@termix-ssh/plugin-sdk 1.0.22 → 1.0.24

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.0.24
+
+Plugin API 1.14.0.
+
+### Added
+
+- `app.registerHostSection` adds a card to the host page
+- `/ui` exports `HostTabEmbed`, which draws any tab type inside another view, the host section registry, and `operationsApi` for core's `/operations` routes
+
+## 1.0.23
+
+Plugin API 1.14.0.
+
+### Added
+
+- `contributes.operations` declares a plugin's actions, events, resources and signals, so Automations, Fleets, the assistant, the CLI, the phone app and the command palette can find them with no wiring
+- `ctx.operations` registers handlers, runs other plugins' declared actions, emits events and provides approval rules, with the new `operations:provide`, `operations:invoke` and `operations:approve` capabilities
+- `@termix-ssh/plugin-sdk/operations` has the types, input checks, redaction and JSON Schema for declared actions
+- `contributes.hostSections` declares cards for the host page
+
 ## 1.0.22
 
 Plugin API 1.13.0.

package/PLUGIN-GUIDE.md

@@ -1,6 +1,6 @@
 # Termix plugin guide
 
-SDK 1.0.22 | Plugin API 1.13.0
+SDK 1.0.24 | Plugin API 1.14.0
 
 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
@@ -414,6 +414,70 @@ ctx.schedule.every(60_000, () => refresh(), { jitterMs: 5_000 });
 - Use a service: declare it in `requires`, then `ctx.services.get<T>("snippets.access")`. It returns
   nothing while no provider runs, so always handle that.
 
+### Operations
+
+Declare what your plugin can do in `contributes.operations`, and it shows up in Automations, Fleets, the
+assistant, the CLI, the phone app and the command palette with no other wiring. It also gets per host results,
+dry runs, run history, approvals and drift checks.
+
+```json
+"capabilities": ["operations:provide"],
+"engine": { "termix": ">=26.11.1-0", "api": "^1.13" },
+"contributes": {
+  "operations": {
+    "actions": [{
+      "id": "demo.restart",
+      "titleKey": "ops.restart.title",
+      "scope": "host",
+      "inputs": [{ "key": "name", "type": "string", "labelKey": "ops.restart.name", "required": true }],
+      "risk": "change",
+      "permission": "use",
+      "hostAccess": "edit",
+      "dryRun": "describe"
+    }]
+  }
+}
+```
+
+```ts
+ctx.operations.register("demo.restart", {
+  describe: (input) => `Would restart ${input.name}`,
+  run: async (input, { hostId, signal, log }) => {
+    return { summary: `Restarted ${input.name}`, changed: true };
+  },
+});
+```
+
+- Actions: `scope` is `host`, `resource` or `server`. `risk` is `read`, `change` or `destructive`. Host actions declare
+  `hostAccess`. Use `edit` for changes unless people with `connect` already do this today. A destructive action
+  must use `edit` or `manage` and needs a confirm.
+- Inputs use the settings field types, plus `required`, `pattern`, `optionsFrom` (a read action fills the choices)
+  and type `resource`. Keys you did not declare are refused before your handler runs. `secret` values reach the handler
+  but are never stored or shown. Mark private outputs `sensitive`.
+- `dryRun`: `native` calls `run` with `dryRun: true` and nothing may change. `describe` calls `describe` instead.
+- `check` names a read action that proves the result, used for drift. `undo` names the reverse action, and `run` returns
+  `undoInput`. `idempotent` lets a rollout retry it. `exclusive` allows one at a time per host. `when` limits it to
+  hosts by setting or OS.
+- `surfaces`: the assistant and MCP are off until you set them true. Only do that for actions safe for a model to
+  ask for. The rest are on unless you set them false.
+- Resources describe a kind of thing, such as a container: a read action on one host returns `{ rows }` as `data`, and
+  core draws the All hosts table and host page section. Attach actions with `scope: "resource"`.
+- Signals are status tiles: a read action returns `{ value, status, label }` as `data`, with status `ok`, `warn`, `fail` or
+  `unknown`. `fix` names the action offered when it is not ok. Keep these reads cheap, they run for every host.
+- Events: declare them, then call `ctx.operations.emit(id, payload, { hostId })`.
+- Handlers must watch `signal` and stop when it fires. Throw on failure; a failed run never counts against your
+  plugin's error budget. Throw an error with `code = "NEEDS_INTERACTION"` when a host needs a person to sign in first.
+- Handlers have no request and no session. Take what you need from the input and `hostId`.
+- Keep your REST routes. Inside one, call `ctx.operations.run(id, { hostId, input })` so a button press goes through
+  the same checks and lands in the same history.
+- To run another plugin's action, add `operations:invoke`, list it in `operations.invokes` and call
+  `ctx.operations.invoke(id, { hostId, input, via: "automation" })`. It acts as the current user and rules still apply.
+- `risk` is your plugin's claim. Plugins run in-process, so this is not a sandbox. Actions from plugins not signed as
+  official count as `change` when rules decide what needs a person, and stay off the assistant and MCP until an admin
+  allows them.
+- Set `engine.termix` to at least `>=26.11.1-0`. Keep `engine.api` as it was unless you import something new from
+  `/ui`, or the phone app will ask people to update to see your plugin.
+
 ### Shared packages
 
 These come from Termix and are never bundled: `@termix-ssh/plugin-sdk`, `express`, `ssh2`, `ws`, `multer`,
@@ -962,6 +1026,7 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 | `@termix-ssh/plugin-sdk/db`                                          | `defineTable` and column builders                                                              |
 | `@termix-ssh/plugin-sdk/manifest`                                    | `PluginManifest` type and manifest checks                                                      |
 | `@termix-ssh/plugin-sdk/capabilities`                                | The capability catalog                                                                         |
+| `@termix-ssh/plugin-sdk/operations`                                  | Types, input checks and JSON Schema for declared actions                                       |
 | `@termix-ssh/plugin-sdk/settings`                                    | Settings field validation                                                                      |
 | `@termix-ssh/plugin-sdk/testing`                                     | `createMockCtx`, `createTestDb`, `renderWithApp`, `createFakeContext`                          |
 | `@termix-ssh/plugin-sdk/vitest-preset`                               | `pluginVitestConfig`                                                                           |
@@ -993,6 +1058,8 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 | `desktop:local`          | high     | Use the user's own computer, desktop app only                 |
 | `hosts:export`           | high     | Export hosts with their saved logins                          |
 | `notify:hub`             | high     | Receive every alert (the alerts hub only)                     |
+| `operations:invoke`      | high     | Run other plugins' declared actions, listed in `invokes`      |
+| `operations:approve`     | high     | Decide which actions need a person                            |
 | `ui:layout`              | high     | Replace the whole app layout                                  |
 | `hosts:write`            | medium   | Add and edit hosts                                            |
 | `hosts:status-provide`   | medium   | Be the source of host status dots                             |
@@ -1008,6 +1075,7 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 | `users:read`             | medium   | Usernames, roles and UI language                              |
 | `events:core`            | medium   | Listen to core events                                         |
 | `notify:send`            | medium   | Send alerts                                                   |
+| `operations:provide`     | medium   | Offer declared actions and events                             |
 | `audit:read`             | medium   | Read the audit log                                            |
 | `desktop:window`         | medium   | Open windows in the desktop app                               |
 | `hosts:read`             | low      | Read hosts the user can see                                   |

package/dist/backend.d.ts

@@ -13,6 +13,7 @@ import type { HostSshOptions } from "./ssh-options.js";
 export type { HostSshOptions } from "./ssh-options.js";
 import type { PluginManifest, PluginSettingsField } from "./manifest.js";
 import type { PluginTableDefinition } from "./db.js";
+import type { OperationResult, OperationRisk, OperationSurfaces } from "./operations.js";
 /**
  * Thrown when a plugin calls a guarded member without the capability.
  *
@@ -2680,6 +2681,110 @@ export interface PluginSummary {
 export interface PluginPlugins {
     list: () => Promise<PluginSummary[]>;
 }
+/** What a handler gets besides its input. */
+export interface PluginOperationContext {
+    hostId?: number;
+    /** The row a resource action targets. */
+    resourceKey?: string;
+    /** Null for a background read. */
+    runId: string | null;
+    /** Nothing may change when this is set. */
+    dryRun: boolean;
+    /** Fires when the run is cancelled, times out or the plugin stops. */
+    signal: AbortSignal;
+    log: (line: string) => void;
+}
+export interface PluginOperationHandler {
+    run: (input: Record<string, unknown>, context: PluginOperationContext) => Promise<OperationResult> | OperationResult;
+    /** The dry run text for an action declared with dryRun "describe". */
+    describe?: (input: Record<string, unknown>, context: PluginOperationContext) => string | Promise<string>;
+}
+export interface PluginOperationInvokeOptions {
+    hostId?: number;
+    resourceKey?: string;
+    input?: Record<string, unknown>;
+    dryRun?: boolean;
+    /** A person agreed to a destructive action. */
+    confirmed?: boolean;
+    idempotencyKey?: string;
+    batchId?: string;
+    /** What this plugin is doing: automation, assistant, mcp, rollout and so on. */
+    via?: string;
+}
+export interface PluginOperationOutcome {
+    runId: string | null;
+    status: string;
+    summary?: string;
+    changed?: boolean;
+    data?: unknown;
+    error?: string;
+    errorCode?: string;
+    approvalId?: string;
+}
+export interface PluginOperationApprovalInput {
+    actionId: string;
+    pluginId: string;
+    risk: OperationRisk;
+    /** What rules should use. Plugins not signed as official count as change. */
+    effectiveRisk: OperationRisk;
+    origin: {
+        kind: string;
+        pluginId?: string;
+        via?: string;
+    };
+    userId: string;
+    hostId?: number;
+    hostTags?: string[];
+    batchId?: string;
+}
+export interface PluginOperationApprovalDecision {
+    decision: "allow" | "approve" | "deny";
+    reason?: string;
+    allowSelf?: boolean;
+    expiresInMinutes?: number;
+}
+export interface PluginOperationEvent {
+    id: string;
+    eventId: string;
+    pluginId: string;
+    hostId?: number;
+    severity?: string;
+    payload?: unknown;
+    runId?: string;
+    depth: number;
+    at: string;
+}
+/**
+ * Declared actions and events. See contributes.operations in the manifest.
+ * register and emit need operations:provide. invoke, list and onEvent need
+ * operations:invoke, and invoke only reaches ids in the manifest's invokes list.
+ */
+export interface PluginOperations {
+    register: (id: string, handler: PluginOperationHandler) => void;
+    /**
+     * Runs one of this plugin's own actions from its route, so a button press
+     * goes through the same checks and lands in the same history.
+     */
+    run: (actionId: string, options?: PluginOperationInvokeOptions) => Promise<PluginOperationOutcome>;
+    invoke: (actionId: string, options?: PluginOperationInvokeOptions) => Promise<PluginOperationOutcome>;
+    list: (options?: {
+        lang?: string;
+        surface?: keyof OperationSurfaces;
+    }) => Promise<unknown>;
+    emit: (eventId: string, payload?: unknown, options?: {
+        hostId?: number;
+    }) => Promise<void>;
+    onEvent: (subscription: {
+        pattern: string;
+        handler: (event: PluginOperationEvent) => void | Promise<void>;
+        userId?: string;
+        cooldownMs?: number;
+    }) => () => void;
+    /** Rules for what needs a person. Needs operations:approve. */
+    approvals: {
+        provide: (provider: (input: PluginOperationApprovalInput) => PluginOperationApprovalDecision | null | undefined | Promise<PluginOperationApprovalDecision | null | undefined>) => () => void;
+    };
+}
 export interface PluginContext {
     readonly pluginId: string;
     readonly manifest: PluginManifest;
@@ -2720,6 +2825,8 @@ export interface PluginContext {
     readonly schedule: PluginSchedule;
     /** Core's notification channels. Needs notify:send. */
     readonly notify: PluginNotify;
+    /** Declared actions and events, reachable from every surface. */
+    readonly operations: PluginOperations;
     /** Outbound HTTP through core's SSRF guard. Needs network:outbound. */
     readonly fetch: PluginFetch;
     /** Plain reachability checks. Needs network:probe. */

package/dist/capabilities.js

@@ -38,6 +38,8 @@ export const CAPABILITY_CATALOG = [
     entry("ssh:transport", "high"),
     entry("device:serial", "high"),
     entry("notify:hub", "high"),
+    entry("operations:invoke", "high"),
+    entry("operations:approve", "high"),
     entry("ui:layout", "high"),
     entry("hosts:write", "medium"),
     entry("hosts:export", "high"),
@@ -53,6 +55,7 @@ export const CAPABILITY_CATALOG = [
     entry("users:read", "medium"),
     entry("events:core", "medium"),
     entry("notify:send", "medium"),
+    entry("operations:provide", "medium"),
     entry("audit:read", "medium"),
     entry("desktop:window", "medium"),
     entry("desktop:local", "high"),

package/dist/frontend.d.ts

@@ -643,6 +643,20 @@ export interface HostBadgeContribution {
 export type HostStatusIndicatorContribution = HostBadgeContribution;
 /** A control in the host editor's toolbar. */
 export type HostEditorToolbarItemContribution = HostBadgeContribution;
+export interface HostSectionProps {
+    host: PluginHostRecord;
+    isVisible: boolean;
+    shell: ShellApi;
+}
+export interface HostSectionContribution {
+    /** Declare it in manifest contributes.hostSections too. */
+    id: string;
+    titleKey: string;
+    /** Lower sorts first. */
+    order?: number;
+    when?: (host: PluginHostRecord) => boolean;
+    component: ComponentType<HostSectionProps>;
+}
 export interface HostContextMenuItemContribution {
     id: string;
     titleKey: string;
@@ -1085,6 +1099,11 @@ export interface TermixApp extends TermixAppInfo {
     /** Adds a control to the host editor's toolbar. */
     registerHostEditorToolbarItem: (item: HostEditorToolbarItemContribution) => Disposer;
     registerHostContextMenuItem: (item: HostContextMenuItemContribution) => Disposer;
+    /**
+     * A card on the host page. Core 26.11.1 and newer; call it as
+     * app.registerHostSection?.(...) if your plugin allows older cores.
+     */
+    registerHostSection: (section: HostSectionContribution) => Disposer;
     registerPaletteEntry: (entry: PaletteEntryContribution) => Disposer;
     registerPaletteGroup: (group: PaletteGroupContribution) => Disposer;
     registerKeybindingAction: (action: KeybindingActionContribution) => Disposer;

package/dist/host/{PluginsTab-CM2B33BD.js → PluginsTab-MNQU5OJ3.js}

@@ -29,7 +29,7 @@ import {
   sortPlugins,
   uploadEntry,
   youtubeEmbedUrl
-} from "./chunk-ROB2SH5Q.js";
+} from "./chunk-C52NRTA6.js";
 import {
   Button,
   FakeSwitch,
@@ -37,7 +37,7 @@ import {
   PluginIcon,
   SectionCard,
   hasSettingsPage
-} from "./chunk-7J4QNGFM.js";
+} from "./chunk-IMPLAAUM.js";
 import {
   ArrowDownWideNarrow,
   BookOpen,
@@ -109,8 +109,8 @@ import {
   updatePlugin,
   uploadPlugin,
   useConfirm
-} from "./chunk-VKNGNEF3.js";
-import "./chunk-P26QKKU5.js";
+} from "./chunk-DN6YKMFJ.js";
+import "./chunk-6WLECSNB.js";
 import {
   __toESM,
   define_import_meta_env_default,

package/dist/host/{chunk-HQ6NNFSX.js → chunk-5W6F6GJJ.js}

@@ -3,7 +3,7 @@ import {
   hasPermission,
   resetPermissionsCache,
   usePermissions
-} from "./chunk-JRV2HIDK.js";
+} from "./chunk-GRH7GSKG.js";
 import {
   Columns2,
   KeyRound,
@@ -51,7 +51,7 @@ import {
   withIconBoundary,
   withPluginContext,
   withPluginScope
-} from "./chunk-VKNGNEF3.js";
+} from "./chunk-DN6YKMFJ.js";
 import {
   SYNC_CHANGED_EVENT,
   TRUST_TOKEN_KEY,
@@ -99,7 +99,7 @@ import {
   usePluginStore,
   useTabTypes,
   websocketAuthProtocols
-} from "./chunk-P26QKKU5.js";
+} from "./chunk-6WLECSNB.js";
 import {
   init_define_import_meta_env
 } from "./chunk-YGYBM7SQ.js";
@@ -2010,6 +2010,18 @@ var en_default = {
         title: "Send alerts",
         consequence: "To you or other users, and through the channels they set up."
       },
+      "operations:provide": {
+        title: "Offer actions",
+        consequence: "Its actions can be run from Automations, the CLI, the phone app and other places, by people allowed to use them."
+      },
+      "operations:invoke": {
+        title: "Run other plugins' actions",
+        consequence: "Acts for the signed-in user on the actions its manifest lists. Approval rules still apply."
+      },
+      "operations:approve": {
+        title: "Decide what needs approval",
+        consequence: "Can let actions run with no approval, or block them, for every user."
+      },
       "notify:hub": {
         title: "Receive every alert",
         consequence: "Stores and delivers the alerts all plugins send, including their contents."
@@ -3048,6 +3060,23 @@ function withProtocolSettings(pluginSettings, flags, list = listHostProtocols())
   return next;
 }
 
+// src/ui/shell/host-sections.ts
+init_define_import_meta_env();
+var sections2 = createRegistry(byOrderThenId);
+var registerHostSection = sections2.register;
+var useHostSections = sections2.useList;
+var listHostSections = sections2.list;
+var resetHostSections = sections2.reset;
+function hostSectionsFor(all, host) {
+  return all.filter((section) => {
+    try {
+      return section.when(host);
+    } catch {
+      return false;
+    }
+  });
+}
+
 // src/ui/dashboard/dashboard-cards-registry.ts
 init_define_import_meta_env();
 var registry3 = createRegistry();
@@ -3232,6 +3261,22 @@ function createPluginApi(pluginId) {
     }
   });
 }
+function createOperationsApi() {
+  return new Proxy(authApi, {
+    get(target, property, receiver) {
+      const value = Reflect.get(target, property, receiver);
+      if (typeof value !== "function") return value;
+      if (property === "get" || property === "delete" || property === "post" || property === "put" || property === "patch") {
+        return (url, ...rest) => value.call(
+          target,
+          `/operations${url.startsWith("/") ? url : `/${url}`}`,
+          ...rest
+        );
+      }
+      return value.bind(target);
+    }
+  });
+}
 function pluginFetch(pluginId, path2, init = {}) {
   const base = (authApi.defaults.baseURL ?? "").replace(/\/+$/, "");
   const headers = new Headers(init.headers);
@@ -8676,6 +8721,20 @@ function createPluginApp(pluginId, manifest, contributes, options = {}) {
         })
       );
     },
+    registerHostSection(section) {
+      return track(
+        registerHostSection({
+          id: section.id,
+          pluginId,
+          titleKey: key(section.titleKey),
+          order: section.order,
+          when: hostCallback(section.when ?? (() => true)),
+          component: scoped(
+            section.component
+          )
+        })
+      );
+    },
     registerHostContextMenuItem(item) {
       return track(
         registerHostContextMenuItem({
@@ -9084,6 +9143,11 @@ export {
   hostProtocolFlags,
   enabledHostProtocols,
   withProtocolSettings,
+  registerHostSection,
+  useHostSections,
+  listHostSections,
+  resetHostSections,
+  hostSectionsFor,
   registerDashboardCard,
   getRegisteredDashboardCard,
   registeredDashboardCardList,
@@ -9101,6 +9165,7 @@ export {
   registerSlotContribution,
   getSlotContributions,
   resetActionRegistry,
+  createOperationsApi,
   pluginWsUrl,
   PluginComponent,
   onboardingSteps,

package/dist/host/{chunk-P26QKKU5.js → chunk-6WLECSNB.js}

@@ -4691,6 +4691,8 @@ var DatabaseHealthMonitor = class _DatabaseHealthMonitor {
   static instance;
   listeners = /* @__PURE__ */ new Map();
   degradedActive = false;
+  probe = null;
+  probing = null;
   constructor() {
   }
   static getInstance() {
@@ -4729,10 +4731,28 @@ var DatabaseHealthMonitor = class _DatabaseHealthMonitor {
     const errorCode = errorLike.response?.data?.code || errorLike.code;
     const lowerMessage = errorMessage.toLowerCase();
     const isDatabaseError = lowerMessage.includes("database") || lowerMessage.includes("sqlite") || lowerMessage.includes("drizzle") || errorCode === "DATABASE_ERROR" || errorCode === "DB_CONNECTION_FAILED";
-    const isBackendUnreachable = errorCode === "ERR_NETWORK" || errorCode === "ECONNREFUSED" || errorCode === "ECONNABORTED" || errorCode === "ECONNRESET" || errorCode === "ETIMEDOUT" || errorCode === "ERR_CANCELED" || lowerMessage.includes("network error") && errorLike.response === void 0 || lowerMessage.includes("request aborted") || lowerMessage.includes("timeout");
-    if (!(isDatabaseError || isBackendUnreachable)) {
-      return;
+    if (errorCode === "ERR_CANCELED" || lowerMessage === "canceled") return;
+    const isBackendUnreachable = errorCode === "ERR_NETWORK" || errorCode === "ECONNREFUSED" || errorCode === "ECONNRESET" || lowerMessage.includes("network error") && errorLike.response === void 0;
+    const isTimeout = errorCode === "ECONNABORTED" || errorCode === "ETIMEDOUT" || lowerMessage.includes("request aborted") || lowerMessage.includes("timeout");
+    if (isDatabaseError || isBackendUnreachable) {
+      this.markDegraded(errorMessage, errorCode);
+    } else if (isTimeout) {
+      if (!this.probe) {
+        this.markDegraded(errorMessage, errorCode);
+        return;
+      }
+      this.probing ??= this.probe().catch(() => false).then((reachable) => {
+        if (!reachable) this.markDegraded(errorMessage, errorCode);
+      }).finally(() => {
+        this.probing = null;
+      });
     }
+  }
+  /** Sets the quick check used after a request times out. */
+  setReachabilityProbe(probe) {
+    this.probe = probe;
+  }
+  markDegraded(errorMessage, errorCode) {
     if (!this.degradedActive) {
       this.degradedActive = true;
       this.emit("database-connection-degraded", {
@@ -6320,7 +6340,7 @@ async function updateRole(roleId, roleData) {
   try {
     const response = await rbacApi.put(`/rbac/roles/${roleId}`, roleData);
     if (roleData.permissions) {
-      const { notifyPermissionsChanged } = await import("./use-permissions-EWRI3WLT.js");
+      const { notifyPermissionsChanged } = await import("./use-permissions-FLQAN6I7.js");
       notifyPermissionsChanged();
     }
     return response.data;
@@ -6927,7 +6947,7 @@ function createRemoteOriginApiInstance(path) {
   });
   instance.interceptors.request.use(
     async (config) => {
-      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-J5G457OA.js");
+      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-YCAJ2NX3.js");
       const linked = await getLinkedSession2();
       config.baseURL = linked ? `${linked.serverUrl}${path}` : "http://no-server-configured";
       if (config.headers.set) {
@@ -6954,6 +6974,16 @@ function initializeApiInstances() {
   hostApi = createApiInstance(getApiUrl("/host", 30001), "HOST");
   sshHostApi = hostApi;
   authApi = createApiInstance(getApiUrl("", 30001), "AUTH");
+  const healthApi = authApi;
+  dbHealthMonitor.setReachabilityProbe(
+    () => healthApi.get("/health", {
+      timeout: 5e3,
+      __silentRetry: true
+    }).then(
+      () => true,
+      () => false
+    )
+  );
   rbacApi = createApiInstance(getApiUrl("", 30001), "RBAC");
 }
 var hostApi;

package/dist/host/{chunk-ROB2SH5Q.js → chunk-C52NRTA6.js}

@@ -1,7 +1,7 @@
 const __termixNoGlob = () => ({});
 import {
   Button
-} from "./chunk-7J4QNGFM.js";
+} from "./chunk-IMPLAAUM.js";
 import {
   ChevronRight,
   PANEL,
@@ -10,10 +10,10 @@ import {
   cn,
   gridSizeStyle,
   useAreaPreferences
-} from "./chunk-VKNGNEF3.js";
+} from "./chunk-DN6YKMFJ.js";
 import {
   isElectron
-} from "./chunk-P26QKKU5.js";
+} from "./chunk-6WLECSNB.js";
 import {
   __commonJS,
   __toESM,
@@ -2429,6 +2429,8 @@ var CAPABILITY_CATALOG = [
   entry("ssh:transport", "high"),
   entry("device:serial", "high"),
   entry("notify:hub", "high"),
+  entry("operations:invoke", "high"),
+  entry("operations:approve", "high"),
   entry("ui:layout", "high"),
   entry("hosts:write", "medium"),
   entry("hosts:export", "high"),
@@ -2444,6 +2446,7 @@ var CAPABILITY_CATALOG = [
   entry("users:read", "medium"),
   entry("events:core", "medium"),
   entry("notify:send", "medium"),
+  entry("operations:provide", "medium"),
   entry("audit:read", "medium"),
   entry("desktop:window", "medium"),
   entry("desktop:local", "high"),
@@ -2540,8 +2543,9 @@ function mergePlugins(installed, registry) {
       latestBeta: entry2?.latestBeta ?? null,
       channel: summary.channel ?? entry2?.channel ?? "stable",
       isBeta: isPrerelease(summary.version),
-      // The server keeps its own copy up to date.
-      updateAvailable: summary.runsOnServer ? false : entry2?.updateAvailable ?? false,
+      // The server keeps its own copy up to date, and a plugin that is off
+      // should not ask for attention.
+      updateAvailable: summary.runsOnServer || !summary.enabled ? false : entry2?.updateAvailable ?? false,
       addedCapabilities: entry2?.addedCapabilities ?? [],
       versions: entry2?.versions ?? [],
       capabilities: summary.capabilities ?? [],

package/dist/host/{chunk-VKNGNEF3.js → chunk-DN6YKMFJ.js}

@@ -4,7 +4,7 @@ import {
   getPluginRecord,
   rbacApi,
   usePluginStore
-} from "./chunk-P26QKKU5.js";
+} from "./chunk-6WLECSNB.js";
 import {
   __export,
   init_define_import_meta_env

package/dist/host/{chunk-TK3Y437H.js → chunk-EKXGDM5P.js}

@@ -1,7 +1,7 @@
 const __termixNoGlob = () => ({});
 import {
   useTheme
-} from "./chunk-HQ6NNFSX.js";
+} from "./chunk-5W6F6GJJ.js";
 import {
   init_define_import_meta_env
 } from "./chunk-YGYBM7SQ.js";

package/dist/host/{chunk-JRV2HIDK.js → chunk-GRH7GSKG.js}

@@ -26,7 +26,7 @@ var inFlight = null;
 function load() {
   if (cache) return Promise.resolve(cache);
   if (inFlight) return inFlight;
-  inFlight = import("./rbac-api-PY22W5UY.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
+  inFlight = import("./rbac-api-A64TXDL5.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
     cache = {
       permissions: result.permissions ?? [],
       isAdmin: !!result.isAdmin

package/dist/host/{chunk-7J4QNGFM.js → chunk-IMPLAAUM.js}

@@ -9,7 +9,7 @@ import {
   icons_exports,
   isFieldActive,
   usePluginScope
-} from "./chunk-VKNGNEF3.js";
+} from "./chunk-DN6YKMFJ.js";
 import {
   init_define_import_meta_env
 } from "./chunk-YGYBM7SQ.js";