tailscale: Tailscale status & control (port of the v4 tailscale plugin)

[rylos]

What

rylos/tailscale — Tailscale status and control, built around fast host access: see which peers are online and copy their IP or name in one gesture. A port of the v4 tailscale plugin (credited in the README, MIT) to the v5 Luau plugin API.

Entries: bar widget, panel, headless poller service, up/down control-center shortcut, /ts launcher provider, desktop widget.

Highlights: /ts <query> fuzzy-searches the tailnet and Enter copies the peer's IP (/ts n copies its Tailscale short name); panel with online-first peer list, live filter, per-row copy IP / copy name / ping / SSH / use-as-exit-node, last-seen for offline peers, exit-node banner, Taildrop receive. Duplicate host names are disambiguated with the unique Tailscale short name.

Not ported from v4: Taildrop send (the plugin API has no file picker) and multi-account switching.

Every network call, file access, and spawned process

• Network: none from the plugin itself — everything goes through the Tailscale CLI.
• Processes: tailscale status --json (poll), tailscale up, tailscale down, tailscale set --exit-node=<ip> / --exit-node=, tailscale ping -c 3 <ip>, tailscale file get <dir> (Taildrop receive), xdg-user-dir DOWNLOAD (resolve the default Taildrop folder), gio open/xdg-open (open the daemon's auth URL when login is required), and ssh <host> launched in the user's terminal via noctalia.runInTerminal (SSH button).
• Filesystem: Taildrop receive lists the download directory before and after tailscale file get to report exactly which files arrived. No other reads or writes.
• Privacy: host names/IPs/last-seen come from the user's own tailnet via the local CLI and are only displayed or copied to the local clipboard.

Testing

Developed and tested live on Noctalia 5.0.0_beta.3 (Arch, niri) against a real 18-peer tailnet: launcher copy flows, panel actions (copy/ping/exit node), Taildrop receive (operator mode), name-dedup, bar states, desktop widget. noctalia plugins lint: 0 errors, 0 warnings. plugin_api = 3 — no capability beyond level 3 is used.

Happy to adjust anything (naming, tags, thumbnail) per review.

🤖 Generated with Claude Code

[ItsLemmy]

• 1. blocking - tailscale/service.luau:224
Dynamic values are interpolated into shell command strings without shell-safe quoting. The configured Taildrop
directory permits command substitution even inside double quotes, and paths containing quotes break command
boundaries. Similar unsafe interpolation occurs for ssh_username at tailscale/panel.luau:419 and the
authentication URL at tailscale/service.luau:293. These values can alter the command executed by sh when the
corresponding action is invoked. Shell-quote every dynamic argument, or use an argument-vector API where
available.

2. blocking - tailscale/plugin.toml:14
   The manifest declares only tailscale, but the plugin also executes xdg-user-dir, gio, xdg-open, and ssh at
   tailscale/service.luau:249, tailscale/service.luau:294, and tailscale/panel.luau:421. Repository policy requires
   external commands to be declared in dependencies and mentioned in the README Requirements section. Add and
   document all runtime command dependencies.

3. Use the thumbnail generator, and use the proper PR template. you skipped all the checklist and important stuff