@clawops/cli 2.0.2 → 2.1.1

package/dist/chunk-X56CQ6GB.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import {
+  getConfigDir
+} from "./chunk-64PONSA5.js";
+
+// src/config/secrets.ts
+import { readFileSync, existsSync } from "fs";
+import path from "path";
+function secretsDir(configDir) {
+  return path.join(configDir ?? getConfigDir(), "secrets");
+}
+function resolveSecretRef(name, configDir) {
+  const p = path.join(secretsDir(configDir), name);
+  if (!existsSync(p)) return null;
+  try {
+    return readFileSync(p, "utf-8").trim();
+  } catch {
+    return null;
+  }
+}
+
+// src/harden/modules/tailscale.ts
+var AUTH_KEY_SECRET = "TAILSCALE_AUTH_KEY";
+var KEY_PATH = "/run/clawops-tailscale.key";
+function parseStatus(json) {
+  let body;
+  try {
+    body = JSON.parse(json);
+  } catch {
+    return { state: "unknown" };
+  }
+  const b = body;
+  const state = typeof b.BackendState === "string" ? b.BackendState : "unknown";
+  const ips = Array.isArray(b.Self?.TailscaleIPs) ? b.Self?.TailscaleIPs : [];
+  const ipv4 = ips.find((i) => typeof i === "string" && isTailscaleIpv4(i));
+  const hostname = typeof b.Self?.HostName === "string" ? b.Self.HostName : void 0;
+  return { state, ...ipv4 ? { ipv4 } : {}, ...hostname ? { hostname } : {} };
+}
+function isTailscaleIpv4(ip) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip.trim());
+  if (!m) return false;
+  const octets = m.slice(1).map(Number);
+  if (octets.some((o) => o > 255)) return false;
+  return octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127;
+}
+function tailnetHostname(stack) {
+  const slug = stack.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `clawops-${slug || "stack"}`.slice(0, 63);
+}
+async function installed(exec) {
+  const r = await exec("command -v tailscale >/dev/null 2>&1 && echo yes || echo no");
+  return r.stdout.trim() === "yes";
+}
+var DAEMON_DOWN = /failed to connect to local tailscaled|is tailscaled running|connection refused/i;
+async function status(exec) {
+  const r = await exec("tailscale status --json 2>&1 || true");
+  if (DAEMON_DOWN.test(r.stdout)) return { state: "unknown", daemonDown: true };
+  return parseStatus(r.stdout);
+}
+async function ensureDaemon(exec, sudo) {
+  const r = await exec(
+    `command -v systemctl >/dev/null 2>&1 && ${sudo}systemctl start tailscaled >/dev/null 2>&1 && echo started || echo no`
+  );
+  return r.stdout.trim() === "started";
+}
+async function rootPrefix(exec) {
+  return (await exec("id -u")).stdout.trim() === "0" ? "" : "sudo -n ";
+}
+function shellQuote(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function makeTailscaleModule(stack) {
+  return {
+    id: "tailscale",
+    label: "Tailscale membership (joins the host to your tailnet)",
+    defaultOn: false,
+    providers: "all",
+    async check(exec) {
+      if (!await installed(exec)) {
+        return { status: "missing", detail: "Tailscale is not installed on this host." };
+      }
+      const s = await status(exec);
+      if (s.state === "Running" && s.ipv4) {
+        return { status: "applied", detail: `Joined as ${s.hostname ?? "this host"} on ${s.ipv4}.` };
+      }
+      if (s.daemonDown) {
+        return {
+          status: "drifted",
+          detail: "Tailscale is installed but the tailscaled daemon is not running, so this host is on no tailnet whatever it was joined to before. Start it with `systemctl start tailscaled`, or check `systemctl status tailscaled` for why it stopped."
+        };
+      }
+      if (s.state === "unknown") {
+        return {
+          status: "drifted",
+          detail: "Tailscale is installed but did not report a status that could be parsed."
+        };
+      }
+      return {
+        status: "missing",
+        detail: `Tailscale is installed but not on a tailnet (state: ${s.state}).`
+      };
+    },
+    async apply(exec) {
+      const key = resolveSecretRef(AUTH_KEY_SECRET);
+      if (!key) {
+        throw new Error(
+          `No auth key. Create one in the Tailscale admin console and store it with \`clawops secret set ${AUTH_KEY_SECRET}\`. clawops does not prompt for it here, so a key never reaches a terminal scrollback or a CI log.`
+        );
+      }
+      if (!await installed(exec)) {
+        const r2 = await exec("curl -fsSL https://tailscale.com/install.sh | sh");
+        if (!await installed(exec)) {
+          throw new Error(`Tailscale install failed: ${(r2.stderr || r2.stdout).slice(0, 300)}`);
+        }
+      }
+      const sudo = await rootPrefix(exec);
+      if ((await status(exec)).daemonDown && !await ensureDaemon(exec, sudo)) {
+        throw new Error(
+          "Tailscale is installed but tailscaled is not running and could not be started. On a systemd host, `systemctl status tailscaled` says why; on a host without an init manager, tailscaled has to be supervised by whatever does run there."
+        );
+      }
+      const hostname = tailnetHostname(stack ?? (await exec("hostname")).stdout);
+      const join = [
+        `umask 077`,
+        `trap 'rm -f ${KEY_PATH}' EXIT INT TERM`,
+        `cat > ${KEY_PATH}`,
+        `tailscale up --auth-key=file:${KEY_PATH} --hostname=${hostname} --accept-routes 2>&1`
+      ].join("\n");
+      const r = await exec(`${sudo}sh -c ${shellQuote(join)}`, { stdin: key });
+      const s = await status(exec);
+      if (s.state === "Running" && s.ipv4) {
+        return {
+          changed: true,
+          detail: `Joined the tailnet as ${s.hostname ?? hostname} on ${s.ipv4}. clawops still reaches this host on its public address; nothing has been pointed at the new one yet.`
+        };
+      }
+      throw new Error(
+        `tailscale up did not bring the host onto the network (state: ${s.state}). ` + // The key is never interpolated into a message. An expired or single-use key is the
+        // usual cause and Tailscale says so in output that does not contain the key itself.
+        redactKey(r.stdout || r.stderr, key).slice(0, 300)
+      );
+    }
+  };
+}
+var tailscaleModule = makeTailscaleModule();
+function redactKey(text, key) {
+  if (!key) return text;
+  return text.split(key).join("[redacted]");
+}
+
+export {
+  parseStatus,
+  isTailscaleIpv4,
+  rootPrefix,
+  makeTailscaleModule,
+  tailscaleModule
+};

package/dist/{chunk-BSLIYB5Q.js → chunk-XFN3YDZE.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JW5A7E3X.js";
 
 // src/plan/validate.ts
-import Ajv from "ajv/dist/2020";
+import Ajv from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
 import { readFileSync } from "fs";
 import { join } from "path";

package/dist/{chunk-SDZKCICH.js → chunk-YEBFVLOE.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-BSLIYB5Q.js";
+} from "./chunk-XFN3YDZE.js";
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-WTZ2CT35.js";
+} from "./chunk-QDNFADJI.js";
 import {
   getConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   StateError,
   UsageError
@@ -16,11 +16,12 @@ import {
 
 // src/plan/generate.ts
 import { randomUUID } from "crypto";
-var PREVIEW_LINE_RE = /^([+~-])\s+(\S+)\s+(\S+)?/;
+var PREVIEW_LINE_RE = /^(\+-|-\+|[+~-])\s+(\S+)\s+(\S+)?/;
 function parseDiff(lines) {
   const create = [];
   const update = [];
   const del = [];
+  const replace = [];
   const seen = /* @__PURE__ */ new Set();
   for (const line of lines) {
     const m = PREVIEW_LINE_RE.exec(line.trimStart());
@@ -34,7 +35,8 @@ function parseDiff(lines) {
       type: resourceType,
       ...name ? { name } : {}
     };
-    if (op === "+") create.push(ref);
+    if (op === "+-" || op === "-+") replace.push(ref);
+    else if (op === "+") create.push(ref);
     else if (op === "~") update.push({ resource: ref, before: null, after: null });
     else if (op === "-") del.push(ref);
   }
@@ -42,7 +44,8 @@ function parseDiff(lines) {
     create,
     update,
     delete: del,
-    totalChanges: create.length + update.length + del.length
+    replace,
+    totalChanges: create.length + update.length + del.length + replace.length
   };
 }
 var INSTANCE_ALIASES = ["micro", "small", "medium", "large", "gpu"];
@@ -68,7 +71,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-3A6BOALU.js");
+  const { version } = await import("./package-SAUDFQLG.js");
   const config = getConfig();
   const instanceType = await resolveInstanceType(intent);
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
@@ -120,7 +123,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     );
   }
   try {
-    const { writeStackConfig } = await import("./stack-config-R4SPSUQZ.js");
+    const { writeStackConfig } = await import("./stack-config-LUTS2XAD.js");
     await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({
@@ -148,7 +151,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
-  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-YVI3BJ55.js");
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-JXKN5WD6.js");
   const cfgCheck = await validatePlanConfig(plan);
   for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
 `);