feat: harden plugin api for separate repos, signed updates and generic external login

plugins/proxmox/src/frontend/ProxmoxDiscoverDialog.tsx

@@ -1,5 +1,8 @@
 import { useRef, useState } from "react";
-import { useTranslation } from "@termix/plugin-sdk/frontend";
+import {
+  notifyHostsChanged,
+  useTranslation,
+} from "@termix/plugin-sdk/frontend";
 import { Server, RefreshCw, CheckSquare, Square, Download } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@termix/plugin-sdk/ui";
@@ -201,7 +204,7 @@ export function ProxmoxDiscoverDialog({
       if (toImport.length) {
         const updated = await listHosts();
         onHostsChanged(updated);
-        window.dispatchEvent(new CustomEvent("termix:hosts-changed"));
+        notifyHostsChanged();
       }
 
       const msg = [

plugins/proxmox/src/frontend/proxmox-import-auth.ts

@@ -1,12 +1,4 @@
 const SECRET_BACKED_AUTH_TYPES = new Set(["password", "key"]);
-const SECRETLESS_AUTH_TYPES = new Set([
-  "none",
-  "agent",
-  "opkssh",
-  "stepca",
-  "tailscale",
-  "vault",
-]);
 
 export type ProxmoxImportAuth = {
   authType: string;
@@ -18,8 +10,13 @@ export function resolveProxmoxImportAuth(
   defaultAuthType: string | undefined,
   credentialId: number | null | undefined,
 ): ProxmoxImportAuth {
-  // An explicit secretless auth choice (none/opkssh/tailscale/vault) wins.
-  if (defaultAuthType && SECRETLESS_AUTH_TYPES.has(defaultAuthType)) {
+  // Any auth type that needs no stored secret (none, agent, or one a plugin
+  // adds) wins, the same rule the backend copy applies.
+  if (
+    defaultAuthType &&
+    defaultAuthType !== "credential" &&
+    !SECRET_BACKED_AUTH_TYPES.has(defaultAuthType)
+  ) {
     return { authType: defaultAuthType };
   }
 
@@ -35,14 +32,5 @@ export function resolveProxmoxImportAuth(
     };
   }
 
-  // Explicit non secret-backed special type without a credential.
-  if (
-    defaultAuthType &&
-    defaultAuthType !== "credential" &&
-    !SECRET_BACKED_AUTH_TYPES.has(defaultAuthType)
-  ) {
-    return { authType: defaultAuthType };
-  }
-
   return { authType: "none" };
 }