feat(plugins): let the extra_fields slot hide host credential inputs

[debba]

Summary

Supersedes #775 with a smaller, driver-agnostic host change. Instead of a SQL Server specific supports_integrated_auth capability plus a first-class integrated_auth connection parameter, the host only gains a generic hook on the existing connection-modal.extra_fields slot. The "Use Windows Authentication" checkbox itself moves into the SQL Server plugin as a UI extension, and its value travels in the opaque extra map that the host already persists and forwards verbatim (#596).

What changed

• connection-modal.extra_fields slot context: added credentialFieldsHidden: boolean and setCredentialFieldsHidden(hidden: boolean). When a plugin passes true, the modal removes the username/password block and clears both values, so a stale login never reaches the driver. Passing false shows the inputs again (empty).
• The flag is reset on every driver change (catalogue pick and connection-string import that switches driver) and when the modal is re-initialised, so it cannot leak from one driver to another.
• Save while hidden: the modal sends the explicit empty password instead of omitting it. An untouched empty password on an existing connection is still omitted, so the "keep the stored one" behaviour of the edit dialog is unchanged.
• Backend: keychain_utils::stored_password_change maps an omitted password to keep, an explicit "" to delete and anything else to store. update_connection deletes the keychain entry and invalidates the credential cache on "", so the next connect no longer injects the old secret; save_connection skips storing an empty password. Storing "" was not an option because the Linux keyutils store used by keyring rejects empty secrets.
• Connection-string import: while the inputs are hidden and the driver stays the same, the login part of the string is ignored (it would otherwise sit in invisible fields and be rejected by the driver). When the import switches driver, the plugin extra map is dropped, as the catalogue driver switch already does.
• @tabularis/plugin-api: typed context updated, version bumped to 0.1.2 (additive change, check:sync passes).
• plugins/PLUGIN_GUIDE.md: slot table row documents the new context members and the save/import behaviour while hidden.
• Tests: six cases in tests/components/modals/NewConnectionModal.test.tsx render a fake plugin contribution through PluginSlotContext and verify hide/clear/restore, the explicit empty password in the update_connection payload, the unchanged omission when the inputs are visible, and both import scenarios. Three unit tests cover stored_password_change.

The only backend behaviour change is the password == "" branch with keychain enabled, which the frontend never sent on edit before and which failed on Linux on create. Other callers of update_connection (built-in driver migration) resend the password loaded from the keychain, so they are unaffected. No new capability flag, no new ConnectionParams field, no changes to the built-in drivers. Existing plugins ignore the extra context members; plugins built against @tabularis/plugin-api 0.1.1 keep type-checking.

Plugin side

The SQL Server plugin ships ui/dist/index.js on this slot (gated with driver: "sqlserver"): a checkbox that writes extra.integrated_auth = "true" and calls setCredentialFieldsHidden. The Rust side resolves the flag from extra or from Integrated Security=True in a connection string, rejects a login combined with integrated authentication, and folds the flag into the pool key. On hosts without this hook the checkbox still works, only the login inputs stay visible. That work builds on TabularisDB/tabularis-sqlserver-plugin#25 and will be opened as a follow-up PR there.

Verification

• pnpm typecheck, pnpm exec eslint on the changed files: clean
• pnpm build:plugin-api and pnpm check:plugin-api: OK
• pnpm exec vitest run: 271 files, 4422 tests passing (35 in the modal file, 6 new)
• cargo test --lib keychain_utils_tests: 6 passing; clippy and rustfmt clean on the touched hunks
• GitNexus detect-changes against the merge base: 8 files; save_connection and update_connection sit on 15 execution flows, the behaviour change is limited to the explicit empty password branch described above
• Installed SQL Server plugin driven over stdio against a local SQL Server 2022 container: SQL authentication succeeds, integrated auth alone reaches GSSAPI and fails with the expected "run kinit" error on a machine without a ticket, integrated auth combined with a username or with a password (the keychain injection case this PR fixes) is rejected, Integrated Security=True in a connection string also reaches GSSAPI
• Still to do: end-to-end check of the checkbox in a dev build (pnpm tauri dev with the modified plugin installed), including edit of an existing keychain-stored SQL auth connection to Windows auth, and a live SSPI test on a domain-joined Windows machine as in feat: add Windows Authentication checkbox for integrated-auth drivers #775

Credits

The Windows Authentication checkbox, the hide/clear behaviour of the login inputs and the live SSPI verification against a domain-joined SQL Server come from @egertaia's work in #775 and TabularisDB/tabularis-sqlserver-plugin#25. This PR moves that design onto a generic slot hook; @egertaia is listed as co-author on the commit.

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[github-actions]

Preview build

The preview build of commit ea3b0af failed (skipped). See the workflow run for logs.