feat(plugins): show installed state in marketplace and stream install tasks

- report download progress (bytes, speed) and human-readable install stages
  from the plugin runtime connector via the install task context
- add a marketplace installed-state helper so market cards reflect whether a
  plugin is already installed
- surface install progress / queue state in the plugin install-task UI
- extend BackendClient and API entities with install-task status
- i18n for the new marketplace / install strings

src/langbot/pkg/api/http/controller/groups/user.py

@@ -1,10 +1,3 @@
-"""Account, authentication, passkey and TOTP HTTP routes.
-
-Exposes the unauthenticated login/recovery surface as well as the authenticated
-account-management, passkey (WebAuthn) and TOTP second-factor endpoints under
-``/api/v1/user``.
-"""
-
 from __future__ import annotations
 
 import quart
@@ -22,7 +15,6 @@ from .....entity.errors import account as account_errors
 from ...context import RequestContext
 from .....cloud.launch import SpaceLaunchError
 from ...service.user import ControlPlaneDirectoryRequiredError, PublicRegistrationClosedError
-from ...service.totp import TotpAlreadyEnabledError, TotpInvalidCodeError, TotpNotEnabledError
 
 # Fixed-window admission quota for the unauthenticated reset-password endpoint (#2392).
 # The admission check and slot bump share ONE synchronous critical section with no await
@@ -54,10 +46,7 @@ def _admit_reset_attempt(now: float) -> bool:
 
 @group.group_class('user', '/api/v1/user')
 class UserRouterGroup(group.RouterGroup):
-    """``/api/v1/user`` routes for accounts, auth, passkeys and TOTP."""
-
     def _validate_space_redirect_uri(self, redirect_uri: str, *, bind: bool) -> str:
-        """Validate a Space OAuth redirect URI against the expected callback shape."""
         parsed = urlsplit(redirect_uri)
         if (
             parsed.scheme not in {'http', 'https'}
@@ -78,11 +67,7 @@ class UserRouterGroup(group.RouterGroup):
 
         return redirect_uri
 
-    def _extract_origin_and_rp_id(
-        self,
-        json_data: dict[str, typing.Any] | None = None,
-    ) -> tuple[str, str]:
-        """Resolve the WebAuthn origin and relying-party ID for a request."""
+    def _extract_origin_and_rp_id(self, json_data: dict[str, typing.Any] | None = None) -> tuple[str, str]:
         origin = ''
         if json_data and isinstance(json_data, dict):
             origin = json_data.get('origin', '')
@@ -95,21 +80,14 @@ class UserRouterGroup(group.RouterGroup):
 
         parsed = urlsplit(origin)
         rp_id = parsed.hostname or 'localhost'
-        if parsed.scheme and parsed.netloc:
-            clean_origin = f'{parsed.scheme}://{parsed.netloc}'
-        else:
-            clean_origin = origin.rstrip('/')
+        clean_origin = f'{parsed.scheme}://{parsed.netloc}' if parsed.scheme and parsed.netloc else origin.rstrip('/')
         return clean_origin, rp_id
 
     async def initialize(self) -> None:
-        """Register every ``/api/v1/user`` route on this router group."""
-
         @self.route('/init', methods=['GET', 'POST'], auth_type=group.AuthType.NONE)
         async def _() -> str:
-            """Report initialization state, or create the first account (POST)."""
             if quart.request.method == 'GET':
-                initialized = await self.ap.user_service.is_initialized()
-                return self.success(data={'initialized': initialized})
+                return self.success(data={'initialized': await self.ap.user_service.is_initialized()})
 
             if await self.ap.user_service.is_initialized():
                 return self.fail(1, 'System already initialized')
@@ -130,56 +108,27 @@ class UserRouterGroup(group.RouterGroup):
 
         @self.route('/auth', methods=['POST'], auth_type=group.AuthType.NONE)
         async def _() -> str:
-            """Authenticate a local Account, requiring a TOTP factor when enabled."""
-            deployment = getattr(self.ap, 'deployment', None)
-            if getattr(deployment, 'mode', 'oss') == 'cloud':
-                return self.http_status(
-                    403,
-                    'password_login_disabled',
-                    'Password login is disabled on LangBot Cloud',
-                )
+            if getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud':
+                return self.http_status(403, 'password_login_disabled', 'Password login is disabled on LangBot Cloud')
             json_data = await quart.request.json
 
-            user_email = json_data['user']
             try:
-                token = await self.ap.user_service.authenticate(user_email, json_data['password'])
+                token = await self.ap.user_service.authenticate(json_data['user'], json_data['password'])
             except argon2.exceptions.VerifyMismatchError:
                 return self.fail(1, 'Invalid username or password')
             except ValueError as e:
                 return self.fail(1, str(e))
 
-            # Second factor: an enabled TOTP credential makes the password alone
-            # insufficient. The client retries the same request with a code.
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is not None and await self.ap.totp_service.is_enabled(user_obj.uuid):
-                totp_code = json_data.get('totp_code')
-                recovery_code = json_data.get('recovery_code')
-                verified = False
-                if totp_code:
-                    verified = await self.ap.totp_service.verify_for_account(
-                        user_obj.uuid,
-                        str(totp_code),
-                    )
-                elif recovery_code:
-                    verified = await self.ap.totp_service.redeem_recovery_code(
-                        user_obj.uuid,
-                        str(recovery_code),
-                    )
-                if not verified:
-                    return self.http_status(401, 'totp_required', 'TOTP verification required')
-
             return self.success(data={'token': token})
 
         @self.route('/check-token', methods=['GET'], auth_type=group.AuthType.ACCOUNT_TOKEN)
         async def _(account) -> str:
-            """Issue a fresh user token for an already-authenticated Account."""
             token = await self.ap.user_service.generate_jwt_token(account)
 
             return self.success(data={'token': token})
 
         @self.route('/reset-password', methods=['POST'], auth_type=group.AuthType.NONE)
         async def _() -> str:
-            """Reset a password using the recovery key, TOTP, or a recovery code."""
             # Admit (or reject) BEFORE touching the body or any service call (#2392):
             # rejecting requests never reach the slow path, and quota accounting happens
             # synchronously at entry, closing the post-await race of burst requests.
@@ -189,11 +138,7 @@ class UserRouterGroup(group.RouterGroup):
             json_data = await quart.request.json
 
             user_email = json_data['user']
-            # Recovery accepts either the instance recovery key, or (for accounts
-            # that enrolled one) a TOTP code or a one-time TOTP recovery code.
-            recovery_key = json_data.get('recovery_key')
-            totp_code = json_data.get('totp_code')
-            recovery_code = json_data.get('recovery_code')
+            recovery_key = json_data['recovery_key']
             new_password = json_data['new_password']
 
             # hard sleep 3s for security
@@ -207,39 +152,19 @@ class UserRouterGroup(group.RouterGroup):
             if user_obj is None:
                 return self.http_status(400, -1, 'User not found')
 
-            if totp_code or recovery_code:
-                if not await self.ap.totp_service.is_enabled(user_obj.uuid):
-                    return self.http_status(
-                        403,
-                        'totp_not_enabled',
-                        'TOTP is not enabled for this account',
-                    )
-                if totp_code:
-                    authorized = await self.ap.totp_service.verify_for_account(
-                        user_obj.uuid,
-                        str(totp_code),
-                    )
-                else:
-                    authorized = await self.ap.totp_service.redeem_recovery_code(
-                        user_obj.uuid,
-                        str(recovery_code),
-                    )
-                if not authorized:
-                    return self.http_status(403, 'totp_invalid_code', 'Invalid TOTP code')
-            else:
-                stored_key = self.ap.instance_config.data['system']['recovery_key']
-                try:
-                    key_matches = (
-                        isinstance(recovery_key, str)
-                        and isinstance(stored_key, str)
-                        and hmac.compare_digest(recovery_key.encode(), stored_key.encode())
-                    )
-                except UnicodeEncodeError:
-                    # JSON can contain lone surrogates, which are not valid UTF-8.
-                    key_matches = False
+            stored_key = self.ap.instance_config.data['system']['recovery_key']
+            try:
+                key_matches = (
+                    isinstance(recovery_key, str)
+                    and isinstance(stored_key, str)
+                    and hmac.compare_digest(recovery_key.encode(), stored_key.encode())
+                )
+            except UnicodeEncodeError:
+                # JSON can contain lone surrogates, which are not valid UTF-8.
+                key_matches = False
 
-                if not key_matches:
-                    return self.http_status(403, -1, 'Invalid recovery key')
+            if not key_matches:
+                return self.http_status(403, -1, 'Invalid recovery key')
 
             await self.ap.user_service.reset_password(user_email, new_password)
 
@@ -247,7 +172,6 @@ class UserRouterGroup(group.RouterGroup):
 
         @self.route('/change-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str) -> str:
-            """Change the current Account password after verifying the old one."""
             # Check if password change is allowed
             allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
                 'allow_modify_login_info', True
@@ -261,11 +185,7 @@ class UserRouterGroup(group.RouterGroup):
             new_password = json_data['new_password']
 
             try:
-                await self.ap.user_service.change_password(
-                    user_email,
-                    current_password,
-                    new_password,
-                )
+                await self.ap.user_service.change_password(user_email, current_password, new_password)
             except argon2.exceptions.VerifyMismatchError:
                 return self.http_status(400, -1, 'Current password is incorrect')
             except ValueError as e:
@@ -289,8 +209,7 @@ class UserRouterGroup(group.RouterGroup):
                 redirect_uri = self._validate_space_redirect_uri(redirect_uri, bind=False)
                 launch_workspace_uuid = quart.request.args.get('launch_workspace_uuid')
                 if launch_workspace_uuid:
-                    deployment = getattr(self.ap, 'deployment', None)
-                    if not getattr(deployment, 'multi_workspace_enabled', False):
+                    if not getattr(getattr(self.ap, 'deployment', None), 'multi_workspace_enabled', False):
                         return self.fail(1, 'Space launch requires Cloud mode')
                     try:
                         uuid.UUID(launch_workspace_uuid)
@@ -307,11 +226,7 @@ class UserRouterGroup(group.RouterGroup):
             except ValueError as e:
                 return self.fail(1, str(e))
 
-        @self.route(
-            '/space/bind-authorize-url',
-            methods=['GET'],
-            auth_type=group.AuthType.USER_TOKEN,
-        )
+        @self.route('/space/bind-authorize-url', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
         async def _(request_context: RequestContext) -> str:
             """Issue an account-bound, one-time Space OAuth redirect."""
             redirect_uri = quart.request.args.get('redirect_uri', '')
@@ -357,24 +272,19 @@ class UserRouterGroup(group.RouterGroup):
 
             try:
                 redirect_uri = self._validate_space_redirect_uri(str(redirect_uri), bind=False)
-                consumed_state = await self.ap.user_service.consume_space_oauth_state_details(
-                    state,
-                    'login',
-                )
+                consumed_state = await self.ap.user_service.consume_space_oauth_state_details(state, 'login')
                 # Exchange code for tokens
                 launch_workspace_uuid = consumed_state.launch_workspace_uuid
                 workspace_uuids = [launch_workspace_uuid] if launch_workspace_uuid else []
                 workspace_created_ats: dict[str, int] = {}
-                deployment = getattr(self.ap, 'deployment', None)
-                if not workspace_uuids and getattr(deployment, 'mode', 'oss') != 'cloud':
+                if not workspace_uuids and getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') != 'cloud':
                     binding = await self.ap.workspace_service.get_execution_binding()
                     workspace_uuids = [binding.workspace_uuid]
                     workspace_created_at = binding.workspace_created_at
                     if workspace_created_at is not None:
                         if workspace_created_at.tzinfo is None:
                             workspace_created_at = workspace_created_at.replace(tzinfo=datetime.UTC)
-                        created_at_epoch = int(workspace_created_at.timestamp())
-                        workspace_created_ats[binding.workspace_uuid] = created_at_epoch
+                        workspace_created_ats[binding.workspace_uuid] = int(workspace_created_at.timestamp())
                 token_data = await self.ap.space_service.exchange_oauth_code(
                     code,
                     workspace_uuids,
@@ -389,20 +299,14 @@ class UserRouterGroup(group.RouterGroup):
                 if not access_token:
                     return self.fail(1, 'Failed to get access token from Space')
 
-                deployment = getattr(self.ap, 'deployment', None)
-                cloud_mode = getattr(deployment, 'mode', 'oss') == 'cloud'
-                launch_mismatch = launch_workspace_uuid != cloud_workspace_uuid
-                if cloud_mode and launch_workspace_uuid and launch_mismatch:
+                cloud_mode = getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud'
+                if cloud_mode and launch_workspace_uuid and launch_workspace_uuid != cloud_workspace_uuid:
                     return self.fail(1, 'Space OAuth Workspace binding mismatch')
                 target_workspace_uuid = launch_workspace_uuid or cloud_workspace_uuid
                 if cloud_mode:
                     if not target_workspace_uuid:
-                        return self.fail(
-                            1,
-                            'Space OAuth response is missing the Cloud Workspace binding',
-                        )
-                    projection_service = self.ap.directory_projection_service
-                    await projection_service.reconcile_workspaces((target_workspace_uuid,))
+                        return self.fail(1, 'Space OAuth response is missing the Cloud Workspace binding')
+                    await self.ap.directory_projection_service.reconcile_workspaces((target_workspace_uuid,))
 
                 # Authenticate only after the signed, exact Workspace delta has
                 # established the Account and membership runtime shadow rows.
@@ -412,15 +316,12 @@ class UserRouterGroup(group.RouterGroup):
 
                 if target_workspace_uuid:
                     try:
-                        collab_service = self.ap.workspace_collaboration_service
-                        access = await collab_service.resolve_account_workspace(
+                        access = await self.ap.workspace_collaboration_service.resolve_account_workspace(
                             user_obj.uuid,
                             target_workspace_uuid,
                         )
                     except Exception:
-                        self.ap.logger.warning(
-                            'Rejected Space OAuth launch for unauthorized Workspace',
-                        )
+                        self.ap.logger.warning('Rejected Space OAuth launch for unauthorized Workspace')
                         return self.fail(1, 'Space OAuth failed')
                     return self.success(
                         data={
@@ -455,7 +356,6 @@ class UserRouterGroup(group.RouterGroup):
                     'user': account.user,
                     'account_type': account.account_type,
                     'has_password': bool(account.password and account.password.strip()),
-                    'totp_enabled': await self.ap.totp_service.is_enabled(account.uuid),
                 }
             )
 
@@ -508,7 +408,6 @@ class UserRouterGroup(group.RouterGroup):
             capabilities['invitation_registration_enabled'] = not cloud_mode
             capabilities['passkey_login_enabled'] = True
             capabilities['passkey_supported'] = True
-            capabilities['totp_supported'] = True
             return self.success(data={'initialized': True, **capabilities})
 
         @self.route('/set-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
@@ -599,11 +498,7 @@ class UserRouterGroup(group.RouterGroup):
             except Exception:
                 raise
 
-        @self.route(
-            '/passkey/register/options',
-            methods=['POST'],
-            auth_type=group.AuthType.USER_TOKEN,
-        )
+        @self.route('/passkey/register/options', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str) -> str:
             """Generate WebAuthn registration options for current account."""
             allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
@@ -620,9 +515,7 @@ class UserRouterGroup(group.RouterGroup):
             origin, rp_id = self._extract_origin_and_rp_id(json_data)
 
             try:
-                user_service = self.ap.user_service
-                reg_options = user_service.generate_passkey_registration_options
-                options, challenge_token = await reg_options(
+                options, challenge_token = await self.ap.user_service.generate_passkey_registration_options(
                     account_uuid=user_obj.uuid,
                     rp_id=rp_id,
                     origin=origin,
@@ -632,11 +525,7 @@ class UserRouterGroup(group.RouterGroup):
             except Exception as e:
                 return self.fail(1, str(e))
 
-        @self.route(
-            '/passkey/register/verify',
-            methods=['POST'],
-            auth_type=group.AuthType.USER_TOKEN,
-        )
+        @self.route('/passkey/register/verify', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str) -> str:
             """Verify WebAuthn registration response and save credential."""
             allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
@@ -681,9 +570,7 @@ class UserRouterGroup(group.RouterGroup):
             origin, rp_id = self._extract_origin_and_rp_id(json_data)
 
             try:
-                user_service = self.ap.user_service
-                auth_options = user_service.generate_passkey_authentication_options
-                options, challenge_token = await auth_options(
+                options, challenge_token = await self.ap.user_service.generate_passkey_authentication_options(
                     rp_id=rp_id,
                     origin=origin,
                     email=email,
@@ -739,11 +626,7 @@ class UserRouterGroup(group.RouterGroup):
                 ]
             )
 
-        @self.route(
-            '/passkey/<passkey_uuid>',
-            methods=['PATCH'],
-            auth_type=group.AuthType.USER_TOKEN,
-        )
+        @self.route('/passkey/<passkey_uuid>', methods=['PATCH'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str, passkey_uuid: str) -> str:
             """Rename a registered passkey."""
             allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
@@ -770,11 +653,7 @@ class UserRouterGroup(group.RouterGroup):
                 return self.http_status(404, -1, 'Passkey not found')
             return self.success(data={'uuid': updated.uuid, 'name': updated.name})
 
-        @self.route(
-            '/passkey/<passkey_uuid>',
-            methods=['DELETE'],
-            auth_type=group.AuthType.USER_TOKEN,
-        )
+        @self.route('/passkey/<passkey_uuid>', methods=['DELETE'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str, passkey_uuid: str) -> str:
             """Delete/revoke a registered passkey."""
             allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
@@ -795,160 +674,6 @@ class UserRouterGroup(group.RouterGroup):
                 return self.http_status(404, -1, 'Passkey not found')
             return self.success()
 
-        @self.route('/totp/check', methods=['POST'], auth_type=group.AuthType.NONE)
-        async def _() -> str:
-            """Report whether TOTP is enabled for a given Account (unauthenticated).
-
-            Used by the password-recovery page to decide whether the TOTP and
-            recovery-code verification methods are selectable. Only the boolean
-            capability is disclosed; no account details leak.
-            """
-            if not await self.ap.user_service.is_initialized():
-                return self.http_status(400, -1, 'System not initialized')
-
-            json_data = await quart.request.json
-            user_email = json_data.get('user')
-            if not isinstance(user_email, str) or not user_email:
-                return self.fail(1, 'User is required')
-
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            enabled = user_obj is not None and await self.ap.totp_service.is_enabled(user_obj.uuid)
-
-            return self.success(data={'totp_enabled': enabled})
-
-        @self.route('/totp/status', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Report whether the current Account has TOTP enabled."""
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
-            return self.success(
-                data={
-                    'enabled': await self.ap.totp_service.is_enabled(user_obj.uuid),
-                    'remaining_recovery_codes': await self.ap.totp_service.remaining_recovery_codes(
-                        user_obj.uuid,
-                    ),
-                }
-            )
-
-        @self.route('/totp/enroll', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Start TOTP enrolment and return the QR payload plus recovery codes.
-
-            The secret is not enforced until ``/totp/enroll/verify`` confirms the
-            authenticator app can produce a valid code.
-            """
-            allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
-                'allow_modify_login_info', True
-            )
-            if not allow_modify_login_info:
-                return self.http_status(403, -1, 'Modifying login info is disabled')
-
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
-            try:
-                enrollment, recovery_codes = await self.ap.totp_service.begin_enrollment(user_obj)
-            except TotpAlreadyEnabledError as e:
-                return self.http_status(409, e.code, str(e))
-
-            return self.success(
-                data={
-                    'secret': enrollment.secret,
-                    'otpauth_uri': enrollment.otpauth_uri,
-                    'qr_svg': self.ap.totp_service.build_qr_svg(enrollment.otpauth_uri),
-                    'recovery_codes': recovery_codes,
-                }
-            )
-
-        @self.route('/totp/enroll/verify', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Confirm enrolment with the first code from the authenticator app."""
-            allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
-                'allow_modify_login_info', True
-            )
-            if not allow_modify_login_info:
-                return self.http_status(403, -1, 'Modifying login info is disabled')
-
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
-            json_data = await quart.request.json
-            code = json_data.get('code')
-            if not code:
-                return self.fail(1, 'Verification code is required')
-
-            try:
-                await self.ap.totp_service.confirm_enrollment(user_obj.uuid, str(code))
-            except TotpNotEnabledError as e:
-                return self.http_status(400, e.code, str(e))
-            except TotpAlreadyEnabledError as e:
-                return self.http_status(409, e.code, str(e))
-            except TotpInvalidCodeError as e:
-                return self.http_status(400, e.code, str(e))
-
-            return self.success(data={'enabled': True})
-
-        @self.route('/totp/recovery-codes', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Regenerate one-time recovery codes after proving a valid TOTP code."""
-            allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
-                'allow_modify_login_info', True
-            )
-            if not allow_modify_login_info:
-                return self.http_status(403, -1, 'Modifying login info is disabled')
-
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
-            json_data = await quart.request.json
-            code = json_data.get('code')
-            if not code:
-                return self.fail(1, 'Verification code is required')
-
-            if not await self.ap.totp_service.verify_for_account(user_obj.uuid, str(code)):
-                return self.http_status(400, TotpInvalidCodeError.code, 'Invalid verification code')
-
-            try:
-                _, recovery_codes = await self.ap.totp_service.regenerate_recovery_codes(
-                    user_obj.uuid,
-                )
-            except TotpNotEnabledError as e:
-                return self.http_status(400, e.code, str(e))
-
-            return self.success(data={'recovery_codes': recovery_codes})
-
-        @self.route('/totp/disable', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Disable TOTP for the current Account after a valid code check."""
-            allow_modify_login_info = self.ap.instance_config.data.get('system', {}).get(
-                'allow_modify_login_info', True
-            )
-            if not allow_modify_login_info:
-                return self.http_status(403, -1, 'Modifying login info is disabled')
-
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
-            json_data = await quart.request.json
-            code = json_data.get('code')
-            if not code:
-                return self.fail(1, 'Verification code is required')
-
-            try:
-                await self.ap.totp_service.disable(user_obj.uuid, str(code))
-            except TotpNotEnabledError as e:
-                return self.http_status(400, e.code, str(e))
-            except TotpInvalidCodeError as e:
-                return self.http_status(400, e.code, str(e))
-
-            return self.success(data={'enabled': False})
-
     async def _handle_space_direct_launch(
         self,
         launch_assertion: str,

src/langbot/pkg/api/http/service/totp.py

@@ -1,478 +0,0 @@
-"""Second-factor TOTP (RFC 6238) enrolment, verification and recovery.
-
-This service backs the optional TOTP second factor for LangBot Accounts:
-
-* the shared secret is encrypted at rest with a Fernet key derived from the
-  instance JWT secret via HKDF, and is never persisted in plaintext;
-* recovery codes are stored only as salted PBKDF2-HMAC-SHA256 digests;
-* the plaintext secret and recovery codes leave the server exactly once, in the
-  enrolment response.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import base64
-import dataclasses
-import datetime
-import hashlib
-import hmac
-import json
-import logging
-import secrets
-import struct
-import time
-import typing
-import uuid
-
-import sqlalchemy
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
-
-from ....entity.persistence import totp
-from ....entity.persistence import user
-
-if typing.TYPE_CHECKING:
-    from ....core.app import Application
-
-_logger = logging.getLogger(__name__)
-
-# RFC 6238 parameters. Six digits and a 30 second step are what every common
-# authenticator app (Google Authenticator, Authy, 1Password, ...) defaults to.
-_TOTP_DIGITS = 6
-_TOTP_STEP_SECONDS = 30
-# Accept one step of clock skew in either direction, which tolerates small
-# device clock drift without materially widening the brute-force window.
-_TOTP_WINDOW_STEPS = 1
-_RECOVERY_CODE_COUNT = 10
-# 10 groups drawn from 32 symbols provide 50 bits of entropy per recovery code.
-_RECOVERY_CODE_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ'
-_RECOVERY_CODE_LENGTH = 10
-# Recovery codes are stored only as salted PBKDF2-HMAC-SHA256 digests. The work
-# factor is intentionally high: guessing is already infeasible against 50 bits of
-# entropy, and the slow KDF keeps a dumped database from being attacked cheaply.
-# Hashing runs off the event loop, so this is a latency cost paid only at
-# enrolment / regeneration / redemption.
-_RECOVERY_CODE_KDF_ITERATIONS = 300_000
-
-
-class TotpAlreadyEnabledError(ValueError):
-    """Raised when enrolling an Account that already has TOTP enabled."""
-
-    code = 'totp_already_enabled'
-
-
-class TotpNotEnabledError(ValueError):
-    """Raised when an operation requires an enabled TOTP credential."""
-
-    code = 'totp_not_enabled'
-
-
-class TotpInvalidCodeError(ValueError):
-    """Raised when a supplied TOTP or recovery code fails verification."""
-
-    code = 'totp_invalid_code'
-
-
-@dataclasses.dataclass(frozen=True, slots=True)
-class TotpEnrollment:
-    """Result of starting (or restarting) TOTP enrolment for an Account."""
-
-    secret: str
-    otpauth_uri: str
-
-
-class TotpService:
-    """Second-factor TOTP enrolment, verification and recovery for Accounts.
-
-    Nothing usable is persisted in plaintext:
-
-    * The shared TOTP secret is encrypted at rest with a Fernet key derived from
-      the instance JWT secret via HKDF, so a leaked database file alone does not
-      expose live secrets (the attacker additionally needs ``config.yaml``).
-    * Recovery codes are stored only as salted PBKDF2-HMAC-SHA256 digests and are
-      consumed one at a time.
-    * The plaintext secret / recovery codes leave the server exactly once, in the
-      enrolment response, and are never stored or logged server-side.
-    """
-
-    ap: Application
-
-    def __init__(self, ap: Application) -> None:
-        self.ap = ap
-
-    # -- storage helpers -------------------------------------------------
-
-    def _session_factory(self) -> async_sessionmaker[AsyncSession]:
-        return async_sessionmaker(self.ap.persistence_mgr.get_db_engine(), expire_on_commit=False)
-
-    def _encryption_key(self) -> bytes:
-        """Derive a stable 32-byte Fernet key from the instance JWT secret.
-
-        HKDF-SHA256 with a fixed domain-separation salt keeps the key stable
-        across restarts and distinct from the JWT signing secret. The key
-        material is NOT stored in the database, so a leaked ``langbot.db`` alone
-        cannot decrypt the TOTP secrets.
-        """
-        secret = ''
-        try:
-            secret = self.ap.instance_config.data['system']['jwt']['secret'] or ''
-        except (KeyError, TypeError):
-            secret = ''
-        if not secret:
-            # Defence in depth: a missing JWT secret must not silently produce a
-            # well-known encryption key. This should never happen because
-            # GenKeysStage seeds it, but failing closed is safer than encrypting
-            # with a predictable key. The caller maps this to an invalid-code
-            # failure, so no plaintext is ever persisted.
-            raise TotpInvalidCodeError('Instance JWT secret unavailable')
-
-        from cryptography.hazmat.primitives import hashes
-        from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-
-        # HKDF enforces the label internally, so include it as `info`.
-        derived = HKDF(
-            algorithm=hashes.SHA256(),
-            length=32,
-            salt=b'langbot-totp-v1',
-            info=b'langbot-totp-secret-encryption',
-        ).derive(secret.encode('utf-8'))
-        return base64.urlsafe_b64encode(derived)
-
-    def _encrypt_secret(self, secret: str) -> str:
-        from cryptography.fernet import Fernet
-
-        return Fernet(self._encryption_key()).encrypt(secret.encode('utf-8')).decode('ascii')
-
-    def _decrypt_secret(self, token: str) -> str:
-        from cryptography.fernet import Fernet, InvalidToken
-
-        try:
-            return Fernet(self._encryption_key()).decrypt(token.encode('ascii')).decode('utf-8')
-        except (InvalidToken, ValueError) as exc:
-            raise TotpInvalidCodeError('Stored TOTP secret cannot be decrypted') from exc
-
-    # -- RFC 6238 primitives ---------------------------------------------
-
-    @staticmethod
-    def generate_secret() -> str:
-        """Return a fresh base32 secret (160 bits, the RFC 4226 recommendation)."""
-        return base64.b32encode(secrets.token_bytes(20)).decode('ascii').rstrip('=')
-
-    @staticmethod
-    def _hotp(secret: str, counter: int) -> str:
-        padding = '=' * (-len(secret) % 8)
-        key = base64.b32decode(secret.upper() + padding)
-        msg = struct.pack('>Q', counter)
-        digest = hmac.new(key, msg, hashlib.sha1).digest()
-        offset = digest[-1] & 0x0F
-        binary = struct.unpack('>I', digest[offset : offset + 4])[0] & 0x7FFFFFFF
-        return str(binary % (10**_TOTP_DIGITS)).zfill(_TOTP_DIGITS)
-
-    @classmethod
-    def generate_code(cls, secret: str, at: float | None = None) -> str:
-        """Return the TOTP code for ``secret`` at the given (or current) time."""
-        counter = int((at if at is not None else time.time()) // _TOTP_STEP_SECONDS)
-        return cls._hotp(secret, counter)
-
-    @classmethod
-    def verify_code(cls, secret: str, code: str, at: float | None = None) -> bool:
-        """Constant-time check of a user-supplied code within the skew window."""
-        candidate = (code or '').strip().replace(' ', '')
-        if not candidate.isdigit() or len(candidate) != _TOTP_DIGITS:
-            return False
-        now = at if at is not None else time.time()
-        counter = int(now // _TOTP_STEP_SECONDS)
-        for offset in range(-_TOTP_WINDOW_STEPS, _TOTP_WINDOW_STEPS + 1):
-            expected = cls._hotp(secret, counter + offset)
-            if hmac.compare_digest(expected, candidate):
-                return True
-        return False
-
-    @staticmethod
-    def build_otpauth_uri(secret: str, account_name: str, issuer: str = 'LangBot') -> str:
-        """Build the otpauth:// URI an authenticator app scans from the QR code."""
-        from urllib.parse import quote, urlencode
-
-        label = quote(f'{issuer}:{account_name}')
-        params = urlencode(
-            {
-                'secret': secret,
-                'issuer': issuer,
-                'algorithm': 'SHA1',
-                'digits': _TOTP_DIGITS,
-                'period': _TOTP_STEP_SECONDS,
-            }
-        )
-        return f'otpauth://totp/{label}?{params}'
-
-    @staticmethod
-    def build_qr_svg(otpauth_uri: str) -> str:
-        """Render the otpauth URI to an inline SVG QR code.
-
-        SVG keeps the response text-only so the frontend can drop it straight
-        into a dialog without byte-encoding a PNG data URL.
-        """
-        import qrcode
-        import qrcode.image.svg
-
-        qr = qrcode.QRCode(
-            version=None,
-            error_correction=qrcode.constants.ERROR_CORRECT_M,
-            box_size=10,
-            border=2,
-            image_factory=qrcode.image.svg.SvgPathImage,
-        )
-        qr.add_data(otpauth_uri)
-        qr.make(fit=True)
-        image = qr.make_image()
-        import io
-
-        buffer = io.BytesIO()
-        image.save(buffer)
-        return buffer.getvalue().decode('utf-8')
-
-    # -- recovery codes ---------------------------------------------------
-
-    @staticmethod
-    def _normalise_recovery_code(code: str) -> str:
-        return (code or '').strip().upper().replace('-', '').replace(' ', '')
-
-    @classmethod
-    def _hash_recovery_code(cls, code: str, *, salt: bytes | None = None) -> str:
-        """Return a self-describing PBKDF2-HMAC-SHA256 digest of a recovery code.
-
-        The format is ``pbkdf2_sha256$<iterations>$<salt_hex>$<digest_hex>`` so the
-        work factor is stored alongside the digest and can be raised later
-        without invalidating existing codes. Salted and slow, so a database dump
-        does not allow offline brute-forcing of recovery codes.
-        """
-        if salt is None:
-            salt = secrets.token_bytes(16)
-        digest = hashlib.pbkdf2_hmac(
-            'sha256',
-            cls._normalise_recovery_code(code).encode('utf-8'),
-            salt,
-            _RECOVERY_CODE_KDF_ITERATIONS,
-        )
-        return f'pbkdf2_sha256${_RECOVERY_CODE_KDF_ITERATIONS}${salt.hex()}${digest.hex()}'
-
-    @staticmethod
-    def _split_recovery_digest(stored: str) -> tuple[int, bytes, bytes] | None:
-        parts = (stored or '').split('$')
-        if len(parts) != 4 or parts[0] != 'pbkdf2_sha256':
-            return None
-        try:
-            iterations = int(parts[1])
-            salt = bytes.fromhex(parts[2])
-            digest = bytes.fromhex(parts[3])
-        except ValueError:
-            return None
-        return iterations, salt, digest
-
-    @staticmethod
-    def _random_recovery_code() -> str:
-        """Return one random recovery code from the unambiguous alphabet."""
-        alphabet = _RECOVERY_CODE_ALPHABET
-        return ''.join(secrets.choice(alphabet) for _ in range(_RECOVERY_CODE_LENGTH))
-
-    @classmethod
-    async def generate_recovery_codes(cls) -> tuple[list[str], list[str]]:
-        """Return ``(plaintext_codes, hashed_codes)`` for one enrolment."""
-        plaintext: list[str] = []
-        hashed: list[str] = []
-        for _ in range(_RECOVERY_CODE_COUNT):
-            code = cls._random_recovery_code()
-            plaintext.append(code)
-            # Offload the expensive KDF so 10 codes do not stall the event loop.
-            hashed.append(await asyncio.to_thread(cls._hash_recovery_code, code))
-        return plaintext, hashed
-
-    # -- persistence ------------------------------------------------------
-
-    @staticmethod
-    def _credential_statement(account_uuid: str) -> typing.Any:
-        """Build the SELECT that loads an Account's TOTP credential row."""
-        entity = totp.TotpCredential
-        return sqlalchemy.select(entity).where(entity.account_uuid == account_uuid)
-
-    async def get_credential(self, account_uuid: str) -> totp.TotpCredential | None:
-        """Load the (single) TOTP credential row for an Account, if any."""
-        statement = self._credential_statement(account_uuid)
-        async with self._session_factory()() as session:
-            return await session.scalar(statement)
-
-    async def is_enabled(self, account_uuid: str) -> bool:
-        """Return whether the Account has a confirmed, enabled TOTP credential."""
-        credential = await self.get_credential(account_uuid)
-        return bool(credential and credential.enabled)
-
-    async def begin_enrollment(self, account: user.User) -> tuple[TotpEnrollment, list[str]]:
-        """Create or replace a pending TOTP secret and return recovery codes.
-
-        A previous *enabled* credential is left untouched until the new secret
-        is confirmed, so a failed re-enrolment cannot lock the account out.
-        """
-        secret = self.generate_secret()
-        uri = self.build_otpauth_uri(secret, account_name=account.user)
-        plaintext_codes, hashed_codes = await self.generate_recovery_codes()
-
-        async with self._session_factory()() as session:
-            async with session.begin():
-                credential = await session.scalar(self._credential_statement(account.uuid))
-                if credential is None:
-                    credential = totp.TotpCredential(
-                        uuid=str(uuid.uuid4()),
-                        account_uuid=account.uuid,
-                        secret_encrypted=self._encrypt_secret(secret),
-                        account_name=account.user,
-                        enabled=False,
-                        recovery_codes=json.dumps(hashed_codes),
-                    )
-                    session.add(credential)
-                elif not credential.enabled:
-                    credential.secret_encrypted = self._encrypt_secret(secret)
-                    credential.account_name = account.user
-                    credential.recovery_codes = json.dumps(hashed_codes)
-                else:
-                    raise TotpAlreadyEnabledError('TOTP is already enabled for this account')
-                await session.flush()
-
-        return TotpEnrollment(secret=secret, otpauth_uri=uri), plaintext_codes
-
-    async def confirm_enrollment(self, account_uuid: str, code: str) -> None:
-        """Verify the first code and flip the credential to enabled."""
-        credential = await self.get_credential(account_uuid)
-        if credential is None:
-            raise TotpNotEnabledError('No pending TOTP enrolment found')
-        if credential.enabled:
-            raise TotpAlreadyEnabledError('TOTP is already enabled for this account')
-
-        try:
-            code_matches = self.verify_code(self._decrypt_secret(credential.secret_encrypted), code)
-        except TotpInvalidCodeError:
-            code_matches = False
-        if not code_matches:
-            raise TotpInvalidCodeError('Invalid verification code')
-
-        async with self._session_factory()() as session:
-            async with session.begin():
-                record = await session.scalar(self._credential_statement(account_uuid))
-                if record is None:
-                    raise TotpNotEnabledError('No pending TOTP enrolment found')
-                record.enabled = True
-                record.last_used_at = datetime.datetime.now()
-
-    async def verify_for_account(self, account_uuid: str, code: str) -> bool:
-        """Validate a live TOTP code for an enabled credential."""
-        credential = await self.get_credential(account_uuid)
-        if credential is None or not credential.enabled:
-            return False
-        try:
-            secret = self._decrypt_secret(credential.secret_encrypted)
-        except TotpInvalidCodeError:
-            return False
-        if not self.verify_code(secret, code):
-            return False
-        async with self._session_factory()() as session:
-            async with session.begin():
-                record = await session.scalar(self._credential_statement(account_uuid))
-                if record is not None:
-                    record.last_used_at = datetime.datetime.now()
-        return True
-
-    @classmethod
-    def _match_recovery_code(cls, code: str, hashed_codes: list[str]) -> int:
-        """Return the index of the matching digest, or -1. Constant-time per entry."""
-        candidate = cls._normalise_recovery_code(code)
-        for index, stored in enumerate(hashed_codes):
-            parsed = cls._split_recovery_digest(stored)
-            if parsed is None:
-                continue
-            iterations, salt, expected = parsed
-            digest = hashlib.pbkdf2_hmac('sha256', candidate.encode('utf-8'), salt, iterations)
-            if hmac.compare_digest(digest, expected):
-                return index
-        return -1
-
-    async def redeem_recovery_code(self, account_uuid: str, code: str) -> bool:
-        """Consume a one-time recovery code for password reset fallback."""
-        credential = await self.get_credential(account_uuid)
-        if credential is None:
-            return False
-
-        hashed_codes: list[str] = []
-        if credential.recovery_codes:
-            try:
-                parsed = json.loads(credential.recovery_codes)
-                if isinstance(parsed, list):
-                    hashed_codes = [str(item) for item in parsed]
-            except (ValueError, TypeError):
-                hashed_codes = []
-
-        # Recomputing PBKDF2 for up to 10 salted digests is CPU-bound; keep it
-        # off the event loop so a recovery attempt cannot stall other requests.
-        matched_index = await asyncio.to_thread(self._match_recovery_code, code or '', hashed_codes)
-        if matched_index < 0:
-            return False
-
-        remaining = hashed_codes[:matched_index] + hashed_codes[matched_index + 1 :]
-        async with self._session_factory()() as session:
-            async with session.begin():
-                record = await session.scalar(self._credential_statement(account_uuid))
-                if record is not None:
-                    record.recovery_codes = json.dumps(remaining)
-                    record.last_used_at = datetime.datetime.now()
-        return True
-
-    async def regenerate_recovery_codes(self, account_uuid: str) -> tuple[None, list[str]]:
-        """Replace the recovery codes for an enabled credential.
-
-        The caller is responsible for proving possession of a valid TOTP code
-        first; this method only swaps the stored digests for a fresh set and
-        returns the plaintext codes for one-time display.
-        """
-        credential = await self.get_credential(account_uuid)
-        if credential is None or not credential.enabled:
-            raise TotpNotEnabledError('TOTP is not enabled for this account')
-
-        plaintext_codes, hashed_codes = await self.generate_recovery_codes()
-        async with self._session_factory()() as session:
-            async with session.begin():
-                record = await session.scalar(self._credential_statement(account_uuid))
-                if record is None:
-                    raise TotpNotEnabledError('TOTP is not enabled for this account')
-                record.recovery_codes = json.dumps(hashed_codes)
-                record.updated_at = datetime.datetime.now()
-        return None, plaintext_codes
-
-    async def disable(self, account_uuid: str, code: str) -> bool:
-        """Remove TOTP after the caller proves possession of a valid factor."""
-        credential = await self.get_credential(account_uuid)
-        if credential is None or not credential.enabled:
-            raise TotpNotEnabledError('TOTP is not enabled for this account')
-
-        try:
-            secret = self._decrypt_secret(credential.secret_encrypted)
-            code_matches = self.verify_code(secret, code)
-        except TotpInvalidCodeError:
-            code_matches = False
-        if not code_matches:
-            raise TotpInvalidCodeError('Invalid verification code')
-
-        async with self._session_factory()() as session:
-            async with session.begin():
-                record = await session.scalar(self._credential_statement(account_uuid))
-                if record is not None:
-                    await session.delete(record)
-        return True
-
-    async def remaining_recovery_codes(self, account_uuid: str) -> int:
-        """Return how many unused recovery codes remain for the Account."""
-        credential = await self.get_credential(account_uuid)
-        if credential is None or not credential.recovery_codes:
-            return 0
-        try:
-            parsed = json.loads(credential.recovery_codes)
-        except (ValueError, TypeError):
-            return 0
-        return len(parsed) if isinstance(parsed, list) else 0

src/langbot/pkg/core/app.py

@@ -34,7 +34,6 @@ from ..api.http.service import apikey as apikey_service
 from ..api.http.service import webhook as webhook_service
 from ..api.http.service import monitoring as monitoring_service
 from ..api.http.service import skill as skill_service
-from ..api.http.service import totp as totp_service
 from ..api.http.service import maintenance as maintenance_service
 from ..discover import engine as discover_engine
 from ..storage import mgr as storagemgr
@@ -162,8 +161,6 @@ class Application:
 
     user_service: user_service.UserService = None
 
-    totp_service: totp_service.TotpService = None
-
     space_service: space_service.SpaceService = None
 
     llm_model_service: model_service.LLMModelsService = None

src/langbot/pkg/core/stages/build_app.py

@@ -28,7 +28,6 @@ from ...api.http.service import apikey as apikey_service
 from ...api.http.service import webhook as webhook_service
 from ...api.http.service import monitoring as monitoring_service
 from ...api.http.service import skill as skill_service
-from ...api.http.service import totp as totp_service
 from ...skill import manager as skill_mgr
 from ...api.http.service import maintenance as maintenance_service
 from ...discover import engine as discover_engine
@@ -199,9 +198,6 @@ class BuildAppStage(stage.BootingStage):
         user_service_inst = user_service.UserService(ap)
         ap.user_service = user_service_inst
 
-        totp_service_inst = totp_service.TotpService(ap)
-        ap.totp_service = totp_service_inst
-
         async def resolve_singleton_execution_context() -> ExecutionContext:
             if workspace_policy.multi_workspace_enabled:
                 raise WorkspaceRequiredError('Cloud runtime work requires an explicit Workspace context')

src/langbot/pkg/entity/persistence/totp.py

@@ -1,60 +0,0 @@
-"""Persistence entity for per-Account TOTP (RFC 6238) second factors."""
-
-from __future__ import annotations
-
-import uuid as uuid_lib
-
-import sqlalchemy
-
-from .base import Base
-
-
-class TotpCredential(Base):
-    """Per-Account TOTP (RFC 6238) second factor and its recovery codes.
-
-    A single row is kept per Account. The shared secret is stored encrypted
-    (``secret_encrypted``, Fernet keyed off the instance JWT secret via HKDF)
-    rather than in plaintext, and remains unenforced until the owner confirms
-    possession by submitting a valid code (``enabled``). Recovery codes are
-    stored only as salted PBKDF2-HMAC-SHA256 digests, so a database leak does
-    not hand out account recovery. No plaintext secret or recovery code is ever
-    persisted; both leave the server exactly once, in the enrolment response.
-    """
-
-    __tablename__ = 'totp_credentials'
-
-    id = sqlalchemy.Column(sqlalchemy.Integer, primary_key=True, autoincrement=True)
-    uuid = sqlalchemy.Column(
-        sqlalchemy.String(36),
-        nullable=False,
-        default=lambda: str(uuid_lib.uuid4()),
-    )
-    account_uuid = sqlalchemy.Column(
-        sqlalchemy.String(36),
-        sqlalchemy.ForeignKey('users.uuid', ondelete='CASCADE'),
-        nullable=False,
-    )
-    # Fernet-encrypted base32 secret; never exposed to the client after enrol.
-    secret_encrypted = sqlalchemy.Column(sqlalchemy.Text, nullable=False)
-    # Issuer label shown inside the authenticator app (e.g. the account email).
-    account_name = sqlalchemy.Column(sqlalchemy.String(320), nullable=False)
-    enabled = sqlalchemy.Column(sqlalchemy.Boolean, nullable=False, server_default='0')
-    # JSON-encoded list of salted PBKDF2 hashes for the one-time recovery codes.
-    recovery_codes = sqlalchemy.Column(sqlalchemy.Text, nullable=True)
-    last_used_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=True)
-    created_at = sqlalchemy.Column(
-        sqlalchemy.DateTime,
-        nullable=False,
-        server_default=sqlalchemy.func.now(),
-    )
-    updated_at = sqlalchemy.Column(
-        sqlalchemy.DateTime,
-        nullable=False,
-        server_default=sqlalchemy.func.now(),
-        onupdate=sqlalchemy.func.now(),
-    )
-
-    __table_args__ = (
-        sqlalchemy.Index('uq_totp_credentials_uuid', 'uuid', unique=True),
-        sqlalchemy.Index('uq_totp_credentials_account', 'account_uuid', unique=True),
-    )

src/langbot/pkg/persistence/alembic/versions/0025_totp_credentials.py

@@ -1,50 +0,0 @@
-"""add totp credentials table
-
-Revision ID: 0025_totp_credentials
-Revises: 0024_passkey_credentials
-Create Date: 2026-09-12
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = '0025_totp_credentials'
-down_revision = '0024_passkey_credentials'
-branch_labels = None
-depends_on = None
-
-_TABLE_NAME = 'totp_credentials'
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    existing_tables = set(sa.inspect(conn).get_table_names())
-    if _TABLE_NAME not in existing_tables:
-        op.create_table(
-            _TABLE_NAME,
-            sa.Column('id', sa.Integer(), primary_key=True, autoincrement=True),
-            sa.Column('uuid', sa.String(36), nullable=False),
-            sa.Column(
-                'account_uuid',
-                sa.String(36),
-                sa.ForeignKey('users.uuid', ondelete='CASCADE'),
-                nullable=False,
-            ),
-            sa.Column('secret_encrypted', sa.Text(), nullable=False),
-            sa.Column('account_name', sa.String(320), nullable=False),
-            sa.Column('enabled', sa.Boolean(), nullable=False, server_default='0'),
-            sa.Column('recovery_codes', sa.Text(), nullable=True),
-            sa.Column('last_used_at', sa.DateTime(), nullable=True),
-            sa.Column('created_at', sa.DateTime(), nullable=False, server_default=sa.func.now()),
-            sa.Column('updated_at', sa.DateTime(), nullable=False, server_default=sa.func.now()),
-        )
-        op.create_index('uq_totp_credentials_uuid', _TABLE_NAME, ['uuid'], unique=True)
-        op.create_index('uq_totp_credentials_account', _TABLE_NAME, ['account_uuid'], unique=True)
-
-
-def downgrade() -> None:
-    op.drop_index('uq_totp_credentials_account', table_name=_TABLE_NAME)
-    op.drop_index('uq_totp_credentials_uuid', table_name=_TABLE_NAME)
-    op.drop_table(_TABLE_NAME)

src/langbot/pkg/plugin/connector.py

@@ -87,8 +87,10 @@ async def _read_httpx_response_limited(
     response: httpx.Response,
     *,
     max_bytes: int,
+    task_context: taskmgr.TaskContext | None = None,
 ) -> bytes:
     content_length = response.headers.get('content-length')
+    declared_size: int | None = None
     if content_length is not None:
         try:
             declared_size = int(content_length)
@@ -97,11 +99,23 @@ async def _read_httpx_response_limited(
         if declared_size is not None and declared_size > max_bytes:
             raise ValueError(f'Remote response exceeds the {max_bytes}-byte limit')
 
+    if task_context is not None and declared_size is not None:
+        task_context.metadata['download_total'] = declared_size
+
+    start_time = time.time()
     body = bytearray()
     async for chunk in response.aiter_bytes(chunk_size=64 * 1024):
         body.extend(chunk)
         if len(body) > max_bytes:
             raise ValueError(f'Remote response exceeds the {max_bytes}-byte limit')
+        if task_context is not None:
+            elapsed = time.time() - start_time
+            task_context.metadata.update(
+                {
+                    'download_current': len(body),
+                    'download_speed': len(body) / elapsed if elapsed > 0 else 0,
+                }
+            )
     return bytes(body)
 
 
@@ -111,6 +125,7 @@ async def _marketplace_get(
     *,
     max_bytes: int,
     allow_not_found: bool = False,
+    task_context: taskmgr.TaskContext | None = None,
 ) -> tuple[int, bytes]:
     async with client.stream('GET', url) as response:
         if allow_not_found and response.status_code == 404:
@@ -119,6 +134,7 @@ async def _marketplace_get(
         return response.status_code, await _read_httpx_response_limited(
             response,
             max_bytes=max_bytes,
+            task_context=task_context,
         )
 
 
@@ -1680,6 +1696,7 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
                 client,
                 f'{space_url}/api/v1/marketplace/plugins/download/{plugin_author}/{plugin_name}/{latest_version}',
                 max_bytes=_MARKETPLACE_PLUGIN_DOWNLOAD_MAX_BYTES,
+                task_context=task_context,
             )
             return plugin_package, latest_version
 
@@ -1695,7 +1712,21 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         plugin_name = str(install_info.get('plugin_name') or '')
         file_bytes: bytes | None
 
+        if task_context is not None:
+            # Reset per-install progress counters so a re-install of the same
+            # plugin does not inherit stale metadata from a previous task.
+            task_context.set_current_action('preparing plugin install')
+            task_context.metadata.update(
+                {
+                    'download_total': 0,
+                    'download_current': 0,
+                    'download_speed': 0,
+                }
+            )
+
         if install_source == PluginInstallSource.MARKETPLACE:
+            if task_context is not None:
+                task_context.set_current_action('downloading plugin package')
             file_bytes, version = await self._download_marketplace_package(
                 execution_context,
                 plugin_author,
@@ -1719,6 +1750,8 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         else:
             raise ValueError(f'Unsupported plugin install source: {install_source.value}')
 
+        if task_context is not None:
+            task_context.set_current_action('inspecting plugin package')
         manifest_author, manifest_name = self._inspect_plugin_package(file_bytes, task_context)
         if not manifest_author or not manifest_name:
             raise ValueError('Plugin package manifest identity is missing')
@@ -1730,8 +1763,12 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         if task_context is not None:
             task_context.metadata['plugin_name'] = f'{plugin_author}/{plugin_name}'
 
+        if task_context is not None:
+            task_context.set_current_action('storing plugin package')
         artifact_digest = hashlib.sha256(file_bytes).hexdigest()
         await self._store_artifact_package(execution_context, artifact_digest, file_bytes)
+        if task_context is not None:
+            task_context.set_current_action('installing plugin dependencies')
         try:
             binding, previous_digest, previous_was_durable = await self._persist_installation_package(
                 execution_context,
@@ -1749,6 +1786,8 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
             plugin_author=plugin_author,
             plugin_name=plugin_name,
         )
+        if task_context is not None:
+            task_context.set_current_action('launching plugin')
         await self._apply_desired_state(
             PluginInstallationDesiredState(binding=binding, enabled=True),
             artifact_package=file_bytes,
@@ -1766,6 +1805,8 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
                         pass
             except Exception as exc:
                 self.ap.logger.debug(f'Legacy OSS plugin cleanup skipped: {exc}')
+        if task_context is not None:
+            task_context.set_current_action('waiting for plugin to become ready')
         await self._wait_for_installed_plugin_ready(plugin_author, plugin_name, task_context)
 
     async def upgrade_plugin(

web/src/app/home/components/account-settings-dialog/AccountSettingsPanel.tsx

@@ -21,11 +21,9 @@ import {
   Plus,
   Trash2,
   Pencil,
-  ShieldCheck,
 } from 'lucide-react';
 import { startRegistration } from '@simplewebauthn/browser';
 import PasswordChangeDialog from '../password-change-dialog/PasswordChangeDialog';
-import TotpEnrollDialog from './TotpEnrollDialog';
 import { PanelBody } from '../settings-dialog/panel-layout';
 
 interface AccountSettingsPanelProps {
@@ -58,16 +56,11 @@ export default function AccountSettingsPanel({
   const [passkeys, setPasskeys] = useState<PasskeyItem[]>([]);
   const [passkeyLoading, setPasskeyLoading] = useState(false);
   const [registeringPasskey, setRegisteringPasskey] = useState(false);
-  const [totpEnabled, setTotpEnabled] = useState(false);
-  const [remainingRecoveryCodes, setRemainingRecoveryCodes] = useState(0);
-  const [totpLoading, setTotpLoading] = useState(false);
-  const [totpDialogOpen, setTotpDialogOpen] = useState(false);
 
   useEffect(() => {
     if (active) {
       loadUserInfo();
       loadPasskeys();
-      loadTotpStatus();
     }
   }, [active]);
 
@@ -98,19 +91,6 @@ export default function AccountSettingsPanel({
     }
   }
 
-  async function loadTotpStatus() {
-    setTotpLoading(true);
-    try {
-      const status = await httpClient.getTotpStatus();
-      setTotpEnabled(status.enabled);
-      setRemainingRecoveryCodes(status.remaining_recovery_codes);
-    } catch {
-      // ignore
-    } finally {
-      setTotpLoading(false);
-    }
-  }
-
   const handleAddPasskey = async () => {
     setRegisteringPasskey(true);
     try {
@@ -352,56 +332,6 @@ export default function AccountSettingsPanel({
               </div>
             )}
           </div>
-
-          {/* TOTP (2FA) Section */}
-          <div className="pt-4 space-y-3">
-            <div className="flex items-center justify-between">
-              <div>
-                <h4 className="text-sm font-medium">
-                  {t('account.totpSectionTitle')}
-                </h4>
-                <p className="text-xs text-muted-foreground">
-                  {t('account.totpSectionDesc')}
-                </p>
-              </div>
-              <Button
-                variant="outline"
-                size="sm"
-                onClick={() => setTotpDialogOpen(true)}
-                disabled={totpLoading || !systemInfo.allow_modify_login_info}
-                className="cursor-pointer"
-              >
-                {totpLoading ? (
-                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                ) : (
-                  <ShieldCheck className="mr-2 h-4 w-4" />
-                )}
-                {totpEnabled
-                  ? t('account.disableTotp')
-                  : t('account.enableTotp')}
-              </Button>
-            </div>
-
-            <Item size="sm" variant="muted" className="rounded-lg">
-              <ItemMedia variant="icon">
-                <ShieldCheck className="h-4 w-4" />
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>
-                  {totpEnabled
-                    ? t('account.totpEnabled')
-                    : t('account.totpDisabled')}
-                </ItemTitle>
-                <ItemDescription>
-                  {totpEnabled
-                    ? t('account.totpRecoveryCodesRemaining', {
-                        count: remainingRecoveryCodes,
-                      })
-                    : t('account.totpSectionDesc')}
-                </ItemDescription>
-              </ItemContent>
-            </Item>
-          </div>
         </div>
       )}
 
@@ -410,13 +340,6 @@ export default function AccountSettingsPanel({
         onOpenChange={handlePasswordDialogClose}
         hasPassword={hasPassword}
       />
-
-      <TotpEnrollDialog
-        open={totpDialogOpen}
-        onOpenChange={setTotpDialogOpen}
-        enabled={totpEnabled}
-        onChanged={loadTotpStatus}
-      />
     </PanelBody>
   );
 }

web/src/app/home/plugins/components/plugin-install-task/PluginInstallProgressDialog.tsx

@@ -10,6 +10,7 @@ import { Button } from '@/components/ui/button';
 import {
   Download,
   Package,
+  Rocket,
   Server,
   Sparkles,
   CheckCircle2,
@@ -39,11 +40,27 @@ const STAGES: {
     icon: Package,
     i18nKey: 'plugins.installProgress.installingDeps',
   },
+  {
+    key: InstallStage.LAUNCHING,
+    icon: Rocket,
+    i18nKey: 'plugins.installProgress.launching',
+  },
 ];
 
+/**
+ * Find the row that should be highlighted for a given stage.
+ * LAUNCHING/INITIALIZING/DONE collapse onto the launching row.
+ */
 function getStageIndex(stage: InstallStage): number {
+  if (
+    stage === InstallStage.LAUNCHING ||
+    stage === InstallStage.INITIALIZING ||
+    stage === InstallStage.DONE
+  ) {
+    return STAGES.length - 1;
+  }
   const idx = STAGES.findIndex((s) => s.key === stage);
-  return idx >= 0 ? idx : -1;
+  return idx >= 0 ? idx : 0;
 }
 
 function formatFileSize(bytes: number): string {
@@ -169,9 +186,12 @@ function formatSpeed(bytesPerSec: number): string {
 function TaskProgressContent({ task }: { task: PluginInstallTask }) {
   const { t } = useTranslation();
 
-  const currentStageIndex = getStageIndex(task.stage);
   const isDone = task.stage === InstallStage.DONE;
   const isError = task.stage === InstallStage.ERROR;
+  // When a task fails, `stage` becomes ERROR — fall back to the furthest
+  // stage it actually reached so the failed phase is still displayed.
+  const displayStage = isError && task.lastStage ? task.lastStage : task.stage;
+  const currentStageIndex = getStageIndex(displayStage);
 
   // MCP / Skill don't have the plugin's download + dependency-install stages;
   // show a single "installing → done/failed" row instead of plugin steps.

web/src/app/home/plugins/components/plugin-install-task/PluginInstallTaskContext.tsx

@@ -27,6 +27,9 @@ export interface PluginInstallTask {
   pluginName: string; // display name
   source: 'github' | 'marketplace' | 'local';
   stage: InstallStage;
+  /** Furthest non-terminal stage reached — kept when the task fails so the
+   *  UI can still show which phase failed. */
+  lastStage?: InstallStage;
   overallProgress: number; // 0-100
   extensionType: 'plugin' | 'mcp' | 'skill'; // type of extension being installed
   fileSize?: number; // bytes, if known
@@ -43,6 +46,8 @@ export interface PluginInstallTask {
   depsSpeed?: number; // deps download speed bytes/s
   error?: string;
   startedAt: number; // timestamp
+  /** Timestamp when the current stage began; used for smooth creeping. */
+  stageStartedAt?: number;
   currentAction: string; // raw backend action string
 }
 
@@ -84,42 +89,158 @@ export function usePluginInstallTasks() {
 }
 
 /**
- * Map backend `current_action` to our InstallStage.
+ * Ordered lifecycle stages. Used to enforce forward-only transitions so the
+ * progress bar never moves backwards while a task is running.
  */
-function mapActionToStage(action: string): InstallStage {
-  if (!action) return InstallStage.DOWNLOADING;
-  const lower = action.toLowerCase();
-  if (lower.includes('download')) return InstallStage.DOWNLOADING;
-  if (lower.includes('dependencies') || lower.includes('requirements'))
-    return InstallStage.INSTALLING_DEPS;
-  if (lower.includes('initializ') || lower.includes('setting'))
-    return InstallStage.INSTALLING_DEPS;
-  if (lower.includes('launch')) return InstallStage.INSTALLING_DEPS;
-  if (lower.includes('installed') || lower.includes('complete'))
-    return InstallStage.DONE;
-  return InstallStage.DOWNLOADING;
+const STAGE_ORDER: InstallStage[] = [
+  InstallStage.DOWNLOADING,
+  InstallStage.INSTALLING_DEPS,
+  InstallStage.INITIALIZING,
+  InstallStage.LAUNCHING,
+  InstallStage.DONE,
+];
+
+/**
+ * Lower bound (%) for each stage. A task's progress is never allowed to drop
+ * below the floor of the furthest stage it has already reached.
+ */
+const STAGE_FLOOR: Record<InstallStage, number> = {
+  [InstallStage.DOWNLOADING]: 2,
+  [InstallStage.INSTALLING_DEPS]: 55,
+  [InstallStage.INITIALIZING]: 85,
+  [InstallStage.LAUNCHING]: 94,
+  [InstallStage.DONE]: 100,
+  [InstallStage.ERROR]: 0,
+};
+
+/** Get the lower-bound percentage for a stage. */
+function stageFloor(stage: InstallStage): number {
+  return STAGE_FLOOR[stage] ?? 0;
+}
+
+/** Get the lower bound of the stage that follows the given one. */
+function nextStageFloor(stage: InstallStage): number {
+  const idx = STAGE_ORDER.indexOf(stage);
+  const next = idx >= 0 ? STAGE_ORDER[idx + 1] : undefined;
+  return next ? stageFloor(next) : 100;
+}
+
+/** Return whichever stage is further along in the lifecycle. */
+function maxStage(current: InstallStage, incoming: InstallStage): InstallStage {
+  const currentIdx = STAGE_ORDER.indexOf(current);
+  const incomingIdx = STAGE_ORDER.indexOf(incoming);
+  if (currentIdx === -1) return incoming;
+  if (incomingIdx === -1) return current;
+  return incomingIdx >= currentIdx ? incoming : current;
 }
 
 /**
- * Get overall progress percentage from a stage.
+ * Map backend `current_action` to our InstallStage.
+ *
+ * Unknown / transitional actions must NOT map back to an earlier stage,
+ * otherwise the bar would jump backwards mid-install.
  */
-function stageToProgress(stage: InstallStage): number {
-  switch (stage) {
-    case InstallStage.DOWNLOADING:
-      return 10;
-    case InstallStage.INSTALLING_DEPS:
-      return 70;
-    case InstallStage.INITIALIZING:
-      return 70;
-    case InstallStage.LAUNCHING:
-      return 85;
-    case InstallStage.DONE:
-      return 100;
-    case InstallStage.ERROR:
-      return 0;
-    default:
-      return 0;
+function mapActionToStage(action: string): InstallStage {
+  const lower = (action || '').toLowerCase();
+  if (!lower) return InstallStage.DOWNLOADING;
+
+  // "preparing"/"resolving" happen before any bytes land on disk.
+  if (lower.includes('prepar') || lower.includes('resolv'))
+    return InstallStage.DOWNLOADING;
+
+  if (lower.includes('download') && !lower.includes('dependenc'))
+    return InstallStage.DOWNLOADING;
+
+  // Activation / readiness tail phase — its own slice of the bar.
+  if (
+    lower.includes('launch') ||
+    lower.includes('start') ||
+    lower.includes('wait') ||
+    lower.includes('ready') ||
+    lower.includes('initializ')
+  ) {
+    return InstallStage.LAUNCHING;
   }
+
+  // Dependency installation and package finalization.
+  if (
+    lower.includes('dependenc') ||
+    lower.includes('requirements') ||
+    lower.includes('parsing') ||
+    lower.includes('extract') ||
+    lower.includes('inspect') ||
+    lower.includes('persist') ||
+    lower.includes('stor') ||
+    lower.includes('install') ||
+    lower.includes('setting')
+  ) {
+    return InstallStage.INSTALLING_DEPS;
+  }
+
+  // Unknown transitional actions belong to the busy middle of the install.
+  return InstallStage.INSTALLING_DEPS;
+}
+
+/**
+ * Time-based creep so the bar keeps moving when no counters exist.
+ *
+ * Uses an asymptote so the increment decelerates as it approaches the stage
+ * ceiling — the bar always feels alive but never overshoots into the next
+ * stage's range.
+ */
+function creep(stageStartedAt: number, span: number): number {
+  if (span <= 0) return 0;
+  const elapsed = (Date.now() - stageStartedAt) / 1000;
+  // Approaching `span` asymptotically: after ~60s we are ~86% of the span.
+  const ratio = 1 - Math.exp(-elapsed / 30);
+  return span * ratio;
+}
+
+/**
+ * Compute a progress value for the current stage.
+ *
+ * Real byte / dependency counters drive the value when available; otherwise
+ * the value creeps forward slowly based on elapsed time. Callers are expected
+ * to combine the result with the previous value via `Math.max` so it is
+ * monotonic.
+ */
+function computeStageProgress(
+  task: PluginInstallTask,
+  stage: InstallStage,
+): number {
+  const floor = stageFloor(stage);
+  const ceiling = Math.max(floor, nextStageFloor(stage) - 1);
+  // Creep from when this stage began so a stage change restarts the ramp
+  // instead of inheriting the previous stage's elapsed time.
+  const stageStartedAt = task.stageStartedAt ?? task.startedAt;
+  const creepValue = Math.min(
+    ceiling,
+    floor + creep(stageStartedAt, ceiling - floor),
+  );
+
+  if (stage === InstallStage.DOWNLOADING) {
+    const total = task.downloadTotal ?? task.fileSize;
+    const current = task.downloadCurrent;
+    if (total && total > 0 && current != null && current > 0) {
+      const ratio = Math.min(1, current / total);
+      // Never let a stale counter pull the value below the creep baseline.
+      return Math.max(creepValue, floor + (ceiling - floor) * ratio);
+    }
+    return creepValue;
+  }
+
+  if (stage === InstallStage.INSTALLING_DEPS) {
+    const total = task.depsTotal;
+    const installed = task.depsInstalled;
+    if (total && total > 0 && installed != null && installed > 0) {
+      const ratio = Math.min(1, installed / total);
+      // Leave headroom for the finalize/launch phase that has no counters.
+      return Math.max(creepValue, floor + (ceiling - floor) * ratio * 0.9);
+    }
+    return creepValue;
+  }
+
+  return creepValue;
 }
 
 /**
@@ -146,8 +267,14 @@ function isPluginInstallTask(name: string): boolean {
 
 /**
  * Convert a backend AsyncTask to our PluginInstallTask.
+ *
+ * `previous` (when provided) carries monotonic state forward so re-syncing
+ * after a refresh or a poll cannot make the progress bar move backwards.
  */
-function asyncTaskToPluginInstallTask(task: AsyncTask): PluginInstallTask {
+function asyncTaskToPluginInstallTask(
+  task: AsyncTask,
+  previous?: PluginInstallTask,
+): PluginInstallTask {
   const source = extractSourceFromName(task.name);
   const md = (task.task_context?.metadata ?? {}) as Record<string, unknown>;
   const action = task.task_context?.current_action || '';
@@ -157,24 +284,6 @@ function asyncTaskToPluginInstallTask(task: AsyncTask): PluginInstallTask {
   const num = (v: unknown) => (typeof v === 'number' ? v : undefined);
   const str = (v: unknown) => (typeof v === 'string' ? v : undefined);
 
-  let stage: InstallStage;
-  let overallProgress: number;
-  let error: string | undefined;
-
-  if (done) {
-    if (exception) {
-      stage = InstallStage.ERROR;
-      overallProgress = 0;
-      error = exception;
-    } else {
-      stage = InstallStage.DONE;
-      overallProgress = 100;
-    }
-  } else {
-    stage = mapActionToStage(action);
-    overallProgress = Math.min(95, stageToProgress(stage));
-  }
-
   const pluginName = str(md.plugin_name) || task.label || `${source} extension`;
 
   let extensionType: 'plugin' | 'mcp' | 'skill' = 'plugin';
@@ -184,6 +293,75 @@ function asyncTaskToPluginInstallTask(task: AsyncTask): PluginInstallTask {
     extensionType = 'skill';
   }
 
+  // Prefer the task's real creation time so a refresh (or first sync) restores
+  // the correct elapsed baseline instead of restarting the ramp from zero.
+  const backendStartedAt =
+    typeof task.created_at === 'number' && task.created_at > 0
+      ? task.created_at * 1000
+      : undefined;
+  const startedAt = previous?.startedAt ?? backendStartedAt ?? Date.now();
+  let stageStartedAt =
+    previous?.stageStartedAt ??
+    previous?.startedAt ??
+    backendStartedAt ??
+    startedAt;
+
+  let stage: InstallStage;
+  let overallProgress: number;
+  let error: string | undefined;
+
+  // Furthest non-terminal stage reached, kept across failures.
+  let lastStage = previous?.lastStage ?? previous?.stage;
+
+  if (done) {
+    if (exception) {
+      // Preserve how far the task got before failing, so the bar shows the
+      // failure point instead of jumping back to zero.
+      stage = InstallStage.ERROR;
+      overallProgress = previous?.overallProgress ?? 0;
+      error = exception;
+    } else {
+      stage = InstallStage.DONE;
+      overallProgress = 100;
+    }
+  } else {
+    const incoming = mapActionToStage(action);
+    // Forward-only: never move back to an earlier stage than we already reached.
+    stage = previous ? maxStage(previous.stage, incoming) : incoming;
+    if (!previous || previous.stage !== stage) {
+      stageStartedAt = Date.now();
+    }
+    lastStage = stage;
+
+    const counters: PluginInstallTask = {
+      id: `${source}-${task.id}`,
+      taskId: task.id,
+      pluginName,
+      source,
+      extensionType,
+      stage,
+      overallProgress: 0,
+      downloadCurrent: num(md.download_current) ?? previous?.downloadCurrent,
+      downloadTotal: num(md.download_total) ?? previous?.downloadTotal,
+      downloadSpeed: num(md.download_speed) ?? previous?.downloadSpeed,
+      depsTotal: num(md.deps_total) ?? previous?.depsTotal,
+      depsInstalled: num(md.deps_installed) ?? previous?.depsInstalled,
+      depsRemaining: num(md.deps_remaining) ?? previous?.depsRemaining,
+      currentDep: str(md.current_dep) ?? previous?.currentDep,
+      depsDownloadedSize:
+        num(md.deps_downloaded_size) ?? previous?.depsDownloadedSize,
+      depsSpeed: num(md.deps_speed) ?? previous?.depsSpeed,
+      startedAt,
+      stageStartedAt,
+      currentAction: action,
+    };
+
+    const computed = computeStageProgress(counters, stage);
+    overallProgress = Math.max(previous?.overallProgress ?? 0, computed);
+    // Keep the bar strictly below 100 until the backend confirms completion.
+    overallProgress = Math.round(Math.min(99, overallProgress));
+  }
+
   return {
     id: `${source}-${task.id}`,
     taskId: task.id,
@@ -191,18 +369,21 @@ function asyncTaskToPluginInstallTask(task: AsyncTask): PluginInstallTask {
     source,
     extensionType,
     stage,
+    lastStage,
     overallProgress,
-    downloadCurrent: num(md.download_current),
-    downloadTotal: num(md.download_total),
-    downloadSpeed: num(md.download_speed),
-    depsTotal: num(md.deps_total),
-    depsInstalled: num(md.deps_installed),
-    depsRemaining: num(md.deps_remaining),
-    currentDep: str(md.current_dep),
-    depsDownloadedSize: num(md.deps_downloaded_size),
-    depsSpeed: num(md.deps_speed),
+    downloadCurrent: num(md.download_current) ?? previous?.downloadCurrent,
+    downloadTotal: num(md.download_total) ?? previous?.downloadTotal,
+    downloadSpeed: num(md.download_speed) ?? previous?.downloadSpeed,
+    depsTotal: num(md.deps_total) ?? previous?.depsTotal,
+    depsInstalled: num(md.deps_installed) ?? previous?.depsInstalled,
+    depsRemaining: num(md.deps_remaining) ?? previous?.depsRemaining,
+    currentDep: str(md.current_dep) ?? previous?.currentDep,
+    depsDownloadedSize:
+      num(md.deps_downloaded_size) ?? previous?.depsDownloadedSize,
+    depsSpeed: num(md.deps_speed) ?? previous?.depsSpeed,
     error,
-    startedAt: Date.now(),
+    startedAt,
+    stageStartedAt,
     currentAction: action,
   };
 }
@@ -315,8 +496,11 @@ export function PluginInstallTaskProvider({
                     return {
                       ...t,
                       stage: InstallStage.ERROR,
+                      // Keep the phase that failed for the UI to display.
+                      lastStage: t.lastStage ?? t.stage,
                       error: exception,
-                      overallProgress: 0,
+                      // Show where it failed instead of resetting to 0.
+                      overallProgress: t.overallProgress,
                       currentAction: action,
                       ...progressFields,
                     };
@@ -332,26 +516,28 @@ export function PluginInstallTaskProvider({
                   };
                 }
 
-                const stage = mapActionToStage(action);
-                const baseProgress = stageToProgress(stage);
-                // Add small time-based increment within stage
-                const elapsed = (Date.now() - t.startedAt) / 1000;
-                const withinStageIncrement = Math.min(
-                  15,
-                  Math.floor(elapsed / 2),
-                );
-                const progress = Math.min(
-                  95,
-                  baseProgress + withinStageIncrement,
-                );
+                // Forward-only stage transition.
+                const incoming = mapActionToStage(action);
+                const stage = maxStage(t.stage, incoming);
+                // Reset the per-stage ramp whenever we enter a new stage.
+                const stageAdvanced = stage !== t.stage;
 
-                return {
+                const next: PluginInstallTask = {
                   ...t,
                   stage,
-                  overallProgress: progress,
+                  lastStage: stage,
+                  stageStartedAt: stageAdvanced
+                    ? Date.now()
+                    : (t.stageStartedAt ?? t.startedAt),
                   currentAction: action,
                   ...progressFields,
                 };
+                const computed = computeStageProgress(next, stage);
+                // Progress must never move backwards while the task runs.
+                const overallProgress = Math.round(
+                  Math.min(99, Math.max(t.overallProgress, computed)),
+                );
+                return { ...next, overallProgress };
               }),
             );
           })
@@ -377,46 +563,61 @@ export function PluginInstallTaskProvider({
       );
 
       setTasks((prevTasks) => {
-        const existingTaskIds = new Set(prevTasks.map((t) => t.taskId));
         const updatedTasks = [...prevTasks];
+        // Collect tasks that need polling started after state is committed.
+        const toPoll: Array<{ key: string; taskId: number }> = [];
 
         for (const bt of backendTasks) {
           // Skip tasks that the user has dismissed
           if (dismissedTaskIds.current.has(bt.id)) continue;
 
-          if (!existingTaskIds.has(bt.id)) {
+          const idx = updatedTasks.findIndex((t) => t.taskId === bt.id);
+
+          if (idx === -1) {
             // New task from backend (e.g. after page refresh) — add it
             const newTask = asyncTaskToPluginInstallTask(bt);
             updatedTasks.push(newTask);
 
-            // If not done, start polling for progress
             if (!bt.runtime.done) {
-              pollTask(newTask.id, bt.id);
+              toPoll.push({ key: newTask.id, taskId: bt.id });
             } else {
               // Mark as already notified so we don't re-trigger toasts for old completed tasks
               notifiedTaskIds.current.add(bt.id);
             }
-          } else {
-            // Already tracking — if it's done in backend but still active locally, update it
-            const idx = updatedTasks.findIndex((t) => t.taskId === bt.id);
-            if (idx !== -1) {
-              const existing = updatedTasks[idx];
-              if (
-                bt.runtime.done &&
-                existing.stage !== InstallStage.DONE &&
-                existing.stage !== InstallStage.ERROR
-              ) {
-                const converted = asyncTaskToPluginInstallTask(bt);
-                converted.startedAt = existing.startedAt;
-                converted.pluginName = existing.pluginName;
-                converted.fileSize = existing.fileSize;
-                converted.extensionType = existing.extensionType;
-                updatedTasks[idx] = converted;
-              }
-            }
+            continue;
+          }
+
+          // Already tracking — merge the backend snapshot into the existing
+          // task. Passing `existing` keeps `startedAt`, `pluginName` and
+          // progress monotonic so re-syncing never rewinds the bar.
+          const existing = updatedTasks[idx];
+          const converted = asyncTaskToPluginInstallTask(bt, existing);
+          converted.pluginName = existing.pluginName;
+          converted.fileSize = existing.fileSize;
+          converted.extensionType = existing.extensionType;
+
+          // Never downgrade a terminal task that is already done/failed locally,
+          // unless the backend reports it finished as well.
+          if (
+            (existing.stage === InstallStage.DONE ||
+              existing.stage === InstallStage.ERROR) &&
+            !bt.runtime.done
+          ) {
+            continue;
+          }
+
+          updatedTasks[idx] = converted;
+
+          if (!bt.runtime.done) {
+            toPoll.push({ key: converted.id, taskId: bt.id });
           }
         }
 
+        // Schedule polling outside the state updater.
+        queueMicrotask(() => {
+          toPoll.forEach(({ key, taskId }) => pollTask(key, taskId));
+        });
+
         return updatedTasks;
       });
     } catch {
@@ -464,6 +665,7 @@ export function PluginInstallTaskProvider({
       // Remove from dismissed set if re-added
       dismissedTaskIds.current.delete(params.taskId);
 
+      const startedAt = Date.now();
       const newTask: PluginInstallTask = {
         id: taskKey,
         taskId: params.taskId,
@@ -471,9 +673,11 @@ export function PluginInstallTaskProvider({
         source: params.source,
         extensionType: params.extensionType,
         stage: InstallStage.DOWNLOADING,
-        overallProgress: 5,
+        // Start at the downloading floor and creep up from real counters.
+        overallProgress: stageFloor(InstallStage.DOWNLOADING),
         fileSize: params.fileSize,
-        startedAt: Date.now(),
+        downloadTotal: params.fileSize,
+        startedAt,
         currentAction: '',
       };
 

web/src/app/home/plugins/components/plugin-install-task/PluginInstallTaskQueue.tsx

@@ -7,6 +7,7 @@ import {
   CheckCircle2,
   XCircle,
   Loader2,
+  Rocket,
   X,
   ListTodo,
   Puzzle,
@@ -30,6 +31,7 @@ import { cn } from '@/lib/utils';
 const STAGE_ICONS: Record<string, React.ElementType> = {
   [InstallStage.DOWNLOADING]: Download,
   [InstallStage.INSTALLING_DEPS]: Package,
+  [InstallStage.LAUNCHING]: Rocket,
   [InstallStage.DONE]: CheckCircle2,
   [InstallStage.ERROR]: XCircle,
 };
@@ -95,6 +97,8 @@ function TaskQueueItem({
         return t('plugins.installProgress.downloading');
       case InstallStage.INSTALLING_DEPS:
         return t('plugins.installProgress.installingDeps');
+      case InstallStage.LAUNCHING:
+        return t('plugins.installProgress.launching');
       case InstallStage.DONE:
         return isDone
           ? getInstallCompleteMessage()

web/src/app/home/plugins/components/plugin-market/PluginMarketComponent.tsx

@@ -1,4 +1,11 @@
-import { useState, useEffect, useCallback, useRef, Suspense } from 'react';
+import {
+  useState,
+  useEffect,
+  useCallback,
+  useMemo,
+  useRef,
+  Suspense,
+} from 'react';
 import { useSearchParams } from 'react-router-dom';
 import { Input } from '@/components/ui/input';
 import {
@@ -51,6 +58,10 @@ import { ApiRespMarketplacePlugins } from '@/app/infra/entities/api';
 import { LoadingSpinner } from '@/components/ui/loading-spinner';
 import { Button } from '@/components/ui/button';
 import { PluginTag } from '@/app/infra/http/CloudServiceClient';
+import {
+  resolveInstalledState,
+  useMarketplaceInstalledIndex,
+} from './marketplace-installed';
 
 interface SortOption {
   value: string;
@@ -91,6 +102,20 @@ function MarketPageContent({
   const { t } = useTranslation();
   const [searchParams] = useSearchParams();
 
+  // Installed-extension lookup, recomputed whenever the sidebar lists change
+  // (e.g. right after an install completes).
+  const installedIndex = useMarketplaceInstalledIndex();
+
+  const decorateInstalled = useCallback(
+    (vo: PluginMarketCardVO): PluginMarketCardVO => {
+      const state = resolveInstalledState(installedIndex, vo);
+      vo.installed = state.installed;
+      vo.hasUpdate = state.hasUpdate;
+      return vo;
+    },
+    [installedIndex],
+  );
+
   const validTypes = ['plugin', 'mcp', 'skill'];
 
   const extensionTypeOptions = [
@@ -571,7 +596,12 @@ function MarketPageContent({
     };
   }, []);
 
-  const visiblePlugins = plugins;
+  // Decorate with installed state at render time so the badge updates the
+  // moment the sidebar lists refresh (e.g. after an install completes).
+  const visiblePlugins = useMemo(
+    () => plugins.map((plugin) => decorateInstalled(plugin)),
+    [plugins, decorateInstalled],
+  );
 
   // 加载更多
   const loadMore = useCallback(() => {

web/src/app/home/plugins/components/plugin-market/RecommendationLists.tsx

@@ -8,6 +8,10 @@ import { I18nObject } from '@/app/infra/entities/common';
 import { extractI18nObject } from '@/i18n/I18nProvider';
 import { getCloudServiceClientSync } from '@/app/infra/http';
 import { useTranslation } from 'react-i18next';
+import {
+  resolveInstalledState,
+  useMarketplaceInstalledIndex,
+} from './marketplace-installed';
 
 export interface RecommendationList {
   uuid: string;
@@ -66,6 +70,7 @@ function RecommendationListRow({
   isLast: boolean;
 }) {
   const { t } = useTranslation();
+  const installedIndex = useMarketplaceInstalledIndex();
   const [page, setPage] = useState(0);
   const [perPage, setPerPage] = useState(4);
   // Countdown progress to the next auto-advance, 0 → 1 over AUTO_ADVANCE_MS.
@@ -261,16 +266,22 @@ function RecommendationListRow({
         ref={gridRef}
         className="grid gap-6 [grid-template-columns:repeat(auto-fill,minmax(min(100%,24rem),1fr))]"
       >
-        {visiblePlugins.map((plugin) => (
-          <PluginMarketCardComponent
-            key={plugin.author + ' / ' + plugin.name}
-            cardVO={pluginToVO(plugin, t)}
-            tagNames={tagNames}
-            onInstall={onInstall}
-            installDisabled={installDisabled}
-            installDisabledTooltip={installDisabledTooltip}
-          />
-        ))}
+        {visiblePlugins.map((plugin) => {
+          const cardVO = pluginToVO(plugin, t);
+          const state = resolveInstalledState(installedIndex, cardVO);
+          cardVO.installed = state.installed;
+          cardVO.hasUpdate = state.hasUpdate;
+          return (
+            <PluginMarketCardComponent
+              key={plugin.author + ' / ' + plugin.name}
+              cardVO={cardVO}
+              tagNames={tagNames}
+              onInstall={onInstall}
+              installDisabled={installDisabled}
+              installDisabledTooltip={installDisabledTooltip}
+            />
+          );
+        })}
       </div>
       {totalPages > 1 && !isLast && (
         <div className="border-b border-border mt-6" />

web/src/app/home/plugins/components/plugin-market/marketplace-installed.ts

@@ -0,0 +1,85 @@
+import { useMemo } from 'react';
+import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataContext';
+
+export interface MarketplaceInstalledState {
+  installed: boolean;
+  hasUpdate: boolean;
+}
+
+export interface InstalledIndexEntry {
+  hasUpdate: boolean;
+}
+
+/** Composite key used to look up installed extensions: `type:author/name`. */
+export function installedExtensionKey(
+  type: string | undefined,
+  author: string,
+  name: string,
+): string {
+  return `${type || 'plugin'}:${author}/${name}`;
+}
+
+/**
+ * Build a lookup of already-installed extensions.
+ *
+ * The sidebar identifies each kind differently:
+ * - plugins: `author/name`
+ * - MCP servers: `author__name` (double underscore)
+ * - skills: the bare skill name
+ */
+export function buildInstalledIndex(
+  plugins: { id: string; hasUpdate?: boolean }[],
+  mcpServers: { id: string }[],
+  skills: { id: string }[],
+): Map<string, InstalledIndexEntry> {
+  const index = new Map<string, InstalledIndexEntry>();
+  for (const plugin of plugins) {
+    index.set(`plugin:${plugin.id}`, { hasUpdate: plugin.hasUpdate ?? false });
+  }
+  for (const server of mcpServers) {
+    index.set(`mcp:${server.id.replace(/__/g, '/')}`, { hasUpdate: false });
+  }
+  for (const skill of skills) {
+    index.set(`skill:${skill.id}`, { hasUpdate: false });
+  }
+  return index;
+}
+
+/**
+ * Resolve whether a marketplace extension is installed.
+ *
+ * Marketplace entries always use `author/name`; skills may be stored under
+ * their bare name, so both keys are checked for that case.
+ */
+export function resolveInstalledState(
+  index: Map<string, InstalledIndexEntry>,
+  extension: { type?: string; author: string; pluginName: string },
+): MarketplaceInstalledState {
+  const type = extension.type || 'plugin';
+  const keys = [
+    `${type}:${extension.author}/${extension.pluginName}`,
+    `${type}:${extension.pluginName}`,
+  ];
+  for (const key of keys) {
+    const entry = index.get(key);
+    if (entry) {
+      return { installed: true, hasUpdate: entry.hasUpdate };
+    }
+  }
+  return { installed: false, hasUpdate: false };
+}
+
+/**
+ * Reactive installed-extension index derived from the sidebar data context.
+ * Recomputes automatically after an install finishes and the sidebar refreshes.
+ */
+export function useMarketplaceInstalledIndex(): Map<
+  string,
+  InstalledIndexEntry
+> {
+  const { plugins, mcpServers, skills } = useSidebarData();
+  return useMemo(
+    () => buildInstalledIndex(plugins, mcpServers, skills),
+    [plugins, mcpServers, skills],
+  );
+}

web/src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardComponent.tsx

@@ -3,7 +3,14 @@ import { useRef, useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import PluginComponentList from '../PluginComponentList';
 import { Badge } from '@/components/ui/badge';
-import { Info, Package, ExternalLink, Heart, Loader2 } from 'lucide-react';
+import {
+  CheckCircle2,
+  Info,
+  Package,
+  ExternalLink,
+  Heart,
+  Loader2,
+} from 'lucide-react';
 import {
   Tooltip,
   TooltipContent,
@@ -48,6 +55,10 @@ export default function PluginMarketCardComponent({
     return keys.length > 0 && keys.every((k) => k === 'KnowledgeRetriever');
   })();
 
+  // Already installed → swap the download count for an "installed" marker.
+  // Click behaviour stays identical to a normal card.
+  const isInstalled = cardVO.installed === true;
+
   const showTypeBadge = cardVO.type;
   const typeLabel =
     cardVO.type === 'mcp'
@@ -320,23 +331,34 @@ export default function PluginMarketCardComponent({
           className="w-full flex flex-row items-center justify-between gap-2 px-0 sm:px-[0.4rem] flex-shrink-0 overflow-hidden"
         >
           <div className="flex flex-row items-center justify-start gap-2 min-w-0 overflow-hidden">
-            <div className="flex flex-row items-center gap-[0.3rem] sm:gap-[0.4rem] flex-shrink-0">
-              <svg
-                className="w-4 h-4 sm:w-[1.2rem] sm:h-[1.2rem] text-[#2563eb] dark:text-[#5b8def] flex-shrink-0"
-                xmlns="http://www.w3.org/2000/svg"
-                viewBox="0 0 24 24"
-                fill="none"
-                stroke="currentColor"
-                strokeWidth="2"
-              >
-                <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
-                <polyline points="7,10 12,15 17,10" />
-                <line x1="12" y1="15" x2="12" y2="3" />
-              </svg>
-              <div className="text-xs sm:text-sm text-[#2563eb] dark:text-[#5b8def] font-medium whitespace-nowrap">
-                {cardVO.installCount?.toLocaleString() ?? '0'}
+            {/* Installed extensions replace the download count with an
+                "installed" marker so the card reflects local state. */}
+            {isInstalled ? (
+              <div className="flex flex-row items-center gap-[0.3rem] sm:gap-[0.4rem] flex-shrink-0">
+                <CheckCircle2 className="w-4 h-4 sm:w-[1.2rem] sm:h-[1.2rem] text-green-600 dark:text-green-400 flex-shrink-0" />
+                <div className="text-xs sm:text-sm text-green-600 dark:text-green-400 font-medium whitespace-nowrap">
+                  {t('market.installed')}
+                </div>
               </div>
-            </div>
+            ) : (
+              <div className="flex flex-row items-center gap-[0.3rem] sm:gap-[0.4rem] flex-shrink-0">
+                <svg
+                  className="w-4 h-4 sm:w-[1.2rem] sm:h-[1.2rem] text-[#2563eb] dark:text-[#5b8def] flex-shrink-0"
+                  xmlns="http://www.w3.org/2000/svg"
+                  viewBox="0 0 24 24"
+                  fill="none"
+                  stroke="currentColor"
+                  strokeWidth="2"
+                >
+                  <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+                  <polyline points="7,10 12,15 17,10" />
+                  <line x1="12" y1="15" x2="12" y2="3" />
+                </svg>
+                <div className="text-xs sm:text-sm text-[#2563eb] dark:text-[#5b8def] font-medium whitespace-nowrap">
+                  {cardVO.installCount?.toLocaleString() ?? '0'}
+                </div>
+              </div>
+            )}
 
             {cardVO.tags && cardVO.tags.length > 0 && visibleTags > 0 && (
               <div className="flex flex-row items-center gap-1.5 overflow-hidden flex-shrink min-w-0">

web/src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardVO.ts

@@ -12,6 +12,10 @@ export interface IPluginMarketCardVO {
   components?: Record<string, number>;
   tags?: string[];
   type?: 'plugin' | 'mcp' | 'skill';
+  /** Whether this extension is already installed in the current workspace. */
+  installed?: boolean;
+  /** Whether an installed extension has a newer marketplace version. */
+  hasUpdate?: boolean;
 }
 
 export class PluginMarketCardVO implements IPluginMarketCardVO {
@@ -28,6 +32,8 @@ export class PluginMarketCardVO implements IPluginMarketCardVO {
   components?: Record<string, number>;
   tags?: string[];
   type?: 'plugin' | 'mcp' | 'skill';
+  installed?: boolean;
+  hasUpdate?: boolean;
 
   constructor(prop: IPluginMarketCardVO) {
     this.description = prop.description;
@@ -43,5 +49,7 @@ export class PluginMarketCardVO implements IPluginMarketCardVO {
     this.components = prop.components;
     this.tags = prop.tags;
     this.type = prop.type;
+    this.installed = prop.installed ?? false;
+    this.hasUpdate = prop.hasUpdate ?? false;
   }
 }

web/src/app/infra/entities/api/index.ts

@@ -460,6 +460,8 @@ export interface AsyncTask {
   name: string;
   label: string;
   task_type: string; // system or user
+  /** Unix epoch seconds (float) when the task was created. */
+  created_at?: number;
   runtime: AsyncTaskRuntimeInfo;
   task_context: AsyncTaskTaskContext;
 }

web/src/app/infra/http/BackendClient.ts

@@ -1241,21 +1241,10 @@ export class BackendClient extends BaseHttpClient {
     );
   }
 
-  public authUser(
-    user: string,
-    password: string,
-    secondFactor?: { totpCode?: string; recoveryCode?: string },
-  ): Promise<ApiRespUserToken> {
+  public authUser(user: string, password: string): Promise<ApiRespUserToken> {
     return this.post(
       '/api/v1/user/auth',
-      {
-        user,
-        password,
-        ...(secondFactor?.totpCode ? { totp_code: secondFactor.totpCode } : {}),
-        ...(secondFactor?.recoveryCode
-          ? { recovery_code: secondFactor.recoveryCode }
-          : {}),
-      },
+      { user, password },
       { skipWorkspace: true },
     );
   }
@@ -1268,25 +1257,15 @@ export class BackendClient extends BaseHttpClient {
 
   public resetPassword(
     user: string,
+    recoveryKey: string,
     newPassword: string,
-    factor:
-      | { recoveryKey: string }
-      | { totpCode: string }
-      | { recoveryCode: string },
   ): Promise<{ user: string }> {
     return this.post(
       '/api/v1/user/reset-password',
       {
         user,
+        recovery_key: recoveryKey,
         new_password: newPassword,
-        // Exactly one proof-of-ownership factor is accepted by the backend.
-        ...('recoveryKey' in factor
-          ? { recovery_key: factor.recoveryKey }
-          : {}),
-        ...('totpCode' in factor ? { totp_code: factor.totpCode } : {}),
-        ...('recoveryCode' in factor
-          ? { recovery_code: factor.recoveryCode }
-          : {}),
       },
       { skipWorkspace: true },
     );
@@ -1311,7 +1290,6 @@ export class BackendClient extends BaseHttpClient {
     user: string;
     account_type: 'local' | 'space';
     has_password: boolean;
-    totp_enabled?: boolean;
   }> {
     return this.get('/api/v1/user/info', undefined, { skipWorkspace: true });
   }
@@ -1328,28 +1306,12 @@ export class BackendClient extends BaseHttpClient {
     space_login_enabled?: boolean;
     passkey_login_enabled?: boolean;
     passkey_supported?: boolean;
-    totp_supported?: boolean;
   }> {
     return this.get('/api/v1/user/account-info', undefined, {
       skipWorkspace: true,
     });
   }
 
-  /**
-   * Whether the account identified by the given email has TOTP enabled.
-   *
-   * This endpoint is unauthenticated so the password-recovery page can decide
-   * whether to offer the TOTP / recovery-code verification methods. The
-   * response only exposes the boolean capability.
-   */
-  public checkTotpForEmail(user: string): Promise<{ totp_enabled: boolean }> {
-    return this.post(
-      '/api/v1/user/totp/check',
-      { user },
-      { skipWorkspace: true },
-    );
-  }
-
   // ============ Passkey (WebAuthn) API ============
   public getPasskeyAuthOptions(
     email?: string,
@@ -1428,51 +1390,6 @@ export class BackendClient extends BaseHttpClient {
     });
   }
 
-  // ============ TOTP (2FA) API ============
-  public getTotpStatus(): Promise<{
-    enabled: boolean;
-    remaining_recovery_codes: number;
-  }> {
-    return this.get('/api/v1/user/totp/status', undefined, {
-      skipWorkspace: true,
-    });
-  }
-
-  public beginTotpEnrollment(): Promise<{
-    secret: string;
-    otpauth_uri: string;
-    qr_svg: string;
-    recovery_codes: string[];
-  }> {
-    return this.post('/api/v1/user/totp/enroll', {}, { skipWorkspace: true });
-  }
-
-  public verifyTotpEnrollment(code: string): Promise<{ enabled: boolean }> {
-    return this.post(
-      '/api/v1/user/totp/enroll/verify',
-      { code },
-      { skipWorkspace: true },
-    );
-  }
-
-  public regenerateTotpRecoveryCodes(
-    code: string,
-  ): Promise<{ recovery_codes: string[] }> {
-    return this.post(
-      '/api/v1/user/totp/recovery-codes',
-      { code },
-      { skipWorkspace: true },
-    );
-  }
-
-  public disableTotp(code: string): Promise<{ success: boolean }> {
-    return this.post(
-      '/api/v1/user/totp/disable',
-      { code },
-      { skipWorkspace: true },
-    );
-  }
-
   // ============ Workspace API ============
   public getWorkspaceBootstrap(): Promise<WorkspaceBootstrapResponse> {
     return this.get('/api/v1/workspaces/bootstrap', undefined, {

web/src/app/login/page.tsx

@@ -36,7 +36,6 @@ import {
   RefreshCw,
   Layers,
   Fingerprint,
-  ShieldCheck,
 } from 'lucide-react';
 import { startAuthentication } from '@simplewebauthn/browser';
 import langbotIcon from '@/app/assets/langbot-logo.webp';
@@ -72,15 +71,6 @@ export default function Login() {
   const [loadError, setLoadError] = useState<string | null>(null);
   const [retrying, setRetrying] = useState(false);
   const autoSpaceLoginStarted = useRef(false);
-  // Second-factor state: when /auth replies with totp_required we keep the
-  // credentials and ask for a TOTP or recovery code instead of a password.
-  const [totpRequired, setTotpRequired] = useState(false);
-  const [totpCode, setTotpCode] = useState('');
-  const [totpSubmitting, setTotpSubmitting] = useState(false);
-  const [pendingCredentials, setPendingCredentials] = useState<{
-    username: string;
-    password: string;
-  } | null>(null);
 
   const form = useForm<z.infer<ReturnType<typeof formSchema>>>({
     resolver: zodResolver(formSchema(t)),
@@ -233,49 +223,11 @@ export default function Login() {
           toast.success(t('common.loginSuccess'));
         }
       })
-      .catch((error: unknown) => {
-        const apiError = error as { code?: string };
-        if (apiError?.code === 'totp_required') {
-          // Password was accepted; the account additionally requires TOTP.
-          setPendingCredentials({ username, password });
-          setTotpCode('');
-          setTotpRequired(true);
-          return;
-        }
+      .catch(() => {
         toast.error(t('common.loginFailed'));
       });
   }
 
-  async function handleTotpSubmit() {
-    if (!pendingCredentials || !totpCode.trim()) {
-      return;
-    }
-    setTotpSubmitting(true);
-    try {
-      const code = totpCode.trim();
-      // A recovery code is longer than six digits; treat it as such so users
-      // can sign in even when the authenticator is unavailable.
-      const isRecoveryCode = code.replace(/\s/g, '').length !== 6;
-      const res = await httpClient.authUser(
-        pendingCredentials.username,
-        pendingCredentials.password,
-        isRecoveryCode ? { recoveryCode: code } : { totpCode: code },
-      );
-      setTotpRequired(false);
-      setPendingCredentials(null);
-      if (await finishLogin(res.token, pendingCredentials.username)) {
-        toast.success(t('common.loginSuccess'));
-      }
-    } catch (error: unknown) {
-      const apiError = error as { code?: string; message?: string };
-      // Keep the second-factor step open so the user can retry; surface the
-      // server message when available.
-      toast.error(apiError?.message || t('common.loginTotpInvalid'));
-    } finally {
-      setTotpSubmitting(false);
-    }
-  }
-
   const handleSpaceLoginClick = useCallback(async () => {
     setSpaceLoading(true);
     try {
@@ -384,67 +336,8 @@ export default function Login() {
           </CardDescription>
         </CardHeader>
         <CardContent className="space-y-6">
-          {/* TOTP second-factor step: shown after the password is accepted. */}
-          {totpRequired && (
-            <div className="space-y-4">
-              <div className="flex flex-col items-center gap-1 text-center">
-                <ShieldCheck className="h-8 w-8 text-primary" />
-                <p className="text-sm font-medium">
-                  {t('common.loginTotpTitle')}
-                </p>
-                <p className="text-xs text-muted-foreground">
-                  {t('common.loginTotpDesc')}
-                </p>
-              </div>
-              <div className="relative">
-                <ShieldCheck className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                <Input
-                  value={totpCode}
-                  onChange={(e) => setTotpCode(e.target.value)}
-                  placeholder={t('common.loginTotpPlaceholder')}
-                  className="pl-10 font-mono tracking-widest"
-                  inputMode="text"
-                  autoComplete="one-time-code"
-                  autoFocus
-                  onKeyDown={(e) => {
-                    if (e.key === 'Enter') {
-                      void handleTotpSubmit();
-                    }
-                  }}
-                />
-              </div>
-              <Button
-                type="button"
-                className="w-full cursor-pointer"
-                onClick={handleTotpSubmit}
-                disabled={totpSubmitting || !totpCode.trim()}
-              >
-                {totpSubmitting ? (
-                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                ) : (
-                  <ShieldCheck className="mr-2 h-4 w-4" />
-                )}
-                {totpSubmitting
-                  ? t('common.loginTotpVerifying')
-                  : t('common.loginTotpVerify')}
-              </Button>
-              <Button
-                type="button"
-                variant="ghost"
-                className="w-full cursor-pointer"
-                onClick={() => {
-                  setTotpRequired(false);
-                  setPendingCredentials(null);
-                  setTotpCode('');
-                }}
-              >
-                {t('common.backToLogin')}
-              </Button>
-            </div>
-          )}
-
           {/* Space and password login are per-account capabilities. */}
-          {!totpRequired && showSpaceLogin && (
+          {showSpaceLogin && (
             <div className="space-y-3">
               <Button
                 type="button"
@@ -462,7 +355,7 @@ export default function Login() {
             </div>
           )}
 
-          {!totpRequired && showPasskeyLogin && (
+          {showPasskeyLogin && (
             <div className="space-y-3">
               <Button
                 type="button"
@@ -482,23 +375,21 @@ export default function Login() {
           )}
 
           {/* Divider - only show if both login methods are available */}
-          {!totpRequired &&
-            (showSpaceLogin || showPasskeyLogin) &&
-            showLocalLogin && (
-              <div className="relative">
-                <div className="absolute inset-0 flex items-center">
-                  <span className="w-full border-t" />
-                </div>
-                <div className="relative flex justify-center text-xs uppercase">
-                  <span className="bg-white dark:bg-card px-2 text-muted-foreground">
-                    {t('common.or')}
-                  </span>
-                </div>
+          {(showSpaceLogin || showPasskeyLogin) && showLocalLogin && (
+            <div className="relative">
+              <div className="absolute inset-0 flex items-center">
+                <span className="w-full border-t" />
               </div>
-            )}
+              <div className="relative flex justify-center text-xs uppercase">
+                <span className="bg-white dark:bg-card px-2 text-muted-foreground">
+                  {t('common.or')}
+                </span>
+              </div>
+            </div>
+          )}
 
           {/* Password login remains available to every account with a password. */}
-          {!totpRequired && showLocalLogin && (
+          {showLocalLogin && (
             <Form {...form}>
               <form
                 onSubmit={form.handleSubmit(onSubmit)}

web/src/app/register/page.tsx

@@ -22,7 +22,7 @@ import {
 import { useEffect, useState } from 'react';
 import { httpClient } from '@/app/infra/http/HttpClient';
 import { useNavigate } from 'react-router-dom';
-import { Mail, Lock, Loader2, Info, Layers, ShieldCheck } from 'lucide-react';
+import { Mail, Lock, Loader2, Info, Layers } from 'lucide-react';
 import {
   Popover,
   PopoverContent,
@@ -236,11 +236,6 @@ export default function Register() {
                   >
                     {t('register.registerWithPassword')}
                   </Button>
-                  {/* Recommend enabling TOTP once the account exists */}
-                  <p className="flex items-start gap-1.5 text-xs text-muted-foreground">
-                    <ShieldCheck className="mt-0.5 h-3.5 w-3.5 shrink-0 text-primary" />
-                    <span>{t('register.totpHint')}</span>
-                  </p>
                 </form>
               </Form>
             </>

web/src/app/reset-password/page.tsx

@@ -19,24 +19,19 @@ import {
   FormMessage,
   FormDescription,
 } from '@/components/ui/form';
-import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
-import { useEffect, useState } from 'react';
+import { useState } from 'react';
 import { httpClient } from '@/app/infra/http/HttpClient';
 import { useNavigate } from 'react-router-dom';
-import { Mail, Lock, ArrowLeft, KeyRound, ShieldCheck } from 'lucide-react';
+import { Mail, Lock, ArrowLeft, KeyRound } from 'lucide-react';
 import { toast } from 'sonner';
 import { useTranslation } from 'react-i18next';
 import { Link } from 'react-router-dom';
 import { ThemeToggle } from '@/components/ui/theme-toggle';
 
-type RecoveryMethod = 'recoveryKey' | 'totp' | 'recoveryCode';
-
 const formSchema = (t: (key: string) => string) =>
   z.object({
     email: z.string().email(t('common.invalidEmail')),
-    recoveryKey: z.string().optional(),
-    totpCode: z.string().optional(),
-    recoveryCode: z.string().optional(),
+    recoveryKey: z.string().min(1, t('resetPassword.recoveryKeyRequired')),
     newPassword: z.string().min(1, t('resetPassword.newPasswordRequired')),
   });
 
@@ -44,129 +39,34 @@ export default function ResetPassword() {
   const navigate = useNavigate();
   const { t } = useTranslation();
   const [isResetting, setIsResetting] = useState(false);
-  const [method, setMethod] = useState<RecoveryMethod>('recoveryKey');
-  // Whether TOTP is enabled for the email currently entered. `null` means we have
-  // not yet resolved it (empty/invalid email), so the TOTP methods stay disabled
-  // until we can confirm the account actually enrolled one.
-  const [totpEnabledForEmail, setTotpEnabledForEmail] = useState<
-    boolean | null
-  >(null);
 
   const form = useForm<z.infer<ReturnType<typeof formSchema>>>({
     resolver: zodResolver(formSchema(t)),
     defaultValues: {
       email: '',
       recoveryKey: '',
-      totpCode: '',
-      recoveryCode: '',
       newPassword: '',
     },
   });
 
-  // Watch the email so we can resolve, per account, whether TOTP is enabled.
-  const email = form.watch('email');
-
-  // Resolve whether the entered email has TOTP enabled; only then may the user
-  // pick the TOTP / recovery-code verification methods. While unresolved (empty
-  // or invalid email) both TOTP methods stay disabled, so an account without
-  // TOTP can never select them.
-  useEffect(() => {
-    if (!email || !z.string().email().safeParse(email).success) {
-      setTotpEnabledForEmail(null);
-      setMethod('recoveryKey');
-      return;
-    }
-    let cancelled = false;
-    // Debounce so we only query once the user pauses typing.
-    const timer = setTimeout(() => {
-      httpClient
-        .checkTotpForEmail(email)
-        .then((res) => {
-          if (cancelled) {
-            return;
-          }
-          setTotpEnabledForEmail(res.totp_enabled);
-          if (!res.totp_enabled) {
-            setMethod('recoveryKey');
-          }
-        })
-        .catch(() => {
-          if (!cancelled) {
-            // Fail closed: if we cannot confirm TOTP, only the recovery key is
-            // offered rather than letting an unverified TOTP path through.
-            setTotpEnabledForEmail(null);
-            setMethod('recoveryKey');
-          }
-        });
-    }, 400);
-    return () => {
-      cancelled = true;
-      clearTimeout(timer);
-    };
-  }, [email]);
-
-  const totpMethodsDisabled = totpEnabledForEmail !== true;
-
   function onSubmit(values: z.infer<ReturnType<typeof formSchema>>) {
-    if (method === 'recoveryKey') {
-      if (!values.recoveryKey || !values.recoveryKey.trim()) {
-        toast.error(t('resetPassword.recoveryKeyRequired'));
-        return;
-      }
-      handleResetPassword(
-        values.email,
-        { recoveryKey: values.recoveryKey.trim() },
-        values.newPassword,
-      );
-      return;
-    }
-    if (method === 'totp') {
-      if (!values.totpCode || !values.totpCode.trim()) {
-        toast.error(t('resetPassword.totpCodeRequired'));
-        return;
-      }
-      handleResetPassword(
-        values.email,
-        { totpCode: values.totpCode.trim() },
-        values.newPassword,
-      );
-      return;
-    }
-    if (!values.recoveryCode || !values.recoveryCode.trim()) {
-      toast.error(t('resetPassword.recoveryCodeRequired'));
-      return;
-    }
-    handleResetPassword(
-      values.email,
-      { recoveryCode: values.recoveryCode.trim() },
-      values.newPassword,
-    );
+    handleResetPassword(values.email, values.recoveryKey, values.newPassword);
   }
 
   function handleResetPassword(
     email: string,
-    factor:
-      | { recoveryKey: string }
-      | { totpCode: string }
-      | { recoveryCode: string },
+    recoveryKey: string,
     newPassword: string,
   ) {
     setIsResetting(true);
     httpClient
-      .resetPassword(email, newPassword, factor)
+      .resetPassword(email, recoveryKey, newPassword)
       .then(() => {
         toast.success(t('resetPassword.resetSuccess'));
         navigate('/login');
       })
-      .catch((error: unknown) => {
-        const apiError = error as { code?: string };
-        if (apiError?.code === 'totp_not_enabled') {
-          toast.error(t('resetPassword.totpNotEnabled'));
-        } else if (apiError?.code === 'totp_invalid_code') {
-          toast.error(t('resetPassword.invalidTotpCode'));
-        } else {
-          toast.error(t('resetPassword.resetFailed'));
-        }
+      .catch(() => {
+        toast.error(t('resetPassword.resetFailed'));
       })
       .finally(() => {
         setIsResetting(false);
@@ -218,124 +118,32 @@ export default function ResetPassword() {
                 )}
               />
 
-              {/* Recovery method selector: recovery key, TOTP, or recovery code.
-                  The TOTP-based methods are only selectable once we have
-                  confirmed the entered account actually enrolled TOTP. */}
-              <div className="space-y-3">
-                <FormLabel>{t('resetPassword.verifyMethod')}</FormLabel>
-                <Tabs
-                  value={method}
-                  onValueChange={(v) => setMethod(v as RecoveryMethod)}
-                >
-                  <TabsList className="w-full">
-                    <TabsTrigger value="recoveryKey" className="flex-1">
-                      {t('resetPassword.recoveryKey')}
-                    </TabsTrigger>
-                    <TabsTrigger
-                      value="totp"
-                      className="flex-1"
-                      disabled={totpMethodsDisabled}
-                    >
-                      {t('resetPassword.totpMethod')}
-                    </TabsTrigger>
-                    <TabsTrigger
-                      value="recoveryCode"
-                      className="flex-1"
-                      disabled={totpMethodsDisabled}
-                    >
-                      {t('resetPassword.recoveryCodeMethod')}
-                    </TabsTrigger>
-                  </TabsList>
-                </Tabs>
-                {totpMethodsDisabled && (
-                  <p className="text-xs text-muted-foreground">
-                    {t('resetPassword.totpMethodsUnavailable')}
-                  </p>
+              <FormField
+                control={form.control}
+                name="recoveryKey"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('resetPassword.recoveryKey')}</FormLabel>
+                    <FormDescription>
+                      {t('resetPassword.recoveryKeyDescription')}
+                    </FormDescription>
+                    <FormControl>
+                      {/* Recovery keys are case-sensitive base64url strings; send them verbatim */}
+                      <div className="relative">
+                        <KeyRound className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
+                        <Input
+                          placeholder={t('resetPassword.enterRecoveryKey')}
+                          className="pl-10 font-mono"
+                          autoComplete="off"
+                          spellCheck={false}
+                          {...field}
+                        />
+                      </div>
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
                 )}
-              </div>
-
-              {method === 'recoveryKey' && (
-                <FormField
-                  control={form.control}
-                  name="recoveryKey"
-                  render={({ field }) => (
-                    <FormItem>
-                      <FormLabel>{t('resetPassword.recoveryKey')}</FormLabel>
-                      <FormDescription>
-                        {t('resetPassword.recoveryKeyDescription')}
-                      </FormDescription>
-                      <FormControl>
-                        {/* Recovery keys are case-sensitive base64url strings; send them verbatim */}
-                        <div className="relative">
-                          <KeyRound className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                          <Input
-                            placeholder={t('resetPassword.enterRecoveryKey')}
-                            className="pl-10 font-mono"
-                            autoComplete="off"
-                            spellCheck={false}
-                            {...field}
-                          />
-                        </div>
-                      </FormControl>
-                      <FormMessage />
-                    </FormItem>
-                  )}
-                />
-              )}
-
-              {method === 'totp' && (
-                <FormField
-                  control={form.control}
-                  name="totpCode"
-                  render={({ field }) => (
-                    <FormItem>
-                      <FormLabel>{t('resetPassword.totpCode')}</FormLabel>
-                      <FormDescription>
-                        {t('resetPassword.totpMethodDescription')}
-                      </FormDescription>
-                      <FormControl>
-                        <div className="relative">
-                          <ShieldCheck className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                          <Input
-                            placeholder={t('resetPassword.enterTotpCode')}
-                            className="pl-10 font-mono tracking-widest"
-                            inputMode="numeric"
-                            autoComplete="one-time-code"
-                            maxLength={6}
-                            {...field}
-                          />
-                        </div>
-                      </FormControl>
-                      <FormMessage />
-                    </FormItem>
-                  )}
-                />
-              )}
-
-              {method === 'recoveryCode' && (
-                <FormField
-                  control={form.control}
-                  name="recoveryCode"
-                  render={({ field }) => (
-                    <FormItem>
-                      <FormLabel>{t('resetPassword.recoveryCode')}</FormLabel>
-                      <FormControl>
-                        <div className="relative">
-                          <ShieldCheck className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                          <Input
-                            placeholder={t('resetPassword.enterRecoveryCode')}
-                            className="pl-10 font-mono"
-                            autoComplete="off"
-                            spellCheck={false}
-                            {...field}
-                          />
-                        </div>
-                      </FormControl>
-                      <FormMessage />
-                    </FormItem>
-                  )}
-                />
-              )}
+              />
 
               <FormField
                 control={form.control}

web/src/i18n/locales/en-US.ts

@@ -90,13 +90,6 @@ const enUS = {
     passkeyLoginSuccess: 'Passkey verified successfully, signing in...',
     passkeyLoginFailed: 'Failed to sign in with Passkey',
     passkeyNotSupported: 'Passkey is not supported on this browser or device',
-    loginTotpTitle: 'Two-Factor Verification',
-    loginTotpDesc:
-      'Enter the 6-digit code from your authenticator app, or a recovery code',
-    loginTotpPlaceholder: 'Authenticator or recovery code',
-    loginTotpVerify: 'Verify',
-    loginTotpVerifying: 'Verifying...',
-    loginTotpInvalid: 'Invalid code, please try again',
     spaceLoginTitle: 'Login with LangBot Account',
     spaceLoginDescription:
       'Scan the QR code or visit the link below to authorize',
@@ -755,6 +748,9 @@ const enUS = {
       'Are you sure you want to install plugin "{{name}}" ({{version}})?',
     downloadComplete: 'Plugin "{{name}}" download completed',
     installFailed: 'Installation failed, please try again later',
+    installed: 'Installed',
+    updateAvailable: 'Update available',
+    alreadyInstalled: '{{name}} is already installed',
     loadFailed: 'Failed to get plugin list, please try again later',
     noDescription: 'No description available',
     recommendation: {
@@ -1286,8 +1282,6 @@ const enUS = {
     registerWithPassword: 'Register with email and password',
     initSuccess: 'Initialization successful, please login',
     initFailed: 'Initialization failed: ',
-    totpHint:
-      'Recommended: enable two-factor authentication (TOTP) after signing in to secure your account.',
   },
   resetPassword: {
     title: 'Reset Password 🔐',
@@ -1307,22 +1301,6 @@ const enUS = {
     resetFailed:
       'Password reset failed, please check your email and recovery key',
     backToLogin: 'Back to Login',
-    totpMethod: 'TOTP Authenticator',
-    recoveryCodeMethod: 'Recovery Code',
-    verifyMethod: 'Verification Method',
-    totpMethodsUnavailable:
-      'TOTP is not enabled for this account; only the recovery key can be used.',
-    totpCode: 'Authenticator Code',
-    enterTotpCode: 'Enter the 6-digit code from your authenticator app',
-    recoveryCode: 'Recovery Code',
-    enterRecoveryCode: 'Enter one of your recovery codes',
-    totpCodeRequired: 'Authenticator code cannot be empty',
-    recoveryCodeRequired: 'Recovery code cannot be empty',
-    totpNotEnabled:
-      'TOTP is not enabled for this account, use the recovery key instead',
-    invalidTotpCode: 'Invalid verification code, please try again',
-    totpMethodDescription:
-      'Verify with a TOTP authenticator app or one of your recovery codes',
   },
   embedding: {
     description: 'Manage Embedding models for text vectorization',
@@ -1382,38 +1360,6 @@ const enUS = {
     passkeyAddedSuccess: 'Passkey added successfully',
     passkeyDeleteSuccess: 'Passkey deleted',
     passkeyRenameSuccess: 'Passkey renamed successfully',
-    totpSectionTitle: 'Two-Factor Authentication (TOTP)',
-    totpSectionDesc:
-      'Scan a QR code to add a TOTP authenticator for extra login security',
-    totpEnabled: 'Enabled',
-    totpDisabled: 'Disabled',
-    enableTotp: 'Enable TOTP',
-    disableTotp: 'Disable TOTP',
-    totpEnabledSuccess: 'Two-factor authentication enabled',
-    totpDisabledSuccess: 'Two-factor authentication disabled',
-    totpEnrollTitle: 'Add TOTP Authenticator',
-    totpEnrollDesc:
-      'Scan the QR code with your authenticator app, then enter the 6-digit code to confirm',
-    totpScanHint: 'Scan this QR code with your authenticator app',
-    totpManualSecret: 'Or enter this key manually',
-    totpCodeLabel: 'Authenticator Code',
-    totpCodePlaceholder: '6-digit code',
-    totpVerify: 'Verify and Enable',
-    totpVerifying: 'Verifying...',
-    totpRecoveryCodesTitle: 'Recovery Codes',
-    totpRecoveryCodesDesc:
-      'Store these codes somewhere safe. Each code can be used once if you lose access to your authenticator.',
-    totpRecoveryCodesRemaining: '{{count}} recovery codes remaining',
-    totpRegenerateRecoveryCodes: 'Regenerate Recovery Codes',
-    totpRecoveryCodesRegenerated: 'Recovery codes regenerated',
-    totpDisableTitle: 'Disable Two-Factor Authentication',
-    totpDisableDesc:
-      'Enter a valid authenticator code to disable two-factor authentication',
-    totpConfirmDisable: 'Disable',
-    totpInvalidCode: 'Invalid code, please try again',
-    totpLoadFailed: 'Failed to load two-factor authentication status',
-    totpCopySecret: 'Copy key',
-    totpCopied: 'Copied to clipboard',
     bindSpaceFailed: 'Failed to bind LangBot Account',
     bindSpaceInvalidState:
       'Invalid bind request. Please try again from account settings.',

web/src/i18n/locales/es-ES.ts

@@ -769,6 +769,9 @@ const esES = {
     installFailed: 'Error en la instalación, por favor inténtalo más tarde',
     loadFailed:
       'Error al obtener la lista de plugins, por favor inténtalo más tarde',
+    installed: 'Instalado',
+    updateAvailable: 'Actualización disponible',
+    alreadyInstalled: '{{name}} ya está instalado',
     noDescription: 'No hay descripción disponible',
     recommendation: {
       pause: 'Pausar rotación automática',
@@ -1330,8 +1333,6 @@ const esES = {
     newPasswordRequired: 'La nueva contraseña no puede estar vacía',
     resetPassword: 'Restablecer contraseña',
     resetting: 'Restableciendo...',
-    totpMethodsUnavailable:
-      'TOTP no está habilitado para esta cuenta; solo se puede usar la clave de recuperación.',
     resetSuccess:
       'Contraseña restablecida correctamente, por favor inicia sesión',
     resetFailed:

web/src/i18n/locales/ja-JP.ts

@@ -92,13 +92,6 @@ const jaJP = {
     passkeyLoginFailed: 'パスキーでのログインに失敗しました',
     passkeyNotSupported:
       'お使いのブラウザまたはデバイスはパスキーをサポートしていません',
-    loginTotpTitle: '二要素認証',
-    loginTotpDesc:
-      '認証アプリの6桁のコード、またはリカバリーコードを入力してください',
-    loginTotpPlaceholder: '認証コードまたはリカバリーコード',
-    loginTotpVerify: '確認',
-    loginTotpVerifying: '確認中...',
-    loginTotpInvalid: 'コードが無効です。もう一度お試しください',
     spaceLoginTitle: 'LangBot アカウントでログイン',
     spaceLoginDescription:
       'QRコードをスキャンするか、下のリンクにアクセスして認証してください',
@@ -765,6 +758,9 @@ const jaJP = {
     installFailed: 'インストールに失敗しました。後でもう一度お試しください',
     loadFailed:
       'プラグインリストの取得に失敗しました。後でもう一度お試しください',
+    installed: 'インストール済み',
+    updateAvailable: '更新あり',
+    alreadyInstalled: '{{name}} はインストール済みです',
     noDescription: '説明がありません',
     recommendation: {
       pause: '自動ローテーションを一時停止',
@@ -1293,8 +1289,6 @@ const jaJP = {
     registerWithPassword: 'メールアドレスとパスワードで登録',
     initSuccess: '初期化に成功しました。ログインしてください',
     initFailed: '初期化に失敗しました：',
-    totpHint:
-      '推奨：ログイン後、アカウント設定で二要素認証（TOTP）を有効にしてアカウントを保護してください。',
   },
   resetPassword: {
     title: 'パスワードをリセット 🔐',
@@ -1314,21 +1308,6 @@ const jaJP = {
     resetFailed:
       'パスワードのリセットに失敗しました。メールアドレスと復旧キーを確認してください',
     backToLogin: 'ログインに戻る',
-    totpMethod: 'TOTP 認証アプリ',
-    recoveryCodeMethod: 'リカバリーコード',
-    verifyMethod: '確認方法',
-    totpMethodsUnavailable:
-      'このアカウントでは TOTP が有効になっていません。リカバリーキーのみ使用できます。',
-    totpCode: '認証コード',
-    enterTotpCode: '認証アプリに表示される6桁のコードを入力',
-    recoveryCode: 'リカバリーコード',
-    enterRecoveryCode: 'リカバリーコードのいずれかを入力',
-    totpCodeRequired: '認証コードは必須です',
-    recoveryCodeRequired: 'リカバリーコードは必須です',
-    totpNotEnabled:
-      'このアカウントでは TOTP が有効になっていません。復旧キーを使用してください',
-    invalidTotpCode: '認証コードが無効です。もう一度お試しください',
-    totpMethodDescription: 'TOTP 認証アプリまたはリカバリーコードで確認します',
   },
   embedding: {
     description: 'テキストのベクトル化に使用する埋め込みモデルを管理します',
@@ -1388,37 +1367,6 @@ const jaJP = {
     passkeyAddedSuccess: 'パスキーが正常に追加されました',
     passkeyDeleteSuccess: 'パスキーを削除しました',
     passkeyRenameSuccess: 'パスキー名を変更しました',
-    totpSectionTitle: '二要素認証 (TOTP)',
-    totpSectionDesc:
-      'QR コードをスキャンして TOTP 認証アプリを追加し、ログインの安全性を高めます',
-    totpEnabled: '有効',
-    totpDisabled: '無効',
-    enableTotp: 'TOTP を有効化',
-    disableTotp: 'TOTP を無効化',
-    totpEnabledSuccess: '二要素認証を有効にしました',
-    totpDisabledSuccess: '二要素認証を無効にしました',
-    totpEnrollTitle: 'TOTP 認証アプリを追加',
-    totpEnrollDesc:
-      '認証アプリで QR コードをスキャンし、6桁のコードを入力して確認します',
-    totpScanHint: '認証アプリでこの QR コードをスキャンしてください',
-    totpManualSecret: 'またはこのキーを手動で入力',
-    totpCodeLabel: '認証コード',
-    totpCodePlaceholder: '6桁のコード',
-    totpVerify: '確認して有効化',
-    totpVerifying: '確認中...',
-    totpRecoveryCodesTitle: 'リカバリーコード',
-    totpRecoveryCodesDesc:
-      'これらのコードは安全な場所に保管してください。認証アプリが使えない場合、各コードは一度だけ使用できます。',
-    totpRecoveryCodesRemaining: '残り {{count}} 個のリカバリーコード',
-    totpRegenerateRecoveryCodes: 'リカバリーコードを再生成',
-    totpRecoveryCodesRegenerated: 'リカバリーコードを再生成しました',
-    totpDisableTitle: '二要素認証を無効化',
-    totpDisableDesc: '有効な認証コードを入力して二要素認証を無効化します',
-    totpConfirmDisable: '無効化',
-    totpInvalidCode: 'コードが無効です。もう一度お試しください',
-    totpLoadFailed: '二要素認証の状態の読み込みに失敗しました',
-    totpCopySecret: 'キーをコピー',
-    totpCopied: 'クリップボードにコピーしました',
     bindSpaceFailed: 'LangBot アカウントの連携に失敗しました',
     bindSpaceInvalidState:
       '無効な連携リクエストです。アカウント設定から再度お試しください。',

web/src/i18n/locales/ru-RU.ts

@@ -763,6 +763,9 @@ const ruRU = {
     downloadComplete: 'Плагин "{{name}}" загружен',
     installFailed: 'Ошибка установки, попробуйте позже',
     loadFailed: 'Не удалось получить список плагинов, попробуйте позже',
+    installed: 'Установлено',
+    updateAvailable: 'Доступно обновление',
+    alreadyInstalled: '{{name}} уже установлен',
     noDescription: 'Описание отсутствует',
     recommendation: {
       pause: 'Приостановить авто-прокрутку',
@@ -1306,8 +1309,6 @@ const ruRU = {
     newPasswordRequired: 'Новый пароль не может быть пустым',
     resetPassword: 'Сбросить пароль',
     resetting: 'Сброс...',
-    totpMethodsUnavailable:
-      'TOTP не включён для этой учётной записи; доступен только ключ восстановления.',
     resetSuccess: 'Пароль успешно сброшен, пожалуйста, войдите',
     resetFailed: 'Ошибка сброса пароля, проверьте email и ключ восстановления',
     backToLogin: 'Вернуться к входу',

web/src/i18n/locales/th-TH.ts

@@ -741,6 +741,9 @@ const thTH = {
     downloadComplete: 'ดาวน์โหลดปลั๊กอิน "{{name}}" เสร็จสมบูรณ์',
     installFailed: 'ติดตั้งล้มเหลว กรุณาลองใหม่ภายหลัง',
     loadFailed: 'ไม่สามารถดึงรายการปลั๊กอินได้ กรุณาลองใหม่ภายหลัง',
+    installed: 'ติดตั้งแล้ว',
+    updateAvailable: 'มีอัปเดต',
+    alreadyInstalled: '{{name}} ติดตั้งแล้ว',
     noDescription: 'ไม่มีคำอธิบาย',
     recommendation: {
       pause: 'หยุดการหมุนอัตโนมัติชั่วคราว',
@@ -1277,8 +1280,6 @@ const thTH = {
     newPasswordRequired: 'รหัสผ่านใหม่ต้องไม่ว่างเปล่า',
     resetPassword: 'รีเซ็ตรหัสผ่าน',
     resetting: 'กำลังรีเซ็ต...',
-    totpMethodsUnavailable:
-      'บัญชีนี้ยังไม่ได้เปิดใช้ TOTP ใช้ได้เฉพาะคีย์กู้คืนเท่านั้น',
     resetSuccess: 'รีเซ็ตรหัสผ่านสำเร็จ กรุณาเข้าสู่ระบบ',
     resetFailed: 'รีเซ็ตรหัสผ่านล้มเหลว กรุณาตรวจสอบอีเมลและคีย์กู้คืน',
     backToLogin: 'กลับไปหน้าเข้าสู่ระบบ',

web/src/i18n/locales/vi-VN.ts

@@ -756,6 +756,9 @@ const viVN = {
     downloadComplete: 'Tải plugin "{{name}}" hoàn tất',
     installFailed: 'Cài đặt thất bại, vui lòng thử lại sau',
     loadFailed: 'Lấy danh sách plugin thất bại, vui lòng thử lại sau',
+    installed: 'Đã cài đặt',
+    updateAvailable: 'Có bản cập nhật',
+    alreadyInstalled: '{{name}} đã được cài đặt',
     noDescription: 'Không có mô tả',
     recommendation: {
       pause: 'Tạm dừng tự động xoay',
@@ -1298,8 +1301,6 @@ const viVN = {
     newPasswordRequired: 'Mật khẩu mới không được để trống',
     resetPassword: 'Đặt lại mật khẩu',
     resetting: 'Đang đặt lại...',
-    totpMethodsUnavailable:
-      'TOTP chưa được bật cho tài khoản này; chỉ có thể dùng khóa khôi phục.',
     resetSuccess: 'Đặt lại mật khẩu thành công, vui lòng đăng nhập',
     resetFailed:
       'Đặt lại mật khẩu thất bại, vui lòng kiểm tra email và khóa khôi phục',

web/src/i18n/locales/zh-Hans.ts

@@ -88,12 +88,6 @@ const zhHans = {
     passkeyLoginSuccess: 'Passkey 验证成功，正在登录...',
     passkeyLoginFailed: 'Passkey 登录失败',
     passkeyNotSupported: '当前浏览器或设备不支持 Passkey',
-    loginTotpTitle: '两步验证',
-    loginTotpDesc: '请输入验证器应用中的 6 位验证码，或使用恢复码',
-    loginTotpPlaceholder: '验证码或恢复码',
-    loginTotpVerify: '验证',
-    loginTotpVerifying: '验证中...',
-    loginTotpInvalid: '验证码无效，请重试',
     spaceLoginTitle: '通过 LangBot 账号登录',
     spaceLoginDescription: '扫描二维码或访问下方链接进行授权',
     spaceLoginUserCode: '您的验证码',
@@ -721,6 +715,9 @@ const zhHans = {
     installConfirm: '确定要安装插件 "{{name}}" ({{version}}) 吗？',
     downloadComplete: '插件 "{{name}}" 下载完成',
     installFailed: '安装失败，请稍后重试',
+    installed: '已安装',
+    updateAvailable: '有更新',
+    alreadyInstalled: '{{name}} 已安装',
     loadFailed: '获取插件列表失败，请稍后重试',
     noDescription: '暂无描述',
     recommendation: {
@@ -1225,8 +1222,6 @@ const zhHans = {
     registerWithPassword: '通过邮箱密码组合注册',
     initSuccess: '初始化成功 请登录',
     initFailed: '初始化失败：',
-    totpHint:
-      '推荐：登录后在账户设置中开启两步验证（TOTP）以保护您的账户安全。',
   },
   resetPassword: {
     title: '重置密码 🔐',
@@ -1244,19 +1239,6 @@ const zhHans = {
     resetSuccess: '密码重置成功，请登录',
     resetFailed: '密码重置失败，请检查邮箱和恢复密钥是否正确',
     backToLogin: '返回登录',
-    totpMethod: 'TOTP 验证器',
-    recoveryCodeMethod: '恢复码',
-    verifyMethod: '验证方式',
-    totpCode: '验证器验证码',
-    enterTotpCode: '输入验证器应用中的 6 位验证码',
-    recoveryCode: '恢复码',
-    enterRecoveryCode: '输入您的其中一个恢复码',
-    totpCodeRequired: '验证码不能为空',
-    recoveryCodeRequired: '恢复码不能为空',
-    totpNotEnabled: '该账户未开启 TOTP，请改用恢复密钥',
-    invalidTotpCode: '验证码无效，请重试',
-    totpMethodDescription: '使用 TOTP 验证器应用或恢复码进行验证',
-    totpMethodsUnavailable: '该账户未开启 TOTP 验证，仅可使用恢复密钥重置密码',
   },
   embedding: {
     description: '管理嵌入模型，用于向量化文本',
@@ -1312,35 +1294,6 @@ const zhHans = {
     passkeyAddedSuccess: '通行密钥添加成功',
     passkeyDeleteSuccess: '通行密钥已删除',
     passkeyRenameSuccess: '通行密钥重命名成功',
-    totpSectionTitle: '两步验证 (TOTP)',
-    totpSectionDesc: '扫描二维码添加 TOTP 验证器，提升登录安全性',
-    totpEnabled: '已开启',
-    totpDisabled: '未开启',
-    enableTotp: '开启 TOTP',
-    disableTotp: '关闭 TOTP',
-    totpEnabledSuccess: '两步验证已开启',
-    totpDisabledSuccess: '两步验证已关闭',
-    totpEnrollTitle: '添加 TOTP 验证器',
-    totpEnrollDesc: '使用验证器应用扫描二维码，然后输入 6 位验证码完成确认',
-    totpScanHint: '使用验证器应用扫描此二维码',
-    totpManualSecret: '或手动输入此密钥',
-    totpCodeLabel: '验证码',
-    totpCodePlaceholder: '6 位验证码',
-    totpVerify: '验证并开启',
-    totpVerifying: '验证中...',
-    totpRecoveryCodesTitle: '恢复码',
-    totpRecoveryCodesDesc:
-      '请妥善保存这些恢复码。当您无法使用验证器时，每个恢复码可使用一次。',
-    totpRecoveryCodesRemaining: '剩余 {{count}} 个恢复码',
-    totpRegenerateRecoveryCodes: '重新生成恢复码',
-    totpRecoveryCodesRegenerated: '恢复码已重新生成',
-    totpDisableTitle: '关闭两步验证',
-    totpDisableDesc: '输入有效的验证器验证码以关闭两步验证',
-    totpConfirmDisable: '关闭',
-    totpInvalidCode: '验证码无效，请重试',
-    totpLoadFailed: '加载两步验证状态失败',
-    totpCopySecret: '复制密钥',
-    totpCopied: '已复制到剪贴板',
     bindSpaceFailed: '绑定 LangBot 账号失败',
     bindSpaceInvalidState: '无效的绑定请求，请从账户设置重新发起',
     setPasswordHint: '设置密码后可使用邮箱密码登录',

web/src/i18n/locales/zh-Hant.ts

@@ -719,6 +719,9 @@ const zhHant = {
     downloadComplete: '插件 "{{name}}" 下載完成',
     installFailed: '安裝失敗，請稍後重試',
     loadFailed: '取得插件列表失敗，請稍後重試',
+    installed: '已安裝',
+    updateAvailable: '有更新',
+    alreadyInstalled: '{{name}} 已安裝',
     noDescription: '暫無描述',
     recommendation: {
       pause: '暫停自動輪播',
@@ -1234,7 +1237,6 @@ const zhHant = {
     newPasswordRequired: '新密碼不能為空',
     resetPassword: '重設密碼',
     resetting: '重設中...',
-    totpMethodsUnavailable: '此帳戶未開啟 TOTP 驗證，僅可使用恢復金鑰重設密碼',
     resetSuccess: '密碼重設成功，請登入',
     resetFailed: '密碼重設失敗，請檢查電子郵件和恢復金鑰是否正確',
     backToLogin: '返回登入',