pastilhasandClaude Opus 5
373d67e0a0
The extraction landed months ago and the platform side is clean. What was left was inside the plugin, and it was the half that shows. ── Names a user actually reads ── The three registered panels were still called "Headscale servers", "Headscale" and "Headscale" in the panel picker, and the server picker rendered "Headscale" as its own heading. Those name OUR panels, not the upstream server, so they were simply missed. Deliberately NOT a find-and-replace. Most of the ~175 "headscale" strings in here are correct — "no active Headscale server", "headscale timed out", "is this a Headscale server?" all refer to the thing this plugin drives, and renaming them would make the errors lie. What was fixed is the plugin's own identity, plus nine stale `/headscale` route paths that are wrong rather than merely old (the route is `/offscale`) and one reference to `queries/headscale.ts`, a file the extraction deleted. The console's pty session key moves from `headscale-console-<id>` to `offscale-console-<id>`. That one has a real cost: a console open at the moment of the change keeps running in the sidecar under the old key with nothing pointing at it, until that sidecar restarts. Paid once, deliberately, rather than carrying the pre-extraction name in persisted state forever. ── The manifest was missing a dependency it has always had ── `sidecar/ssh.ts` spawns `ssh`, and so does the reachability probe. The manifest said "Offscale needed nothing", so install checked for nothing and a host without an ssh client failed at RUNTIME with a spawn error — precisely the failure `osDependencies` exists to turn into a refusal at install time. PLUGIN.md listed ssh as a host dependency all along; the manifest was the file that was wrong. Missed because ssh is on effectively every Linux box, which is also why declaring it costs nothing there and is the whole difference where it is absent. ── Documentation that said the opposite of the code ── PLUGIN.md instructed the reader to carry `assist.ts` in "but do not wire it up", as a marker. It has been wired for some time: `policy.ts` routes `POST /_officer/policy/assist`, `PolicyView.tsx` renders `<PolicyAssistant />`, and the manifest declares the route in `readOnlyWrites`. Corrected rather than deleted, because that instruction is exactly the kind someone would follow — a person tidying "unused" code would have found it wired and assumed the document knew something they did not. Present-tense identifiers corrected to the shipped names; the "before" columns of the migration tables still say headscale, because that is what they record. A note at the top says which is which. tsgo clean, 21 plugin tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
3.4 KiB
TypeScript
64 lines
3.4 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
|
|
|
// Offscale — Headscale, plus the Companion that ships beside it.
|
|
//
|
|
// Not a rename of Headscale and not a fork: the server underneath is stock, and the Companion adds what
|
|
// Headscale itself does not do — the invite flow being the first of them. The distinct name marks a
|
|
// distinct product rather than a badge on someone else's.
|
|
//
|
|
// The first real plugin, extracted from the platform on 2026-08-15. Everything it needs is here:
|
|
//
|
|
// api/router.ts a thin auth-gated proxy — no Headscale knowledge, and it must never grow any
|
|
// sidecar/ the whole Headscale contract, holding the admin API keys
|
|
// db/ offscale_servers, and the only table this plugin owns
|
|
// web/ panels and a layout; the shell renders the Workspace
|
|
export const manifest: PluginManifest = {
|
|
publisher: 'officerdev',
|
|
version: '1.0.0',
|
|
platform: '>=1.0.0',
|
|
|
|
label: 'Offscale',
|
|
summary: 'Your tailnet — machines, users, pre-auth keys, access policy and device invites',
|
|
icon: 'Network',
|
|
color: '#818cf8',
|
|
|
|
// One permission gating the whole surface, grantable per role at read or write like every other.
|
|
//
|
|
// `[open]` What a member's grant MEANS here is this plugin's own job and is not finished. The queries
|
|
// still scope by the caller (`listOffscaleServers(userId)`), so a granted member would see their own
|
|
// empty server list rather than the owner's, and could register a Headscale of their own. The model in
|
|
// ./PLUGIN.md is one shared resource: read sees what the owner sees, write can change it.
|
|
// That is a change inside these queries, not a flag on the manifest.
|
|
//
|
|
// Worth knowing while it is unfinished: the stored credential is a Headscale ADMIN api key that can
|
|
// delete every node on a tailnet, and there is no read-only version of it — so `write` here is close to
|
|
// full control of the tailnet, which is the owner's decision to make deliberately.
|
|
// The Console shells into a machine by spawning `ssh` (sidecar/ssh.ts), and so does the reachability
|
|
// probe behind /ssh-test. This manifest said "Offscale needed nothing" until 2026-08-16, which meant a
|
|
// host without an ssh client passed the install checks and then failed at runtime with a spawn error —
|
|
// the one failure mode `osDependencies` exists to convert into a refusal at install time. PLUGIN.md had
|
|
// listed it as a host dependency all along; the manifest was the file that was wrong.
|
|
//
|
|
// Present on effectively every Linux install, which is exactly why it was missed: the declaration costs
|
|
// nothing on the machines that have it and is the whole difference on the machines that do not.
|
|
osDependencies: [
|
|
{
|
|
binary: 'ssh',
|
|
reason: 'Opens the Console shell to a machine, and probes reachability before you try.',
|
|
packages: { apt: 'openssh-client', pacman: 'openssh', dnf: 'openssh-clients', brew: 'openssh' },
|
|
},
|
|
],
|
|
|
|
permissions: [
|
|
{
|
|
key: 'offscale',
|
|
label: 'Offscale',
|
|
description: 'The tailnet: machines, routes, keys and ACLs',
|
|
// Two POSTs that are really reads — a reachability probe and a policy DRAFT that never saves.
|
|
// Without declaring them a read-level account meets a broken feature where a withheld permission
|
|
// should be. Inert while ownerOnly, and correct the moment that changes.
|
|
readOnlyWrites: ['/ssh-test', '/policy/assist'],
|
|
},
|
|
],
|
|
};
|