@clawops/cli 2.0.1 → 2.1.0

package/dist/flows-RI7FGHAM.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+
+// src/harden/flows.ts
+async function cutOverToTailnet(ctx, conn, config) {
+  const { withRemoteExec } = await import("./harden-3KKCR7BL.js");
+  const { verifyTailnetAddress, probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+  const { setConfig } = await import("./store-OVB3DAJR.js");
+  const result = await withRemoteExec(
+    conn,
+    void 0,
+    (exec) => verifyTailnetAddress(conn, { exec, probe: (target) => probeSsh(target) })
+  );
+  if (!result.ok) return result;
+  const stack = config.stacks[ctx.stackName];
+  if (!stack) {
+    return {
+      ok: false,
+      reason: `Stack "${ctx.stackName}" is not in config, so the tailnet address could not be recorded.`
+    };
+  }
+  setConfig({
+    ...config,
+    stacks: {
+      ...config.stacks,
+      [ctx.stackName]: {
+        ...stack,
+        tailscale: {
+          ip: result.ip,
+          ...result.hostname ? { hostname: result.hostname } : {},
+          verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      }
+    }
+  });
+  return {
+    ok: true,
+    ip: result.ip,
+    ...result.hostname ? { hostname: result.hostname } : {},
+    pinned: result.pinned,
+    message: `clawops now reaches "${ctx.stackName}" at ${result.ip} over the tailnet (${result.pinned} host key${result.pinned === 1 ? "" : "s"} pinned through the public connection). The public address is still open; nothing has been closed.`
+  };
+}
+async function revertTailnet(ctx, config) {
+  const override = config.stacks[ctx.stackName]?.tailscale;
+  if (!override) {
+    return {
+      ok: true,
+      noop: true,
+      message: `Stack "${ctx.stackName}" is not using a tailnet address; nothing to revert.`
+    };
+  }
+  const { buildContext } = await import("./context-7VI3R6EK.js");
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const { probeSsh, leaveTailnet } = await import("./tailscale-cutover-6YP2QKFM.js");
+  const { withRemoteExec } = await import("./harden-3KKCR7BL.js");
+  const { getConfig, setConfig } = await import("./store-OVB3DAJR.js");
+  const { forgetHost } = await import("./known-hosts-file-I3Q3NBYQ.js");
+  const direct = buildContext({ stack: ctx.stackName, ignoreTailnet: true });
+  const outputMap = await (await direct.getStack()).outputs();
+  const raw = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
+  const publicConn = direct.adapter.getConnectionInfo({
+    ...extractBaseOutputs(raw),
+    privateKeyPath: config.ssh.keyPath,
+    knownHostsPath: config.ssh.knownHostsPath
+  });
+  if (!await probeSsh(publicConn)) {
+    return override.privateOnly ? {
+      ok: false,
+      needsReopen: true,
+      reason: `"${ctx.stackName}" is private-only: its public ports are closed, so there is no way to leave the tailnet without losing the host. Reopen SSH first, then run this again:
+  clawops plan --stack ${ctx.stackName} --ssh-cidr auto --out <abs-path>/plan.json
+  clawops apply <abs-path>/plan.json
+Nothing was changed.`
+    } : {
+      ok: false,
+      needsReopen: false,
+      reason: `This machine cannot reach "${ctx.stackName}" at its public address ${publicConn.host}, and leaving the tailnet would leave no way in. Nothing was changed.`
+    };
+  }
+  const left = await withRemoteExec(publicConn, void 0, (exec) => leaveTailnet(exec));
+  if (!left.ok) {
+    return {
+      ok: false,
+      needsReopen: false,
+      reason: `${left.reason}. clawops still uses the tailnet address; nothing else was changed.`
+    };
+  }
+  const fresh = getConfig() ?? config;
+  const stack = fresh.stacks[ctx.stackName];
+  if (stack) {
+    const { tailscale: _dropped, ...rest } = stack;
+    void _dropped;
+    setConfig({ ...fresh, stacks: { ...fresh.stacks, [ctx.stackName]: rest } });
+  }
+  forgetHost(expandHome(config.ssh.knownHostsPath), override.ip, publicConn.port);
+  return {
+    ok: true,
+    publicHost: publicConn.host,
+    tailnetIp: override.ip,
+    message: `"${ctx.stackName}" has left the tailnet; clawops reaches it at ${publicConn.host} again (the pinned key for ${override.ip} was forgotten).`
+  };
+}
+async function connectionFor(ctx, config) {
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const outputMap = await (await ctx.getStack()).outputs();
+  const raw = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
+  return ctx.adapter.getConnectionInfo({
+    ...extractBaseOutputs(raw),
+    privateKeyPath: config.ssh.keyPath,
+    knownHostsPath: config.ssh.knownHostsPath
+  });
+}
+function expandHome(p) {
+  return p.replace(/^~/, process.env["HOME"] ?? "~");
+}
+export {
+  connectionFor,
+  cutOverToTailnet,
+  revertTailnet
+};

package/dist/{generate-I6YQ5V2T.js → generate-YEM73KVB.js}

@@ -5,19 +5,19 @@ import {
   isInstanceAlias,
   parseDiffForTest,
   planId
-} from "./chunk-STLRHLLV.js";
-import "./chunk-BSLIYB5Q.js";
-import "./chunk-5XT5IAJK.js";
+} from "./chunk-A2DS5SB7.js";
+import "./chunk-XFN3YDZE.js";
+import "./chunk-QDNFADJI.js";
 import "./chunk-JW5A7E3X.js";
-import "./chunk-LEVIW2PV.js";
+import "./chunk-BELTQGHT.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 import "./chunk-VUFMZEIM.js";
 export {