offscale is a plugin

headscale leaves the platform. 45 files move to plugins/offscale/ and the
platform stops knowing it exists.

  api/router.ts   the thin auth-gated proxy, now at /api/offscale
  sidecar/        18 files, the whole headscale contract and its admin keys
  db/             schema + queries, offscale_servers
  web/            26 files as panels and a layout — no screen, per the rule

removed from the platform: the hono mount, the `headscale` capability, the
App.tsx route pair, the screen and its barrel, the AppRegistry spread, the
officerdev re-exports, the dock tile, the page-title rule, and both database
barrels. tsgo is clean and nothing references it.

the imports tell the story of what the plugin↔host API actually is. the sidecar
takes @@/sidecar/protocol, @@/sidecar/connect, @@/data-path and
@@/officer-url.mjs; the queries take officerdb/db and officerdb/crypto; the
schema takes officerdb/auth/schema for the one reference a plugin may make; the
web half takes useClient, copyToClipboard, WorkspaceView and TerminalView from
the officerdev barrel. all of it resolves because a plugin lives inside the repo
— no publishing, no version negotiation.

AND IT FOUND A REAL BUG IN THE INSTALLER. createSidecarProxy learns its port
from a one-shot `<name>:server` event and subscribes when the plugin's router is
first imported — at mount. install started the sidecar BEFORE mounting, so the
announcement fired into a void: process online, routes mounted, every request
answering `503 sidecar not available` until something forced a reconnect. it
would have hit every plugin with an http sidecar. `example` never caught it
because it has no listener to announce.

install and enable now mount before starting; disable still unmounts before
stopping. neither direction leaves a mounted route in front of a sidecar that
cannot be reached.

verified live: /api/offscale/_officer/servers answers {"servers":[]}, /offscale
and /offscale/nodes serve, the old /api/headscale is 404, the offscale
capability is registered from the manifest, and officer-offscale is online.

757 pass, same 10 pre-existing failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plugins/offscale/web/useHeadscalePolicy.ts

@@ -0,0 +1,79 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useClient } from 'hooks/useClient';
+import type { HeadscalePolicy } from './shared';
+import { POLICY_READ_ONLY, POLICY_REJECTED } from './shared';
+
+// The active server's ACL policy. One document, one query, one mutation — the interesting part is entirely
+// in how a failed save is classified, because the two failures need opposite reactions from the owner:
+// "your document is wrong, here is where" versus "this server does not accept written policies at all".
+
+const POLICY_KEY = ['headscale', 'policy'] as const;
+const PATH = '/offscale/_officer/policy';
+
+/** What a rejected save means. `rejected` carries Headscale's own message; `readOnly` ends the editing. */
+export type PolicySaveFailure = { kind: 'rejected' | 'readOnly' | 'unknown'; message: string };
+
+/** useClient throws `{status, message}` with the raw body text — dig the sidecar's `{error, code}` out. */
+export function policySaveFailure(err: unknown): PolicySaveFailure {
+  const raw = (err as { message?: unknown } | null)?.message;
+  if (typeof raw !== 'string' || !raw) return { kind: 'unknown', message: 'The policy could not be saved' };
+
+  try {
+    const parsed = JSON.parse(raw) as { error?: unknown; code?: unknown };
+    const message = typeof parsed.error === 'string' && parsed.error ? parsed.error : 'The policy could not be saved';
+    if (parsed.code === POLICY_READ_ONLY) return { kind: 'readOnly', message };
+    if (parsed.code === POLICY_REJECTED) return { kind: 'rejected', message };
+    return { kind: 'unknown', message };
+  } catch {
+    return { kind: 'unknown', message: raw.slice(0, 300) };
+  }
+}
+
+/** What the assistant proposes. Never saved by the hook — PolicyView puts it in the draft. */
+export type PolicyProposal = { explanation: string; policy: string };
+
+/** The assistant's failures are all one sentence to the owner; only the sidecar's `error` field is useful. */
+export function assistFailure(err: unknown): string {
+  const raw = (err as { message?: unknown } | null)?.message;
+  if (typeof raw !== 'string' || !raw) return 'The assistant could not be reached';
+  try {
+    const parsed = JSON.parse(raw) as { error?: unknown };
+    return typeof parsed.error === 'string' && parsed.error ? parsed.error : 'The assistant could not be reached';
+  } catch {
+    return raw.slice(0, 300);
+  }
+}
+
+/**
+ * Ask for a revised policy in English. Separate from `useHeadscalePolicy` because it is a different kind of
+ * thing: no cache, no query key, nothing to invalidate — one request, one answer, discarded on reload.
+ */
+export function useHeadscalePolicyAssist() {
+  const { post } = useClient();
+  return useMutation({
+    mutationFn: (input: { prompt: string; policy: string }) => post<PolicyProposal>(`${PATH}/assist`, input),
+  });
+}
+
+export function useHeadscalePolicy() {
+  const { get, put } = useClient();
+  const qc = useQueryClient();
+
+  const query = useQuery({
+    queryKey: POLICY_KEY,
+    queryFn: () => get<HeadscalePolicy>(PATH),
+    // No polling and a long staleTime: this is a document someone is editing. A background refetch that
+    // replaced the textarea under a half-written rule would be the worst thing this screen could do.
+    staleTime: 5 * 60_000,
+    refetchOnWindowFocus: false,
+  });
+
+  const save = useMutation({
+    mutationFn: (policy: string) => put<HeadscalePolicy>(PATH, { policy }),
+    // Seed the cache from the response rather than invalidating: a refetch here would race the editor's
+    // own state and could show the pre-save document for a frame.
+    onSuccess: (data) => qc.setQueryData(POLICY_KEY, data),
+  });
+
+  return { policy: query.data ?? null, isLoading: query.isLoading, error: query.error, refetch: query.refetch, save };
+}