feat: harden plugin api for separate repos, signed updates and generic external login

docker/Dockerfile

@@ -1,3 +1,12 @@
+# Stage 0: every plugin's package.json and manifest.json and nothing else.
+# npm ci needs each workspace package.json in place or it silently skips it,
+# and a glob COPY flattens paths, so the tree is trimmed here instead. The
+# deps layer below stays cached until one of these files changes.
+FROM node:26-slim AS workspace-manifests
+WORKDIR /src
+COPY plugins ./plugins
+RUN find plugins -mindepth 2 -maxdepth 2 ! -name package.json ! -name manifest.json -exec rm -rf {} +
+
 # Stage 1: Install dependencies
 FROM node:26-slim AS deps
 WORKDIR /app
@@ -5,51 +14,14 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
-# Every workspace package needs its package.json present before npm ci, or
-# npm ci silently skips linking it and its dependencies never get installed
-# (a glob COPY like plugins/*/package.json flattens into one file, so each
-# plugin needs its own line).
 COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
-COPY plugins/acme-ssl/package.json ./plugins/acme-ssl/package.json
-COPY plugins/ai/package.json ./plugins/ai/package.json
-COPY plugins/alerts/package.json ./plugins/alerts/package.json
-COPY plugins/automations/package.json ./plugins/automations/package.json
-COPY plugins/docker/package.json ./plugins/docker/package.json
-COPY plugins/file-manager/package.json ./plugins/file-manager/package.json
-COPY plugins/fleets/package.json ./plugins/fleets/package.json
-COPY plugins/homepage/package.json ./plugins/homepage/package.json
-COPY plugins/host-metrics/package.json ./plugins/host-metrics/package.json
-COPY plugins/ldap/package.json ./plugins/ldap/package.json
-COPY plugins/network-topology/package.json ./plugins/network-topology/package.json
-COPY plugins/opkssh/package.json ./plugins/opkssh/package.json
-COPY plugins/proxmox/package.json ./plugins/proxmox/package.json
-COPY plugins/remote-desktop/package.json ./plugins/remote-desktop/package.json
-COPY plugins/secret-sources/package.json ./plugins/secret-sources/package.json
-COPY plugins/serial/package.json ./plugins/serial/package.json
-COPY plugins/session-recording/package.json ./plugins/session-recording/package.json
-COPY plugins/session-sharing/package.json ./plugins/session-sharing/package.json
-COPY plugins/snippets/package.json ./plugins/snippets/package.json
-COPY plugins/ssh-terminal/package.json ./plugins/ssh-terminal/package.json
-COPY plugins/sso/package.json ./plugins/sso/package.json
-COPY plugins/step-ca/package.json ./plugins/step-ca/package.json
-COPY plugins/tailscale/package.json ./plugins/tailscale/package.json
-COPY plugins/termix-identity/package.json ./plugins/termix-identity/package.json
-COPY plugins/tmux-monitor/package.json ./plugins/tmux-monitor/package.json
-COPY plugins/totp/package.json ./plugins/totp/package.json
-COPY plugins/tunnels/package.json ./plugins/tunnels/package.json
-COPY plugins/vault/package.json ./plugins/vault/package.json
-COPY plugins/wake-on-lan/package.json ./plugins/wake-on-lan/package.json
-COPY plugins/warpgate/package.json ./plugins/warpgate/package.json
-COPY plugins/web-endpoint/package.json ./plugins/web-endpoint/package.json
-COPY plugins/webauthn/package.json ./plugins/webauthn/package.json
-COPY plugins/workspaces/package.json ./plugins/workspaces/package.json
+COPY --from=workspace-manifests /src/plugins ./plugins
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs scripts/patch-ssh2-agent.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
 RUN npm ci --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
     node scripts/patch-ssh2-agent.cjs && \
     npm cache clean --force
 
@@ -110,10 +82,15 @@ COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs scripts/patch-ssh2-agent.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs scripts/install-native-plugin-deps.cjs ./scripts/
+# Plugin manifests only, for their nativeDependencies. Outside plugins/ so npm
+# ci does not treat them as workspaces: everything else a plugin uses is
+# already inside its bundle.
+COPY --from=workspace-manifests /src/plugins ./plugin-manifests
 
 RUN npm ci --omit=dev --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/install-native-plugin-deps.cjs plugin-manifests && \
+    rm -rf plugin-manifests && \
     node scripts/patch-ssh2-agent.cjs && \
     rm -rf node_modules/better-sqlite3/prebuilds && \
     npm run build-release --prefix node_modules/better-sqlite3 && \