feat: finish the web-endpoint plugin, add ctx.desktop (B8)

src/backend/plugins/ctx.ts

@@ -42,6 +42,7 @@ import {
   PluginCapabilityError,
   type PluginContext,
   type PluginModule,
+  type PluginOpenIsolatedWindowRequest,
 } from "@termix/plugin-sdk/backend";
 import type { PluginTableDefinition } from "@termix/plugin-sdk/db";
 import * as syncRegistry from "./sync-registry.js";
@@ -299,6 +300,28 @@ export function createPluginContext(
     { action: "db_refs" },
   );
 
+  const desktopOpenIsolatedWindow = guarded(
+    manifest,
+    "desktop:window",
+    async (request: PluginOpenIsolatedWindowRequest) => {
+      const { isElectronIpcAvailable, requestFromElectronMain } =
+        await import("../utils/electron-ipc-bridge.js");
+      if (!isElectronIpcAvailable()) {
+        throw new Error(
+          `Plugin ${pluginId} tried to open an isolated window outside the desktop app`,
+        );
+      }
+      return requestFromElectronMain<{ success: true }>(
+        "open-isolated-window",
+        request,
+      );
+    },
+    {
+      action: "desktop_open_isolated_window",
+      details: () => "opened an isolated Electron window",
+    },
+  );
+
   return {
     pluginId,
     manifest,
@@ -613,6 +636,10 @@ export function createPluginContext(
     ssh: createPluginSsh({ manifest, bag: handle.bag, audit: auditCall }),
     auth: createPluginAuth({ manifest, bag: handle.bag, audit: auditCall }),
 
+    desktop: {
+      openIsolatedWindow: (request) => desktopOpenIsolatedWindow(request),
+    },
+
     /**
      * Background work acts as a named user. Always audited, because "this ran
      * as someone" is exactly the thing an operator needs to be able to see.