feat: make each plugin an npm workspace built by a termix-plugin CLI

plugins/fleets/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## 1.0.0
+
+Bundled with Termix 2.9.0.

plugins/fleets/README.md

@@ -0,0 +1,22 @@
+# Fleets
+
+Group hosts into fleets by static membership or tag rules, and run commands, package actions, and file transfers across every member at once.
+
+Bundled with Termix and enabled by default.
+
+## Layout
+
+    manifest.json        id, capabilities and what this plugin contributes
+    src/backend/         activate(ctx) / deactivate(), plus the routes
+    src/frontend/        the UI it registers
+    locales/en.json      its strings (English only; the rest are translated)
+    tests/backend/       vitest, node
+    tests/frontend/      vitest, jsdom
+
+## Commands
+
+    npm run build     bundle into dist/
+    npm run test      run this plugin's tests
+    npm run typecheck
+
+See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows.

plugins/fleets/backend/index.mjs

@@ -1,63 +0,0 @@
-/**
- * Fleets - first-party, in-process plugin.
- *
- * This plugin runs on the main thread rather than in a worker for the same
- * reason proxmox and ai do (see src/backend/plugins/first-party.ts): its
- * execute/transfer routes resolve and connect to many hosts concurrently over
- * the shared SSH pool via resolveHostById and withConnection, read/write
- * files over SFTP, and stream a zip archive back for pull requests. None of
- * that fits the worker ctx -- ctx.hosts is a 13-field read-only view with no
- * fleets surface at all, and ctx.http.route replies with a single postMessage
- * value rather than a stream.
- *
- * Like proxmox, this plugin does not own a live transport (no WebSocket
- * server, no dedicated port), so it registers its Express router with the
- * always-mounted /fleets dispatcher in
- * src/backend/database/routes/fleet-dispatch.ts instead of getting its own
- * port.
- *
- * routes.ts is what used to be src/backend/database/routes/fleet-routes.ts,
- * moved here and rewritten from `export default router` into
- * startFleetsService()/stopFleetsService(), called from
- * activate()/deactivate() below. The fleets/fleetMembers/fleetInventory
- * tables and their repositories stay in core (src/backend/database/db/schema.ts,
- * src/backend/database/repositories/fleet-repository.ts,
- * fleet-inventory-repository.ts) -- this plugin system has no owned-table
- * migration mechanism of its own, and these tables carry FKs into core's
- * hosts/users tables.
- */
-
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-/**
- * Loads a module by its path relative to this file's own directory.
- *
- * The plugin ships beside dist/backend, so in a built server the compiled
- * .js for routes.js sits right next to this .mjs, and core modules resolve
- * via ../../../backend/backend/... from there (dist/plugins/fleets/backend
- * -> dist/backend/backend). Under vitest/dev nothing imports this plugin
- * directly (the loader loads in-process plugins with a plain dynamic import,
- * no tsx loader involved), so the only layout that needs to resolve here is
- * the built one.
- */
-async function loadRelative(relativePath) {
-  const here = path.dirname(fileURLToPath(import.meta.url));
-  const target = path.join(here, `${relativePath}.js`);
-  return import(new URL(`file://${target.replace(/\\/g, "/")}`).href);
-}
-
-let routesModule = null;
-
-export async function activate(ctx) {
-  routesModule = await loadRelative("routes");
-  routesModule.startFleetsService();
-  ctx.log.info("Fleets router registered at /fleets");
-}
-
-export async function deactivate() {
-  if (routesModule) {
-    routesModule.stopFleetsService();
-    routesModule = null;
-  }
-}

plugins/fleets/locales/en.json

@@ -0,0 +1 @@
+{}

plugins/fleets/manifest.json

@@ -21,8 +21,6 @@
     "db:own",
     "ui:surface"
   ],
-  "backend": "backend/index.mjs",
-  "frontend": "frontend/index.mjs",
   "locales": "locales",
   "platforms": ["linux", "win32", "darwin"]
 }

plugins/fleets/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@termix-plugin/fleets",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "termix-plugin build",
+    "test": "termix-plugin test",
+    "typecheck": "tsc -p tsconfig.json",
+    "validate": "termix-plugin validate"
+  },
+  "devDependencies": {
+    "@termix/plugin-sdk": "*"
+  }
+}

plugins/fleets/src/backend/index.ts

@@ -0,0 +1,11 @@
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import { startFleetsService, stopFleetsService } from "./routes.js";
+
+export async function activate(ctx: PluginContext) {
+  startFleetsService();
+  ctx.log.info("Fleets router registered at /fleets");
+}
+
+export async function deactivate() {
+  stopFleetsService();
+}

plugins/fleets/src/backend/routes.ts

@@ -1,5 +1,5 @@
-import { getErrorMessage } from "../../../src/backend/utils/error-message.js";
-import type { AuthenticatedRequest } from "../../../src/types/index.js";
+import { getErrorMessage } from "../../../../src/backend/utils/error-message.js";
+import type { AuthenticatedRequest } from "../../../../src/types/index.js";
 import express, { type Request, type Response } from "express";
 import multer from "multer";
 import JSZip from "jszip";
@@ -7,43 +7,43 @@ import type { Client, SFTPWrapper } from "ssh2";
 import {
   authLogger,
   databaseLogger,
-} from "../../../src/backend/utils/logger.js";
-import { AuthManager } from "../../../src/backend/utils/auth-manager.js";
+} from "../../../../src/backend/utils/logger.js";
+import { AuthManager } from "../../../../src/backend/utils/auth-manager.js";
 import {
   PermissionManager,
   type HostAction,
-} from "../../../src/backend/utils/permission-manager.js";
+} from "../../../../src/backend/utils/permission-manager.js";
 import {
   isSharePermissionLevel,
   expiryFromDuration,
   parseShareTargets,
-} from "../../../src/backend/database/routes/rbac.js";
+} from "../../../../src/backend/database/routes/rbac.js";
 import {
   createCurrentFleetRepository,
   createCurrentFleetInventoryRepository,
   createCurrentRbacAccessRepository,
   createCurrentRoleRepository,
   createCurrentUserRepository,
-} from "../../../src/backend/database/repositories/factory.js";
-import { resolveHostById } from "../../../src/backend/hosts/host-resolver.js";
+} from "../../../../src/backend/database/repositories/factory.js";
+import { resolveHostById } from "../../../../src/backend/hosts/host-resolver.js";
 import {
   getFleetPoolKey,
   createFleetSshFactory,
-} from "../../../src/backend/hosts/ssh-client-factory.js";
-import { withConnection } from "../../../src/backend/hosts/ssh-connection-pool.js";
-import { execCommand } from "../../../src/backend/hosts/metrics-shared/common-utils.js";
-import { detectPlatform } from "../../../src/backend/hosts/metrics-shared/platform.js";
+} from "../../../../src/backend/hosts/ssh-client-factory.js";
+import { withConnection } from "../../../../src/backend/hosts/ssh-connection-pool.js";
+import { execCommand } from "../../../../src/backend/hosts/metrics-shared/common-utils.js";
+import { detectPlatform } from "../../../../src/backend/hosts/metrics-shared/platform.js";
 import {
   execElevated,
   ElevationError,
-} from "../../../src/backend/hosts/metrics-shared/exec-elevated.js";
-import { buildPackageActionCommand } from "../../../src/backend/hosts/metrics-shared/package-commands.js";
-import { isValidPackageName } from "../../../src/backend/hosts/metrics-shared/validation.js";
-import { resolveSnippetCommand } from "../../../src/backend/database/routes/snippets-execution.js";
+} from "../../../../src/backend/hosts/metrics-shared/exec-elevated.js";
+import { buildPackageActionCommand } from "../../../../src/backend/hosts/metrics-shared/package-commands.js";
+import { isValidPackageName } from "../../../../src/backend/hosts/metrics-shared/validation.js";
+import { resolveSnippetCommand } from "../../../../src/backend/database/routes/snippets-execution.js";
 import {
   registerFleetsRouter,
   unregisterFleetsRouter,
-} from "../../../src/backend/database/routes/fleet-dispatch.js";
+} from "../../../../src/backend/database/routes/fleet-dispatch.js";
 
 export const router = express.Router();
 
@@ -629,7 +629,7 @@ router.post(
       const expiresAt = expiryFromDuration(durationHours);
       const rbacAccessRepository = createCurrentRbacAccessRepository();
       const { SharedHostSecretsManager } =
-        await import("../../../src/backend/utils/shared-host-secrets-manager.js");
+        await import("../../../../src/backend/utils/shared-host-secrets-manager.js");
       const secretsManager = SharedHostSecretsManager.getInstance();
 
       const hostResults: Array<{

plugins/fleets/tests/backend/repositories/fleet-repository.test.ts

@@ -0,0 +1,103 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { TestSqliteDatabase } from "../../../../../src/backend/tests/database/repositories/test-support.js";
+import { FleetRepository } from "../../../../../src/backend/database/repositories/fleet-repository.js";
+
+describe("FleetRepository", () => {
+  let adapter: TestSqliteDatabase | null = null;
+
+  afterEach(async () => {
+    if (adapter) {
+      await adapter.close();
+      adapter = null;
+    }
+  });
+
+  async function createRepository(
+    onWrite?: () => void | Promise<void>,
+  ): Promise<{ repository: FleetRepository }> {
+    adapter = new TestSqliteDatabase();
+    const context = await adapter.connect();
+    await adapter.exec(`
+      INSERT INTO users (id, username, password_hash)
+      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
+      INSERT INTO ssh_data (id, user_id, name, ip, port, username, auth_type, tags)
+      VALUES
+        (1, 'user-1', 'web-1', '10.0.0.1', 22, 'root', 'password', 'prod-web,edge'),
+        (2, 'user-1', 'web-2', '10.0.0.2', 22, 'root', 'password', 'prod-web'),
+        (3, 'user-1', 'db-1', '10.0.0.3', 22, 'root', 'password', 'prod-db'),
+        (4, 'user-1', 'static-only', '10.0.0.4', 22, 'root', 'password', NULL),
+        (5, 'user-2', 'other-user-host', '10.0.0.5', 22, 'root', 'password', 'prod-web');
+    `);
+
+    return { repository: new FleetRepository(context, onWrite) };
+  }
+
+  it("unions static membership and tag-matched hosts, deduplicated by id", async () => {
+    let writes = 0;
+    const { repository } = await createRepository(() => {
+      writes += 1;
+    });
+
+    const fleet = await repository.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+    // host 1 matches by tag AND is added statically - must appear once.
+    await repository.addMember(fleet.id, 1);
+    // host 4 has no tags - only reachable via static membership.
+    await repository.addMember(fleet.id, 4);
+
+    const members = await repository.listEffectiveMembers("user-1", fleet.id);
+    const ids = members.map((m) => m.id).sort((a, b) => a - b);
+
+    expect(ids).toEqual([1, 2, 4]);
+    expect(writes).toBeGreaterThan(0);
+  });
+
+  it("never returns another user's hosts even if tags match", async () => {
+    const { repository } = await createRepository();
+
+    const fleet = await repository.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+
+    const members = await repository.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).not.toContain(5);
+  });
+
+  it("returns only static members when a fleet has no tag rules", async () => {
+    const { repository } = await createRepository();
+
+    const fleet = await repository.create("user-1", { name: "static fleet" });
+    await repository.addMember(fleet.id, 3);
+
+    const members = await repository.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).toEqual([3]);
+  });
+
+  it("removeMember only drops the static row, not tag-based membership", async () => {
+    const { repository } = await createRepository();
+
+    const fleet = await repository.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+    await repository.addMember(fleet.id, 1);
+
+    await expect(repository.removeMember(fleet.id, 1)).resolves.toBe(true);
+
+    // host 1 still matches the tag rule, so it remains an effective member.
+    const members = await repository.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).toContain(1);
+  });
+
+  it("returns an empty list for a fleet the caller does not own", async () => {
+    const { repository } = await createRepository();
+    const fleet = await repository.create("user-1", { name: "private" });
+
+    await expect(
+      repository.listEffectiveMembers("user-2", fleet.id),
+    ).resolves.toEqual([]);
+  });
+});

plugins/fleets/tests/backend/routes.test.ts

@@ -0,0 +1,446 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import type { Request, Response, Router } from "express";
+
+const state = vi.hoisted(() => ({
+  currentUserId: "user-1",
+  fleets: new Map<number, { id: number; userId: string; name: string }>(),
+  members: new Map<number, { id: number; name: string }[]>(),
+  hostAccess: new Map<string, { hasAccess: boolean; isOwner: boolean }>(),
+  hosts: new Map<number, Record<string, unknown>>(),
+}));
+
+vi.mock("../../../../src/backend/database/db/index.js", () => ({ db: {} }));
+
+vi.mock("../../../../src/backend/utils/logger.js", () => ({
+  authLogger: {
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+  },
+  databaseLogger: {
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+vi.mock("../../../../src/backend/utils/auth-manager.js", () => ({
+  AuthManager: {
+    getInstance: () => ({
+      createAuthMiddleware:
+        () =>
+        (req: Record<string, unknown>, _res: unknown, next: () => void) => {
+          req.userId = state.currentUserId;
+          next();
+        },
+      createDataAccessMiddleware:
+        () => (_req: unknown, _res: unknown, next: () => void) =>
+          next(),
+    }),
+  },
+}));
+
+vi.mock("../../../../src/backend/utils/permission-manager.js", () => ({
+  PermissionManager: {
+    getInstance: () => ({
+      canAccessHost: async (userId: string, hostId: number, level: string) => {
+        const key = `${userId}:${hostId}:${level}`;
+        const found = state.hostAccess.get(key);
+        if (found) return found;
+        // default: full access unless a test explicitly denies it
+        return { hasAccess: true, isOwner: true, permissionLevel: "manage" };
+      },
+    }),
+  },
+}));
+
+vi.mock("../../../../src/backend/hosts/host-resolver.js", () => ({
+  resolveHostById: async (hostId: number) => state.hosts.get(hostId) ?? null,
+}));
+
+vi.mock("../../../../src/backend/hosts/ssh-client-factory.js", () => ({
+  getFleetPoolKey: () => "pool-key",
+  createFleetSshFactory: () => async () => ({}),
+}));
+
+vi.mock("../../../../src/backend/hosts/ssh-connection-pool.js", () => ({
+  withConnection: async (
+    _key: string,
+    _factory: unknown,
+    fn: (client: unknown) => unknown,
+  ) => fn({}),
+}));
+
+vi.mock("../../../../src/backend/hosts/metrics-shared/common-utils.js", () => ({
+  execCommand: vi.fn(async () => ({ stdout: "ok", stderr: "", code: 0 })),
+}));
+
+vi.mock("../../../../src/backend/hosts/metrics-shared/platform.js", () => ({
+  detectPlatform: vi.fn(async () => ({ pkg: "apt", osPrettyName: "Debian" })),
+}));
+
+vi.mock(
+  "../../../../src/backend/hosts/metrics-shared/exec-elevated.js",
+  async () => {
+    class ElevationError extends Error {
+      code: string;
+      constructor(code: string, message: string) {
+        super(message);
+        this.code = code;
+      }
+    }
+    return {
+      execElevated: vi.fn(),
+      ElevationError,
+    };
+  },
+);
+
+vi.mock(
+  "../../../../src/backend/hosts/metrics-shared/package-commands.js",
+  () => ({
+    buildPackageActionCommand: vi.fn(() => "apt-get install -y foo"),
+  }),
+);
+
+vi.mock("../../../../src/backend/hosts/metrics-shared/validation.js", () => ({
+  isValidPackageName: (v: unknown) => typeof v === "string" && v.length > 0,
+}));
+
+vi.mock(
+  "../../../../src/backend/database/routes/snippets-execution.js",
+  () => ({
+    resolveSnippetCommand: (command: string) => command,
+  }),
+);
+
+vi.mock("../../../../src/backend/database/routes/rbac.js", () => ({
+  isSharePermissionLevel: (v: unknown) =>
+    ["connect", "view", "edit", "manage"].includes(v as string),
+  expiryFromDuration: () => null,
+  parseShareTargets: () => null,
+}));
+
+vi.mock("../../../../src/backend/database/repositories/factory.js", () => ({
+  createCurrentFleetRepository: () => ({
+    findById: async (userId: string, fleetId: number) => {
+      const fleet = state.fleets.get(fleetId);
+      return fleet && fleet.userId === userId ? fleet : null;
+    },
+    listEffectiveMembers: async (_userId: string, fleetId: number) =>
+      state.members.get(fleetId) ?? [],
+    listStaticMemberIds: async () => [],
+    listByUser: async (userId: string) =>
+      [...state.fleets.values()].filter((f) => f.userId === userId),
+  }),
+  createCurrentFleetInventoryRepository: () => ({
+    listForHosts: async () => [],
+    upsert: async () => ({}),
+  }),
+  createCurrentRbacAccessRepository: () => ({}),
+  createCurrentRoleRepository: () => ({}),
+  createCurrentUserRepository: () => ({}),
+}));
+
+vi.mock("../../../../src/backend/database/routes/fleet-dispatch.js", () => ({
+  registerFleetsRouter: vi.fn(),
+  unregisterFleetsRouter: vi.fn(),
+}));
+
+const { router, parseInventoryProbe, buildRemoveCommand } =
+  await import("../../src/backend/routes.js");
+
+function findLayer(method: string, path: string) {
+  const stack = (router as unknown as Router).stack as Array<{
+    route?: {
+      path: string;
+      methods: Record<string, boolean>;
+      stack: Array<{ handle: (req: Request, res: Response) => unknown }>;
+    };
+  }>;
+  const layer = stack.find(
+    (l) => l.route?.path === path && l.route?.methods[method],
+  );
+  if (!layer?.route) throw new Error(`No route for ${method} ${path}`);
+  return layer.route.stack[layer.route.stack.length - 1].handle;
+}
+
+function makeReqRes(overrides: {
+  body?: Record<string, unknown>;
+  params?: Record<string, unknown>;
+}) {
+  const req = {
+    userId: state.currentUserId,
+    body: overrides.body ?? {},
+    params: overrides.params ?? {},
+    headers: {},
+  } as unknown as Request;
+
+  const res = {
+    statusCode: 200,
+    jsonBody: null as unknown,
+    status(code: number) {
+      (this as unknown as { statusCode: number }).statusCode = code;
+      return this;
+    },
+    json(payload: unknown) {
+      (this as unknown as { jsonBody: unknown }).jsonBody = payload;
+      return this;
+    },
+  } as unknown as Response & { statusCode: number; jsonBody: unknown };
+
+  return { req, res };
+}
+
+async function invoke(
+  method: string,
+  path: string,
+  overrides: {
+    body?: Record<string, unknown>;
+    params?: Record<string, unknown>;
+  } = {},
+) {
+  const handler = findLayer(method, path);
+  const { req, res } = makeReqRes(overrides);
+  await handler(req, res);
+  return res as unknown as {
+    statusCode: number;
+    jsonBody: Record<string, unknown> | null;
+  };
+}
+
+beforeEach(() => {
+  state.currentUserId = "user-1";
+  state.fleets = new Map([[1, { id: 1, userId: "user-1", name: "web fleet" }]]);
+  state.members = new Map([
+    [
+      1,
+      [
+        { id: 10, name: "host-a" },
+        { id: 11, name: "host-b" },
+      ],
+    ],
+  ]);
+  state.hostAccess = new Map();
+  state.hosts = new Map([
+    [
+      10,
+      {
+        id: 10,
+        userId: "user-1",
+        name: "host-a",
+        ip: "10.0.0.1",
+        port: 22,
+        username: "root",
+        sudoPassword: "secret",
+      },
+    ],
+    [
+      11,
+      {
+        id: 11,
+        userId: "user-1",
+        name: "host-b",
+        ip: "10.0.0.2",
+        port: 22,
+        username: "root",
+        sudoPassword: "secret",
+      },
+    ],
+  ]);
+});
+
+describe("GET /:id/members", () => {
+  it("404s for a fleet the caller does not own", async () => {
+    const res = await invoke("get", "/:id/members", {
+      params: { id: "999" },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("400s on a non-numeric fleet id", async () => {
+    const res = await invoke("get", "/:id/members", {
+      params: { id: "not-a-number" },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+describe("POST /:id/execute", () => {
+  it("400s when command is missing", async () => {
+    const res = await invoke("post", "/:id/execute", {
+      params: { id: "1" },
+      body: {},
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("reports per-host success with the {hostId, hostName, success} shape", async () => {
+    const res = await invoke("post", "/:id/execute", {
+      params: { id: "1" },
+      body: { command: "uptime" },
+    });
+    expect(res.statusCode).toBe(200);
+    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
+    expect(results).toHaveLength(2);
+    expect(results[0]).toMatchObject({
+      hostId: 10,
+      hostName: "host-a",
+      success: true,
+    });
+  });
+
+  it("isolates one host's access denial - the other host still succeeds", async () => {
+    state.hostAccess.set("user-1:10:edit", {
+      hasAccess: false,
+      isOwner: false,
+    });
+
+    const res = await invoke("post", "/:id/execute", {
+      params: { id: "1" },
+      body: { command: "uptime" },
+    });
+
+    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
+    const denied = results.find((r) => r.hostId === 10);
+    const allowed = results.find((r) => r.hostId === 11);
+    expect(denied).toMatchObject({ success: false });
+    expect(String(denied?.error)).toMatch(/edit/);
+    expect(allowed).toMatchObject({ success: true });
+  });
+
+  it("404s for a fleet the caller does not own", async () => {
+    const res = await invoke("post", "/:id/execute", {
+      params: { id: "999" },
+      body: { command: "uptime" },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+});
+
+describe("POST /:id/packages", () => {
+  it("400s on an invalid action", async () => {
+    const res = await invoke("post", "/:id/packages", {
+      params: { id: "1" },
+      body: { action: "reformat-disk" },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("surfaces an ElevationError as a per-host error, not a request failure", async () => {
+    const { execElevated, ElevationError } =
+      await import("../../../../src/backend/hosts/metrics-shared/exec-elevated.js");
+    (execElevated as ReturnType<typeof vi.fn>).mockRejectedValue(
+      new ElevationError("SUDO_REQUIRED", "sudo password required"),
+    );
+
+    const res = await invoke("post", "/:id/packages", {
+      params: { id: "1" },
+      body: { action: "install", package: "curl" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
+    expect(results.every((r) => r.success === false)).toBe(true);
+    expect(results[0].error).toMatch(/sudo password required/);
+  });
+
+  it("requires manage-level access, not just edit", async () => {
+    state.hostAccess.set("user-1:10:manage", {
+      hasAccess: false,
+      isOwner: false,
+    });
+    state.hostAccess.set("user-1:11:manage", {
+      hasAccess: false,
+      isOwner: false,
+    });
+
+    const { execElevated } =
+      await import("../../../../src/backend/hosts/metrics-shared/exec-elevated.js");
+    (execElevated as ReturnType<typeof vi.fn>).mockResolvedValue({
+      code: 0,
+      stdout: "done",
+      stderr: "",
+    });
+
+    const res = await invoke("post", "/:id/packages", {
+      params: { id: "1" },
+      body: { action: "upgrade-all" },
+    });
+
+    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
+    expect(results.every((r) => r.success === false)).toBe(true);
+    expect(String(results[0].error)).toMatch(/manage/);
+  });
+});
+
+describe("POST /:id/members", () => {
+  it("404s when the caller cannot access the target host", async () => {
+    state.hostAccess.set("user-1:99:connect", {
+      hasAccess: false,
+      isOwner: false,
+    });
+
+    const res = await invoke("post", "/:id/members", {
+      params: { id: "1" },
+      body: { hostId: 99 },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+});
+
+describe("parseInventoryProbe", () => {
+  it("extracts kernel, arch, hostname, and uptime from key=value lines", () => {
+    const out = [
+      "kernel=6.1.0-generic",
+      "arch=x86_64",
+      "hostname=web-1",
+      "uptime_seconds=123456",
+    ].join("\n");
+
+    expect(parseInventoryProbe(out)).toEqual({
+      kernel: "6.1.0-generic",
+      architecture: "x86_64",
+      hostname: "web-1",
+      uptimeSeconds: 123456,
+    });
+  });
+
+  it("nulls out fields missing from the probe output", () => {
+    expect(parseInventoryProbe("kernel=6.1.0")).toEqual({
+      kernel: "6.1.0",
+      architecture: null,
+      hostname: null,
+      uptimeSeconds: null,
+    });
+  });
+
+  it("nulls uptimeSeconds when the value is not a bare integer", () => {
+    const out = "uptime_seconds=";
+    expect(parseInventoryProbe(out).uptimeSeconds).toBeNull();
+  });
+
+  it("ignores lines with no '=' separator", () => {
+    const out = ["garbage line", "kernel=6.1.0"].join("\n");
+    expect(parseInventoryProbe(out).kernel).toBe("6.1.0");
+  });
+});
+
+describe("buildRemoveCommand", () => {
+  it("builds the correct remove command per package manager", () => {
+    expect(buildRemoveCommand("apt", "curl")).toContain(
+      "apt-get -y remove curl",
+    );
+    expect(buildRemoveCommand("dnf", "curl")).toBe("dnf -y remove curl");
+    expect(buildRemoveCommand("yum", "curl")).toBe("yum -y remove curl");
+    expect(buildRemoveCommand("pacman", "curl")).toBe(
+      "pacman -R --noconfirm curl",
+    );
+  });
+
+  it("returns null when no package manager was detected", () => {
+    expect(buildRemoveCommand(null, "curl")).toBeNull();
+  });
+});

plugins/fleets/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "@termix/plugin-sdk/tsconfig.plugin.json",
+  "compilerOptions": {
+    "paths": {
+      "@/types/*": ["../../src/types/*"],
+      "@/*": ["../../src/ui/*"]
+    }
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx", "tests/**/*.ts", "tests/**/*.tsx"]
+}

plugins/fleets/vitest.config.ts

@@ -0,0 +1,3 @@
+import { pluginVitestConfig } from "@termix/plugin-sdk/vitest-preset";
+
+export default pluginVitestConfig(import.meta.url);