@termix-ssh/plugin-sdk 1.0.9 → 1.0.11

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.0.11
+
+Plugin API 1.3.0.
+
+### Added
+
+- `ctx.auth.issueUserToken()` mints a short-lived session for a user, for calling Termix's own API as them from background work. Needs `users:impersonate` and `engine.api` 1.3
+- `ctx.users.getLocale()` reads a user's UI language. Needs `users:read` and `engine.api` 1.3
+
+## 1.0.10
+
+### Changed
+
+- `termix-plugin pack` includes the plugin's `LICENSE` and `NOTICE` files, so third-party notices ship with it
+
 ## 1.0.9
 
 ### Added

package/PLUGIN-GUIDE.md

@@ -1,6 +1,6 @@
 # Termix plugin guide
 
-SDK 1.0.9 | Plugin API 1.2.0
+SDK 1.0.11 | Plugin API 1.3.0
 
 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
@@ -90,7 +90,7 @@ npm test             # termix-plugin test: Vitest
 npm run typecheck    # tsc
 npm run validate     # termix-plugin validate: manifest, files, migrations, changelog, docs
 npm run migrations   # termix-plugin migrations: write migrations after changing tables.ts
-npm run pack         # termix-plugin pack: write <id>-<version>.tmxplug
+npm run pack         # termix-plugin pack: write <id>-<version>.tmxplug (with LICENSE and NOTICE)
 npm run format       # Prettier
 npm run format:check
 ```
@@ -105,7 +105,7 @@ Before you call a change finished:
 - [ ] `npm run build` passes
 - [ ] `npm run format:check` passes
 - [ ] `npx termix-plugin migrations --check` passes (you ran `npm run migrations` after changing tables)
-- [ ] New strings are in `locales/en.json`
+- [ ] New strings are in `locales/en.json`, and `plugin.name` / `plugin.description` match the manifest
 - [ ] New routes have an `@openapi` block and a test, including without the permission
 - [ ] New env vars are listed in `env` in the manifest
 - [ ] `docs/` and the "About this plugin" section of `AGENTS.md` still match what the plugin does
@@ -225,6 +225,8 @@ Bundled as ESM for Node 22+ into `dist/backend.js`. Backend imports of your own
 | `audit.record`         | none                             | Write your own audit line                                      |
 | `sync`                 | none                             | Sync your tables to a linked desktop                           |
 | `auth`                 | `auth:provide`                   | Login methods, second factors, SSH auth types                  |
+| `auth.issueUserToken`  | `users:impersonate`              | A short-lived session for calling Termix's API as a user       |
+| `users.getLocale`      | `users:read`                     | A user's UI language                                           |
 | `system`               | `system:tls`                     | The server's HTTPS certificate                                 |
 | `plugins.list()`       | `plugins:read`                   | Which plugins are installed                                    |
 | `asUser(userId, fn)`   | always audited                   | Run background work as a user                                  |
@@ -237,6 +239,13 @@ In a route the actor is the signed-in user, set by Termix. `ctx.currentActor()`
 work with no request (a timer, an event) uses `ctx.asUser(userId, fn)`, which is audited and still applies
 that user's permissions.
 
+Background work that must call Termix's own HTTP API (the Termix CLI, say) asks for a session with
+`ctx.auth.issueUserToken(userId, { purpose, ttlSeconds })` and sends it as `Authorization: Bearer <token>`.
+It needs `users:impersonate` and `engine.api` `^1.3`, lasts 300 seconds by default and 900 at most, and is
+audited as `plugin_user_token_issued`. The user's permissions apply, and it is refused on routes that change
+their password, second factors, API keys or linked logins. `ctx.users.getLocale(userId)` gives the user's
+UI language, like `zh_CN`, or null, for writing to them in it.
+
 ### Routes
 
 Routes live at `/plugin-api/<id>/`, sockets at `/plugin-ws/<id>/`, on the main Termix port. You never need
@@ -484,7 +493,7 @@ your own host settings, under `host.pluginSettings[<id>]`.
 
 Slots you can fill include `terminal.toolbar`, `terminal.toolbarStatus`, `terminal.sidePanel`,
 `terminal.overlay`, `dashboard.counters`, `dashboard.hostMetrics`, `admin.userTabs`, `hosts.importMenu`,
-`hosts.panel`, `credentials.badges`, `shell.overlay` and `tab.menu`. See
+`hosts.panel`, `credentials.badges`, `shell.overlay`, `shell.rightEdge` and `tab.menu`. See
 https://docs.termix.site/develop/more-extension-points.
 
 ## Looking native
@@ -538,6 +547,20 @@ Plurals use `_one` and `_other` with `t("hosts", { count })`. Other languages go
 `locales/translated/<code>.json` (like `de_DE.json`) with the same keys. Keep `{{placeholders}}` as they are.
 Untranslated strings show in English.
 
+Termix shows your plugin's name and description in the plugin manager, the setup picker and settings.
+Put them in `locales/en.json` as `plugin.name` and `plugin.description`, with the same text as `name` and
+`description` in the manifest, so they get translated too. Without them, the English manifest text shows in
+every language.
+
+```json
+{
+  "plugin": {
+    "name": "Host Metrics",
+    "description": "Live CPU, memory, disk, network and GPU stats."
+  }
+}
+```
+
 ## Docs
 
 `docs/index.md` is the first page: what the plugin does in a sentence or two, how to turn it on, how to use
@@ -740,37 +763,37 @@ To run your own registry instead, see https://docs.termix.site/develop/registrie
 
 ## Capabilities
 
-| Capability           | Risk     | What it allows                                         |
-| -------------------- | -------- | ------------------------------------------------------ |
-| `credentials:read`   | critical | Read stored secrets for hosts the user can reach       |
-| `system:tls`         | critical | Replace the HTTPS certificate, answer CA domain checks |
-| `ssh:connect`        | high     | Run any command on hosts, with the user's access       |
-| `process:spawn`      | high     | Run programs on the Termix server                      |
-| `users:write`        | high     | Add users and change their roles                       |
-| `users:impersonate`  | high     | Run background work as another user, audited           |
-| `db:core-refs`       | high     | Query core users, roles and hosts tables (read only)   |
-| `auth:provide`       | high     | Add login methods, second factors, SSH auth types      |
-| `device:serial`      | high     | Open serial and USB ports on the server                |
-| `notify:hub`         | high     | Receive every alert (the alerts hub only)              |
-| `hosts:write`        | medium   | Add and edit hosts                                     |
-| `credentials:use`    | medium   | Connect with saved credentials without seeing them     |
-| `credentials:write`  | medium   | Save new credentials                                   |
-| `network:outbound`   | medium   | Outbound HTTP through `ctx.fetch`                      |
-| `network:serve`      | medium   | HTTP routes and sockets                                |
-| `network:broadcast`  | medium   | Local network broadcasts, like Wake-on-LAN             |
-| `users:read`         | medium   | Usernames and roles                                    |
-| `events:core`        | medium   | Listen to core events                                  |
-| `notify:send`        | medium   | Send alerts                                            |
-| `audit:read`         | medium   | Read the audit log                                     |
-| `desktop:window`     | medium   | Open windows in the desktop app                        |
-| `hosts:read`         | low      | Read hosts the user can see                            |
-| `db:own`             | low      | Your own tables                                        |
-| `kv:own`             | low      | Small key value state                                  |
-| `files:own`          | low      | Your own folder on disk                                |
-| `secrets:own`        | low      | Your own encrypted secrets                             |
-| `settings:read-core` | low      | Read Termix server settings                            |
-| `plugins:read`       | low      | See installed plugins                                  |
-| `ui:surface`         | low      | Add tabs, panels and settings                          |
+| Capability           | Risk     | What it allows                                          |
+| -------------------- | -------- | ------------------------------------------------------- |
+| `credentials:read`   | critical | Read stored secrets for hosts the user can reach        |
+| `system:tls`         | critical | Replace the HTTPS certificate, answer CA domain checks  |
+| `ssh:connect`        | high     | Run any command on hosts, with the user's access        |
+| `process:spawn`      | high     | Run programs on the Termix server                       |
+| `users:write`        | high     | Add users and change their roles                        |
+| `users:impersonate`  | high     | Act as another user, or get a session for them, audited |
+| `db:core-refs`       | high     | Query core users, roles and hosts tables (read only)    |
+| `auth:provide`       | high     | Add login methods, second factors, SSH auth types       |
+| `device:serial`      | high     | Open serial and USB ports on the server                 |
+| `notify:hub`         | high     | Receive every alert (the alerts hub only)               |
+| `hosts:write`        | medium   | Add and edit hosts                                      |
+| `credentials:use`    | medium   | Connect with saved credentials without seeing them      |
+| `credentials:write`  | medium   | Save new credentials                                    |
+| `network:outbound`   | medium   | Outbound HTTP through `ctx.fetch`                       |
+| `network:serve`      | medium   | HTTP routes and sockets                                 |
+| `network:broadcast`  | medium   | Local network broadcasts, like Wake-on-LAN              |
+| `users:read`         | medium   | Usernames, roles and UI language                        |
+| `events:core`        | medium   | Listen to core events                                   |
+| `notify:send`        | medium   | Send alerts                                             |
+| `audit:read`         | medium   | Read the audit log                                      |
+| `desktop:window`     | medium   | Open windows in the desktop app                         |
+| `hosts:read`         | low      | Read hosts the user can see                             |
+| `db:own`             | low      | Your own tables                                         |
+| `kv:own`             | low      | Small key value state                                   |
+| `files:own`          | low      | Your own folder on disk                                 |
+| `secrets:own`        | low      | Your own encrypted secrets                              |
+| `settings:read-core` | low      | Read Termix server settings                             |
+| `plugins:read`       | low      | See installed plugins                                   |
+| `ui:surface`         | low      | Add tabs, panels and settings                           |
 
 An update that adds a capability waits for an admin to approve it.
 

package/cli/lib/tmxplug.mjs

@@ -11,6 +11,9 @@ export const TMXPLUG_CONTENTS = [
   "README.md",
   "CHANGELOG.md",
   "icon.svg",
+  // Licence texts, so third-party notices travel with the plugin.
+  "LICENSE",
+  "NOTICE",
 ];
 
 const BLOCK = 512;

package/dist/backend.d.ts

@@ -1223,6 +1223,18 @@ export interface PluginSecondFactor {
     /** Removes the user's enrolment. Called by the admin reset. */
     reset?: (userId: string) => Promise<void>;
 }
+export interface PluginUserTokenOptions {
+    /** Why the token exists, kept in the audit log and on the session. */
+    purpose: string;
+    /** Seconds until it expires. Defaults to 300 and is capped at 900. */
+    ttlSeconds?: number;
+}
+export interface PluginUserToken {
+    /** Send as `Authorization: Bearer <token>` to core's own API. */
+    token: string;
+    /** ISO time the session ends. */
+    expiresAt: string;
+}
 /**
  * Login methods, second factors and SSH auth types. Every register call needs
  * auth:provide and a matching contributes.auth entry, and is undone on
@@ -1278,6 +1290,22 @@ export interface PluginAuth {
      * delete a provider people still sign in with.
      */
     countLinkedUsers: (provider: string) => Promise<number>;
+    /**
+     * A short-lived session for an existing user, for calling core's own HTTP
+     * API as them from work with no request behind it, like a scheduled task
+     * driving the Termix CLI. The user's RBAC applies unchanged. Needs
+     * users:impersonate, not auth:provide, and every call is audited.
+     *
+     * The session is marked with the plugin and purpose. It cannot change the
+     * user's password, second factors, API keys or linked logins, so it can
+     * never outlive itself.
+     */
+    issueUserToken: (userId: string, options: PluginUserTokenOptions) => Promise<PluginUserToken>;
+}
+/** What a plugin may learn about a user. Needs users:read. */
+export interface PluginUsers {
+    /** The user's UI language, like "zh_CN", or null when they never chose one. */
+    getLocale: (userId: string) => Promise<string | null>;
 }
 export interface PluginOpenIsolatedWindowRequest {
     /** http(s) only. Refused when it points anywhere else. */
@@ -1738,8 +1766,13 @@ export interface PluginContext {
     readonly hosts: PluginHosts;
     /** SSH through core's connect pipeline. Needs ssh:connect and credentials:use. */
     readonly ssh: PluginSsh;
-    /** Login methods, second factors and SSH auth types. Needs auth:provide. */
+    /**
+     * Login methods, second factors and SSH auth types. Needs auth:provide,
+     * except issueUserToken, which needs users:impersonate.
+     */
     readonly auth: PluginAuth;
+    /** What a plugin may learn about a user. Needs users:read. */
+    readonly users: PluginUsers;
     /** Opens Electron windows outside the main renderer. Needs desktop:window. */
     readonly desktop: PluginDesktop;
     /** Host protocol credentials and the user's saved SSH keys. See PluginCredentials. */
@@ -1763,8 +1796,9 @@ export interface PluginContext {
      * no request behind it. Always audited, and every core API inside still
      * applies that user's RBAC.
      *
-     * Needs users:impersonate. That and a `userId` option on services.get or
-     * secrets.getShared are the only ways a plugin can name a user.
+     * Needs users:impersonate. That, auth.issueUserToken and a `userId` option
+     * on services.get or secrets.getShared are the only ways a plugin can act
+     * as a user it names.
      */
     asUser: <T>(userId: string, fn: () => Promise<T> | T) => Promise<T>;
     /** The acting user for the current call, when there is one. */

package/dist/host/{chunk-NZG6HNQH.js → chunk-7RRTYD6B.js}

@@ -13,6 +13,12 @@ function isElectron() {
   const isElectronProp = win.electronAPI?.isElectron === true;
   return hasISElectron || hasElectronAPI || isElectronProp;
 }
+var DEFAULT_LOCAL_BACKEND_PORT = 30001;
+function localBackendPort() {
+  if (typeof window === "undefined") return DEFAULT_LOCAL_BACKEND_PORT;
+  const port = window.electronAPI?.backendPort;
+  return typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : DEFAULT_LOCAL_BACKEND_PORT;
+}
 
 // src/ui/lib/error-message.ts
 function getErrorMessage(error, fallback = "Unknown error") {
@@ -5038,7 +5044,7 @@ async function updateRole(roleId, roleData) {
   try {
     const response = await rbacApi.put(`/rbac/roles/${roleId}`, roleData);
     if (roleData.permissions) {
-      const { notifyPermissionsChanged } = await import("./use-permissions-2P2TP6GY.js");
+      const { notifyPermissionsChanged } = await import("./use-permissions-GYCBY2AU.js");
       notifyPermissionsChanged();
     }
     return response.data;
@@ -5575,7 +5581,7 @@ function getApiUrl(path, defaultPort) {
   const devMode = isDev();
   const electronMode = isElectron();
   if (electronMode) {
-    return `http://localhost:${defaultPort}${path}`;
+    return `http://localhost:${localBackendPort()}${path}`;
   } else if (devMode) {
     if (!define_import_meta_env_default.VITE_API_HOST) {
       return `/__termix_api/${defaultPort}${path}`;
@@ -5595,7 +5601,7 @@ function createRemoteOriginApiInstance(path) {
   });
   instance.interceptors.request.use(
     async (config) => {
-      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-QAKKDBFM.js");
+      const { getLinkedSession: getLinkedSession2 } = await import("./linked-server-UCW74T2V.js");
       const linked = await getLinkedSession2();
       config.baseURL = linked ? `${linked.serverUrl}${path}` : "http://no-server-configured";
       if (config.headers.set) {
@@ -5958,6 +5964,7 @@ export {
   getPluginRecord,
   knownPluginIds,
   isElectron,
+  localBackendPort,
   createRegistry,
   byOrderThenId,
   manifestDeclares,

package/dist/host/{chunk-DIOJ3KW2.js → chunk-LSWB3ZZV.js}

@@ -21,7 +21,7 @@ var inFlight = null;
 function load() {
   if (cache) return Promise.resolve(cache);
   if (inFlight) return inFlight;
-  inFlight = import("./rbac-api-5267EMX7.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
+  inFlight = import("./rbac-api-6UYMFIFV.js").then(({ getMyPermissions }) => getMyPermissions()).then((result) => {
     cache = {
       permissions: result.permissions ?? [],
       isAdmin: !!result.isAdmin

package/dist/host/{chunk-G346FUE4.js → chunk-RLQBKJRK.js}

@@ -2,7 +2,7 @@ const __termixNoGlob = () => ({});
 import {
   hasPermission,
   usePermissions
-} from "./chunk-DIOJ3KW2.js";
+} from "./chunk-LSWB3ZZV.js";
 import {
   PRESETS,
   SYNC_CHANGED_EVENT,
@@ -25,6 +25,7 @@ import {
   handleApiError,
   isElectron,
   knownPluginIds,
+  localBackendPort,
   logActivity,
   manifestDeclares,
   markUserAuthenticated,
@@ -39,7 +40,7 @@ import {
   usePluginStore,
   useTabTypes,
   websocketAuthProtocols
-} from "./chunk-NZG6HNQH.js";
+} from "./chunk-7RRTYD6B.js";
 import {
   __export,
   define_import_meta_env_default
@@ -49078,6 +49079,17 @@ function scopeHostCallback(fn, pluginId) {
 
 // src/ui/plugin-host/scope.tsx
 import { useTranslation } from "react-i18next";
+
+// src/ui/lib/plugin-i18n.ts
+function pluginKey(pluginId, key) {
+  if (!key) return key;
+  return key.includes(":") ? key : `${pluginId}:${key}`;
+}
+function pluginName(t, plugin) {
+  return t(pluginKey(plugin.id, "plugin.name"), { defaultValue: plugin.name });
+}
+
+// src/ui/plugin-host/scope.tsx
 import { jsx as jsx29, jsxs as jsxs7 } from "react/jsx-runtime";
 var PluginScopeContext = createContext6(null);
 function usePluginScope() {
@@ -49088,7 +49100,8 @@ function CrashNotice({
   onRetry
 }) {
   const { t } = useTranslation();
-  const name = getPluginRecord(pluginId)?.summary.name ?? pluginId;
+  const summary = getPluginRecord(pluginId)?.summary;
+  const name = summary ? pluginName(t, summary) : pluginId;
   return /* @__PURE__ */ jsxs7("div", { className: "flex flex-col items-center justify-center gap-2 p-4 text-center text-sm text-muted-foreground", children: [
     /* @__PURE__ */ jsx29("span", { children: t("plugins.runtime.crashed", { name }) }),
     /* @__PURE__ */ jsx29(
@@ -53579,7 +53592,7 @@ async function pluginWsUrl(pluginId, path2, options2 = {}) {
   if (isElectron()) {
     return buildOriginWsUrl({
       origin: options2.origin ?? "local",
-      localPort: BACKEND_PORT,
+      localPort: localBackendPort(),
       localPath: route,
       remotePath: route
     });
@@ -54432,12 +54445,6 @@ function onRemoteServerChange(listener) {
   return () => window.removeEventListener(SYNC_CHANGED_EVENT, handler);
 }
 
-// src/ui/lib/plugin-i18n.ts
-function pluginKey(pluginId, key) {
-  if (!key) return key;
-  return key.includes(":") ? key : `${pluginId}:${key}`;
-}
-
 // src/ui/plugin-host/app.ts
 var ONBOARDING_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function createDocsApi(manifest) {
@@ -54973,7 +54980,7 @@ function PluginViewPlaceholder({
   usePluginStore();
   const { has } = usePermissions();
   const { status, owner } = unregisteredViewStatus(kind, viewId);
-  const name = owner?.summary.name ?? viewId;
+  const name = owner ? pluginName(t, owner.summary) : viewId;
   if (status === "loading") {
     return /* @__PURE__ */ jsx39(
       "div",
@@ -55101,6 +55108,8 @@ export {
   setShellHosts,
   notifyShellReady,
   resetShellBridge,
+  pluginKey,
+  pluginName,
   usePluginScope,
   DocsLink,
   PANEL,
@@ -55177,7 +55186,6 @@ export {
   installPluginHostBridge,
   setRemoteServerUrlForTesting,
   remoteServerUrl,
-  pluginKey,
   createPluginApp,
   ActionSlot,
   ComponentSlot,

package/dist/host/{linked-server-QAKKDBFM.js → linked-server-UCW74T2V.js}

@@ -3,7 +3,7 @@ import {
   SYNC_CHANGED_EVENT,
   getLinkedSession,
   notifySyncChanged
-} from "./chunk-NZG6HNQH.js";
+} from "./chunk-7RRTYD6B.js";
 import "./chunk-YC2MAKSP.js";
 export {
   SYNC_CHANGED_EVENT,

package/dist/host/{rbac-api-5267EMX7.js → rbac-api-6UYMFIFV.js}

@@ -23,7 +23,7 @@ import {
   shareHost,
   updateHostAccess,
   updateRole
-} from "./chunk-NZG6HNQH.js";
+} from "./chunk-7RRTYD6B.js";
 import "./chunk-YC2MAKSP.js";
 export {
   assignRoleToUser,

package/dist/host/testing-host.js

@@ -40,16 +40,16 @@ import {
   setShellCallbacks,
   setShellHosts,
   setShellLayoutProvider
-} from "./chunk-G346FUE4.js";
+} from "./chunk-RLQBKJRK.js";
 import {
   setPermissionsForTesting
-} from "./chunk-DIOJ3KW2.js";
+} from "./chunk-LSWB3ZZV.js";
 import {
   getTabType,
   listTabTypes,
   setFrontendState,
   setPluginSummaries
-} from "./chunk-NZG6HNQH.js";
+} from "./chunk-7RRTYD6B.js";
 import "./chunk-YC2MAKSP.js";
 
 // src/ui/plugin-host/testing-host.tsx

package/dist/host/types/src/ui/lib/connection-origin.d.ts

@@ -14,11 +14,10 @@ interface OriginResolvableHost {
  * the desktop-wide default.
  *
  * `defaultRemote` makes a host left on Default resolve to "remote" instead of
- * following the desktop-wide setting. Remote desktop passes it: it needs a
- * guacd, which the desktop does not ship, so originating it here only works
- * once the user has pointed Termix at one of their own. Making that opt-in
- * per host keeps an upgrade from moving working connections onto a guacd
- * that isn't there -- see Termix-SSH/Support#1240.
+ * following the desktop-wide setting. Remote desktop passes it when this
+ * desktop is set to use an external guacd, so a host is not moved onto a
+ * guacd that isn't there (see Termix-SSH/Support#1240). With the built-in
+ * engine it runs locally like SSH.
  */
 export declare function resolveConnectionOrigin(host: OriginResolvableHost, options?: {
     defaultRemote?: boolean;

package/dist/host/types/src/ui/lib/electron.d.ts

@@ -1 +1,6 @@
 export declare function isElectron(): boolean;
+/**
+ * The port of the desktop app's embedded backend. It moves off 30001 when
+ * another program holds that port.
+ */
+export declare function localBackendPort(): number;

package/dist/host/types/src/ui/lib/plugin-i18n.d.ts

@@ -1,3 +1,4 @@
+import type { TFunction } from "i18next";
 /**
  * Where a plugin's i18n keys resolve from.
  *
@@ -9,3 +10,17 @@
  */
 export declare function pluginKey(pluginId: string, key: string): string;
 export declare function pluginKey(pluginId: string, key: string | undefined): string | undefined;
+/**
+ * A plugin's name in the UI language: "plugin.name" from its own locales,
+ * else the manifest's. A plugin whose strings are not loaded, like one only
+ * listed in a registry, shows the manifest name.
+ */
+export declare function pluginName(t: TFunction, plugin: {
+    id: string;
+    name: string;
+}): string;
+/** Same as pluginName, for "plugin.description". */
+export declare function pluginDescription(t: TFunction, plugin: {
+    id: string;
+    description?: string | null;
+}): string;

package/dist/host/types/src/ui/sidebar/HostManagerTabs.d.ts

@@ -34,7 +34,7 @@ export interface HostEditorSectionDef {
     pluginId?: string;
     group: "top" | "ssh";
     labelKey: string;
-    /** Already-translated label, used instead of labelKey when set. */
+    /** Shown when labelKey has no translation. */
     label?: string;
     icon?: ComponentType<{
         className?: string;
@@ -59,7 +59,13 @@ export declare function isSshGroupTab(id: string): boolean;
  * The main strip. With `protocols`, registered tabs are filtered by their
  * `visible`; without, every registered top tab is listed.
  */
-export declare function makeHostTabs(t: (key: string) => string, protocols?: Record<string, boolean>, defaultsMode?: boolean): HostTab[];
-export declare function makeHostSshSubTabs(t: (key: string) => string, protocols?: Record<string, boolean>, defaultsMode?: boolean): HostTab[];
-export declare function makeCredentialTabs(t: (key: string) => string): CredentialTab[];
+export declare function makeHostTabs(t: (key: string, options?: {
+    defaultValue?: string;
+}) => string, protocols?: Record<string, boolean>, defaultsMode?: boolean): HostTab[];
+export declare function makeHostSshSubTabs(t: (key: string, options?: {
+    defaultValue?: string;
+}) => string, protocols?: Record<string, boolean>, defaultsMode?: boolean): HostTab[];
+export declare function makeCredentialTabs(t: (key: string, options?: {
+    defaultValue?: string;
+}) => string): CredentialTab[];
 export { TabStrip } from "../components/tab-strip";

package/dist/host/ui.js

@@ -120,6 +120,7 @@ import {
   isRedactedSecret,
   normalizeLanguageCode,
   pluginKey,
+  pluginName,
   pluginWsUrl,
   registerHostEditorSection,
   rememberLoginLanguage,
@@ -139,8 +140,8 @@ import {
   useSurfaceKind,
   useTheme,
   verifySecondFactor
-} from "./chunk-G346FUE4.js";
-import "./chunk-DIOJ3KW2.js";
+} from "./chunk-RLQBKJRK.js";
+import "./chunk-LSWB3ZZV.js";
 import {
   TabProvider,
   buildOriginWsUrl,
@@ -179,7 +180,7 @@ import {
   useTabs,
   useTabsSafe,
   verifyPasswordResetCode
-} from "./chunk-NZG6HNQH.js";
+} from "./chunk-7RRTYD6B.js";
 import "./chunk-YC2MAKSP.js";
 
 // src/ui/components/alert.tsx
@@ -3852,11 +3853,13 @@ function HostPluginSection({
   return /* @__PURE__ */ jsxs24(
     SectionCard,
     {
-      title: plugin.name,
+      title: pluginName(t2, plugin),
       icon: /* @__PURE__ */ jsx36(PluginIcon, { name: plugin.icon, className: "size-3.5" }),
       action: /* @__PURE__ */ jsx36(DocsLink, { href: plugin.docs }),
       children: [
-        !running && /* @__PURE__ */ jsx36("div", { className: "my-3 border border-warning/40 bg-warning/10 px-3 py-2 text-xs text-warning", children: t2("settings.featureUnavailable", { name: plugin.name }) }),
+        !running && /* @__PURE__ */ jsx36("div", { className: "my-3 border border-warning/40 bg-warning/10 px-3 py-2 text-xs text-warning", children: t2("settings.featureUnavailable", {
+          name: pluginName(t2, plugin)
+        }) }),
         enableKey && /* @__PURE__ */ jsx36(
           SettingsFieldRow,
           {
@@ -4164,7 +4167,7 @@ function syncHostFeatureTabs(plugins) {
       pluginId: plugin.id,
       group: placement?.group ?? host.editorGroup ?? "top",
       order: placement?.order ?? host.editorOrder ?? 100,
-      labelKey: plugin.name,
+      labelKey: pluginKey(plugin.id, "plugin.name"),
       label: plugin.name,
       // Nothing but the plugin's host settings, so it works for defaults too.
       defaults: ownSections.has(plugin.id) ? "only" : true,

package/dist/host/{use-permissions-2P2TP6GY.js → use-permissions-GYCBY2AU.js}

@@ -7,7 +7,7 @@ import {
   resetPermissionsCache,
   setPermissionsForTesting,
   usePermissions
-} from "./chunk-DIOJ3KW2.js";
+} from "./chunk-LSWB3ZZV.js";
 import "./chunk-YC2MAKSP.js";
 export {
   hasPermission,

package/dist/manifest.d.ts

@@ -19,7 +19,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export declare const PLUGIN_API_VERSION = "1.2.0";
+export declare const PLUGIN_API_VERSION = "1.3.0";
 /** The API major, the default engine.api for a new plugin. */
 export declare const SUPPORTED_PLUGIN_API_VERSION: string;
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/manifest.js

@@ -21,7 +21,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.2.0";
+export const PLUGIN_API_VERSION = "1.3.0";
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(semver.major(PLUGIN_API_VERSION));
 /** Whether this build's plugin API satisfies a manifest's engine.api. */

package/dist/testing.d.ts

@@ -112,6 +112,8 @@ export interface FakeContextOptions {
     linkedUsers?: Record<string, number>;
     /** Failures before ctx.auth.loginRateLimit locks a key. Defaults to 5. */
     loginAttemptLimit?: number;
+    /** What ctx.users.getLocale answers, by user id. A missing user answers null. */
+    locales?: Record<string, string>;
 }
 export interface FakeProcessOptions {
     run?: (file: string, args: readonly string[], options?: PluginProcessOptions) => PluginProcessHandle | Promise<PluginProcessHandle>;
@@ -147,6 +149,12 @@ export interface FakeAuthRegistrations {
     }>;
     /** Failures recorded through ctx.auth.loginRateLimit, by "<ip>|<key>". */
     loginFailures: Map<string, number>;
+    /** Every ctx.auth.issueUserToken call, in order. */
+    userTokens: Array<{
+        userId: string;
+        purpose: string;
+        ttlSeconds?: number;
+    }>;
 }
 export interface FakePluginContext {
     ctx: PluginContext;
@@ -363,6 +371,8 @@ export interface MockContextOptions {
     linkedUsers?: Record<string, number>;
     /** See FakeContextOptions. */
     loginAttemptLimit?: number;
+    /** See FakeContextOptions. */
+    locales?: Record<string, string>;
 }
 export interface MockPluginContext extends FakePluginContext {
     /** Capability ids checked during the test, in order, denied ones included. */
@@ -377,7 +387,8 @@ export interface MockPluginContext extends FakePluginContext {
  * topic outside the plugin's own namespace, settings:read-core on
  * ctx.settings.readCore, ssh:connect plus credentials:use on ctx.ssh,
  * notify:send on ctx.notify (notify:hub on serve), network:outbound on ctx.fetch, process:spawn on
- * ctx.process, system:tls on ctx.system, plugins:read on ctx.plugins, and auth:provide on ctx.auth. Reading a plugin's own settings is deliberately
+ * ctx.process, system:tls on ctx.system, plugins:read on ctx.plugins, auth:provide on ctx.auth
+ * (users:impersonate on issueUserToken), and users:read on ctx.users. Reading a plugin's own settings is deliberately
  * ungated. As the SDK grows a member, add its gate here in the same shape.
  */
 export declare function createMockCtx(options?: MockContextOptions): MockPluginContext;

package/dist/testing.js

@@ -194,6 +194,7 @@ export function createFakeContext(options = {}) {
         completedLogins: [],
         revokedSessions: [],
         loginFailures: new Map(),
+        userTokens: [],
     };
     const sshClient = options.sshClient ?? {};
     let actor = options.actor;
@@ -673,6 +674,17 @@ export function createFakeContext(options = {}) {
                 },
             },
             countLinkedUsers: async (provider) => options.linkedUsers?.[provider] ?? 0,
+            issueUserToken: async (userId, tokenOptions) => {
+                auth.userTokens.push({ userId, ...tokenOptions });
+                const ttl = Math.min(tokenOptions.ttlSeconds ?? 300, 900);
+                return {
+                    token: `fake-token-${auth.userTokens.length}`,
+                    expiresAt: new Date(Date.now() + ttl * 1000).toISOString(),
+                };
+            },
+        },
+        users: {
+            getLocale: async (userId) => options.locales?.[userId] ?? null,
         },
         desktop: {
             openIsolatedWindow: async (request) => {
@@ -914,7 +926,8 @@ export function createFakeContext(options = {}) {
  * topic outside the plugin's own namespace, settings:read-core on
  * ctx.settings.readCore, ssh:connect plus credentials:use on ctx.ssh,
  * notify:send on ctx.notify (notify:hub on serve), network:outbound on ctx.fetch, process:spawn on
- * ctx.process, system:tls on ctx.system, plugins:read on ctx.plugins, and auth:provide on ctx.auth. Reading a plugin's own settings is deliberately
+ * ctx.process, system:tls on ctx.system, plugins:read on ctx.plugins, auth:provide on ctx.auth
+ * (users:impersonate on issueUserToken), and users:read on ctx.users. Reading a plugin's own settings is deliberately
  * ungated. As the SDK grows a member, add its gate here in the same shape.
  */
 export function createMockCtx(options = {}) {
@@ -948,6 +961,7 @@ export function createMockCtx(options = {}) {
         baseUrl: options.baseUrl,
         linkedUsers: options.linkedUsers,
         loginAttemptLimit: options.loginAttemptLimit,
+        locales: options.locales,
         manifest: {
             capabilities: options.capabilities ?? [],
             ...options.manifest,
@@ -1218,6 +1232,16 @@ export function createMockCtx(options = {}) {
                 require("auth:provide");
                 return ctx.auth.countLinkedUsers(provider);
             },
+            issueUserToken: async (userId, tokenOptions) => {
+                require("users:impersonate");
+                return ctx.auth.issueUserToken(userId, tokenOptions);
+            },
+        },
+        users: {
+            getLocale: async (userId) => {
+                require("users:read");
+                return ctx.users.getLocale(userId);
+            },
         },
         desktop: {
             openIsolatedWindow: async (request) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {