feat: make each plugin an npm workspace built by a termix-plugin CLI

plugins/tailscale/tests/backend/tailscale-check.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect } from "vitest";
+import {
+  parseTailscaleCheckBanner,
+  isTailscaleCheckCompleteBanner,
+} from "../../../../src/backend/hosts/tailscale-check.js";
+
+describe("parseTailscaleCheckBanner", () => {
+  it("extracts the login URL from a real check-mode banner", () => {
+    const banner =
+      "# Tailscale SSH requires an additional check.\n# To authenticate, visit: https://login.tailscale.com/a/lefcb2f3377403\n";
+
+    const result = parseTailscaleCheckBanner(banner);
+
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe("https://login.tailscale.com/a/lefcb2f3377403");
+  });
+
+  it("strips comment markers from the message it returns", () => {
+    const banner =
+      "# Tailscale SSH requires an additional check.\n# To authenticate, visit: https://login.tailscale.com/a/abc123\n";
+
+    const result = parseTailscaleCheckBanner(banner);
+
+    expect(result?.message).toBe(
+      "Tailscale SSH requires an additional check.\nTo authenticate, visit: https://login.tailscale.com/a/abc123",
+    );
+  });
+
+  it("returns null for an ordinary MOTD banner", () => {
+    const banner =
+      "Welcome to Ubuntu 24.04 LTS\nLast login: Tue Aug 5 09:12:03 2026\n";
+
+    expect(parseTailscaleCheckBanner(banner)).toBeNull();
+  });
+
+  it("returns null for a lookalike URL on another host", () => {
+    const banner =
+      "# To authenticate, visit: https://login.tailscale.com.evil.example/a/abc123\n";
+
+    expect(parseTailscaleCheckBanner(banner)).toBeNull();
+  });
+
+  it("returns null for empty input", () => {
+    expect(parseTailscaleCheckBanner("")).toBeNull();
+  });
+});
+
+describe("isTailscaleCheckCompleteBanner", () => {
+  it("recognises the completion banner", () => {
+    expect(
+      isTailscaleCheckCompleteBanner(
+        "# Authentication checked with Tailscale SSH.",
+      ),
+    ).toBe(true);
+  });
+
+  it("recognises the completion banner with a time suffix", () => {
+    expect(
+      isTailscaleCheckCompleteBanner(
+        "Authentication checked with Tailscale SSH. Time since last authentication: 0s",
+      ),
+    ).toBe(true);
+  });
+
+  it("does not match the check-required banner", () => {
+    expect(
+      isTailscaleCheckCompleteBanner(
+        "# Tailscale SSH requires an additional check.",
+      ),
+    ).toBe(false);
+  });
+
+  it("does not match empty input", () => {
+    expect(isTailscaleCheckCompleteBanner("")).toBe(false);
+  });
+});

plugins/tailscale/tests/frontend/AdminTailscaleSection.test.tsx

@@ -0,0 +1,62 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { AdminTailscaleSection } from "../../src/frontend/AdminTailscaleSection";
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+describe("AdminTailscaleSection", () => {
+  it("renders the API key and base URL fields and saves on click", async () => {
+    const user = userEvent.setup();
+    const handleSave = vi.fn();
+    render(
+      <AdminTailscaleSection
+        open
+        onToggle={vi.fn()}
+        tailscaleApiKey="tskey-api-abc"
+        setTailscaleApiKey={vi.fn()}
+        tailscaleApiBaseUrl="https://api.tailscale.com/api/v2"
+        setTailscaleApiBaseUrl={vi.fn()}
+        handleSaveTailscaleApiKey={handleSave}
+      />,
+    );
+
+    expect(
+      (
+        screen.getByPlaceholderText(
+          "tskey-api-... / hskey-api-...",
+        ) as HTMLInputElement
+      ).value,
+    ).toBe("tskey-api-abc");
+    expect(
+      (
+        screen.getByPlaceholderText(
+          "https://api.tailscale.com/api/v2",
+        ) as HTMLInputElement
+      ).value,
+    ).toBe("https://api.tailscale.com/api/v2");
+
+    await user.click(screen.getByText("common.save"));
+    expect(handleSave).toHaveBeenCalledOnce();
+  });
+
+  it("does not render its content when closed", () => {
+    render(
+      <AdminTailscaleSection
+        open={false}
+        onToggle={vi.fn()}
+        tailscaleApiKey=""
+        setTailscaleApiKey={vi.fn()}
+        tailscaleApiBaseUrl=""
+        setTailscaleApiBaseUrl={vi.fn()}
+        handleSaveTailscaleApiKey={vi.fn()}
+      />,
+    );
+
+    expect(
+      screen.queryByPlaceholderText("tskey-api-... / hskey-api-..."),
+    ).toBeNull();
+  });
+});

plugins/tailscale/tests/frontend/TailscaleDevicesPanel.test.tsx

@@ -0,0 +1,76 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+const getTailscaleDevicesMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../../src/frontend/tailscale-api", () => ({
+  getTailscaleDevices: getTailscaleDevicesMock,
+}));
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+import { TailscaleDevicesPanel } from "../../src/frontend/TailscaleDevicesPanel";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("TailscaleDevicesPanel", () => {
+  it("shows the no-api-key message when hasApiKey is false", async () => {
+    getTailscaleDevicesMock.mockResolvedValue({
+      devices: [],
+      hasApiKey: false,
+    });
+
+    render(<TailscaleDevicesPanel onConnect={vi.fn()} />);
+
+    await waitFor(() =>
+      expect(screen.getByText("hosts.tailscaleNoApiKey")).toBeTruthy(),
+    );
+  });
+
+  it("shows the empty-devices message when the tailnet has no devices", async () => {
+    getTailscaleDevicesMock.mockResolvedValue({ devices: [], hasApiKey: true });
+
+    render(<TailscaleDevicesPanel onConnect={vi.fn()} />);
+
+    await waitFor(() =>
+      expect(screen.getByText("hosts.tailscaleNoDevices")).toBeTruthy(),
+    );
+  });
+
+  it("renders devices and connects with an ephemeral tailscale host", async () => {
+    const user = userEvent.setup();
+    getTailscaleDevicesMock.mockResolvedValue({
+      hasApiKey: true,
+      devices: [
+        {
+          id: "d1",
+          name: "box",
+          hostname: "box",
+          addresses: ["100.64.0.1"],
+          os: "linux",
+          lastSeen: "2026-01-01T00:00:00Z",
+        },
+      ],
+    });
+
+    const onConnect = vi.fn();
+    render(<TailscaleDevicesPanel onConnect={onConnect} />);
+
+    await waitFor(() => expect(screen.getByText("box")).toBeTruthy());
+    await user.click(
+      screen.getByText("newUi.sidebar.quickConnect.connectToTerminal"),
+    );
+
+    expect(onConnect).toHaveBeenCalledOnce();
+    const [host, type] = onConnect.mock.calls[0];
+    expect(type).toBe("terminal");
+    expect(host.ip).toBe("100.64.0.1");
+    expect(host.authType).toBe("tailscale");
+    expect(host.username).toBe("root");
+  });
+});

plugins/tailscale/tests/frontend/tailscale-api.test.ts

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const authApiMock = vi.hoisted(() => ({ get: vi.fn(), patch: vi.fn() }));
+const handleApiErrorMock = vi.hoisted(() => vi.fn());
+
+vi.mock("@/main-axios", () => ({
+  authApi: authApiMock,
+  statsApi: { get: vi.fn(), patch: vi.fn() },
+  handleApiError: handleApiErrorMock,
+}));
+
+import { getTailscaleDevices } from "../../src/frontend/tailscale-api";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("getTailscaleDevices", () => {
+  it("preserves configured-key state when discovery fails", async () => {
+    authApiMock.get.mockRejectedValue({
+      isAxiosError: true,
+      response: {
+        data: {
+          devices: [],
+          hasApiKey: true,
+          error: "Failed to fetch Tailscale devices",
+        },
+      },
+    });
+
+    await expect(getTailscaleDevices()).resolves.toEqual({
+      devices: [],
+      hasApiKey: true,
+      error: "Failed to fetch Tailscale devices",
+    });
+    expect(handleApiErrorMock).not.toHaveBeenCalled();
+  });
+
+  it("uses normal API error handling when no structured state is available", async () => {
+    const error = { isAxiosError: true, response: { data: {} } };
+    authApiMock.get.mockRejectedValue(error);
+
+    await expect(getTailscaleDevices()).rejects.toBe(error);
+    expect(handleApiErrorMock).toHaveBeenCalledWith(
+      error,
+      "fetch Tailscale devices",
+    );
+  });
+});