fix: fleets, proxmox and automations not getting the host sudo password

plugins/fleets/manifest.json

@@ -18,6 +18,7 @@
     "hosts:read",
     "hosts:write",
     "credentials:use",
+    "credentials:read",
     "ssh:connect",
     "db:own",
     "network:serve",

plugins/fleets/src/backend/routes.ts

@@ -1357,9 +1357,9 @@ export function registerFleetRoutes(
           fleetId,
           "manage",
           async (host) => {
-            // Package actions need the host's sudo password, an operational
-            // secret ctx.hosts.get() leaves out. ctx.ssh.connect resolves the
-            // full host the connect pipeline uses, which carries it.
+            // Package actions need the host's sudo password. connect() hands
+            // back a redacted host, so read it through resolveHost.
+            const full = await ctx.ssh.resolveHost(host.id);
             const connection = await ctx.ssh.connect(host.id, {
               purpose: "fleet",
             });
@@ -1388,7 +1388,7 @@ export function registerFleetRoutes(
                 const result = await execElevated(
                   sshClient,
                   cmd,
-                  connection.host.sudoPassword as string | undefined,
+                  full?.sudoPassword as string | undefined,
                   { forceSudo: true, timeoutMs: 600000 },
                 );
                 return {

plugins/fleets/tests/backend/sudo-capability.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// Elevated commands read the host's sudo password, which core only hands to
+// a plugin holding credentials:read.
+describe("sudo password access", () => {
+  it("declares credentials:read", () => {
+    const manifest = JSON.parse(
+      fs.readFileSync(
+        path.resolve(import.meta.dirname, "../../manifest.json"),
+        "utf8",
+      ),
+    );
+    expect(manifest.capabilities).toContain("credentials:read");
+  });
+});