feat: harden plugin api for separate repos, signed updates and generic external login

plugins/remote-desktop/src/backend/routes.ts

@@ -636,7 +636,8 @@ export function registerRoutes(router: Router, deps: RouteDeps): void {
       return res.status(400).json({ error: "Missing host" });
     }
     try {
-      const result = await ctx.desktop.launchNativeRdp({
+      const result = await ctx.desktop.launchExternalClient({
+        protocol: "rdp",
         host: body.host,
         port: Number(body.port) || DEFAULT_PORT.rdp,
         username: typeof body.username === "string" ? body.username : undefined,

plugins/remote-desktop/src/backend/token-service.ts

@@ -117,17 +117,8 @@ export class GuacamoleTokenService {
       }
     }
 
-    const jwtSecret = process.env.JWT_SECRET;
-    if (jwtSecret) {
-      return crypto
-        .createHash("sha256")
-        .update(jwtSecret + "_guacamole")
-        .digest();
-    }
-
-    this.log.warn("No persistent encryption key found, generating random key", {
-      operation: "guac_key_generation",
-    });
+    // A token lives for seconds between issue and connect, so a fresh key
+    // per boot is enough and nothing is derived from core's own secrets.
     return crypto.randomBytes(KEY_LENGTH);
   }