feat: harden plugin api for separate repos, signed updates and generic external login

plugins/proxmox/locales/en.json

@@ -88,7 +88,8 @@
     "proxmoxLastSyncSummary": "{{created}} created, {{updated}} updated, {{markedMissing}} missing, {{skipped}} skipped",
     "proxmoxLastSyncStatus": {
       "error": "Failed",
-      "pending": "Pending"
+      "pending": "Pending",
+      "success": "Success"
     },
     "proxmoxDiscoverAction": "Discover & import Proxmox guests",
     "proxmoxImportTitle": "Import from Proxmox",

plugins/proxmox/manifest.json

@@ -21,7 +21,8 @@
     "ssh:connect",
     "db:own",
     "network:serve",
-    "ui:surface"
+    "ui:surface",
+    "users:impersonate"
   ],
   "contributes": {
     "tabs": [

plugins/proxmox/package.json

@@ -6,10 +6,27 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -b ../../tsconfig.plugins.backend.json ../../tsconfig.plugins.frontend.json",
+    "typecheck": "tsc -p .",
     "validate": "termix-plugin validate"
   },
+  "dependencies": {
+    "lucide-react": "^1.33.0"
+  },
   "devDependencies": {
-    "@termix/plugin-sdk": "*"
+    "@termix/plugin-sdk": "^1.0.0",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "better-sqlite3": "^13.0.3",
+    "jsdom": "^30.0.1",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "drizzle-orm": "^0.45.2",
+    "express": "^5.2.1",
+    "react": "^19.2.8",
+    "sonner": "^2.0.8",
+    "ssh2": "^1.17.0"
   }
 }

plugins/proxmox/src/frontend/ProxmoxDiscoverDialog.tsx

@@ -1,5 +1,8 @@
 import { useRef, useState } from "react";
-import { useTranslation } from "@termix/plugin-sdk/frontend";
+import {
+  notifyHostsChanged,
+  useTranslation,
+} from "@termix/plugin-sdk/frontend";
 import { Server, RefreshCw, CheckSquare, Square, Download } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@termix/plugin-sdk/ui";
@@ -201,7 +204,7 @@ export function ProxmoxDiscoverDialog({
       if (toImport.length) {
         const updated = await listHosts();
         onHostsChanged(updated);
-        window.dispatchEvent(new CustomEvent("termix:hosts-changed"));
+        notifyHostsChanged();
       }
 
       const msg = [

plugins/proxmox/src/frontend/proxmox-import-auth.ts

@@ -1,12 +1,4 @@
 const SECRET_BACKED_AUTH_TYPES = new Set(["password", "key"]);
-const SECRETLESS_AUTH_TYPES = new Set([
-  "none",
-  "agent",
-  "opkssh",
-  "stepca",
-  "tailscale",
-  "vault",
-]);
 
 export type ProxmoxImportAuth = {
   authType: string;
@@ -18,8 +10,13 @@ export function resolveProxmoxImportAuth(
   defaultAuthType: string | undefined,
   credentialId: number | null | undefined,
 ): ProxmoxImportAuth {
-  // An explicit secretless auth choice (none/opkssh/tailscale/vault) wins.
-  if (defaultAuthType && SECRETLESS_AUTH_TYPES.has(defaultAuthType)) {
+  // Any auth type that needs no stored secret (none, agent, or one a plugin
+  // adds) wins, the same rule the backend copy applies.
+  if (
+    defaultAuthType &&
+    defaultAuthType !== "credential" &&
+    !SECRET_BACKED_AUTH_TYPES.has(defaultAuthType)
+  ) {
     return { authType: defaultAuthType };
   }
 
@@ -35,14 +32,5 @@ export function resolveProxmoxImportAuth(
     };
   }
 
-  // Explicit non secret-backed special type without a credential.
-  if (
-    defaultAuthType &&
-    defaultAuthType !== "credential" &&
-    !SECRET_BACKED_AUTH_TYPES.has(defaultAuthType)
-  ) {
-    return { authType: defaultAuthType };
-  }
-
   return { authType: "none" };
 }

plugins/proxmox/tests/backend/proxmox-stats-polling.test.ts

@@ -86,7 +86,7 @@ describe("ProxmoxPollingManager", () => {
     };
     const manager = new ProxmoxPollingManager<TestHost>({
       fetchHostById,
-      withSshConnection,
+      withSshConnection: withSshConnection as never,
       historyRepository,
     });
     return { manager, fetchHostById, withSshConnection, historyRepository };