Shkarko Voltius 0.13.0

Added
- Simplified Chinese (简体中文) interface language, contributed by
@CoconutHR. Pick it under Appearance settings;
like every language, it syncs across your devices.
- Plugins: an update flow. Voltius now detects when an installed plugin has a
newer version, offers a one-click update, and asks you to re-consent if the
update declares permissions you had not already granted (#52).
- Plugins: bundle integrity. A plugin's bundle hash is verified on install and
recorded, plugins that cannot be verified carry an "unverified" badge, and
install failures are surfaced instead of failing quietly (#44).
- Plugins: new capabilities for plugin authors — session open/close lifecycle
verbs, a streaming http.stream verb backed by server-sent events, terminal
reading (snapshot and live stream), selection reading, and OS-keychain storage
for plugin secrets.
- Plugins: two new UI surfaces — a shell-level panel mount and a reusable
titlebar.right status-bar slot.
- Settings: plugin pages now appear as expandable children under the Plugins
nav entry rather than as flat top-level items, on both desktop and mobile.
- SFTP: a "Copy path" action in the file-row context menu on desktop (#62).
- Sync: an exclusion filter, so objects you exclude are stripped from outbound
sync on push, on pull merge, and from the gist-sync export path (#43, #47).
- Themes: Dracula and Monokai reworked with real elevation and text ramps
instead of flat approximations (#40, #60).
Fixed
- Terminal: the wheel and touchpad now scroll full-screen terminal apps (vim,
less, htop) instead of doing nothing, and Select-to-Copy is respected there
(#50).
- Team vaults: members who accepted an invitation while the vault owner was
offline could be left without a vault key and silently unable to decrypt.
Key distribution is now reconciled for those members (#41, #49).
- Audit log: the local per-vault log is capped, so a full quota can no longer
silently stop recording new entries.
- Settings: the About-page links and the update-download button now open.
- Themes: on-accent text now picks its colour at the WCAG 0.179 luminance
crossover, fixing low-contrast label text on some accent colours.
- Interface languages: corrected the Select-to-Copy setting description.
Security
- Plugins: the gated capability tier — reading, watching, and typing into your
terminal sessions, plus per-plugin keychain storage — is now grantable to
third-party marketplace plugins behind explicit, danger-styled install-time
consent. It was previously first-party-only. The install and update dialogs
now show every declared permission in plain language, with the powerful ones
called out in a separate warning block; a plugin that declares one always
prompts for consent, even when install review is turned off. Command injection
(sessions.sendCommand) moved from the public sessions:write permission to
a new gated terminal:write, split from terminal reading. Keychain storage is
now isolated per plugin (keys are namespaced plugin:<id>:), so one plugin can
no longer read or overwrite another's secrets. No installed plugin gains
anything without a fresh consent, and no shipped build exposed cross-plugin
keychain data. Side-loaded and locally-scanned plugins still load without a
consent prompt — writing to the plugins folder already implies full app
privileges — so only install a local bundle you trust.
- Updated the bundled quinn-proto dependency to 0.11.15, picking up the fix
for GHSA-4w2j-m93h-cj5j (#82).