feat: harden plugin api for separate repos, signed updates and generic external login

plugins/automations/manifest.json

@@ -24,7 +24,8 @@
     "network:outbound",
     "network:serve",
     "settings:read-core",
-    "ui:surface"
+    "ui:surface",
+    "users:impersonate"
   ],
   "optionalDependencies": {
     "fleets": "^1.0.0",
@@ -119,7 +120,8 @@
     ],
     "http": {
       "legacyPaths": ["/automations/webhook"]
-    }
+    },
+    "uses": ["alerts.openChannels"]
   },
   "locales": "locales",
   "platforms": ["linux", "win32", "darwin"],

plugins/automations/package.json

@@ -6,10 +6,29 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -b ../../tsconfig.plugins.backend.json ../../tsconfig.plugins.frontend.json",
+    "typecheck": "tsc -p .",
     "validate": "termix-plugin validate"
   },
+  "dependencies": {
+    "lucide-react": "^1.33.0"
+  },
   "devDependencies": {
-    "@termix/plugin-sdk": "*"
+    "@termix/plugin-sdk": "^1.0.0",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "better-sqlite3": "^13.0.3",
+    "jsdom": "^30.0.1",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "drizzle-orm": "^0.45.2",
+    "express": "^5.2.1",
+    "react": "^19.2.8",
+    "sonner": "^2.0.8",
+    "ssh2": "^1.17.0"
   }
 }

plugins/automations/tests/backend/activate.test.ts

@@ -61,7 +61,7 @@ describe("automations activate", () => {
       capabilities: manifest.capabilities.filter((c) => c !== "notify:send"),
     });
     await expect(
-      withoutNotify.ctx.notify.send([1], { title: "t", body: "b" }),
+      withoutNotify.ctx.notify.send({ title: "t", body: "b" } as never),
     ).rejects.toBeInstanceOf(PluginCapabilityError);
   });
 

plugins/automations/tests/backend/triggers.test.ts

@@ -99,7 +99,7 @@ describe("onMetrics", () => {
     });
 
     expect(run).toHaveBeenCalledTimes(1);
-    expect(run.mock.calls[0][0]).toMatchObject({
+    expect((run.mock.calls[0] as unknown[])[0]).toMatchObject({
       triggerType: "metric_threshold",
       triggerHostId: 7,
     });