feat: harden plugin api for separate repos, signed updates and generic external login

plugins/ssh-terminal/tests/backend/activate.test.ts

@@ -48,9 +48,7 @@ describe("ssh-terminal activate", () => {
     const history = server.mock.services.get(
       "terminal.history",
     ) as TerminalHistoryV1;
-    const listed = await server.mock.ctx.asUser("user-1", () =>
-      history.list(1, 10),
-    );
+    const listed = await server.mock.actAs("user-1", () => history.list(1, 10));
     expect(listed.map((entry) => entry.command)).toEqual(["df -h"]);
   });
 
@@ -59,7 +57,7 @@ describe("ssh-terminal activate", () => {
     const live = server.mock.services.get(
       "sessions.live#ssh",
     ) as LiveSessionsV1;
-    const other = await server.mock.ctx.asUser("user-2", async () =>
+    const other = await server.mock.actAs("user-2", async () =>
       live.listForUser("user-1"),
     );
     expect(other).toEqual([]);

plugins/ssh-terminal/tests/backend/images/image-storage.test.ts

@@ -264,7 +264,7 @@ describe("storeImageViaSftp", () => {
           stream.destroyed = true;
         };
         streams.push(stream);
-        stream.end = (data: Buffer) => {
+        (stream as { end: unknown }).end = (data: Buffer) => {
           if (behavior.stallWrite) return;
           queueMicrotask(() => {
             if (behavior.writeError) {

plugins/ssh-terminal/tests/backend/memory-agent.test.ts

@@ -45,7 +45,7 @@ describe("MemoryAgent", () => {
     expect((parsed as ParsedKey).verify(data, signature)).toBe(true);
 
     client.destroy();
-    stream.destroy();
+    (stream as unknown as { destroy: () => void }).destroy();
   });
 });
 
@@ -98,7 +98,7 @@ describe("MemoryAgent unsupported extension framing", () => {
         expect(replies[1][0]).toBe(12); // The following identities request succeeds.
         expect(replies[1].readUInt32BE(1)).toBe(1);
       } finally {
-        stream.destroy();
+        (stream as unknown as { destroy: () => void }).destroy();
       }
     },
   );