feat: harden plugin api for separate repos, signed updates and generic external login

plugins/tunnels/manifest.json

@@ -20,7 +20,9 @@
     "ssh:connect",
     "db:own",
     "network:serve",
-    "ui:surface"
+    "ui:surface",
+    "users:impersonate",
+    "db:core-refs"
   ],
   "provides": [
     {
@@ -86,7 +88,8 @@
       "key": "enableTunnel",
       "labelKey": "hosts.tabTunnels",
       "editorTab": "general"
-    }
+    },
+    "uses": ["homepage.widgets"]
   },
   "locales": "locales",
   "platforms": ["linux", "win32", "darwin"]

plugins/tunnels/package.json

@@ -6,10 +6,30 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -b ../../tsconfig.plugins.backend.json ../../tsconfig.plugins.frontend.json",
+    "typecheck": "tsc -p .",
     "validate": "termix-plugin validate"
   },
+  "dependencies": {
+    "lucide-react": "^1.33.0"
+  },
   "devDependencies": {
-    "@termix/plugin-sdk": "*"
+    "@termix/plugin-sdk": "^1.0.0",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "better-sqlite3": "^13.0.3",
+    "jsdom": "^30.0.1",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "drizzle-orm": "^0.45.2",
+    "express": "^5.2.1",
+    "react": "^19.2.8",
+    "sonner": "^2.0.8",
+    "ssh2": "^1.17.0",
+    "ws": "^8.21.3"
   }
 }

plugins/tunnels/src/frontend/index.tsx

@@ -20,7 +20,13 @@ function TunnelTabView({ host }: TabProps) {
   return <TunnelTab host={host} />;
 }
 
+/** This plugin's C2S relay socket, which the desktop app dials on the linked server. */
+const C2S_RELAY_PATH = "/plugin-ws/tunnels/c2s/stream";
+
 export function activate(app: TermixApp): void {
+  if (typeof window !== "undefined" && window.electronAPI?.setC2SRelayPath) {
+    void window.electronAPI.setC2SRelayPath(C2S_RELAY_PATH);
+  }
   // apiFor("remote") hands back app.api itself outside the desktop app.
   const remote = app.apiFor("remote");
   setTunnelsApi(app.api, {