offscale is a plugin

headscale leaves the platform. 45 files move to plugins/offscale/ and the
platform stops knowing it exists.

  api/router.ts   the thin auth-gated proxy, now at /api/offscale
  sidecar/        18 files, the whole headscale contract and its admin keys
  db/             schema + queries, offscale_servers
  web/            26 files as panels and a layout — no screen, per the rule

removed from the platform: the hono mount, the `headscale` capability, the
App.tsx route pair, the screen and its barrel, the AppRegistry spread, the
officerdev re-exports, the dock tile, the page-title rule, and both database
barrels. tsgo is clean and nothing references it.

the imports tell the story of what the plugin↔host API actually is. the sidecar
takes @@/sidecar/protocol, @@/sidecar/connect, @@/data-path and
@@/officer-url.mjs; the queries take officerdb/db and officerdb/crypto; the
schema takes officerdb/auth/schema for the one reference a plugin may make; the
web half takes useClient, copyToClipboard, WorkspaceView and TerminalView from
the officerdev barrel. all of it resolves because a plugin lives inside the repo
— no publishing, no version negotiation.

AND IT FOUND A REAL BUG IN THE INSTALLER. createSidecarProxy learns its port
from a one-shot `<name>:server` event and subscribes when the plugin's router is
first imported — at mount. install started the sidecar BEFORE mounting, so the
announcement fired into a void: process online, routes mounted, every request
answering `503 sidecar not available` until something forced a reconnect. it
would have hit every plugin with an http sidecar. `example` never caught it
because it has no listener to announce.

install and enable now mount before starting; disable still unmounts before
stopping. neither direction leaves a mounted route in front of a sidecar that
cannot be reached.

verified live: /api/offscale/_officer/servers answers {"servers":[]}, /offscale
and /offscale/nodes serve, the old /api/headscale is 404, the offscale
capability is registered from the manifest, and officer-offscale is online.

757 pass, same 10 pre-existing failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plugins/offscale/web/useHeadscaleData.ts

@@ -0,0 +1,163 @@
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { useClient } from 'hooks/useClient';
+import type { HeadscaleNode, HeadscaleUserWithCounts, HeadscalePreAuthKey } from './shared';
+
+// Queries for the domain sections. All three act on whichever server is active, so they live under the
+// same ['headscale'] key prefix that switching servers invalidates wholesale (see useHeadscaleServers).
+//
+// Mutations invalidate broadly rather than patching caches: deleting a user changes node counts, approving
+// a route changes subnetRoutes, expiring a key changes nothing else but costs one cheap refetch. The lists
+// are small and the correctness is worth more than the round trip.
+
+const NODES_KEY = ['headscale', 'nodes'] as const;
+const USERS_KEY = ['headscale', 'users'] as const;
+const KEYS_KEY = ['headscale', 'keys'] as const;
+
+const EMPTY_NODES: HeadscaleNode[] = [];
+const EMPTY_USERS: HeadscaleUserWithCounts[] = [];
+const EMPTY_KEYS: HeadscalePreAuthKey[] = [];
+
+export function useHeadscaleNodes() {
+  const { get, post, delete: del } = useClient();
+  const qc = useQueryClient();
+  const invalidate = () => qc.invalidateQueries({ queryKey: ['headscale'] });
+
+  const query = useQuery({
+    queryKey: NODES_KEY,
+    queryFn: () => get<{ nodes: HeadscaleNode[] }>('/offscale/_officer/nodes'),
+    // Online/lastSeen go stale fast, and this is a screen you sit on while waiting for a machine to join.
+    refetchInterval: 20_000,
+    staleTime: 10_000,
+  });
+
+  const rename = useMutation({
+    mutationFn: ({ id, name }: { id: string; name: string }) => post(`/offscale/_officer/nodes/${id}/rename`, { name }),
+    onSuccess: invalidate,
+  });
+
+  const setTags = useMutation({
+    mutationFn: ({ id, tags }: { id: string; tags: string[] }) => post(`/offscale/_officer/nodes/${id}/tags`, { tags }),
+    onSuccess: invalidate,
+  });
+
+  // Re-owning a node. Takes the target user's id, not its name — Headscale's ids are uint64-as-string.
+  const moveToUser = useMutation({
+    mutationFn: ({ id, userId }: { id: string; userId: string }) =>
+      post(`/offscale/_officer/nodes/${id}/user`, { userId }),
+    onSuccess: invalidate,
+  });
+
+  // Single-route toggle: the sidecar reads the current approved set and writes it back with one change,
+  // because Headscale's approve_routes replaces the whole set.
+  const toggleRoute = useMutation({
+    mutationFn: ({ id, route, approved }: { id: string; route: string; approved: boolean }) =>
+      post(`/offscale/_officer/nodes/${id}/routes`, { route, approved }),
+    onSuccess: invalidate,
+  });
+
+  const expire = useMutation({
+    mutationFn: (id: string) => post(`/offscale/_officer/nodes/${id}/expire`),
+    onSuccess: invalidate,
+  });
+
+  const remove = useMutation({
+    mutationFn: (id: string) => del(`/offscale/_officer/nodes/${id}`),
+    onSuccess: invalidate,
+  });
+
+  return {
+    nodes: query.data?.nodes ?? EMPTY_NODES,
+    isLoading: query.isLoading,
+    error: query.error,
+    rename,
+    setTags,
+    moveToUser,
+    toggleRoute,
+    expire,
+    remove,
+  };
+}
+
+export function useHeadscaleUsers() {
+  const { get, post, delete: del } = useClient();
+  const qc = useQueryClient();
+  const invalidate = () => qc.invalidateQueries({ queryKey: ['headscale'] });
+
+  const query = useQuery({
+    queryKey: USERS_KEY,
+    queryFn: () => get<{ users: HeadscaleUserWithCounts[] }>('/offscale/_officer/users'),
+    staleTime: 30_000,
+  });
+
+  const create = useMutation({
+    mutationFn: (input: { name: string; displayName?: string; email?: string }) =>
+      post('/offscale/_officer/users', input),
+    onSuccess: invalidate,
+  });
+
+  const rename = useMutation({
+    mutationFn: ({ id, name }: { id: string; name: string }) => post(`/offscale/_officer/users/${id}/rename`, { name }),
+    onSuccess: invalidate,
+  });
+
+  const remove = useMutation({
+    mutationFn: (id: string) => del(`/offscale/_officer/users/${id}`),
+    onSuccess: invalidate,
+  });
+
+  return {
+    users: query.data?.users ?? EMPTY_USERS,
+    isLoading: query.isLoading,
+    error: query.error,
+    create,
+    rename,
+    remove,
+  };
+}
+
+export type CreateKeyInput = {
+  userId: string;
+  reusable: boolean;
+  ephemeral: boolean;
+  expirationDays: number;
+  aclTags: string[];
+};
+
+export function useHeadscaleKeys() {
+  const { get, post, delete: del } = useClient();
+  const qc = useQueryClient();
+  const invalidate = () => qc.invalidateQueries({ queryKey: KEYS_KEY });
+
+  const query = useQuery({
+    queryKey: KEYS_KEY,
+    queryFn: () => get<{ keys: HeadscalePreAuthKey[] }>('/offscale/_officer/keys'),
+    staleTime: 30_000,
+  });
+
+  // The response carries the only copy of the secret that will ever exist. It is returned to the caller
+  // (not merged into the list cache) so the view can show it once and deliberately drop it.
+  const create = useMutation({
+    mutationFn: (input: CreateKeyInput) =>
+      post<{ key: HeadscalePreAuthKey; secretShownOnce: boolean }>('/offscale/_officer/keys', input),
+    onSuccess: invalidate,
+  });
+
+  const expire = useMutation({
+    mutationFn: (id: string) => post(`/offscale/_officer/keys/${id}/expire`),
+    onSuccess: invalidate,
+  });
+
+  const remove = useMutation({
+    mutationFn: (id: string) => del(`/offscale/_officer/keys/${id}`),
+    onSuccess: invalidate,
+  });
+
+  return {
+    keys: query.data?.keys ?? EMPTY_KEYS,
+    isLoading: query.isLoading,
+    error: query.error,
+    create,
+    expire,
+    remove,
+  };
+}