", "react-dom", "react-i18next", "i18next"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.13",
+  "version": "1.0.17",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {

package/schema/manifest.schema.json

@@ -151,6 +151,9 @@
           "process:spawn",
           "users:write",
           "auth:provide",
+          "auth:policy",
+          "sync:provide",
+          "ssh:transport",
           "system:tls",
           "device:serial",
           "hosts:write",
@@ -167,6 +170,7 @@
           "network:probe",
           "hosts:status-provide",
           "hosts:activity-provide",
+          "hosts:lock",
           "desktop:window",
           "desktop:local",
           "users:impersonate",

package/dist/host/types/src/ui/api/sync-api.d.ts

@@ -1,93 +0,0 @@
-export type SyncState = "idle" | "syncing" | "offline" | "error" | "signed_out";
-export interface SyncProxyHeader {
-    name: string;
-    value: string;
-    /** A saved header whose value is not sent back. */
-    set?: boolean;
-}
-export interface SyncBasicAuth {
-    username: string;
-    password: string;
-    set?: boolean;
-}
-export interface SyncEntityInfo {
-    type: string;
-    owner: string;
-    ownerName: string | null;
-    readOnly: boolean;
-    onServer: boolean;
-    onDevice: boolean;
-    enabled: boolean;
-}
-export interface SyncStatus {
-    linked: boolean;
-    serverUrl?: string;
-    serverName?: string | null;
-    serverVersion?: string | null;
-    account?: {
-        username?: string;
-        isAdmin?: boolean;
-        roles?: string[];
-        permissions?: string[];
-    };
-    status?: SyncState;
-    lastError?: string | null;
-    linkedAt?: string;
-    lastSyncAt?: string | null;
-    pending?: number;
-    conflicts?: number;
-    errors?: number;
-    firstSyncDone?: boolean;
-    allowInvalidCertificate?: boolean;
-    customHeaders?: SyncProxyHeader[];
-    basicAuth?: SyncBasicAuth | null;
-    entities: SyncEntityInfo[];
-}
-export type ProbeProblem = "invalid_url" | "unreachable" | "tls_untrusted" | "basic_auth_required" | "proxy_login" | "not_termix" | "version_mismatch" | "different_account";
-export interface ProbeResult {
-    ok: boolean;
-    serverUrl?: string;
-    name?: string;
-    version?: string | null;
-    problem?: ProbeProblem;
-    message?: string;
-}
-export interface ServerTarget {
-    serverUrl: string;
-    customHeaders?: SyncProxyHeader[];
-    basicAuth?: SyncBasicAuth | null;
-    allowInvalidCertificate?: boolean;
-}
-export interface SyncConflictItem {
-    id: number;
-    entityType: string;
-    syncId: string;
-    name: string;
-    createdAt: string;
-}
-export interface SyncErrorItem {
-    entityType: string;
-    syncId: string;
-    reason: string | null;
-}
-export declare function getSyncStatus(): Promise<SyncStatus>;
-export declare function probeServer(target: ServerTarget): Promise<ProbeResult>;
-export declare function getLinkPreview(): Promise<Record<string, number>>;
-export declare function completeLink(input: ServerTarget & {
-    token: string;
-    mode: "merge" | "replace";
-    serverName?: string;
-}): Promise<SyncStatus>;
-export declare function reloginLink(token: string): Promise<SyncStatus>;
-export declare function unlinkServer(keepData: boolean): Promise<SyncStatus>;
-export declare function syncNow(): Promise<SyncStatus>;
-export declare function updateSyncSettings(settings: {
-    disabledTypes?: string[];
-    customHeaders?: SyncProxyHeader[];
-    basicAuth?: SyncBasicAuth | null;
-    allowInvalidCertificate?: boolean;
-}): Promise<SyncStatus>;
-export declare function getSyncConflicts(): Promise<SyncConflictItem[]>;
-export declare function settleSyncConflict(id: number, keep: "mine" | "server"): Promise<void>;
-export declare function getSyncErrors(): Promise<SyncErrorItem[]>;
-export declare function retrySyncErrors(): Promise<SyncStatus>;

package/dist/host/types/src/ui/auth/ElectronLoginForm.d.ts

@@ -1,9 +0,0 @@
-import React from "react";
-interface ElectronLoginFormProps {
-    serverUrl: string;
-    onAuthSuccess: (token: string | null) => void | Promise<void>;
-    onChangeServer: () => void;
-    targetPurpose?: "local" | "link";
-}
-export declare function ElectronLoginForm({ serverUrl, onAuthSuccess, onChangeServer, targetPurpose, }: ElectronLoginFormProps): React.JSX.Element;
-export {};

package/dist/host/types/src/ui/hooks/use-sync-status.d.ts

@@ -1,4 +0,0 @@
-/** The desktop's sync status, kept current while the component is mounted. */
-export declare function useSyncStatus(): any;
-/** What needs the user's attention in Sync, for the rail badge. */
-export declare function useSyncAttentionCount(): number | null;

package/dist/host/types/src/ui/lib/sync-status.d.ts

@@ -1,6 +0,0 @@
-import { type SyncStatus } from "../api/sync-api";
-export declare function subscribeSyncStatus(listener: () => void): () => void;
-export declare function getSyncStatusSnapshot(): SyncStatus | null;
-/** Takes a status a request already returned, and checks again soon. */
-export declare function setSyncStatus(next: SyncStatus): void;
-export declare function refreshSyncStatus(): void;

package/dist/host/types/src/ui/settings/sync/LinkServerDialog.d.ts

@@ -1,12 +0,0 @@
-import { type SyncStatus } from "../../api/sync-api";
-interface LinkServerDialogProps {
-    open: boolean;
-    onOpenChange: (open: boolean) => void;
-    onLinked: (status: SyncStatus) => void;
-    /** Sign back in to the server this desktop is already linked to. */
-    relogin?: {
-        serverUrl: string;
-    };
-}
-export declare function LinkServerDialog({ open, onOpenChange, onLinked, relogin, }: LinkServerDialogProps): import("react").JSX.Element;
-export {};

package/dist/host/types/src/ui/settings/sync/ProxySettingsFields.d.ts

@@ -1,15 +0,0 @@
-import type { SyncBasicAuth, SyncProxyHeader } from "../../api/sync-api";
-interface ProxySettingsFieldsProps {
-    customHeaders: SyncProxyHeader[];
-    basicAuth: SyncBasicAuth | null;
-    onChange: (next: {
-        customHeaders?: SyncProxyHeader[];
-        basicAuth?: SyncBasicAuth | null;
-    }) => void;
-}
-/**
- * What a reverse proxy in front of the server wants: extra headers (a
- * Cloudflare Access service token, a gateway key) and basic auth.
- */
-export declare function ProxySettingsFields({ customHeaders, basicAuth, onChange, }: ProxySettingsFieldsProps): import("react").JSX.Element;
-export {};

package/dist/host/types/src/ui/settings/sync/saved-servers.d.ts

@@ -1,3 +0,0 @@
-export declare function getSavedServerUrls(): string[];
-export declare function rememberServerUrl(url: string): string[];
-export declare function forgetServerUrl(url: string): string[];