@lamalibre/create-lamaste 4.1.0 → 4.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/vendor/docs/00-introduction/how-it-works.md +2 -2
- package/vendor/docs/00-introduction/quickstart.md +5 -5
- package/vendor/docs/00-introduction/what-is-lamaste.md +5 -5
- package/vendor/docs/01-concepts/certificates.md +3 -3
- package/vendor/docs/01-concepts/mtls.md +2 -2
- package/vendor/docs/01-concepts/security-model.md +1 -1
- package/vendor/docs/01-concepts/tickets.md +2 -2
- package/vendor/docs/01-concepts/tunneling.md +4 -4
- package/vendor/docs/02-guides/agent-setup.md +3 -3
- package/vendor/docs/02-guides/certificate-management.md +2 -2
- package/vendor/docs/02-guides/cloud-provisioning.md +3 -3
- package/vendor/docs/02-guides/desktop-app-setup.md +10 -10
- package/vendor/docs/02-guides/installation.md +3 -3
- package/vendor/docs/02-guides/onboarding.md +2 -2
- package/vendor/docs/02-guides/standalone-plugin-with-tickets.md +2 -2
- package/vendor/docs/03-architecture/installer-flow.md +2 -2
- package/vendor/docs/03-architecture/installer.md +4 -4
- package/vendor/docs/03-architecture/management-flow.md +1 -1
- package/vendor/docs/03-architecture/overview.md +5 -5
- package/vendor/docs/03-architecture/panel-client.md +6 -6
- package/vendor/docs/03-architecture/panel-server.md +2 -2
- package/vendor/docs/03-architecture/state-management.md +2 -2
- package/vendor/docs/03-architecture/system-overview.md +1 -1
- package/vendor/docs/04-api-reference/onboarding.md +1 -1
- package/vendor/docs/04-api-reference/registry-and-oidc.md +26 -1
- package/vendor/docs/05-operations/backup-and-restore.md +1 -1
- package/vendor/docs/05-operations/uninstalling.md +1 -1
- package/vendor/docs/05-operations/upgrades.md +5 -5
- package/vendor/docs/06-reference/config-files.md +1 -1
- package/vendor/docs/06-reference/glossary.md +3 -3
- package/vendor/docs/06-reference/installer-flags.md +13 -13
- package/vendor/docs/06-reference/ports-and-services.md +1 -1
- package/vendor/docs/06-reference/troubleshooting.md +8 -8
- package/vendor/docs/gatekeeper-design.md +8 -8
- package/vendor/docs/identity-directory-design.md +2 -2
- package/vendor/docs/package.json +1 -1
- package/vendor/docs/todo/lib-cli-desktop-refactor.md +27 -27
- package/vendor/gatekeeper/package.json +1 -1
- package/vendor/server/package.json +2 -2
- package/vendor/server/src/commands/plugins.js +123 -168
- package/vendor/server/src/panel-api.js +4 -2
- package/vendor/server-ui/dist/assets/{index-B0nWuUyL.js → index-B5Wp8lu-.js} +26 -26
- package/vendor/server-ui/dist/index.html +1 -1
- package/vendor/serverd/package.json +2 -2
- package/vendor/serverd/src/lib/migrations/state/0005_plugin_hosting.sql +3 -0
- package/vendor/serverd/src/lib/plugin-oidc.js +33 -16
- package/vendor/serverd/src/lib/plugins.js +11 -3
- package/vendor/serverd/src/routes/management/storage.js +10 -2
|
@@ -453,7 +453,7 @@ See [nginx-configuration.md](./nginx-configuration.md) for detailed coverage.
|
|
|
453
453
|
|
|
454
454
|
### chisel-users.js — Chisel Credentials and Grants
|
|
455
455
|
|
|
456
|
-
- Thin shim over `@lamalibre/lamaste@4.
|
|
456
|
+
- Thin shim over `@lamalibre/lamaste@4.2.0/server`: per-agent credentials in `chisel-credentials.json` (0600)
|
|
457
457
|
- Renders the authfile `chisel-users` from the credentials and `tunnels.json`: each `agent-<label>` may bind exactly `^R:127\.0\.0\.1:<port>$` for its enabled tunnels
|
|
458
458
|
- Adds the `lamaste-no-grants` sentinel user (password in `chisel-sentinel`, 0600) so the authfile is never empty — Chisel disables authentication on an empty authfile
|
|
459
459
|
- Never grants a reserved port (3100, 9090, 9091, 9292, 9294) or a port claimed by two tunnels
|
|
@@ -535,7 +535,7 @@ Agent-to-agent authorization with scopes, instances, tickets, and sessions. Prov
|
|
|
535
535
|
- **Periodic cleanup** — stale/dead instances, expired tickets, dead sessions
|
|
536
536
|
- **Concurrency** — promise-chain mutex with atomic file writes (temp → fsync → rename)
|
|
537
537
|
|
|
538
|
-
Client SDK: `@lamalibre/lamaste-tickets@4.
|
|
538
|
+
Client SDK: `@lamalibre/lamaste-tickets@4.2.0` (TypeScript, undici) provides `TicketClient`, `TicketInstanceManager` (source side), and `TicketSessionManager` (target side) for plugin integration.
|
|
539
539
|
|
|
540
540
|
State files: `/etc/lamalibre/lamaste/ticket-scopes.json` (scopes, instances, assignments) and `/etc/lamalibre/lamaste/tickets.json` (tickets, sessions).
|
|
541
541
|
|
|
@@ -331,7 +331,7 @@ Read returns `[]` for missing files (ENOENT), enabling the system to start with
|
|
|
331
331
|
5. `DELETE /api/certs/agent/:label` (revocation) — the agent's app and plugin tunnels lose their `agentLabel` (unassigned), and its `agent-<label>` panel tunnel is removed
|
|
332
332
|
6. At startup (background, fail closed): an ownerless `agent-<label>` panel tunnel is bound to the agent it names when that agent is active; other ownerless tunnels (from versions before tunnel ownership) are bound to the sole active agent, or left unassigned when there are several. Then the pinned Chisel binary, the unit and the authfile are re-established — and Chisel is stopped if they cannot be
|
|
333
333
|
|
|
334
|
-
Every one of these workflows runs under the single tunnel lock (`withTunnelLock` in `@lamalibre/lamaste@4.
|
|
334
|
+
Every one of these workflows runs under the single tunnel lock (`withTunnelLock` in `@lamalibre/lamaste@4.2.0/server`), with its validation inside the lock.
|
|
335
335
|
|
|
336
336
|
## Site State (`sites.json`)
|
|
337
337
|
|
|
@@ -486,7 +486,7 @@ The PKI directory belongs to `lamaste` because the panel is the CA (it signs age
|
|
|
486
486
|
|
|
487
487
|
The Panel Server is a single-process Node.js application, but a single-threaded event loop does not serialize asynchronous workflows: two requests that each read `tunnels.json`, await a certificate or an nginx test, and then write it back would interleave, and both could pass the same uniqueness check. Serialization is therefore explicit:
|
|
488
488
|
|
|
489
|
-
**Tunnel state** is guarded by one promise-chain lock, `withTunnelLock` in `@lamalibre/lamaste@4.
|
|
489
|
+
**Tunnel state** is guarded by one promise-chain lock, `withTunnelLock` in `@lamalibre/lamaste@4.2.0/server`'s `tunnels.ts`. Every tunnel workflow — create, delete, toggle, assign, reconfigure, the combined `PATCH /api/tunnels/:id`, releasing a revoked agent's tunnels, and startup reconciliation — takes it for its whole duration, and does its validation (subdomain and port uniqueness, reserved ports, agent checks, authorization against the current entry) inside it.
|
|
490
490
|
|
|
491
491
|
**Chisel authfile renders** are serialized by a promise-chain mutex in `chisel-users.ts`, keyed by the credentials file, around every render (enroll, revoke, rotate, tunnel change). The daemon's `syncChisel()` renders after the tunnel state is written and restarts Chisel (`systemctl try-restart`) only when the render withdrew something.
|
|
492
492
|
|
|
@@ -58,7 +58,7 @@
|
|
|
58
58
|
│ │ │ │
|
|
59
59
|
│ │ Lamaste Desktop (Tauri v2) — dual mode │ │
|
|
60
60
|
│ │ ├─ Agent mode: service discovery + tunnel management │ │
|
|
61
|
-
│ │ │ (pages from @lamalibre/lamaste-agent-ui@4.
|
|
61
|
+
│ │ │ (pages from @lamalibre/lamaste-agent-ui@4.2.0) │ │
|
|
62
62
|
│ │ ├─ Server mode: full admin panel (via lamaste-server-ui) │ │
|
|
63
63
|
│ │ ├─ Multi-server registry (~/.lamalibre/lamaste/servers.json) │ │
|
|
64
64
|
│ │ ├─ Cloud provisioning (DigitalOcean via lamaste-cloud) │ │
|
|
@@ -255,7 +255,7 @@ The wildcard check probes `test-lamaste-check.<domain>`. Wildcard DNS is optiona
|
|
|
255
255
|
|
|
256
256
|
### `POST /api/onboarding/provision`
|
|
257
257
|
|
|
258
|
-
Starts the full stack provisioning process in the background. This configures and starts Chisel and Authelia, issues certbot certificates, and writes nginx vhosts. The Chisel and Authelia binaries and units are installed by `create-lamaste`, not here: if one is missing, the task fails with the error "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.
|
|
258
|
+
Starts the full stack provisioning process in the background. This configures and starts Chisel and Authelia, issues certbot certificates, and writes nginx vhosts. The Chisel and Authelia binaries and units are installed by `create-lamaste`, not here: if one is missing, the task fails with the error "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.2.0` on the server to repair the installation." (likewise for Authelia). Task IDs are unchanged from earlier versions; only the titles changed.
|
|
259
259
|
|
|
260
260
|
Provisioning runs asynchronously. This endpoint returns immediately with a 202 status. Use the WebSocket stream endpoint to follow progress in real time.
|
|
261
261
|
|
|
@@ -61,6 +61,31 @@ Authelia serves its OpenID Connect provider at `https://auth.<domain>`: `/.well-
|
|
|
61
61
|
|
|
62
62
|
Tokens are signed with an RSA-4096 key at `/etc/authelia/oidc-issuer.pem`, generated by `create-lamaste` (fresh install and every redeploy that finds it missing), owned by the `lamaste-authelia` account, mode 0600. The panel, which writes Authelia's configuration, cannot read it: the configuration references the key with a template expression — `key: {{ secret "/etc/authelia/oidc-issuer.pem" | mindent 10 "|" | msquote }}` — which Authelia expands at load time because its unit sets `X_AUTHELIA_CONFIG_FILTERS=template`. The whole file is then a Go template, so the panel refuses to write any value containing `{{` or `}}`.
|
|
63
63
|
|
|
64
|
+
### Agent-hosted plugins: clients without code on the relay
|
|
65
|
+
|
|
66
|
+
An application that runs on its own agent, behind a Lamaste tunnel, still needs its clients on the relay's Authelia — Feria's `feria-cli` is the first. Its manifest says so with `"hosting": "agent"` (default `"server"`):
|
|
67
|
+
|
|
68
|
+
```json
|
|
69
|
+
{
|
|
70
|
+
"name": "feria",
|
|
71
|
+
"version": "0.3.1",
|
|
72
|
+
"hosting": "agent",
|
|
73
|
+
"oidcClients": [
|
|
74
|
+
{
|
|
75
|
+
"id": "feria-cli",
|
|
76
|
+
"grantTypes": ["urn:ietf:params:oauth:grant-type:device_code"],
|
|
77
|
+
"scopes": ["openid", "profile", "groups"],
|
|
78
|
+
"audience": ["https://feria.{domain}"],
|
|
79
|
+
"accessTokenClaims": ["groups", "preferred_username"]
|
|
80
|
+
}
|
|
81
|
+
]
|
|
82
|
+
}
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
It is installed like any plugin (`POST /api/plugins/install` runs `npm install --ignore-scripts` and reads `<package>/lamaste-plugin.json`), but Lamaste never imports the package — not the panel, and not an agent's plugin host if the package is installed there. Nothing is mounted under `/api/<name>/` (requests there answer `404`), no panel bundle is served, and no storage can be bound to it (`400`). A `panel` declaration is a manifest error (`400` on install). What takes effect is what the manifest declares: its `oidcClients` are written to Authelia on enable and removed on disable or uninstall, confidential-client secrets are minted and shown exactly as above, and its `capabilities` can be granted to agents. `GET /api/plugins` reports each plugin's `hosting`; a plugin installed before 4.2 is `"server"`.
|
|
86
|
+
|
|
87
|
+
The application's own tunnel (`feria.<domain>`) is created by the administrator as for any app; Lamaste does not create it from the manifest.
|
|
88
|
+
|
|
64
89
|
## Plugin OIDC client endpoints
|
|
65
90
|
|
|
66
91
|
### `GET /api/plugins/:name/oidc-clients`
|
|
@@ -102,7 +127,7 @@ Admin only, 10 per minute. Replaces a confidential client's secret in the store
|
|
|
102
127
|
|
|
103
128
|
`400` for a public client, `404` for a client the plugin does not declare.
|
|
104
129
|
|
|
105
|
-
CLI: `lamaste-server plugins oidc-clients <name>` and `lamaste-server plugins rotate-secret <name> <clientId
|
|
130
|
+
CLI: `lamaste-server plugins oidc-clients <name>` and `lamaste-server plugins rotate-secret <name> <clientId>`. Every `lamaste-server plugins` subcommand goes through the running panel — `install`, `enable`, `disable` and `uninstall` call the routes above, so a plugin the CLI installs is the one the panel serves and its clients reach Authelia — and `lamaste-server plugins list` shows each plugin's hosting.
|
|
106
131
|
|
|
107
132
|
## Registry credential endpoints
|
|
108
133
|
|
|
@@ -197,7 +197,7 @@ sudo chown lamaste-authelia:lamaste-authelia /etc/authelia/db.sqlite3* /etc/auth
|
|
|
197
197
|
sudo chmod 600 /etc/authelia/db.sqlite3* /etc/authelia/notifications.txt
|
|
198
198
|
```
|
|
199
199
|
|
|
200
|
-
A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.
|
|
200
|
+
A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.2.0 --yes`: the redeploy rewrites the `chisel` and `authelia` units and converts the ownership of `/etc/authelia`, the Chisel key and the PKI directory (see [Upgrades](upgrades.md)).
|
|
201
201
|
|
|
202
202
|
The panel re-applies the authfile's group and mode itself on every start, so a Chisel that fails to read it before the panel is up is started again by the panel's reconciliation.
|
|
203
203
|
|
|
@@ -29,7 +29,7 @@ It stops and disables the panel, gatekeeper, Chisel and Authelia; removes their
|
|
|
29
29
|
The manual guide is also available from the CLI:
|
|
30
30
|
|
|
31
31
|
```bash
|
|
32
|
-
npx @lamalibre/create-lamaste@4.
|
|
32
|
+
npx @lamalibre/create-lamaste@4.2.0 --uninstall
|
|
33
33
|
```
|
|
34
34
|
|
|
35
35
|
This prints the same steps listed below.
|
|
@@ -25,7 +25,7 @@ When a release changes both sides, upgrade every **agent before the server**. Ag
|
|
|
25
25
|
On each agent machine:
|
|
26
26
|
|
|
27
27
|
```bash
|
|
28
|
-
npm install -g @lamalibre/lamaste-agent@4.
|
|
28
|
+
npm install -g @lamalibre/lamaste-agent@4.2.0
|
|
29
29
|
lamaste-agent update
|
|
30
30
|
```
|
|
31
31
|
|
|
@@ -79,7 +79,7 @@ exit
|
|
|
79
79
|
|
|
80
80
|
### Updating Chisel
|
|
81
81
|
|
|
82
|
-
Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.
|
|
82
|
+
Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.2.0`), downloaded from the fixed release URL and verified against a pinned SHA-256 before it is unpacked. **Do not replace the binary by hand.** On the server, `create-lamaste` installs it (as root) and replaces a binary that reports any other version; the panel cannot install binaries, and only logs an error at startup when the installed Chisel is not the pinned release (it then restarts Chisel on every authfile change). Each agent's sync replaces its own copy.
|
|
83
83
|
|
|
84
84
|
A new Chisel version therefore arrives with a Lamaste release that changes the pin: re-run the installer, which installs it and restarts Chisel. To check what is running:
|
|
85
85
|
|
|
@@ -93,7 +93,7 @@ Tunnel clients reconnect on their own after the brief interruption (they retry a
|
|
|
93
93
|
|
|
94
94
|
### Updating Authelia
|
|
95
95
|
|
|
96
|
-
Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.
|
|
96
|
+
Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.2.0`), downloaded by `create-lamaste` from its fixed release URL and verified against a pinned SHA-256 per architecture. A new Authelia version arrives with a Lamaste release that changes the pin — re-run the installer. It stops Authelia while it replaces the binary and starts it again.
|
|
97
97
|
|
|
98
98
|
An installed Authelia **newer** than the pin is kept, never downgraded: its database may already use a schema the pinned release cannot read, and Authelia refuses to start on a database newer than itself. If you install a newer release by hand, stop the service, replace the binary as root with a `root:root 0755` file, and start it again; check the [Authelia changelog](https://github.com/authelia/authelia/blob/master/CHANGELOG.md) first, since the configuration format may change between versions.
|
|
99
99
|
|
|
@@ -232,7 +232,7 @@ The panel server, CLI, client, docs and gatekeeper are always redeployed (files
|
|
|
232
232
|
|
|
233
233
|
### Version Pinning
|
|
234
234
|
|
|
235
|
-
Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.
|
|
235
|
+
Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.2.0`) before anything is unpacked; the server installer uses them in `packages/provisioners/server/src/lib/binaries.js`. The configuration the panel writes needs Authelia 4.38 or later.
|
|
236
236
|
|
|
237
237
|
### Automated Updates
|
|
238
238
|
|
|
@@ -254,7 +254,7 @@ sudo dpkg-reconfigure -plow unattended-upgrades
|
|
|
254
254
|
| Panel server | `/opt/lamalibre/lamaste/lamaste-serverd/` | Re-run `npx @lamalibre/create-lamaste@latest` |
|
|
255
255
|
| Panel client | `/opt/lamalibre/lamaste/lamaste-server-ui/` | Re-run `npx @lamalibre/create-lamaste@latest` |
|
|
256
256
|
| Chisel | `/usr/local/bin/chisel` | Pinned; installed by `create-lamaste` |
|
|
257
|
-
| Agents | `npm install -g @lamalibre/lamaste-agent@4.
|
|
257
|
+
| Agents | `npm install -g @lamalibre/lamaste-agent@4.2.0` | Upgrade before the server, then `lamaste-agent update` |
|
|
258
258
|
| Authelia | `/usr/local/bin/authelia` | Pinned; installed by `create-lamaste` (newer is kept) |
|
|
259
259
|
| nginx | System package | `sudo apt-get update && sudo apt-get upgrade` |
|
|
260
260
|
| certbot | System package | `sudo apt-get update && sudo apt-get upgrade` |
|
|
@@ -874,7 +874,7 @@ Service files use per-agent names:
|
|
|
874
874
|
- macOS: `com.lamalibre.lamaste.chisel-<label>` (plist label), `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` — mode 0600, because it carries `AUTH` in `EnvironmentVariables`
|
|
875
875
|
- Linux: `lamalibre-lamaste-chisel-<label>` (unit name), `~/.config/systemd/user/lamalibre-lamaste-chisel-<label>.service` — a systemd **user** unit with `EnvironmentFile=` pointing at `chisel.env`; enable lingering (`sudo loginctl enable-linger <user>`) for it to start at boot without a login
|
|
876
876
|
|
|
877
|
-
Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.
|
|
877
|
+
Both run `chisel client --max-retry-interval 30s https://tunnel.<domain>:443 R:127.0.0.1:<port>:127.0.0.1:<port> ...` with TLS verification and no credential in argv. They are generated by `@lamalibre/lamaste@4.2.0/agent` (`chisel-service.ts`) and rewritten by `lamaste-agent setup`, `update` and `sync` — do not edit them by hand. An agent carrying no tunnels has its service unloaded (Chisel cannot run without a remote).
|
|
878
878
|
|
|
879
879
|
The sync timer, which runs `<node> <installed lamaste-agent> sync --label <label> --quiet` (`<node>` is a stable path such as `/opt/homebrew/bin/node` when one on `PATH` resolves to the running binary, so a Node.js upgrade does not break it):
|
|
880
880
|
|
|
@@ -24,7 +24,7 @@ If you are reading documentation and hit an unfamiliar term, this is the place t
|
|
|
24
24
|
|
|
25
25
|
**Where it appears:**
|
|
26
26
|
|
|
27
|
-
- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.
|
|
27
|
+
- Enrolled from the panel (**Certificates → Enrollment Token**) and `lamaste-agent setup` (installed globally with `npm install -g @lamalibre/lamaste-agent@4.2.0`)
|
|
28
28
|
- Agent registry: `/etc/lamalibre/lamaste/agents.json` on the server; `~/.lamalibre/lamaste/agents/<label>/` on the agent
|
|
29
29
|
- The **Agent** column and field on the panel's Tunnels page
|
|
30
30
|
|
|
@@ -242,7 +242,7 @@ See also: [mTLS](#mtls-mutual-tls), [CA](#ca-certificate-authority), [PKCS12](#p
|
|
|
242
242
|
|
|
243
243
|
**Where it appears:**
|
|
244
244
|
|
|
245
|
-
- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.
|
|
245
|
+
- Generated by `lamaste-agent setup` / `update` (implementation in `@lamalibre/lamaste@4.2.0/agent`)
|
|
246
246
|
- Installed to `~/Library/LaunchAgents/com.lamalibre.lamaste.chisel-<label>.plist` on the agent
|
|
247
247
|
- Manages the Chisel client process lifecycle
|
|
248
248
|
|
|
@@ -373,7 +373,7 @@ See also: [Client Certificate](#client-certificate), [CA](#ca-certificate-author
|
|
|
373
373
|
|
|
374
374
|
**Plain English:** A small scheduled job on every agent that checks with the panel every 30 seconds and adjusts the tunnel client when the agent's tunnels changed — so tunnels created, disabled or moved in the panel reach the agent without anyone running a command on it.
|
|
375
375
|
|
|
376
|
-
**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.
|
|
376
|
+
**Technical:** Runs `lamaste-agent sync --label <label>`, which fetches `GET /api/tunnels/agent-config` and converges the agent's Chisel client with it (relay URL, credential, pinned binary, granted remotes, running or stopped). It exists because Chisel rejects a client's whole session when one requested remote is not granted: an agent must drop a revoked tunnel promptly or all its other tunnels go dark. Requires a global install of `@lamalibre/lamaste-agent@4.2.0`.
|
|
377
377
|
|
|
378
378
|
**Where it appears:**
|
|
379
379
|
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
# Installer Flags
|
|
2
2
|
|
|
3
|
-
> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.
|
|
3
|
+
> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.2.0`.
|
|
4
4
|
|
|
5
5
|
## Usage
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
|
-
npx @lamalibre/create-lamaste@4.
|
|
8
|
+
npx @lamalibre/create-lamaste@4.2.0 [flags]
|
|
9
9
|
```
|
|
10
10
|
|
|
11
11
|
The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
|
|
@@ -26,7 +26,7 @@ The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-
|
|
|
26
26
|
Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
|
|
27
27
|
|
|
28
28
|
```bash
|
|
29
|
-
npx @lamalibre/create-lamaste@4.
|
|
29
|
+
npx @lamalibre/create-lamaste@4.2.0 --help
|
|
30
30
|
```
|
|
31
31
|
|
|
32
32
|
### `--yes`, `-y`
|
|
@@ -34,7 +34,7 @@ npx @lamalibre/create-lamaste@4.1.0 --help
|
|
|
34
34
|
Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
|
|
35
35
|
|
|
36
36
|
```bash
|
|
37
|
-
npx @lamalibre/create-lamaste@4.
|
|
37
|
+
npx @lamalibre/create-lamaste@4.2.0 --yes
|
|
38
38
|
```
|
|
39
39
|
|
|
40
40
|
Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
|
|
@@ -51,7 +51,7 @@ Skips all OS hardening tasks:
|
|
|
51
51
|
Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
|
|
52
52
|
|
|
53
53
|
```bash
|
|
54
|
-
npx @lamalibre/create-lamaste@4.
|
|
54
|
+
npx @lamalibre/create-lamaste@4.2.0 --skip-harden
|
|
55
55
|
```
|
|
56
56
|
|
|
57
57
|
Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
|
|
@@ -61,7 +61,7 @@ Use this if you manage your own firewall rules, already have fail2ban configured
|
|
|
61
61
|
Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
|
|
62
62
|
|
|
63
63
|
```bash
|
|
64
|
-
npx @lamalibre/create-lamaste@4.
|
|
64
|
+
npx @lamalibre/create-lamaste@4.2.0 --dev
|
|
65
65
|
```
|
|
66
66
|
|
|
67
67
|
This is useful for:
|
|
@@ -76,7 +76,7 @@ When `--dev` is active, the installer prints the detected IP with a note: `(dev
|
|
|
76
76
|
Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
|
|
77
77
|
|
|
78
78
|
```bash
|
|
79
|
-
npx @lamalibre/create-lamaste@4.
|
|
79
|
+
npx @lamalibre/create-lamaste@4.2.0 --force-full
|
|
80
80
|
```
|
|
81
81
|
|
|
82
82
|
Use this if:
|
|
@@ -90,7 +90,7 @@ Use this if:
|
|
|
90
90
|
Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
|
|
91
91
|
|
|
92
92
|
```bash
|
|
93
|
-
npx @lamalibre/create-lamaste@4.
|
|
93
|
+
npx @lamalibre/create-lamaste@4.2.0 --uninstall
|
|
94
94
|
```
|
|
95
95
|
|
|
96
96
|
The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
|
|
@@ -207,25 +207,25 @@ Components that are always redeployed on re-run:
|
|
|
207
207
|
|
|
208
208
|
```bash
|
|
209
209
|
ssh root@203.0.113.42
|
|
210
|
-
npx @lamalibre/create-lamaste@4.
|
|
210
|
+
npx @lamalibre/create-lamaste@4.2.0
|
|
211
211
|
```
|
|
212
212
|
|
|
213
213
|
**Automated install (no confirmation prompt):**
|
|
214
214
|
|
|
215
215
|
```bash
|
|
216
|
-
npx @lamalibre/create-lamaste@4.
|
|
216
|
+
npx @lamalibre/create-lamaste@4.2.0 --yes
|
|
217
217
|
```
|
|
218
218
|
|
|
219
219
|
**Install without OS hardening:**
|
|
220
220
|
|
|
221
221
|
```bash
|
|
222
|
-
npx @lamalibre/create-lamaste@4.
|
|
222
|
+
npx @lamalibre/create-lamaste@4.2.0 --yes --skip-harden
|
|
223
223
|
```
|
|
224
224
|
|
|
225
225
|
**Test in a local VM:**
|
|
226
226
|
|
|
227
227
|
```bash
|
|
228
|
-
npx @lamalibre/create-lamaste@4.
|
|
228
|
+
npx @lamalibre/create-lamaste@4.2.0 --dev
|
|
229
229
|
```
|
|
230
230
|
|
|
231
231
|
**Update an existing installation:**
|
|
@@ -237,7 +237,7 @@ npx @lamalibre/create-lamaste@latest --yes
|
|
|
237
237
|
**View the uninstall guide:**
|
|
238
238
|
|
|
239
239
|
```bash
|
|
240
|
-
npx @lamalibre/create-lamaste@4.
|
|
240
|
+
npx @lamalibre/create-lamaste@4.2.0 --uninstall
|
|
241
241
|
```
|
|
242
242
|
|
|
243
243
|
## Quick Reference
|
|
@@ -34,7 +34,7 @@ A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.
|
|
|
34
34
|
| 9292 | IP-based panel listener |
|
|
35
35
|
| 9294 | Gatekeeper |
|
|
36
36
|
|
|
37
|
-
A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.
|
|
37
|
+
A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.2.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
|
|
38
38
|
|
|
39
39
|
## Systemd Units
|
|
40
40
|
|
|
@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
|
|
|
217
217
|
lamaste-agent update # apply now and (re)install the sync timer
|
|
218
218
|
```
|
|
219
219
|
|
|
220
|
-
`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.
|
|
220
|
+
`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.2.0`); an agent originally set up with `npx` must be installed first.
|
|
221
221
|
|
|
222
222
|
**Cause 3: The agent does not carry the tunnel.**
|
|
223
223
|
|
|
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
|
|
|
320
320
|
| Missing `panel.json` | `Config file not found` | Re-run installer or create the file manually |
|
|
321
321
|
| Invalid JSON in `panel.json` | `contains invalid JSON` | Fix the JSON syntax |
|
|
322
322
|
| Port 3100 in use | `EADDRINUSE` | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100` |
|
|
323
|
-
| Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
323
|
+
| Missing Node.js modules | `Cannot find module` | Re-run the installer (`npx @lamalibre/create-lamaste@4.2.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
|
|
324
324
|
| Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories |
|
|
325
325
|
|
|
326
326
|
### chisel fails to start
|
|
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
|
|
|
329
329
|
|
|
330
330
|
| Cause | Log Message | Fix |
|
|
331
331
|
| -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
332
|
-
| Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
332
|
+
| Binary missing | `exec format error` or `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.2.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries |
|
|
333
333
|
| Not the pinned release | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change |
|
|
334
334
|
| Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key` | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
|
|
335
335
|
| Stopped by the panel | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1 |
|
|
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
|
|
|
343
343
|
| --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
344
344
|
| Invalid `configuration.yml` | `configuration: error` | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml` |
|
|
345
345
|
| Missing `users.yml` | `cannot open file` | Create an initial users file (see [Config Files](config-files.md)) |
|
|
346
|
-
| Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
346
|
+
| Binary missing | `not found` | Re-run the installer (`npx @lamalibre/create-lamaste@4.2.0 --yes`); it installs the pinned release |
|
|
347
347
|
| Wrong permissions | `permission denied` | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
|
|
348
348
|
| Database newer than binary | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand |
|
|
349
349
|
|
|
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
|
|
|
516
516
|
|
|
517
517
|
## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
|
|
518
518
|
|
|
519
|
-
**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.
|
|
519
|
+
**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.2.0` on the server to repair the installation." (or the same for Authelia).
|
|
520
520
|
|
|
521
521
|
**Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
|
|
522
522
|
|
|
523
523
|
**Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
|
|
524
524
|
|
|
525
525
|
```bash
|
|
526
|
-
npx @lamalibre/create-lamaste@4.
|
|
526
|
+
npx @lamalibre/create-lamaste@4.2.0 --yes
|
|
527
527
|
```
|
|
528
528
|
|
|
529
529
|
If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
|
|
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
|
|
|
538
538
|
|
|
539
539
|
**Fix:**
|
|
540
540
|
|
|
541
|
-
1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.
|
|
541
|
+
1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.2.0 --yes`
|
|
542
542
|
2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
|
|
543
543
|
|
|
544
544
|
`sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
|
|
@@ -621,7 +621,7 @@ df -h /
|
|
|
621
621
|
|
|
622
622
|
**Cause 3: The web root is not writable by the panel (`EACCES`).**
|
|
623
623
|
|
|
624
|
-
The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.
|
|
624
|
+
The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.2.0 --yes`); the redeploy converts the tree.
|
|
625
625
|
|
|
626
626
|
---
|
|
627
627
|
|
|
@@ -2,9 +2,9 @@
|
|
|
2
2
|
|
|
3
3
|
## Overview
|
|
4
4
|
|
|
5
|
-
`@lamalibre/lamaste-gatekeeper@4.
|
|
5
|
+
`@lamalibre/lamaste-gatekeeper@4.2.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
|
|
6
6
|
|
|
7
|
-
It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.
|
|
7
|
+
It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.2.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
|
|
8
8
|
|
|
9
9
|
---
|
|
10
10
|
|
|
@@ -204,7 +204,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
|
|
|
204
204
|
|
|
205
205
|
```js
|
|
206
206
|
import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
|
|
207
|
-
addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.
|
|
207
|
+
addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.2.0';
|
|
208
208
|
|
|
209
209
|
createGroup(name, { description?, createdBy? })
|
|
210
210
|
// → { name, description, members: [], createdAt, createdBy }
|
|
@@ -240,7 +240,7 @@ getGroupsForUser(username)
|
|
|
240
240
|
### Grants
|
|
241
241
|
|
|
242
242
|
```js
|
|
243
|
-
import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.
|
|
243
|
+
import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.2.0';
|
|
244
244
|
|
|
245
245
|
createGrant({ principalType, principalId, resourceType, resourceId, context? })
|
|
246
246
|
// → grant object
|
|
@@ -267,7 +267,7 @@ revokeGrant(grantId)
|
|
|
267
267
|
### Authorization
|
|
268
268
|
|
|
269
269
|
```js
|
|
270
|
-
import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.
|
|
270
|
+
import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.2.0';
|
|
271
271
|
|
|
272
272
|
checkAccess(username, resourceType, resourceId);
|
|
273
273
|
// 1. Find direct user grants: principalType='user', principalId=username
|
|
@@ -282,7 +282,7 @@ checkAccess(username, resourceType, resourceId);
|
|
|
282
282
|
### Templates
|
|
283
283
|
|
|
284
284
|
```js
|
|
285
|
-
import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.
|
|
285
|
+
import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.2.0';
|
|
286
286
|
|
|
287
287
|
getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
|
|
288
288
|
// → {
|
|
@@ -861,14 +861,14 @@ On first startup, gatekeeper checks for legacy files:
|
|
|
861
861
|
|
|
862
862
|
### Panel-Server Refactoring
|
|
863
863
|
|
|
864
|
-
- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.
|
|
864
|
+
- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.2.0`)
|
|
865
865
|
- `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
|
|
866
866
|
- `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
|
|
867
867
|
- Tunnel creation/update routes → call gatekeeper for access mode changes
|
|
868
868
|
|
|
869
869
|
### Installer Updates (create-lamaste)
|
|
870
870
|
|
|
871
|
-
- Install `@lamalibre/lamaste-gatekeeper@4.
|
|
871
|
+
- Install `@lamalibre/lamaste-gatekeeper@4.2.0` package
|
|
872
872
|
- Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
|
|
873
873
|
- Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
|
|
874
874
|
- Create `lamalibre-lamaste-gatekeeper.service` systemd unit
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# Lamaste Identity Directory — Design Document
|
|
2
2
|
|
|
3
3
|
> **Status:** design, 2026-10-13. Nothing here is implemented yet.
|
|
4
|
-
> **Package:** `@lamalibre/lamaste-identity@4.
|
|
4
|
+
> **Package:** `@lamalibre/lamaste-identity@4.2.0` (completes the existing SDK).
|
|
5
5
|
> **Companions:** `gatekeeper-design.md` (authorization),
|
|
6
6
|
> `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
|
|
7
7
|
|
|
@@ -178,7 +178,7 @@ and compares it with the local projection (by `userId` and `version`). It
|
|
|
178
178
|
applies differences and logs how many it found — a non-zero count on a
|
|
179
179
|
healthy system is a bug in the change feed and is reported to the panel.
|
|
180
180
|
|
|
181
|
-
## SDK (`@lamalibre/lamaste-identity@4.
|
|
181
|
+
## SDK (`@lamalibre/lamaste-identity@4.2.0`)
|
|
182
182
|
|
|
183
183
|
Today's surface stays; three pieces are added.
|
|
184
184
|
|
package/vendor/docs/package.json
CHANGED
|
@@ -29,7 +29,7 @@ feria dev registry — OUT OF SCOPE, do not touch
|
|
|
29
29
|
|
|
30
30
|
### Naming Rules
|
|
31
31
|
|
|
32
|
-
- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.
|
|
32
|
+
- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.2.0'`. No `-lib` suffix.
|
|
33
33
|
- **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
|
|
34
34
|
- **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
|
|
35
35
|
- **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
|
|
@@ -74,24 +74,24 @@ lamaste core library (types, constants, schemas, pl
|
|
|
74
74
|
|
|
75
75
|
| # | Package (npm name) | Type | Depends on | Purpose |
|
|
76
76
|
| --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
|
|
77
|
-
| 1 | `@lamalibre/lamaste@4.
|
|
78
|
-
| | | | | Subpath: `@lamalibre/lamaste@4.
|
|
79
|
-
| | | | | Subpath: `@lamalibre/lamaste@4.
|
|
80
|
-
| 2 | `@lamalibre/lamaste-agent@4.
|
|
81
|
-
| 3 | `@lamalibre/lamaste-agentd@4.
|
|
82
|
-
| 4 | `@lamalibre/lamaste-agent-ui@4.
|
|
83
|
-
| 5 | `@lamalibre/lamaste-server@4.
|
|
84
|
-
| 6 | `@lamalibre/lamaste-serverd@4.
|
|
85
|
-
| 7 | `@lamalibre/lamaste-server-ui@4.
|
|
86
|
-
| 8 | `@lamalibre/lamaste@4.
|
|
87
|
-
| 9 | `@lamalibre/lamaste-cloud@4.
|
|
88
|
-
| 10 | `@lamalibre/lamaste-tickets@4.
|
|
89
|
-
| 11 | `@lamalibre/lamaste-identity@4.
|
|
90
|
-
| 12 | `@lamalibre/create-lamaste@4.
|
|
91
|
-
| 13 | `@lamalibre/create-lamaste-agent@4.
|
|
92
|
-
| 14 | `@lamalibre/create-lamaste-desktop@4.
|
|
93
|
-
| 15 | `@lamalibre/create-lamaste-admin@4.
|
|
94
|
-
| 16 | `@lamalibre/create-lamaste-e2e@4.
|
|
77
|
+
| 1 | `@lamalibre/lamaste@4.2.0` | core lib | nothing | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces |
|
|
78
|
+
| | | | | Subpath: `@lamalibre/lamaste@4.2.0/agent` — agent domain logic |
|
|
79
|
+
| | | | | Subpath: `@lamalibre/lamaste@4.2.0/server` — server domain logic |
|
|
80
|
+
| 2 | `@lamalibre/lamaste-agent@4.2.0` | CLI | `lamaste` | Thin agent CLI. No Fastify, no HTTP |
|
|
81
|
+
| 3 | `@lamalibre/lamaste-agentd@4.2.0` | daemon | `lamaste` | Agent REST API on :9393. No CLI argument parsing |
|
|
82
|
+
| 4 | `@lamalibre/lamaste-agent-ui@4.2.0` | UI lib | `lamaste` | Agent React components + browser SPA build. Used by desktop and agentd |
|
|
83
|
+
| 5 | `@lamalibre/lamaste-server@4.2.0` | CLI | `lamaste` | **NEW.** Thin server CLI. No Fastify, no HTTP |
|
|
84
|
+
| 6 | `@lamalibre/lamaste-serverd@4.2.0` | daemon | `lamaste` | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd` |
|
|
85
|
+
| 7 | `@lamalibre/lamaste-server-ui@4.2.0` | UI lib | `lamaste` | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel` |
|
|
86
|
+
| 8 | `@lamalibre/lamaste@4.2.0-desktop` | desktop | `lamaste` | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links |
|
|
87
|
+
| 9 | `@lamalibre/lamaste-cloud@4.2.0` | lib + CLI | — | Cloud provider abstraction (already correct pattern) |
|
|
88
|
+
| 10 | `@lamalibre/lamaste-tickets@4.2.0` | SDK | — | Agent-to-agent authorization |
|
|
89
|
+
| 11 | `@lamalibre/lamaste-identity@4.2.0` | SDK | — | Authelia identity parsing and query |
|
|
90
|
+
| 12 | `@lamalibre/create-lamaste@4.2.0` | provisioner | `lamaste` | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste` |
|
|
91
|
+
| 13 | `@lamalibre/create-lamaste-agent@4.2.0` | provisioner | `lamaste` | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
|
|
92
|
+
| 14 | `@lamalibre/create-lamaste-desktop@4.2.0` | installer | — | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop` |
|
|
93
|
+
| 15 | `@lamalibre/create-lamaste-admin@4.2.0` | provisioner | `lamaste` | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin` |
|
|
94
|
+
| 16 | `@lamalibre/create-lamaste-e2e@4.2.0` | test infra | — | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp` |
|
|
95
95
|
| 17 | `@lamalibre/feria` | dev tool | — | Dev registry + release runner. **Out of scope — do not touch in this refactor** |
|
|
96
96
|
|
|
97
97
|
### Rename Map (1.x → 2.0.0)
|
|
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
|
|
|
116
116
|
|
|
117
117
|
```json
|
|
118
118
|
{
|
|
119
|
-
"name": "@lamalibre/lamaste@4.
|
|
119
|
+
"name": "@lamalibre/lamaste@4.2.0",
|
|
120
120
|
"exports": {
|
|
121
121
|
".": "./dist/index.js",
|
|
122
122
|
"./agent": "./dist/agent/index.js",
|
|
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
|
|
|
126
126
|
```
|
|
127
127
|
|
|
128
128
|
```typescript
|
|
129
|
-
import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.
|
|
130
|
-
import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.
|
|
131
|
-
import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.
|
|
129
|
+
import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.2.0';
|
|
130
|
+
import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.2.0/agent';
|
|
131
|
+
import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.2.0/server';
|
|
132
132
|
```
|
|
133
133
|
|
|
134
134
|
**Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
|
|
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.1.0/server';
|
|
|
149
149
|
|
|
150
150
|
| Layer | Agent side | Server side |
|
|
151
151
|
| ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
|
|
152
|
-
| **Domain logic** | `@lamalibre/lamaste@4.
|
|
152
|
+
| **Domain logic** | `@lamalibre/lamaste@4.2.0/agent` | `@lamalibre/lamaste@4.2.0/server` |
|
|
153
153
|
| **Operational CLI** | `lamaste-agent` | `lamaste-server` (new) |
|
|
154
154
|
| **Long-running daemon** | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
|
|
155
155
|
| **UI components** | `lamaste-agent-ui` (renamed) | `lamaste-server-ui` (merged) |
|
|
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
|
|
|
471
471
|
|
|
472
472
|
Create `packages/lamaste/` (TypeScript) with subpath exports:
|
|
473
473
|
|
|
474
|
-
**Root (`@lamalibre/lamaste@4.
|
|
474
|
+
**Root (`@lamalibre/lamaste@4.2.0`):**
|
|
475
475
|
|
|
476
476
|
- Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
|
|
477
477
|
- Constants: Reserved API prefixes, curated plugin list, capability names
|
|
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
|
|
|
479
479
|
- Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
|
|
480
480
|
- File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
|
|
481
481
|
|
|
482
|
-
**Agent subpath (`@lamalibre/lamaste@4.
|
|
482
|
+
**Agent subpath (`@lamalibre/lamaste@4.2.0/agent`):**
|
|
483
483
|
|
|
484
484
|
- Platform: Path helpers, platform detection (from `platform.js`)
|
|
485
485
|
- Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
|
|
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
|
|
|
491
491
|
- Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
|
|
492
492
|
- Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
|
|
493
493
|
|
|
494
|
-
**Server subpath (`@lamalibre/lamaste@4.
|
|
494
|
+
**Server subpath (`@lamalibre/lamaste@4.2.0/server`):**
|
|
495
495
|
|
|
496
496
|
- Plugins: Server-side plugin lifecycle (uses shared schema from root)
|
|
497
497
|
- Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)
|