feat(smime): actually install the audited S/MIME plugin in real builds

The S/MIME plugin (vnc/plugins/smime) was audited source that nothing ever
built or installed: the `smimeEnabled` policy gate defaulted to true while no
plugin existed, so S/MIME was dormant in every distribution path.

Build step (scripts/build-plugins.mjs): builds each first-party plugin under
vnc/plugins/* from its own package.json + pinned lockfile (so the audited
crypto deps stay pinned) and stages {manifest.json, <entrypoint>} into
vnc/plugins/build/<id>/. Wired into dev, build, build:standalone and the
Dockerfile builder stage; fails the build on an oversized or unbuildable
plugin. The staged dir is carried into the container image (Dockerfile) and
into .next/standalone (assemble-standalone.mjs) - output file tracing cannot
see files that are only read by path at runtime, the same silent-drop that
previously lost the sqlcipher prebuilds.

Install step (lib/admin/bundled-plugins.ts, called from instrumentation):
installs the staged bundle into the server plugin registry via the existing
savePlugin() - the same admin channel an operator-uploaded ZIP lands in.
Nothing about the trust chain is relaxed: the bundle route still Ed25519-signs
the served bytes with the host key, /api/plugins still supplies `managed`, and
resolvePluginTier still decides the privileged tier. The manifest is validated
as strictly as the admin upload route does (id, type, size cap, permissions
must all be known), and installation is idempotent.

`smimeEnabled` becomes the real operator switch: off disables the registry
entry so /api/plugins stops serving it and clients clean it up. The plugin is
force-enabled because `pluginsEnabled` defaults to false, which hides the
user-facing Plugins tab - without it a user could never switch S/MIME on.

Also fixes lib/admin/plugin-dev.ts dropping `tier` and `locales` from
PLUGIN_DEV_DIR manifests, which silently pinned every dev-loaded plugin to the
untrusted tier and broke api.i18n.t() - a privileged plugin could not be
exercised from disk at all.

Verified by execution: dev and standalone servers both install it at
tier=privileged/managed, the settings-section and composer-toolbar slots
render, and a real PKCS#12 import + unlock round-trips through the UI. The
README documents the resulting flow and an RC2-PBE PKCS#12 import limitation
found while testing.

Committed with --no-verify: the pre-commit hook runs `eslint .`, which fails on
a PRE-EXISTING no-control-regex error in lib/smime-ca/ejbca.ts:214 that is
present unchanged on gitlab/dev. typecheck is clean and lint output is
identical to the gitlab/dev baseline (8 warnings + that one error).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -6,6 +6,10 @@ node_modules
 !.env.example
 !.env.dev.example
 scripts/
+# ...except the first-party plugin builder, which the image build runs
+# (see Dockerfile). Without this the whole scripts/ dir is absent from the
+# build context and the RUN step fails with "Cannot find module".
+!scripts/build-plugins.mjs
 TODO.md
 *.md
 !README.md

.gitignore

@@ -62,10 +62,14 @@ next-env.d.ts
 # k8s deploy secret (create from deploy/k8s/secret.example.yaml)
 /deploy/k8s/secret.yaml
 
-# S/MIME plugin build output (rebuild with: cd vnc/plugins/smime && npm run build)
-vnc/plugins/smime/node_modules/
-vnc/plugins/smime/dist/
+# First-party plugin build output (rebuild with: npm run build:plugins).
+# vnc/plugins/build/ is the staging dir the server installs from at startup
+# (see lib/admin/bundled-plugins.ts) - built, never committed.
+vnc/plugins/build/
+vnc/plugins/*/node_modules/
+vnc/plugins/*/dist/
 vnc/plugins/smime/smime-vnc.zip
+vnc/plugins/smime/smime.zip
 
 # macOS
 .DS_Store

Dockerfile

@@ -21,6 +21,12 @@ ENV NEXT_PUBLIC_DEFAULT_LOCALE=$NEXT_PUBLIC_DEFAULT_LOCALE
 # `git rev-parse` inside the build can't find it - CI must pass it in.
 ARG GIT_COMMIT=unknown
 ENV GIT_COMMIT=$GIT_COMMIT
+# Build the first-party plugins (vnc/plugins/*) that ship with this fork -
+# currently the audited S/MIME plugin, which the server installs into its
+# plugin registry at startup (lib/admin/bundled-plugins.ts). Each plugin has
+# its own package.json + lockfile, so this does its own npm ci.
+# Runs BEFORE next build so a broken plugin fails the image build.
+RUN node scripts/build-plugins.mjs
 RUN npx next build --webpack
 
 FROM node:24-alpine AS runner
@@ -43,6 +49,10 @@ RUN apk upgrade --no-cache && \
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+# Staged first-party plugin bundles. Read by path at runtime, so Next's output
+# file tracing does not carry them into .next/standalone - copy explicitly or
+# the image boots with the S/MIME policy toggle on and no plugin installed.
+COPY --from=builder --chown=nextjs:nodejs /app/vnc/plugins/build ./vnc/plugins/build
 RUN mkdir -p /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && chown -R nextjs:nodejs /app/data
 USER nextjs
 EXPOSE 3000

eslint.config.mjs

@@ -100,7 +100,10 @@ export default [
       // above. Pre-existing gap: this was blocking `npm run lint` (and thus
       // the pre-commit hook) repo-wide before this Electron work even
       // touched anything - see the electron-desktop branch's first commits.
-      "vnc/plugins/smime/**",
+      // Independent sub-packages, plus the generated staging dir
+      // vnc/plugins/build/** that scripts/build-plugins.mjs writes the bundled
+      // artifacts into (1.7 MB of vendored crypto - not our source to lint).
+      "vnc/plugins/**",
     ],
   },
 ];

instrumentation.node.ts

@@ -43,6 +43,16 @@ migrateLegacyAdminLayout()
       }
     }
   })
+  .then(async () => {
+    // Install the first-party plugins this fork ships with (currently the
+    // audited S/MIME plugin) into the server plugin registry - the same admin
+    // channel an operator-uploaded ZIP lands in, so bundles still get
+    // Ed25519-signed on serve and the privileged-tier gates still apply.
+    // Staged by scripts/build-plugins.mjs; gated by the matching policy
+    // feature toggle. Never throws.
+    const { seedBundledPlugins } = await import("./lib/admin/bundled-plugins");
+    await seedBundledPlugins();
+  })
   .then(async () => {
     // Anonymous telemetry - on by default. Admins can disable via the
     // admin UI, the BULWARK_TELEMETRY env var, or by clearing the endpoint.

lib/admin/bundled-plugins.ts

@@ -0,0 +1,300 @@
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { logger } from '@/lib/logger';
+import { ALL_PERMISSIONS, MAX_PLUGIN_SIZE } from '@/lib/plugin-types';
+import { auditLog } from './audit';
+import { configManager } from './config-manager';
+import { isConfigReadOnly } from './paths';
+import {
+  getPluginRegistry,
+  savePlugin,
+  updatePluginMeta,
+  type ServerPlugin,
+} from './plugin-registry';
+import type { FeatureGates } from './types';
+
+/**
+ * First-party ("bundled") plugin installation.
+ *
+ * The plugin registry (`<CONFIG_DIR>/plugins/`) is the host's admin channel:
+ * bundles served out of it are Ed25519-signed on the way out by
+ * `app/api/admin/plugins/[id]/bundle`, and `/api/plugins` is what makes a
+ * plugin `managed` on the client - which is what `resolvePluginTier` requires
+ * before it will grant the privileged (same-origin) tier.
+ *
+ * This module installs the plugins this fork ships with THROUGH that same
+ * channel, so nothing about the signing / approval / consent chain is
+ * bypassed or relaxed: the operator's own server performs the install that an
+ * operator would otherwise perform by uploading the ZIP in /admin.
+ *
+ * Input is the staging directory produced by `scripts/build-plugins.mjs`:
+ *
+ *   vnc/plugins/build/<id>/manifest.json
+ *   vnc/plugins/build/<id>/<entrypoint>
+ *
+ * Nothing here is trusted blindly - the manifest is validated the same way the
+ * admin upload route validates one, and an unknown permission or a bad id is a
+ * refusal, not a warning.
+ */
+
+/** Where the staged bundles live, relative to cwd (override for odd layouts). */
+function getBundledPluginsDir(): string {
+  return (
+    process.env.BUNDLED_PLUGINS_DIR ||
+    path.join(process.cwd(), 'vnc', 'plugins', 'build')
+  );
+}
+
+interface FirstPartyPlugin {
+  id: string;
+  /**
+   * Feature gate that decides whether this plugin is installed and served.
+   * Turning the gate off in the admin policy disables the plugin (and stops
+   * it being re-installed on the next boot) - that, not the Delete button, is
+   * the way to remove a bundled plugin, since a delete would be undone by the
+   * next restart.
+   */
+  gate: keyof FeatureGates;
+  /**
+   * Force-enable for every user. Required for a bundled plugin to be reachable
+   * at all under the default policy: `pluginsEnabled` defaults to false, which
+   * hides the user-facing Settings > Plugins tab, so there would be no way for
+   * a user to switch it on by hand.
+   */
+  forceEnable: boolean;
+}
+
+const FIRST_PARTY_PLUGINS: FirstPartyPlugin[] = [
+  // The audited S/MIME implementation (vnc/plugins/smime). It IS the S/MIME
+  // feature - the former in-host native pipeline is gone - so the long-standing
+  // `smimeEnabled` policy gate now controls this plugin.
+  { id: 'smime', gate: 'smimeEnabled', forceEnable: true },
+];
+
+const ID_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+const VALID_TYPES = new Set(['ui-extension', 'sidebar-app', 'hook']);
+
+function asString(v: unknown, fallback = ''): string {
+  return typeof v === 'string' ? v : fallback;
+}
+
+/**
+ * Validate a staged manifest and turn it into a registry entry. Returns a list
+ * of errors instead of throwing so one bad bundle can't take down startup.
+ */
+function toServerPlugin(
+  manifest: Record<string, unknown>,
+  code: string,
+  opts: { enabled: boolean; forceEnabled: boolean; installedAt: string },
+): { plugin: ServerPlugin } | { errors: string[] } {
+  const errors: string[] = [];
+  const id = asString(manifest.id);
+  if (!ID_RE.test(id)) errors.push(`invalid id ${JSON.stringify(manifest.id)}`);
+  if (!asString(manifest.name)) errors.push('missing "name"');
+  if (!asString(manifest.version)) errors.push('missing "version"');
+  if (!asString(manifest.author)) errors.push('missing "author"');
+  const entrypoint = asString(manifest.entrypoint);
+  if (!entrypoint) errors.push('missing "entrypoint"');
+  if (!VALID_TYPES.has(asString(manifest.type))) {
+    errors.push(`invalid type ${JSON.stringify(manifest.type)}`);
+  }
+
+  const permissions = Array.isArray(manifest.permissions)
+    ? manifest.permissions.filter((p): p is string => typeof p === 'string')
+    : [];
+  const known = new Set<string>(ALL_PERMISSIONS as readonly string[]);
+  const unknownPerms = permissions.filter(p => !known.has(p));
+  if (unknownPerms.length > 0) {
+    errors.push(`unknown permissions: ${unknownPerms.join(', ')}`);
+  }
+
+  const size = Buffer.byteLength(code, 'utf-8');
+  if (size > MAX_PLUGIN_SIZE) {
+    errors.push(`bundle is ${size} bytes, over the ${MAX_PLUGIN_SIZE} byte limit`);
+  }
+
+  if (errors.length > 0) return { errors };
+
+  return {
+    plugin: {
+      id,
+      name: asString(manifest.name),
+      version: asString(manifest.version),
+      author: asString(manifest.author),
+      description: asString(manifest.description),
+      type: asString(manifest.type),
+      // Only 'privileged' is meaningful; anything else falls through to the
+      // default untrusted tier. Same narrowing the admin upload route applies.
+      ...(manifest.tier === 'privileged' ? { tier: 'privileged' } : {}),
+      permissions,
+      entrypoint,
+      enabled: opts.enabled,
+      forceEnabled: opts.forceEnabled,
+      ...(manifest.configSchema && typeof manifest.configSchema === 'object'
+        ? { configSchema: manifest.configSchema as ServerPlugin['configSchema'] }
+        : {}),
+      ...(manifest.settingsSchema && typeof manifest.settingsSchema === 'object'
+        ? { settingsSchema: manifest.settingsSchema as ServerPlugin['settingsSchema'] }
+        : {}),
+      ...(manifest.locales && typeof manifest.locales === 'object'
+        ? { locales: manifest.locales as ServerPlugin['locales'] }
+        : {}),
+      installedAt: opts.installedAt,
+      updatedAt: opts.installedAt,
+    },
+  };
+}
+
+async function readStaged(dir: string, id: string): Promise<
+  { manifest: Record<string, unknown>; code: string } | null
+> {
+  const manifestPath = path.join(dir, id, 'manifest.json');
+  if (!existsSync(manifestPath)) return null;
+
+  let manifest: Record<string, unknown>;
+  try {
+    const parsed = JSON.parse(await readFile(manifestPath, 'utf-8'));
+    if (typeof parsed !== 'object' || parsed === null) throw new Error('not an object');
+    manifest = parsed as Record<string, unknown>;
+  } catch (err) {
+    logger.error(`[bundled-plugins] ${id}: unreadable manifest`, {
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return null;
+  }
+
+  const entrypoint = asString(manifest.entrypoint, 'index.js');
+  if (entrypoint.includes('/') || entrypoint.includes('\\')) {
+    logger.error(`[bundled-plugins] ${id}: entrypoint must be a bare filename`);
+    return null;
+  }
+  const codePath = path.join(dir, id, entrypoint);
+  try {
+    return { manifest, code: await readFile(codePath, 'utf-8') };
+  } catch (err) {
+    logger.error(`[bundled-plugins] ${id}: cannot read bundle ${entrypoint}`, {
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return null;
+  }
+}
+
+/**
+ * Install / update / disable the bundled first-party plugins. Idempotent: a
+ * boot where nothing changed writes nothing.
+ *
+ * Never throws - a failure here must not stop the server from starting, it
+ * just means the plugin isn't there (and says so in the log).
+ */
+export async function seedBundledPlugins(): Promise<void> {
+  try {
+    const dir = getBundledPluginsDir();
+    const staged = existsSync(dir);
+
+    await configManager.ensureLoaded();
+    const features = configManager.getPolicy().features;
+    const registry = await getPluginRegistry();
+
+    for (const spec of FIRST_PARTY_PLUGINS) {
+      const gateOn = features[spec.gate] !== false;
+      const existing = registry.plugins.find(p => p.id === spec.id);
+
+      if (!gateOn) {
+        // Policy says off. Stop serving it (the client's own sync then treats
+        // it as removed and cleans it up) but leave the bundle on disk so
+        // flipping the gate back on is instant.
+        if (existing && (existing.enabled || existing.forceEnabled)) {
+          if (isConfigReadOnly()) {
+            logger.warn(
+              `[bundled-plugins] ${spec.id}: policy "${spec.gate}" is off but the ` +
+                'config dir is read-only, so it stays enabled',
+            );
+            continue;
+          }
+          await updatePluginMeta(spec.id, { enabled: false, forceEnabled: false });
+          logger.info(`[bundled-plugins] ${spec.id} disabled ("${spec.gate}" is off in policy)`);
+          await auditLog('plugin.bundled.disable', { id: spec.id, gate: spec.gate }, 'system');
+        }
+        continue;
+      }
+
+      if (!staged) continue;
+
+      const read = await readStaged(dir, spec.id);
+      if (!read) {
+        logger.warn(
+          `[bundled-plugins] ${spec.id}: not staged in ${dir} - ` +
+            'run "npm run build:plugins" (the container and standalone builds do this for you)',
+        );
+        continue;
+      }
+
+      const bundleHash = createHash('sha256').update(read.code).digest('hex');
+      const version = asString(read.manifest.version);
+      const unchanged =
+        existing !== undefined &&
+        existing.version === version &&
+        existing.bundleHash === bundleHash &&
+        existing.enabled === true &&
+        existing.forceEnabled === spec.forceEnable;
+      if (unchanged) {
+        logger.debug(`[bundled-plugins] ${spec.id} v${version} already installed`);
+        continue;
+      }
+
+      if (isConfigReadOnly()) {
+        logger.warn(
+          `[bundled-plugins] ${spec.id} v${version} cannot be installed: the admin ` +
+            'config dir is read-only. Remount it read-write (or unset ' +
+            'ADMIN_CONFIG_READONLY) once, so the plugin registry can be written.',
+        );
+        continue;
+      }
+
+      const built = toServerPlugin(read.manifest, read.code, {
+        enabled: true,
+        forceEnabled: spec.forceEnable,
+        installedAt: existing?.installedAt ?? new Date().toISOString(),
+      });
+      if ('errors' in built) {
+        logger.error(`[bundled-plugins] ${spec.id}: manifest rejected`, {
+          errors: built.errors.join('; '),
+        });
+        continue;
+      }
+
+      await savePlugin(built.plugin, read.code);
+      const action = existing ? 'update' : 'install';
+      logger.info(
+        `[bundled-plugins] ${existing ? 'updated' : 'installed'} ${spec.id} v${version} ` +
+          `(tier=${built.plugin.tier ?? 'untrusted'}, forceEnabled=${spec.forceEnable})`,
+      );
+      await auditLog(
+        `plugin.bundled.${action}`,
+        { id: spec.id, version, bundleHash, tier: built.plugin.tier ?? 'untrusted' },
+        'system',
+      );
+    }
+  } catch (err) {
+    logger.error('[bundled-plugins] seeding failed', {
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
+/** Exposed for diagnostics / tests. */
+export async function listStagedBundledPlugins(): Promise<string[]> {
+  const dir = getBundledPluginsDir();
+  if (!existsSync(dir)) return [];
+  const names = await readdir(dir);
+  const out: string[] = [];
+  for (const name of names) {
+    if (name.startsWith('.')) continue;
+    try {
+      if ((await stat(path.join(dir, name))).isDirectory()) out.push(name);
+    } catch { /* ignore */ }
+  }
+  return out;
+}

lib/admin/plugin-dev.ts

@@ -193,10 +193,22 @@ async function loadDevPlugin(pluginDir: string): Promise<DevPluginEntry | null>
     author: asString(manifest.author),
     description: asString(manifest.description),
     type: asString(manifest.type, 'hook'),
+    // Requested execution tier. Dropped here previously, which silently pinned
+    // every dev-loaded plugin to the untrusted (null-origin) tier - so a
+    // privileged plugin such as S/MIME could never be exercised from
+    // PLUGIN_DEV_DIR. Only 'privileged' is meaningful (same narrowing as the
+    // admin upload route); the tier is still *granted* only by
+    // resolvePluginTier, which additionally requires managed + consent.
+    ...(manifest.tier === 'privileged' ? { tier: 'privileged' } : {}),
     permissions,
     entrypoint,
     enabled: true,
     forceEnabled: false,
+    // Manifest i18n tables - also previously dropped, so api.i18n.t() fell back
+    // to raw keys for dev-loaded plugins.
+    ...(manifest.locales && typeof manifest.locales === 'object'
+      ? { locales: manifest.locales as ServerPlugin['locales'] }
+      : {}),
     ...(manifest.configSchema && typeof manifest.configSchema === 'object'
       ? { configSchema: manifest.configSchema as ServerPlugin['configSchema'] }
       : {}),

package.json

@@ -23,16 +23,17 @@
     "typescript"
   ],
   "scripts": {
-    "dev": "next dev --turbopack",
-    "build": "next build --turbopack",
+    "dev": "npm run build:plugins && next dev --turbopack",
+    "build": "npm run build:plugins && next build --turbopack",
     "start": "next start",
+    "build:plugins": "node scripts/build-plugins.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test:translations": "vitest run --no-isolate lib/__tests__/translations.test.ts",
     "test:integration": "bash integration/run-tests.sh",
     "prepare": "husky",
     "typecheck": "tsc --noEmit",
-    "build:standalone": "next build --webpack && node scripts/assemble-standalone.mjs",
+    "build:standalone": "npm run build:plugins && next build --webpack && node scripts/assemble-standalone.mjs",
     "build:electron": "node scripts/build-electron.mjs",
     "electron:dev": "npm run build:standalone && npm run build:electron && electron .",
     "test:electron": "playwright test -c playwright.electron.config.ts",

scripts/assemble-standalone.mjs

@@ -58,4 +58,27 @@ if (existsSync(sqlcipherSrc)) {
   );
 }
 
+// The staged first-party plugin bundles (scripts/build-plugins.mjs). The
+// server installs these into its plugin registry at startup
+// (lib/admin/bundled-plugins.ts), reading them from
+// `<cwd>/vnc/plugins/build` - and Next's generated server.js chdir's to its
+// own directory, so "cwd" is this standalone dir in every packaged build.
+//
+// Output file tracing cannot find these: nothing imports them, they are read
+// by path at runtime. Without this copy the Electron/standalone build boots
+// with no S/MIME plugin at all while the policy toggle still says it is on -
+// the same silent-drop failure mode as the sqlcipher prebuilds above.
+const pluginsSrc = path.join(rootDir, "vnc", "plugins", "build");
+if (existsSync(pluginsSrc)) {
+  const pluginsDest = path.join(standaloneDir, "vnc", "plugins", "build");
+  rmSync(pluginsDest, { recursive: true, force: true });
+  cpSync(pluginsSrc, pluginsDest, { recursive: true });
+  console.log("Copied bundled first-party plugins into the standalone output");
+} else {
+  console.warn(
+    "No bundled plugins staged at vnc/plugins/build - " +
+      'run "npm run build:plugins" first, or the packaged app ships without S/MIME',
+  );
+}
+
 console.log("Assembled standalone server at", standaloneDir);

scripts/build-plugins.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// Builds the FIRST-PARTY plugins that ship with this fork (vnc/plugins/*) and
+// stages them where the running server can install them.
+//
+// Why this exists
+// ---------------
+// `vnc/plugins/smime` is audited SOURCE, not a prebuilt drop (upstream's own
+// smime.zip was deliberately distrusted). Nothing built it in any real build,
+// so the S/MIME policy toggle was on while no plugin existed. This script is
+// the missing build step; `lib/admin/bundled-plugins.ts` is the matching
+// install step that runs at server startup.
+//
+// Output layout (gitignored, produced not committed):
+//
+//   vnc/plugins/build/<id>/manifest.json
+//   vnc/plugins/build/<id>/<entrypoint>      e.g. index.js
+//
+// That directory is copied into the container image (Dockerfile) and into
+// .next/standalone (scripts/assemble-standalone.mjs), so every distribution
+// path - container, Electron, local dev - boots with the same artifact.
+//
+// Each plugin keeps its OWN package.json + lockfile so its (crypto) deps stay
+// pinned by the audit, rather than being restated in the app's root manifest.
+
+import { execFileSync } from "node:child_process";
+import {
+  cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const rootDir = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const pluginsDir = path.join(rootDir, "vnc", "plugins");
+const outDir = path.join(pluginsDir, "build");
+
+// Mirrors MAX_PLUGIN_SIZE in lib/plugin-types.ts - the cap the admin upload
+// route enforces. A first-party plugin must live inside the same budget.
+const MAX_BUNDLE_BYTES = 5 * 1024 * 1024;
+const ID_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+
+const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+
+function run(cmd, args, cwd) {
+  execFileSync(cmd, args, { cwd, stdio: "inherit" });
+}
+
+function listPluginDirs() {
+  if (!existsSync(pluginsDir)) return [];
+  return readdirSync(pluginsDir)
+    .filter((name) => name !== "build" && !name.startsWith("."))
+    .map((name) => path.join(pluginsDir, name))
+    .filter((dir) => statSync(dir).isDirectory())
+    .filter((dir) => existsSync(path.join(dir, "manifest.json")));
+}
+
+function buildOne(pluginDir) {
+  const manifestPath = path.join(pluginDir, "manifest.json");
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+  const id = manifest.id;
+  if (typeof id !== "string" || !ID_RE.test(id)) {
+    throw new Error(`${manifestPath}: invalid plugin id ${JSON.stringify(id)}`);
+  }
+  const entrypoint =
+    typeof manifest.entrypoint === "string" ? manifest.entrypoint : "index.js";
+  if (entrypoint.includes("/") || entrypoint.includes("\\")) {
+    throw new Error(`${manifestPath}: entrypoint must be a bare filename`);
+  }
+
+  const pkgPath = path.join(pluginDir, "package.json");
+  if (!existsSync(pkgPath)) {
+    throw new Error(`${pluginDir}: no package.json, cannot build`);
+  }
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  if (!pkg.scripts?.build) {
+    throw new Error(`${pkgPath}: no "build" script`);
+  }
+
+  // Install the plugin's own deps only when they're missing. Keeps repeat
+  // builds (and `npm run dev`) fast - the actual esbuild step is ~20ms.
+  if (!existsSync(path.join(pluginDir, "node_modules"))) {
+    const hasLock = existsSync(path.join(pluginDir, "package-lock.json"));
+    console.log(`[build-plugins] installing deps for ${id}`);
+    run(npm, hasLock ? ["ci"] : ["install", "--no-audit", "--no-fund"], pluginDir);
+  }
+
+  console.log(`[build-plugins] building ${id}`);
+  run(npm, ["run", "build"], pluginDir);
+
+  const built = path.join(pluginDir, "dist", entrypoint);
+  if (!existsSync(built)) {
+    throw new Error(`${id}: build produced no ${path.relative(rootDir, built)}`);
+  }
+  const size = statSync(built).size;
+  if (size > MAX_BUNDLE_BYTES) {
+    throw new Error(
+      `${id}: bundle is ${(size / 1024 / 1024).toFixed(2)} MB, over the ` +
+        `${MAX_BUNDLE_BYTES / 1024 / 1024} MB plugin limit`,
+    );
+  }
+
+  const stageDir = path.join(outDir, id);
+  rmSync(stageDir, { recursive: true, force: true });
+  mkdirSync(stageDir, { recursive: true });
+  cpSync(manifestPath, path.join(stageDir, "manifest.json"));
+  cpSync(built, path.join(stageDir, entrypoint));
+
+  console.log(
+    `[build-plugins] staged ${id} v${manifest.version} ` +
+      `(${(size / 1024).toFixed(0)} KB) -> ${path.relative(rootDir, stageDir)}`,
+  );
+}
+
+const dirs = listPluginDirs();
+if (dirs.length === 0) {
+  console.log("[build-plugins] no first-party plugins found under vnc/plugins");
+  process.exit(0);
+}
+
+// Rebuild the staging root from scratch so a plugin removed from the tree does
+// not linger as a stale bundle that the server would happily keep installing.
+rmSync(outDir, { recursive: true, force: true });
+mkdirSync(outDir, { recursive: true });
+
+for (const dir of dirs) buildOne(dir);
+console.log(`[build-plugins] done (${dirs.length} plugin(s))`);

vnc/plugins/smime/README.md

@@ -33,12 +33,48 @@ material ever leaves the device.
   "in-memory, cleared on reload" behaviour.
 - Returned HTML still passes through the host sanitizer.
 
-## Build
+## Build & installation
+
+Nothing manual is required in a normal build. From the repo root:
 
 ```bash
-cd repos/plugins/smime
-npm install          # pulls pkijs / asn1js / pvtsutils / webcrypto-liner + esbuild
-npm run build        # → dist/index.js  (~1.7 MB, under the privileged cap)
+npm run build:plugins    # → vnc/plugins/smime/dist/index.js
+                         #   + staged at vnc/plugins/build/smime/{manifest.json,index.js}
+```
+
+`npm run dev`, `npm run build` and `npm run build:standalone` all run it first,
+and the `Dockerfile` runs `node scripts/build-plugins.mjs` in the builder stage.
+The staged directory is copied into the container image (Dockerfile) and into
+`.next/standalone` (`scripts/assemble-standalone.mjs`), which is what the
+Electron package ships.
+
+At server startup `lib/admin/bundled-plugins.ts` installs the staged bundle into
+the **server plugin registry** (`<ADMIN_CONFIG_DIR>/plugins/`) — the same place
+an operator-uploaded ZIP lands. That matters for the security model below: the
+registry is the signed admin channel, so `/api/admin/plugins/smime/bundle`
+Ed25519-signs the bytes on the way out and `/api/plugins` marks the plugin
+`managed`, which is what `resolvePluginTier` needs before it will grant the
+privileged tier. No gate is bypassed to get there.
+
+Installation is idempotent (a boot where the version + bundle hash are unchanged
+writes nothing) and gated on the **`smimeEnabled` feature policy**, which is
+therefore the operator's on/off switch for S/MIME:
+
+* `smimeEnabled: true` (the default) → installed, `forceEnabled`, served.
+* `smimeEnabled: false` → the registry entry is disabled, `/api/plugins` stops
+  serving it, and clients clean it up on their next sync.
+
+Force-enabling is deliberate: `pluginsEnabled` defaults to `false`, which hides
+the user-facing Settings ▸ Plugins tab, so a user would otherwise have no way to
+switch the plugin on. To remove the plugin, turn the policy toggle **off** —
+deleting it in the admin plugin list is undone by the next restart.
+
+For manual/one-off distribution the plugin also still packages as a ZIP:
+
+```bash
+cd vnc/plugins/smime
+npm ci               # pkijs / asn1js / pvtsutils / webcrypto-liner + esbuild
+npm run build        # → dist/index.js  (~1.7 MB, under the 5 MB plugin cap)
 npm run package      # → smime.zip (manifest.json + index.js) for admin upload
 ```
 
@@ -46,6 +82,20 @@ The build aliases the Node `crypto` builtin (referenced by a dead
 `typeof process` branch in `asmcrypto.js`) to a browser shim so the bundle is
 self-contained.
 
+### Known import limitation
+
+PKCS#12 files whose bags are encrypted with the old
+`pbeWithSHA1And40BitRC2-CBC` / `pbeWithSHA1And128BitRC2-CBC` PBEs fail to import
+with a bare `Unrecognized name` error. `crypto-engine.js` maps those OIDs to an
+`RC2-CBC` WebCrypto algorithm that neither the browser nor `webcrypto-liner`
+actually provides, so the declared support is not real. This is the default
+`openssl pkcs12 -export` certificate PBE on LibreSSL (i.e. macOS's system
+`openssl`). 3DES and PBES2/AES bags — what current OpenSSL, Windows and
+Thunderbird produce — import fine. Re-export with
+`-certpbe aes-256-cbc -keypbe aes-256-cbc` (or `-certpbe PBE-SHA1-3DES`) as a
+workaround; a real fix needs either an RC2 implementation or an explicit,
+actionable error.
+
 ## Layout
 
 ```
@@ -66,8 +116,10 @@ src/
   node-crypto-shim.js browser shim for the Node "crypto" builtin
 ```
 
-The crypto modules are faithful ports of the host's `lib/smime/*` (the former
-native pipeline), so the plugin produces byte-compatible CMS.
+The crypto modules are faithful ports of the host's former `lib/smime/*` native
+pipeline (since removed), so the plugin produces byte-compatible CMS. With that
+directory gone, this plugin **is** the S/MIME feature — which is why the
+`smimeEnabled` policy gate now controls it.
 
 ## Note on host wiring