feat: move automations into a first-party plugin

src/backend/tests/plugins/automations/conditions.test.ts

@@ -7,7 +7,7 @@ import {
   metricStateKey,
   severityForValue,
   type MetricsSnapshot,
-} from "../../automations/conditions.js";
+} from "../../../../../plugins/automations/backend/conditions.js";
 
 const metrics: MetricsSnapshot = {
   cpu: { percent: 42.5, load: [1.5, 1.2, 0.9] },

src/backend/tests/plugins/automations/cron.test.ts

@@ -5,7 +5,7 @@ import {
   isValidTimezone,
   nextCronRun,
   parseCron,
-} from "../../automations/cron.js";
+} from "../../../../../plugins/automations/backend/cron.js";
 
 describe("parseCron", () => {
   it("rejects anything that is not five fields", () => {

src/backend/tests/plugins/automations/docker-watcher.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   diffContainerStates,
   parseContainerStates,
-} from "../../automations/docker-watcher.js";
+} from "../../../../../plugins/automations/backend/docker-watcher.js";
 
 /**
  * The polling side needs SSH, so what is tested here is the pure part: turning

src/backend/tests/plugins/automations/engine.test.ts

@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { AutomationDefinition, Step } from "../../../types/automations.js";
+import type {
+  AutomationDefinition,
+  Step,
+} from "../../../../types/automations.js";
 
 /**
  * The engine reaches the database through the repository factory and the
@@ -49,20 +52,21 @@ const repository = {
 
 const resolveHostById = vi.fn();
 
-vi.mock("../../hosts/host-resolver.js", () => ({
+vi.mock("../../../hosts/host-resolver.js", () => ({
   resolveHostById: (...args: unknown[]) => resolveHostById(...args),
 }));
 
-vi.mock("../../database/repositories/factory.js", () => ({
+vi.mock("../../../database/repositories/factory.js", () => ({
   createCurrentAutomationRepository: () => repository,
 }));
 
 const executeStep = vi.fn();
-vi.mock("../../automations/actions/index.js", () => ({
+vi.mock("../../../../../plugins/automations/backend/actions/index.js", () => ({
   executeStep: (...args: unknown[]) => executeStep(...args),
 }));
 
-const { AutomationEngine } = await import("../../automations/engine.js");
+const { AutomationEngine } =
+  await import("../../../../../plugins/automations/backend/engine.js");
 
 function defineAutomation(
   steps: Step[],

src/backend/tests/plugins/automations/headless-viewer.test.ts

@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const listAutomationWatchedHosts = vi.fn();
-vi.mock("../../automations/triggers.js", () => ({
+vi.mock("../../../../../plugins/automations/backend/triggers.js", () => ({
   listAutomationWatchedHosts: () => listAutomationWatchedHosts(),
 }));
 
@@ -10,7 +10,8 @@ const {
   reconcileHeadlessViewers,
   releaseHeadlessViewers,
   setViewerRegistry,
-} = await import("../../automations/headless-viewer.js");
+} =
+  await import("../../../../../plugins/automations/backend/headless-viewer.js");
 
 const registry = {
   registerViewer: vi.fn(),

src/backend/tests/plugins/automations/notify.test.ts

@@ -2,12 +2,12 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const automationFetch = vi.fn();
 
-vi.mock("../../automations/http.js", () => ({
+vi.mock("../../../../../plugins/automations/backend/http.js", () => ({
   automationFetch: (...args: unknown[]) => automationFetch(...args),
 }));
 
 const { sendAutomationNotification } =
-  await import("../../automations/notify.js");
+  await import("../../../../../plugins/automations/backend/notify.js");
 
 beforeEach(() => {
   automationFetch.mockReset();

src/backend/tests/plugins/automations/routes.test.ts

@@ -44,10 +44,15 @@ vi.mock("../../../database/repositories/factory.js", () => ({
 }));
 
 const run = vi.hoisted(() => vi.fn());
-vi.mock("../../../automations/engine.js", () => ({
+vi.mock("../../../../../plugins/automations/backend/engine.js", () => ({
   AutomationEngine: { getInstance: () => ({ run }) },
 }));
 
+vi.mock("../../../database/routes/automation-dispatch.js", () => ({
+  registerAutomationsRouter: vi.fn(),
+  unregisterAutomationsRouter: vi.fn(),
+}));
+
 vi.mock("../../../utils/permission-manager.js", () => ({
   PermissionManager: {
     getInstance: () => ({
@@ -80,23 +85,8 @@ vi.mock("../../../utils/audit-logger.js", () => ({
   getRequestMeta: () => ({ ipAddress: "127.0.0.1", userAgent: "test" }),
 }));
 
-const { default: router } =
-  await import("../../../database/routes/automations.js");
-
-function findHandler(method: string, path: string) {
-  const stack = (router as unknown as Router).stack as Array<{
-    route?: {
-      path: string;
-      methods: Record<string, boolean>;
-      stack: Array<{ handle: (req: Request, res: Response) => unknown }>;
-    };
-  }>;
-  const layer = stack.find(
-    (l) => l.route?.path === path && l.route?.methods[method],
-  );
-  if (!layer?.route) throw new Error(`No route for ${method} ${path}`);
-  return layer.route.stack[layer.route.stack.length - 1].handle;
-}
+const { router } =
+  await import("../../../../../plugins/automations/backend/routes.js");
 
 /** Runs the whole middleware chain for the route, not just its handler. */
 async function invoke(

src/backend/tests/plugins/automations/template.test.ts

@@ -4,7 +4,7 @@ import {
   redactSecrets,
   renderRecord,
   renderTemplate,
-} from "../../automations/template.js";
+} from "../../../../../plugins/automations/backend/template.js";
 
 const context = {
   host: { id: 7, name: "Zeus", ip: "10.0.0.5", username: "root", port: 22 },

src/backend/tests/plugins/automations/triggers.test.ts

@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import type {
   AutomationDefinition,
   Trigger,
-} from "../../../types/automations.js";
+} from "../../../../types/automations.js";
 
 /**
  * Trigger matching, dwell windows and cooldowns. The repository and the engine
@@ -42,16 +42,17 @@ const repository = {
   }),
 };
 
-vi.mock("../../database/repositories/factory.js", () => ({
+vi.mock("../../../database/repositories/factory.js", () => ({
   createCurrentAutomationRepository: () => repository,
 }));
 
 const run = vi.fn(async () => ({ runId: 1, status: "success" as const }));
-vi.mock("../../automations/engine.js", () => ({
+vi.mock("../../../../../plugins/automations/backend/engine.js", () => ({
   AutomationEngine: { getInstance: () => ({ run }) },
 }));
 
-const triggers = await import("../../automations/triggers.js");
+const triggers =
+  await import("../../../../../plugins/automations/backend/triggers.js");
 
 function addAutomation(trigger: Trigger, overrides: Partial<FakeRow> = {}) {
   const definition: AutomationDefinition = { version: 1, trigger, steps: [] };

src/backend/tests/plugins/bundled-plugin.test.ts

@@ -283,3 +283,44 @@ describe("bundled fleets plugin", () => {
     expect(source).toMatch(/export async function deactivate/);
   });
 });
+
+describe("bundled automations plugin", () => {
+  it("ships a directory with a manifest and both entry points", () => {
+    const dir = path.join(getBundledPluginsDir(), "automations");
+
+    expect(fs.existsSync(path.join(dir, "manifest.json"))).toBe(true);
+    expect(fs.existsSync(path.join(dir, "backend", "index.mjs"))).toBe(true);
+    expect(fs.existsSync(path.join(dir, "frontend", "index.mjs"))).toBe(true);
+  });
+
+  it("has a manifest that passes the real validator", () => {
+    const { manifest, errors } = parseManifest(
+      readBundledManifest("automations"),
+    );
+
+    expect(errors).toEqual([]);
+    expect(manifest?.id).toBe("automations");
+    expect(manifest?.category).toBe("Infrastructure");
+  });
+
+  it("declares the transport-owner capability and qualifies for the tier", () => {
+    const { manifest } = parseManifest(readBundledManifest("automations"));
+
+    expect(manifest?.permissions).toContain(TRANSPORT_OWNER_CAPABILITY);
+    expect(isFirstParty("automations")).toBe(true);
+    expect(runsInProcess("automations", manifest!.permissions)).toBe(true);
+  });
+
+  it("exports activate and deactivate from its backend entry", () => {
+    const entry = path.join(
+      getBundledPluginsDir(),
+      "automations",
+      "backend",
+      "index.mjs",
+    );
+    const source = fs.readFileSync(entry, "utf8");
+
+    expect(source).toMatch(/export async function activate/);
+    expect(source).toMatch(/export async function deactivate/);
+  });
+});

src/backend/tests/plugins/first-party.test.ts

@@ -39,9 +39,10 @@ function manifest(overrides: Record<string, unknown> = {}) {
 }
 
 describe("first-party allowlist", () => {
-  it("contains only ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop and fleets", () => {
+  it("contains only ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets and automations", () => {
     expect([...FIRST_PARTY_PLUGIN_IDS].sort()).toEqual([
       "ai",
+      "automations",
       "docker",
       "fleets",
       "host-metrics",
@@ -51,7 +52,7 @@ describe("first-party allowlist", () => {
     ]);
   });
 
-  it("recognises ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop and fleets and nothing else", () => {
+  it("recognises ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets and automations and nothing else", () => {
     expect(isFirstParty("ssh-terminal")).toBe(true);
     expect(isFirstParty("docker")).toBe(true);
     expect(isFirstParty("host-metrics")).toBe(true);
@@ -59,6 +60,7 @@ describe("first-party allowlist", () => {
     expect(isFirstParty("proxmox")).toBe(true);
     expect(isFirstParty("remote-desktop")).toBe(true);
     expect(isFirstParty("fleets")).toBe(true);
+    expect(isFirstParty("automations")).toBe(true);
     expect(isFirstParty("ssh-terminal-pro")).toBe(false);
     expect(isFirstParty("community-plugin")).toBe(false);
     expect(isFirstParty("")).toBe(false);
@@ -79,6 +81,10 @@ describe("runsInProcess", () => {
     expect(runsInProcess("remote-desktop", [TRANSPORT_OWNER_CAPABILITY])).toBe(
       true,
     );
+    expect(runsInProcess("fleets", [TRANSPORT_OWNER_CAPABILITY])).toBe(true);
+    expect(runsInProcess("automations", [TRANSPORT_OWNER_CAPABILITY])).toBe(
+      true,
+    );
 
     // On the list but not asking for it: stays in a worker, so the manifest
     // remains an honest description of what the plugin does.
@@ -88,6 +94,8 @@ describe("runsInProcess", () => {
     expect(runsInProcess("ai", ["hosts.read"])).toBe(false);
     expect(runsInProcess("proxmox", ["hosts.read"])).toBe(false);
     expect(runsInProcess("remote-desktop", ["hosts.read"])).toBe(false);
+    expect(runsInProcess("fleets", ["hosts.read"])).toBe(false);
+    expect(runsInProcess("automations", ["hosts.read"])).toBe(false);
 
     // Asking for it but not on the list.
     expect(
@@ -179,6 +187,18 @@ describe("manifest gate on the reserved capability", () => {
     expect(parsed?.id).toBe("proxmox");
   });
 
+  it("allows it for automations", () => {
+    const { manifest: parsed, errors } = parseManifest(
+      manifest({
+        id: "automations",
+        permissions: [TRANSPORT_OWNER_CAPABILITY],
+      }),
+    );
+
+    expect(errors).toEqual([]);
+    expect(parsed?.id).toBe("automations");
+  });
+
   it("still accepts an ordinary manifest that never mentions it", () => {
     const { manifest: parsed, errors } = parseManifest(
       manifest({ permissions: ["hosts.read"] }),