@clawops/cli 2.0.1 → 2.1.0

package/dist/{chunk-LBE6COC4.js → chunk-R3DTA35B.js}

@@ -13,16 +13,20 @@ import {
 } from "./chunk-2I7KCMXZ.js";
 import {
   writeStackConfig
-} from "./chunk-HSPHXG6W.js";
+} from "./chunk-3Z5TDXCJ.js";
 import {
   validatePlan
-} from "./chunk-BSLIYB5Q.js";
+} from "./chunk-XFN3YDZE.js";
 import {
   buildContext
-} from "./chunk-5XT5IAJK.js";
+} from "./chunk-QDNFADJI.js";
 import {
   GATEWAY_PORT
 } from "./chunk-VOEJYRIK.js";
+import {
+  getConfig,
+  setConfig
+} from "./chunk-64PONSA5.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -49,6 +53,9 @@ ${validation.errors.join("\n")}`
     provider: plan.spec.provider
   });
   const stack = await ctx.getStack();
+  const { guardPrivateOnlyApply } = await import("./private-only-DIA26I2E.js");
+  const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+  await guardPrivateOnlyApply(plan, ctx, opts?.probeTailnet ?? ((conn2) => probeSsh(conn2, opts?.signal)));
   await writeStackConfig(stack, plan);
   if (plan.metadata.stackVersion !== void 0) {
     const currentInfo = await stack.info();
@@ -67,6 +74,7 @@ The diff you reviewed may no longer reflect what will be applied.
   }
   const start = Date.now();
   const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
+  recordPublicExposure(ctx.stackName, plan);
   const outputs = Object.fromEntries(
     Object.entries(result.outputs).map(([k, v]) => [k, v.value])
   );
@@ -238,6 +246,17 @@ async function verifyChannels(session, cfg, signal) {
     );
   }
 }
+function recordPublicExposure(stackName, plan) {
+  const config = getConfig();
+  const stackConfig = config?.stacks[stackName];
+  if (!config || !stackConfig?.tailscale) return;
+  const privateOnly = plan.spec.network.tailscale?.privateOnly === true;
+  if ((stackConfig.tailscale.privateOnly ?? false) === privateOnly) return;
+  const tailscale = { ...stackConfig.tailscale };
+  if (privateOnly) tailscale.privateOnly = true;
+  else delete tailscale.privateOnly;
+  setConfig({ ...config, stacks: { ...config.stacks, [stackName]: { ...stackConfig, tailscale } } });
+}
 
 export {
   applyPlan

package/dist/{preflight-EF52S3WW.js → chunk-TC2VYPLH.js}

@@ -154,9 +154,10 @@ async function createBucket(bucket, project, token, region) {
   );
   if (!res.ok) throw new Error(`Could not create gs://${bucket}: ${res.status} ${await res.text()}`);
 }
+
 export {
+  resolveProjectId,
   gcloudConfiguredProject,
-  gcpPreflight,
   projectFromIni,
-  resolveProjectId
+  gcpPreflight
 };

package/dist/chunk-X56CQ6GB.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import {
+  getConfigDir
+} from "./chunk-64PONSA5.js";
+
+// src/config/secrets.ts
+import { readFileSync, existsSync } from "fs";
+import path from "path";
+function secretsDir(configDir) {
+  return path.join(configDir ?? getConfigDir(), "secrets");
+}
+function resolveSecretRef(name, configDir) {
+  const p = path.join(secretsDir(configDir), name);
+  if (!existsSync(p)) return null;
+  try {
+    return readFileSync(p, "utf-8").trim();
+  } catch {
+    return null;
+  }
+}
+
+// src/harden/modules/tailscale.ts
+var AUTH_KEY_SECRET = "TAILSCALE_AUTH_KEY";
+var KEY_PATH = "/run/clawops-tailscale.key";
+function parseStatus(json) {
+  let body;
+  try {
+    body = JSON.parse(json);
+  } catch {
+    return { state: "unknown" };
+  }
+  const b = body;
+  const state = typeof b.BackendState === "string" ? b.BackendState : "unknown";
+  const ips = Array.isArray(b.Self?.TailscaleIPs) ? b.Self?.TailscaleIPs : [];
+  const ipv4 = ips.find((i) => typeof i === "string" && isTailscaleIpv4(i));
+  const hostname = typeof b.Self?.HostName === "string" ? b.Self.HostName : void 0;
+  return { state, ...ipv4 ? { ipv4 } : {}, ...hostname ? { hostname } : {} };
+}
+function isTailscaleIpv4(ip) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip.trim());
+  if (!m) return false;
+  const octets = m.slice(1).map(Number);
+  if (octets.some((o) => o > 255)) return false;
+  return octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127;
+}
+function tailnetHostname(stack) {
+  const slug = stack.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `clawops-${slug || "stack"}`.slice(0, 63);
+}
+async function installed(exec) {
+  const r = await exec("command -v tailscale >/dev/null 2>&1 && echo yes || echo no");
+  return r.stdout.trim() === "yes";
+}
+var DAEMON_DOWN = /failed to connect to local tailscaled|is tailscaled running|connection refused/i;
+async function status(exec) {
+  const r = await exec("tailscale status --json 2>&1 || true");
+  if (DAEMON_DOWN.test(r.stdout)) return { state: "unknown", daemonDown: true };
+  return parseStatus(r.stdout);
+}
+async function ensureDaemon(exec, sudo) {
+  const r = await exec(
+    `command -v systemctl >/dev/null 2>&1 && ${sudo}systemctl start tailscaled >/dev/null 2>&1 && echo started || echo no`
+  );
+  return r.stdout.trim() === "started";
+}
+async function rootPrefix(exec) {
+  return (await exec("id -u")).stdout.trim() === "0" ? "" : "sudo -n ";
+}
+function shellQuote(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function makeTailscaleModule(stack) {
+  return {
+    id: "tailscale",
+    label: "Tailscale membership (joins the host to your tailnet)",
+    defaultOn: false,
+    providers: "all",
+    async check(exec) {
+      if (!await installed(exec)) {
+        return { status: "missing", detail: "Tailscale is not installed on this host." };
+      }
+      const s = await status(exec);
+      if (s.state === "Running" && s.ipv4) {
+        return { status: "applied", detail: `Joined as ${s.hostname ?? "this host"} on ${s.ipv4}.` };
+      }
+      if (s.daemonDown) {
+        return {
+          status: "drifted",
+          detail: "Tailscale is installed but the tailscaled daemon is not running, so this host is on no tailnet whatever it was joined to before. Start it with `systemctl start tailscaled`, or check `systemctl status tailscaled` for why it stopped."
+        };
+      }
+      if (s.state === "unknown") {
+        return {
+          status: "drifted",
+          detail: "Tailscale is installed but did not report a status that could be parsed."
+        };
+      }
+      return {
+        status: "missing",
+        detail: `Tailscale is installed but not on a tailnet (state: ${s.state}).`
+      };
+    },
+    async apply(exec) {
+      const key = resolveSecretRef(AUTH_KEY_SECRET);
+      if (!key) {
+        throw new Error(
+          `No auth key. Create one in the Tailscale admin console and store it with \`clawops secret set ${AUTH_KEY_SECRET}\`. clawops does not prompt for it here, so a key never reaches a terminal scrollback or a CI log.`
+        );
+      }
+      if (!await installed(exec)) {
+        const r2 = await exec("curl -fsSL https://tailscale.com/install.sh | sh");
+        if (!await installed(exec)) {
+          throw new Error(`Tailscale install failed: ${(r2.stderr || r2.stdout).slice(0, 300)}`);
+        }
+      }
+      const sudo = await rootPrefix(exec);
+      if ((await status(exec)).daemonDown && !await ensureDaemon(exec, sudo)) {
+        throw new Error(
+          "Tailscale is installed but tailscaled is not running and could not be started. On a systemd host, `systemctl status tailscaled` says why; on a host without an init manager, tailscaled has to be supervised by whatever does run there."
+        );
+      }
+      const hostname = tailnetHostname(stack ?? (await exec("hostname")).stdout);
+      const join = [
+        `umask 077`,
+        `trap 'rm -f ${KEY_PATH}' EXIT INT TERM`,
+        `cat > ${KEY_PATH}`,
+        `tailscale up --auth-key=file:${KEY_PATH} --hostname=${hostname} --accept-routes 2>&1`
+      ].join("\n");
+      const r = await exec(`${sudo}sh -c ${shellQuote(join)}`, { stdin: key });
+      const s = await status(exec);
+      if (s.state === "Running" && s.ipv4) {
+        return {
+          changed: true,
+          detail: `Joined the tailnet as ${s.hostname ?? hostname} on ${s.ipv4}. clawops still reaches this host on its public address; nothing has been pointed at the new one yet.`
+        };
+      }
+      throw new Error(
+        `tailscale up did not bring the host onto the network (state: ${s.state}). ` + // The key is never interpolated into a message. An expired or single-use key is the
+        // usual cause and Tailscale says so in output that does not contain the key itself.
+        redactKey(r.stdout || r.stderr, key).slice(0, 300)
+      );
+    }
+  };
+}
+var tailscaleModule = makeTailscaleModule();
+function redactKey(text, key) {
+  if (!key) return text;
+  return text.split(key).join("[redacted]");
+}
+
+export {
+  parseStatus,
+  isTailscaleIpv4,
+  rootPrefix,
+  makeTailscaleModule,
+  tailscaleModule
+};

package/dist/{chunk-BSLIYB5Q.js → chunk-XFN3YDZE.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JW5A7E3X.js";
 
 // src/plan/validate.ts
-import Ajv from "ajv/dist/2020";
+import Ajv from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
 import { readFileSync } from "fs";
 import { join } from "path";

package/dist/{cli-WLD3EBEM.js → cli-NH7VUNOU.js}

@@ -3,7 +3,7 @@ import {
   ensurePulumiCli,
   pulumiCliRoot,
   pulumiCliStatus
-} from "./chunk-W3OLNNJW.js";
+} from "./chunk-PSOSBJVO.js";
 export {
   ensurePulumiCli,
   pulumiCliRoot,