feat(vpn): proton CLI replaces the GTK app, tailscale operator at install

The net panel's Tunnels view drives proton-vpn-cli, and the CLI and GTK app can't run concurrently, so the installer swaps them. tailscaled now enables with --now and the install grants operator to the primary user (brief retry — the daemon takes a moment to accept its socket), so tailscale up/down works without sudo from the panel. VM asserts the vpn stack, the retirement, and the OperatorUser pref (format verified against a live daemon).

1 files changed, 21 insertions, 1 deletions

diff --git a/scripts/testing/tests/test_packages.py b/scripts/testing/tests/test_packages.py
index 5e90cb9..e0387d6 100644
--- a/scripts/testing/tests/test_packages.py
+++ b/scripts/testing/tests/test_packages.py
@@ -61,6 +61,7 @@ def test_dev_tool_present(host, tool):
 
 
 BLUETOOTH_STACK = ["bluez", "bluez-utils"]
+VPN_STACK = ["wireguard-tools", "proton-vpn-cli", "tailscale"]
 
 
 @pytest.mark.attribution("archsetup")
@@ -69,7 +70,9 @@ def test_bluetooth_stack_installed(host, pkg):
     assert host.package(pkg).is_installed
 
 
-RETIRED_PACKAGES = ["blueman", "zoom"]  # bt panel replaced blueman; zoom-web replaced zoom
+# bt panel replaced blueman; zoom-web replaced zoom; the net panel's Tunnels
+# view + proton-vpn-cli replaced the GTK app (they can't run concurrently).
+RETIRED_PACKAGES = ["blueman", "zoom", "proton-vpn-gtk-app"]
 
 
 @pytest.mark.attribution("archsetup")
@@ -80,6 +83,23 @@ def test_retired_package_not_installed(host, pkg):
 
 
 @pytest.mark.attribution("archsetup")
+@pytest.mark.parametrize("pkg", VPN_STACK)
+def test_vpn_stack_installed(host, pkg):
+    assert host.package(pkg).is_installed
+
+
+@pytest.mark.attribution("archsetup")
+def test_tailscale_operator_granted(host, target_user):
+    # The installer grants operator so the net panel can toggle tailscale
+    # without sudo. Prefs only answer when the daemon is up.
+    if not host.service("tailscaled").is_running:
+        pytest.skip("tailscaled not running")
+    out = host.run("tailscale debug prefs")
+    assert out.rc == 0, "tailscale debug prefs failed"
+    assert '"OperatorUser": "%s"' % target_user in out.stdout
+
+
+@pytest.mark.attribution("archsetup")
 def test_eask_installed_user_local(host, home):
     # Installed via npm -g --prefix ~/.local as the user; chime and
     # linear-emacs shell out to it.