feat: per-host WinRM/SSH credentials override (0.5.17)

Allow host-level login/password for home/workgroup PCs while keeping global domain admins in Settings.

backend/app/services/agent_commands.py

@@ -7,17 +7,22 @@ from datetime import datetime, timezone
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from app.config import get_settings
 from app.models import AgentCommand, Host
-from app.services.win_admin_settings import get_effective_win_admin_config
+from app.services.win_admin_settings import (
+    get_effective_win_admin_config,
+    get_effective_win_admin_for_host,
+)
 
 
 def _win_admin_configured() -> bool:
     return get_effective_win_admin_config().configured
 
 
-def win_admin_run_as() -> dict[str, str] | None:
-    cfg = get_effective_win_admin_config()
+def win_admin_run_as(db: Session | None = None, host: Host | None = None) -> dict[str, str] | None:
+    if host is not None and db is not None:
+        cfg = get_effective_win_admin_for_host(db, host)
+    else:
+        cfg = get_effective_win_admin_config(db)
     if not cfg.configured:
         return None
     return {
@@ -26,7 +31,13 @@ def win_admin_run_as() -> dict[str, str] | None:
     }
 
 
-def command_to_dict(cmd: AgentCommand, *, include_run_as: bool = False) -> dict:
+def command_to_dict(
+    cmd: AgentCommand,
+    *,
+    include_run_as: bool = False,
+    db: Session | None = None,
+    host: Host | None = None,
+) -> dict:
     out = {
         "id": cmd.command_uuid,
         "type": cmd.command_type,
@@ -38,7 +49,7 @@ def command_to_dict(cmd: AgentCommand, *, include_run_as: bool = False) -> dict:
         "completed_at": cmd.completed_at.isoformat() if cmd.completed_at else None,
     }
     if include_run_as and cmd.status == "pending":
-        run_as = win_admin_run_as()
+        run_as = win_admin_run_as(db, host)
         if run_as:
             out["run_as"] = run_as
     return out