fix: fleets, proxmox and automations not getting the host sudo password

plugins/proxmox/manifest.json

@@ -18,6 +18,7 @@
     "hosts:read",
     "hosts:write",
     "credentials:use",
+    "credentials:read",
     "ssh:connect",
     "db:own",
     "network:serve",

plugins/proxmox/src/backend/routes.ts

@@ -275,7 +275,13 @@ async function discoverProxmoxGuestsForHost(
     timeoutMs: 35000,
     overrides: { tryKeyboard: false, readyTimeout: 30000 },
   });
-  const hostWithSudo: PluginSshHostWithSudo = host;
+  // connect() always hands back a redacted host; the sudo password comes
+  // from resolveHost, which needs credentials:read.
+  const full = await ctx.ssh.resolveHost(parsedHostId);
+  const hostWithSudo: PluginSshHostWithSudo = {
+    ...host,
+    sudoPassword: (full?.sudoPassword as string | undefined) ?? undefined,
+  };
   const hostCredentialId = (hostWithSudo.credentialId as number | null) ?? null;
 
   try {

plugins/proxmox/tests/backend/sudo-capability.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// Elevated commands read the host's sudo password, which core only hands to
+// a plugin holding credentials:read.
+describe("sudo password access", () => {
+  it("declares credentials:read", () => {
+    const manifest = JSON.parse(
+      fs.readFileSync(
+        path.resolve(import.meta.dirname, "../../manifest.json"),
+        "utf8",
+      ),
+    );
+    expect(manifest.capabilities).toContain("credentials:read");
+  });
+});