feat: add auth extension points and one ssh connect pipeline

src/ui/plugin-host/app.ts

@@ -320,7 +320,7 @@ export function createPluginApp(
           ...method,
           titleKey: key(method.titleKey),
           pluginId,
-          component: scoped(method.component),
+          component: scoped(method.component) as never,
         }),
       );
     },
@@ -331,7 +331,10 @@ export function createPluginApp(
           ...factor,
           titleKey: key(factor.titleKey),
           pluginId,
-          component: scoped(factor.component),
+          component: scoped(factor.component) as never,
+          enrollment: factor.enrollment
+            ? (scoped(factor.enrollment) as never)
+            : undefined,
         }),
       );
     },

src/ui/plugin-host/auth-registry.ts

@@ -1,14 +1,19 @@
 import type { ComponentType } from "react";
+import type {
+  LoginMethodUIProps,
+  SecondFactorUIProps,
+} from "@termix/plugin-sdk/frontend";
 import { createRegistry } from "@/lib/registry";
 
 /**
  * Auth UI plugins contribute.
  *
- * SSH auth editors are live: the host editor lists registered auth types next
- * to the core ones (password, key, credential, agent, none) and renders the
- * plugin's editor when one is picked. Login methods and second factors are
- * declared here so the app object is complete; A8 wires them into the login
- * screen.
+ * SSH auth editors render in the host and credential editors when their auth
+ * type is picked. Login methods render on the login screen for methods the
+ * server reports as enabled; second factors render in the step after a first
+ * login and, when they bring one, in Settings > Security for enrolment.
+ * Core's own (OIDC, LDAP, passkeys, TOTP) register from
+ * src/ui/auth/legacy-auth-ui.tsx until they move into plugins.
  */
 export interface SshAuthEditorDef {
   /** The authType value stored on the host. */
@@ -28,14 +33,15 @@ export interface LoginMethodDef {
   pluginId?: string;
   titleKey: string;
   icon?: ComponentType<{ className?: string }>;
-  component: ComponentType<Record<string, unknown>>;
+  component: ComponentType<LoginMethodUIProps>;
 }
 
 export interface SecondFactorDef {
   id: string;
   pluginId?: string;
   titleKey: string;
-  component: ComponentType<Record<string, unknown>>;
+  component: ComponentType<SecondFactorUIProps>;
+  enrollment?: ComponentType<Record<string, unknown>>;
 }
 
 const sshAuthEditors = createRegistry<SshAuthEditorDef>();
@@ -47,9 +53,11 @@ export const getSshAuthEditor = sshAuthEditors.get;
 export const useSshAuthEditors = sshAuthEditors.useList;
 
 export const registerLoginMethod = loginMethods.register;
+export const getLoginMethodUI = loginMethods.get;
 export const useLoginMethods = loginMethods.useList;
 
 export const registerSecondFactor = secondFactors.register;
+export const getSecondFactorUI = secondFactors.get;
 export const useSecondFactors = secondFactors.useList;
 
 export function resetAuthRegistries(): void {

src/ui/plugin-host/bridge.ts

@@ -24,6 +24,7 @@ import { usePluginScope } from "./scope";
 import { knownPluginIds } from "./plugin-store";
 import { tabsApi, useShellHosts } from "./shell-bridge";
 import { invokeAction } from "@/shell/action-registry";
+import { useSshAuthProviders } from "@/hooks/useSshAuthProviders";
 
 /**
  * Core permission groups, mirroring RESERVED_PERMISSION_PREFIXES in the SDK
@@ -243,6 +244,22 @@ export const pluginHostBridge: PluginHostBridge = {
   useTabs: () => tabsApi,
 
   invokeAction: (id, ...args) => invokeAction(id, ...args),
+
+  useSshAuthTypes: () => {
+    const { providers, loaded } = useSshAuthProviders();
+    return {
+      loaded,
+      types: providers
+        .filter((option) => option.available)
+        .map((option) => ({
+          type: option.type,
+          labelKey: option.editorTitleKey ?? option.labelKey,
+          pluginId: option.pluginId,
+          credentialType: option.credentialType,
+          supportsBackground: option.supportsBackground,
+        })),
+    };
+  },
 };
 
 /** Installs the bridge. Idempotent. */

src/ui/plugin-host/loader.ts

@@ -350,6 +350,35 @@ async function fetchGuestPlugins(): Promise<PluginSummary[]> {
   return Array.isArray(body) ? (body as PluginSummary[]) : [];
 }
 
+async function fetchPreLoginPlugins(): Promise<PluginSummary[]> {
+  const response = await fetch(getBackendUrl("/plugins/public-manifest"));
+  if (!response.ok) return [];
+  const body = (await response.json()) as unknown;
+  return Array.isArray(body) ? (body as PluginSummary[]) : [];
+}
+
+/**
+ * Loads the plugins the login screen needs (login methods and second
+ * factors) before anyone has signed in. After sign-in the full runtime
+ * reconciles, keeping these active when their bundle has not changed.
+ */
+export async function startPreLoginPlugins(): Promise<void> {
+  installPluginHostBridge();
+  let list: PluginSummary[];
+  try {
+    list = await fetchPreLoginPlugins();
+  } catch {
+    return;
+  }
+  if (list.length === 0) return;
+  setPluginLocaleResolver((namespace, _language, file) => {
+    const summary = getPluginRecord(namespace)?.summary;
+    if (!summary) return Promise.resolve(null);
+    return currentDeps().loadLocale(summary, file);
+  });
+  await syncPlugins(list);
+}
+
 /**
  * Starts the runtime. Idempotent. `guest` is for anonymous pages (shared
  * session links): only plugins declaring contributes.guest load, from the