Repair Tailscale authorization flow

test/shell.d/hyprland-focus-app-test.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+test_tmp=$(mktemp -d)
+trap 'rm -rf "$test_tmp"' EXIT
+
+mock_bin="$test_tmp/bin"
+mkdir -p "$mock_bin"
+
+cat >"$mock_bin/hyprctl" <<'SH'
+#!/bin/bash
+if [[ $1 == "clients" ]]; then
+  printf '[{"address":"0xabc","class":"chromium"}]\n'
+elif [[ $1 == "dispatch" ]]; then
+  printf '%s\n' "$2" >"$OMARCHY_TEST_FOCUS_DISPATCH"
+fi
+SH
+chmod +x "$mock_bin/hyprctl"
+
+dispatch_log="$test_tmp/dispatch"
+PATH="$mock_bin:$PATH" OMARCHY_TEST_FOCUS_DISPATCH="$dispatch_log" \
+  bash "$ROOT/bin/omarchy-hyprland-focus-app" chromium
+
+grep -F 'hl.dsp.focus({ window = "address:0xabc" })' "$dispatch_log" >/dev/null || \
+  fail "app focus uses the workspace-aware Hyprland dispatcher"
+
+pass "app focus follows windows across workspaces"

test/shell.d/launch-browser-test.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+test_tmp=$(mktemp -d)
+trap 'rm -rf "$test_tmp"' EXIT
+
+mock_bin="$test_tmp/bin"
+test_home="$test_tmp/home"
+mkdir -p "$mock_bin" "$test_home/.local/share/applications"
+
+cat >"$test_home/.local/share/applications/chromium.desktop" <<'EOF'
+[Desktop Entry]
+Exec=chromium %U
+EOF
+
+cat >"$mock_bin/xdg-settings" <<'SH'
+#!/bin/bash
+echo chromium.desktop
+SH
+cat >"$mock_bin/chromium" <<'SH'
+#!/bin/bash
+exit 0
+SH
+cat >"$mock_bin/systemd-run" <<'SH'
+#!/bin/bash
+printf '%s\n' "$*" >"$OMARCHY_TEST_BROWSER_LAUNCH"
+SH
+cat >"$mock_bin/omarchy-hyprland-focus-app" <<'SH'
+#!/bin/bash
+printf '%s\n' "$1" >"$OMARCHY_TEST_BROWSER_FOCUS"
+SH
+chmod +x "$mock_bin"/*
+
+launch_log="$test_tmp/launch"
+focus_log="$test_tmp/focus"
+HOME="$test_home" PATH="$mock_bin:$PATH" HYPRLAND_INSTANCE_SIGNATURE=test \
+  OMARCHY_TEST_BROWSER_LAUNCH="$launch_log" OMARCHY_TEST_BROWSER_FOCUS="$focus_log" \
+  bash "$ROOT/bin/omarchy-launch-browser" "https://example.test/authorize"
+
+grep -F 'https://example.test/authorize' "$launch_log" >/dev/null || fail "browser launcher passes through the URL"
+grep -Fx '^chromium.*$' "$focus_log" >/dev/null || fail "browser launcher focuses the default browser window"
+
+pass "browser launcher follows opened links to the browser workspace"

test/shell.d/tailscale-test.sh

@@ -165,6 +165,22 @@ assertEqual(
   'tailscale labels connections by tailnet when nickname is missing'
 )
 
+assertDeepEqual(
+  tailscale.loginPlan(true, 'https://login.tailscale.com/a/existing'),
+  { authUrl: 'https://login.tailscale.com/a/existing', command: [] },
+  'tailscale reuses the daemon authorization URL without replacing node identity'
+)
+assertDeepEqual(
+  tailscale.loginPlan(true, ''),
+  { authUrl: '', command: ['tailscale', 'up'] },
+  'tailscale requests a login URL when the daemon has not supplied one'
+)
+assertDeepEqual(
+  tailscale.loginPlan(false, 'https://login.tailscale.com/a/stale'),
+  { authUrl: '', command: ['tailscale', 'up'] },
+  'tailscale ignores stale authorization URLs outside the login state'
+)
+
 assertDeepEqual(tailscale.parseStatus('{'), { ok: false, unavailable: true, message: 'Status error', error: 'Failed to parse tailscale status' }, 'tailscale reports invalid status JSON')
 assertDeepEqual(tailscale.parseAccounts('{'), { accounts: [], selectedAccountId: '', selectedAccountLabel: '' }, 'tailscale handles invalid account JSON')
 JS