[pierreneter]

Problem

A kubeconfig user is often an exec credential plugin — tsh kube credentials
(Teleport), aws eks get-token, kubelogin, gke-gcloud-auth-plugin. client-go
runs it before the first request, and with interactiveMode: IfAvailable (the
default, and what tsh writes) it hands the plugin os.Stdin and os.Stderr
whenever stdin is a TTY.

Under a TUI that is always true, and always wrong:

• A relogin / MFA prompt reads keystrokes meant for k10s and paints over the frame.
  The session looks hung. This is k9s appears to hang when credentials timeout and need to enter another MFA token derailed/k9s#2048, closed "not planned";
  the workaround there is kill -9.
• client-go formats the plugin's failure with %v and drops its stderr, so the
  user sees exec: executable tsh failed with exit code 1 instead of
  Having problems with relogin, please use 'tsh login/tsh kube login' manually.
• The plugin's run time is spent inside the probe's 10s rest.Config.Timeout,
  which client-go cannot interrupt. A slow plugin (minting a cert, calling STS)
  turned into No cluster: context deadline exceeded even though it
  succeeded; r then worked because the credentials were cached.
  Connection issues when using k9s with tsh kube login compared to tsh proxy kube gravitational/teleport#49622 is k9s showing exactly this.

Change

One rule: the TUI owns the terminal, the plugin never gets it.

• StdinUnavailable = true on ExecProvider — what kubectl exec -i does
  when stdin is spoken for. IfAvailable plugins run without stdin and fail
  fast; Always plugins are refused before they run, with a k10s reason.
• k8s.CaptureStderr swaps os.Stderr for a pipe before the first client
  is built (client-go copies os.Stderr at that point and never looks again).
  The last line a plugin wrote becomes k8s.CredentialPluginError, the
  No cluster reason, and the chain still unwraps to client-go's error.
  $EDITOR and foreground plugins get the terminal's real stderr via
  Startup.TerminalStderr; k8s.ReleaseStderr restores it after Run.
• Probe retried once when it timed out with a plugin in play. Credentials
  are cached by then, so the retry is the network alone. No change without a
  plugin (test asserts a single hit).
• Connecting toast names the plugin (… connecting · credentials from tsh),
  the No cluster reason wraps instead of truncating, /setup and
  docs/cluster-setup.md get a "Credential plugins" section with the Teleport
  caveats (tsh proxy kube for per-session MFA / L7 LB).

Not in this PR

• A separate "auth expired" state mid-session (watch_health) that keeps cached rows.
• An l action that runs the context's exec command interactively through
  tea.ExecProcess, then retries.
• tsh-specific hints parsed from the exec args.

Tests

• internal/k8s/credplugin_test.go: fake plugin as a shell script against the
  existing TLS test API server — runs without the terminal and its token is
  used; Always is refused and the plugin does not run; the plugin's last
  stderr line is the error verbatim; a 1s plugin under a 300ms probe succeeds
  via the retry (fails with the retry removed); a slow server without a plugin
  is still hit once; CredentialPlugin() naming.
• internal/ui/credplugin_test.go: toast names the plugin; toTerminal
  keeps a caller-set stderr and does nothing without a terminal.
• main_test.go: noClusterReason keeps the plugin's words intact.
• just check and go test -race ./internal/k8s/ green.

Unverified

Whether tsh's WebAuthn tap works with stdin unavailable (touch needs no
stdin, but tsh may bail early). Needs a real per-session-MFA cluster. If it
does not, the documented path is tsh proxy kube <cluster> --exec.

[junior]

Looks good, and the model is right: the TUI owns the terminal, StdinUnavailable is how kubectl says so too, and the capture lasts only while Run does, so the subcommands, the pod shell and the editor are untouched. The gate on main with #39 and this merged in is clean: gofmt, vet and go test -short on Go 1.27.4 (with -race for ., internal/k8s and internal/ui) and on Go 1.26.11.

Three things, none blocking:

1. A panic inside the TUI loses its stack trace. Bubble Tea 1.3.10 prints the panic value with fmt.Printf, but the stack with debug.PrintStack(), which writes to os.Stderr: it goes into the pipe and only its last line is kept. Keeping the tail of what the pipe read (the last 64 KiB, say) and writing it to the terminal when Run returns an error would keep crash reports useful. I can send that as a follow-up.
2. A cluster that does not answer now takes twice as long to show No cluster when its context uses a plugin, since every timeout with a plugin is retried: an EKS context with the VPN down waits about 20s instead of 10s. Fine if slow plugins are the common case; just noting it.
3. CredentialPlugin loads the whole kubeconfig on the UI goroutine at every connect, for the toast. With a KUBECONFIG of many files that could show as a short pause; the name could come from the config main already loads for the context list.