Powershell connection and sharing

I manage a Windows fleet (Active Directory, on-prem Exchange, Hyper-V, file servers) from a Mac, increasingly through AgentsRoom agents. Today the app speaks SSH and MySQL; for the Microsoft ecosystem I need two new saved-connection families, following the exact model of the existing SSH connections (credential entered once in the form, stored in the OS keychain, never visible to the agent).

1. Remote PowerShell with three auth modes: SSH+pwsh (reuse the existing SSH plumbing), WinRM/NTLM for workgroup machines, WinRM/Kerberos for domain machines — Kerberos is mandatory for on-prem Exchange (IIS /powershell endpoint, NoLanguage runspace). The Kerberos form must allow entering the KDC (domain controller) and realm explicitly, plus the server IP, for machines whose DNS does not resolve the domain — common from an off-domain workstation; the connector should handle FQDN→IP resolution itself without touching /etc/hosts, since the Kerberos SPN needs the FQDN. Suggested stack: pypsrp (pure Python, macOS + Windows), encryption=always for NTLM over 5985.
2. SMB file shares: server FQDN + share + login/password (NTLM) or Kerberos delegation (reusing the AD ticket), read-only flag, ACL reading (and confirmed ACL writes). Suggested stack: smbprotocol + pyspnego (gssapi on macOS, SSPI on Windows).

Example agent requests this would unlock: "list my Exchange send connectors" (Get-SendConnector via Kerberos), "which VMs are running on the hypervisor" (Get-VM via WinRM), "read the ACLs of this shared folder", "reboot the test VM" (writes always user-confirmed).

Détails : problem = « No way for agents to reach Windows machines that only speak WinRM/PSRP or SMB; SSH-only coverage leaves out Exchange on-prem (Kerberos-only) and workgroup hosts. » / proposal = « Two new connection kinds in the SSH/DB/Secrets modal: powershell (ssh | winrm-ntlm | winrm-kerberos) and smb; the Kerberos variant takes FQDN, KDC/domain controller and realm explicitly for n