clawdlets 0.3.4 → 0.4.1

package/{node_modules → vendor}/@clawdlets/core/dist/lib/secrets-init.js

@@ -1,3 +1,5 @@
+import { SecretNameSchema } from "@clawdlets/shared/lib/identifiers";
+import { assertSafeRecordKey, createNullProtoRecord } from "./safe-record.js";
 function getCliFlagValue(argv, flagNames) {
     let found;
     for (let i = 0; i < argv.length; i++) {
@@ -59,33 +61,20 @@ export function listSecretsInitPlaceholders(params) {
     if (params.requiresTailscaleAuthKey && params.input.tailscaleAuthKey && isPlaceholderSecretValue(params.input.tailscaleAuthKey)) {
         out.add("tailscaleAuthKey");
     }
-    if (params.input.secrets && typeof params.input.secrets === "object") {
-        for (const [k, v] of Object.entries(params.input.secrets)) {
-            if (typeof v !== "string")
-                continue;
-            if (v && isPlaceholderSecretValue(v))
-                out.add(`secrets.${k}`);
-        }
-    }
-    const bots = Array.from(new Set(params.bots.map((b) => String(b).trim()).filter(Boolean)));
-    const discordBots = Array.from(new Set((params.discordBots ?? bots).map((b) => String(b).trim()).filter(Boolean)));
-    for (const b of discordBots) {
-        const v = params.input.discordTokens?.[b];
+    for (const [k, v] of Object.entries(params.input.secrets || {})) {
+        if (typeof v !== "string")
+            continue;
         if (v && isPlaceholderSecretValue(v))
-            out.add(`discordTokens.${b}`);
+            out.add(`secrets.${k}`);
     }
     return Array.from(out).sort();
 }
 export function buildSecretsInitTemplate(params) {
-    const bots = Array.from(new Set(params.bots.map((b) => String(b).trim()).filter(Boolean)));
-    const discordBots = Array.from(new Set((params.discordBots ?? bots).map((b) => String(b).trim()).filter(Boolean)));
-    const secrets = params.secrets && typeof params.secrets === "object" ? params.secrets : undefined;
-    const hasSecrets = secrets && Object.keys(secrets).length > 0;
+    const secrets = params.secrets && typeof params.secrets === "object" ? params.secrets : {};
     return {
         adminPasswordHash: "<REPLACE_WITH_YESCRYPT_HASH>",
         ...(params.requiresTailscaleAuthKey ? { tailscaleAuthKey: "<REPLACE_WITH_TSKEY_AUTH>" } : {}),
-        discordTokens: Object.fromEntries(discordBots.map((b) => [b, "<REPLACE_WITH_DISCORD_TOKEN>"])),
-        ...(hasSecrets ? { secrets } : {}),
+        secrets,
     };
 }
 export function parseSecretsInitJson(raw) {
@@ -102,30 +91,25 @@ export function parseSecretsInitJson(raw) {
     const adminPasswordHash = typeof obj.adminPasswordHash === "string" ? obj.adminPasswordHash.trim() : "";
     if (!adminPasswordHash)
         throw new Error("invalid --from-json (missing adminPasswordHash)");
-    if (!obj.discordTokens || typeof obj.discordTokens !== "object")
-        throw new Error("invalid --from-json (missing discordTokens object)");
-    const discordTokens = {};
-    for (const [k, v] of Object.entries(obj.discordTokens)) {
+    const tailscaleAuthKey = typeof obj.tailscaleAuthKey === "string" ? obj.tailscaleAuthKey.trim() : undefined;
+    if (!obj.secrets || typeof obj.secrets !== "object" || Array.isArray(obj.secrets)) {
+        throw new Error("invalid --from-json (missing secrets object)");
+    }
+    const secrets = createNullProtoRecord();
+    for (const [k, v] of Object.entries(obj.secrets)) {
         if (typeof v !== "string")
             continue;
         const token = v.trim();
         if (!token)
             continue;
-        discordTokens[String(k)] = token;
-    }
-    const tailscaleAuthKey = typeof obj.tailscaleAuthKey === "string" ? obj.tailscaleAuthKey.trim() : undefined;
-    const secrets = {};
-    if (obj.secrets && typeof obj.secrets === "object" && !Array.isArray(obj.secrets)) {
-        for (const [k, v] of Object.entries(obj.secrets)) {
-            if (typeof v !== "string")
-                continue;
-            const token = v.trim();
-            if (!token)
-                continue;
-            secrets[String(k)] = token;
-        }
+        const key = String(k || "").trim();
+        if (!key)
+            continue;
+        assertSafeRecordKey({ key, context: "secrets init json secrets" });
+        void SecretNameSchema.parse(key);
+        secrets[key] = token;
     }
-    return { adminPasswordHash, tailscaleAuthKey, discordTokens, ...(Object.keys(secrets).length > 0 ? { secrets } : {}) };
+    return { adminPasswordHash, tailscaleAuthKey, secrets };
 }
 export function validateSecretsInitNonInteractive(params) {
     if (params.interactive)

package/{node_modules → vendor}/@clawdlets/core/dist/lib/secrets-migrate.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { assertSafeSecretName } from "./identifiers.js";
+import { assertSafeSecretName } from "@clawdlets/shared/lib/identifiers";
 function assertPathWithinDir(rootDir, absPath) {
     const root = path.resolve(rootDir);
     const resolved = path.resolve(absPath);

package/vendor/@clawdlets/core/dist/lib/secrets-plan.d.ts

@@ -0,0 +1,172 @@
+import { z } from "zod";
+export declare const SECRET_KINDS: readonly ["env", "file", "extra"];
+export declare const SecretKindSchema: z.ZodEnum<{
+    env: "env";
+    file: "file";
+    extra: "extra";
+}>;
+export type SecretKind = z.infer<typeof SecretKindSchema>;
+export declare const SECRET_SCOPES: readonly ["host", "bot"];
+export declare const SecretScopeSchema: z.ZodEnum<{
+    host: "host";
+    bot: "bot";
+}>;
+export type SecretScope = z.infer<typeof SecretScopeSchema>;
+export declare const SECRET_SOURCES: readonly ["channel", "model", "provider", "custom"];
+export declare const SecretSourceSchema: z.ZodEnum<{
+    custom: "custom";
+    channel: "channel";
+    model: "model";
+    provider: "provider";
+}>;
+export type SecretSource = z.infer<typeof SecretSourceSchema>;
+export declare const SecretSpecSchema: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        env: "env";
+        file: "file";
+        extra: "extra";
+    }>;
+    scope: z.ZodEnum<{
+        host: "host";
+        bot: "bot";
+    }>;
+    source: z.ZodEnum<{
+        custom: "custom";
+        channel: "channel";
+        model: "model";
+        provider: "provider";
+    }>;
+    optional: z.ZodOptional<z.ZodBoolean>;
+    help: z.ZodOptional<z.ZodString>;
+    envVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    bots: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    fileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretSpec = z.infer<typeof SecretSpecSchema>;
+export declare const MissingSecretConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"envVar">;
+    bot: z.ZodString;
+    envVar: z.ZodString;
+    sources: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        custom: "custom";
+        channel: "channel";
+        model: "model";
+        provider: "provider";
+    }>>>;
+    paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"secretFile">;
+    scope: z.ZodEnum<{
+        host: "host";
+        bot: "bot";
+    }>;
+    bot: z.ZodOptional<z.ZodString>;
+    fileId: z.ZodString;
+    targetPath: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type MissingSecretConfig = z.infer<typeof MissingSecretConfigSchema>;
+export declare const SecretsPlanWarningSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        config: "config";
+        inlineToken: "inlineToken";
+        inlineApiKey: "inlineApiKey";
+        statefulChannel: "statefulChannel";
+        auth: "auth";
+    }>;
+    message: z.ZodString;
+    path: z.ZodOptional<z.ZodString>;
+    suggestion: z.ZodOptional<z.ZodString>;
+    channel: z.ZodOptional<z.ZodString>;
+    provider: z.ZodOptional<z.ZodString>;
+    bot: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretsPlanWarning = z.infer<typeof SecretsPlanWarningSchema>;
+export declare const SecretsPlanSchema: z.ZodObject<{
+    required: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            env: "env";
+            file: "file";
+            extra: "extra";
+        }>;
+        scope: z.ZodEnum<{
+            host: "host";
+            bot: "bot";
+        }>;
+        source: z.ZodEnum<{
+            custom: "custom";
+            channel: "channel";
+            model: "model";
+            provider: "provider";
+        }>;
+        optional: z.ZodOptional<z.ZodBoolean>;
+        help: z.ZodOptional<z.ZodString>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bots: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        fileId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    optional: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            env: "env";
+            file: "file";
+            extra: "extra";
+        }>;
+        scope: z.ZodEnum<{
+            host: "host";
+            bot: "bot";
+        }>;
+        source: z.ZodEnum<{
+            custom: "custom";
+            channel: "channel";
+            model: "model";
+            provider: "provider";
+        }>;
+        optional: z.ZodOptional<z.ZodBoolean>;
+        help: z.ZodOptional<z.ZodString>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bots: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        fileId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    missing: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"envVar">;
+        bot: z.ZodString;
+        envVar: z.ZodString;
+        sources: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            custom: "custom";
+            channel: "channel";
+            model: "model";
+            provider: "provider";
+        }>>>;
+        paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"secretFile">;
+        scope: z.ZodEnum<{
+            host: "host";
+            bot: "bot";
+        }>;
+        bot: z.ZodOptional<z.ZodString>;
+        fileId: z.ZodString;
+        targetPath: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strict>], "kind">>>;
+    warnings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            config: "config";
+            inlineToken: "inlineToken";
+            inlineApiKey: "inlineApiKey";
+            statefulChannel: "statefulChannel";
+            auth: "auth";
+        }>;
+        message: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+        suggestion: z.ZodOptional<z.ZodString>;
+        channel: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
+        bot: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type SecretsPlan = z.infer<typeof SecretsPlanSchema>;
+//# sourceMappingURL=secrets-plan.d.ts.map

package/vendor/@clawdlets/core/dist/lib/secrets-plan.js

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import { BotIdSchema, EnvVarNameSchema, SecretNameSchema } from "@clawdlets/shared/lib/identifiers";
+export const SECRET_KINDS = ["env", "file", "extra"];
+export const SecretKindSchema = z.enum(SECRET_KINDS);
+export const SECRET_SCOPES = ["host", "bot"];
+export const SecretScopeSchema = z.enum(SECRET_SCOPES);
+export const SECRET_SOURCES = ["channel", "model", "provider", "custom"];
+export const SecretSourceSchema = z.enum(SECRET_SOURCES);
+export const SecretSpecSchema = z
+    .object({
+    name: SecretNameSchema,
+    kind: SecretKindSchema,
+    scope: SecretScopeSchema,
+    source: SecretSourceSchema,
+    optional: z.boolean().optional(),
+    help: z.string().trim().optional(),
+    envVars: z.array(EnvVarNameSchema).optional(),
+    bots: z.array(BotIdSchema).optional(),
+    fileId: z.string().trim().optional(),
+})
+    .strict();
+export const MissingSecretConfigSchema = z.discriminatedUnion("kind", [
+    z
+        .object({
+        kind: z.literal("envVar"),
+        bot: BotIdSchema,
+        envVar: EnvVarNameSchema,
+        sources: z.array(SecretSourceSchema).default(() => []),
+        paths: z.array(z.string().trim()).default(() => []),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("secretFile"),
+        scope: SecretScopeSchema,
+        bot: BotIdSchema.optional(),
+        fileId: z.string().trim().min(1),
+        targetPath: z.string().trim().min(1),
+        message: z.string().trim().min(1),
+    })
+        .strict(),
+]);
+export const SecretsPlanWarningSchema = z
+    .object({
+    kind: z.enum(["inlineToken", "inlineApiKey", "statefulChannel", "config", "auth"]),
+    message: z.string().trim().min(1),
+    path: z.string().trim().optional(),
+    suggestion: z.string().trim().optional(),
+    channel: z.string().trim().optional(),
+    provider: z.string().trim().optional(),
+    bot: BotIdSchema.optional(),
+})
+    .strict();
+export const SecretsPlanSchema = z
+    .object({
+    required: z.array(SecretSpecSchema).default(() => []),
+    optional: z.array(SecretSpecSchema).default(() => []),
+    missing: z.array(MissingSecretConfigSchema).default(() => []),
+    warnings: z.array(SecretsPlanWarningSchema).default(() => []),
+})
+    .strict();
+//# sourceMappingURL=secrets-plan.js.map

package/vendor/@clawdlets/core/dist/lib/ssh-files.d.ts

@@ -0,0 +1,3 @@
+export declare function readSshPublicKeysFromFile(filePath: string): string[];
+export declare function readKnownHostsFromFile(filePath: string): string[];
+//# sourceMappingURL=ssh-files.d.ts.map

package/vendor/@clawdlets/core/dist/lib/ssh-files.js

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import { looksLikeSshPrivateKey, parseSshPublicKeysFromText } from "./ssh.js";
+export function readSshPublicKeysFromFile(filePath) {
+    const stat = fs.statSync(filePath);
+    if (!stat.isFile())
+        throw new Error(`not a file: ${filePath}`);
+    if (stat.size > 64 * 1024)
+        throw new Error(`ssh key file too large (>64KB): ${filePath}`);
+    const raw = fs.readFileSync(filePath, "utf8");
+    if (looksLikeSshPrivateKey(raw)) {
+        throw new Error(`refusing to read ssh private key (expected .pub): ${filePath}`);
+    }
+    const keys = parseSshPublicKeysFromText(raw);
+    if (keys.length === 0)
+        throw new Error(`no ssh public keys found in file: ${filePath}`);
+    return keys;
+}
+export function readKnownHostsFromFile(filePath) {
+    const stat = fs.statSync(filePath);
+    if (!stat.isFile())
+        throw new Error(`not a file: ${filePath}`);
+    if (stat.size > 256 * 1024)
+        throw new Error(`known_hosts file too large (>256KB): ${filePath}`);
+    const raw = fs.readFileSync(filePath, "utf8");
+    const lines = raw
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith("#"));
+    if (lines.length === 0)
+        throw new Error(`no known_hosts entries found in file: ${filePath}`);
+    return lines;
+}
+//# sourceMappingURL=ssh-files.js.map

package/{node_modules → vendor}/@clawdlets/core/dist/lib/template-source.js

@@ -23,8 +23,9 @@ export function normalizeTemplatePath(input) {
 }
 export function normalizeTemplateRef(input) {
     const trimmed = requireValue("template ref", input);
-    if (!/^[0-9a-f]{40}$/.test(trimmed)) {
-        throw new Error(`template ref must be full 40-hex sha (got: ${trimmed})`);
+    // Allow branch names (main, master, feature/x), tags (v1.0.0), or full 40-hex SHA
+    if (!/^[A-Za-z0-9_./\-]+$/.test(trimmed)) {
+        throw new Error(`template ref must be a valid git ref (branch, tag, or SHA) (got: ${trimmed})`);
     }
     return trimmed;
 }

package/vendor/@clawdlets/core/dist/lib/yaml-scalar.d.ts

@@ -0,0 +1,10 @@
+export declare function upsertYamlScalarLine(params: {
+    text: string;
+    key: string;
+    value: string;
+}): string;
+export declare function readYamlScalarFromMapping(params: {
+    yamlText: string;
+    key: string;
+}): string | null;
+//# sourceMappingURL=yaml-scalar.d.ts.map

package/{node_modules → vendor}/@clawdlets/core/dist/lib/yaml-scalar.js

@@ -1,4 +1,21 @@
 import YAML from "yaml";
+function quoteYamlString(value) {
+    return `"${value
+        .replace(/\\/g, "\\\\")
+        .replace(/\r/g, "\\r")
+        .replace(/\n/g, "\\n")
+        .replace(/\t/g, "\\t")
+        .replace(/"/g, '\\"')}"`;
+}
+export function upsertYamlScalarLine(params) {
+    const { text, key, value } = params;
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const rx = new RegExp(`^\\s*${escaped}\\s*:\\s*.*$`, "m");
+    const line = `${key}: ${quoteYamlString(value)}`;
+    if (rx.test(text))
+        return text.replace(rx, line);
+    return `${text.trimEnd()}\n${line}\n`;
+}
 export function readYamlScalarFromMapping(params) {
     const key = String(params.key || "").trim();
     if (!key)

package/{node_modules → vendor}/@clawdlets/core/dist/repo-layout.d.ts

@@ -8,6 +8,9 @@ export type RepoLayout = {
     opentofuDir: string;
     pluginsDir: string;
     fleetDir: string;
+    fleetWorkspacesDir: string;
+    fleetWorkspacesCommonDir: string;
+    fleetWorkspacesBotsDir: string;
     clawdletsConfigPath: string;
     bundledSkillsPath: string;
     secretsDir: string;
@@ -21,6 +24,7 @@ export type RepoLayout = {
 };
 export declare function getRepoLayout(repoRoot: string, runtimeDir?: string): RepoLayout;
 export declare function getHostOpenTofuDir(layout: RepoLayout, host: string): string;
+export declare function getBotWorkspaceDir(layout: RepoLayout, botId: string): string;
 export declare function getHostSecretsDir(layout: RepoLayout, host: string): string;
 export declare function getHostSecretFile(layout: RepoLayout, host: string, secretName: string): string;
 export declare function getHostExtraFilesDir(layout: RepoLayout, host: string): string;

package/{node_modules → vendor}/@clawdlets/core/dist/repo-layout.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { assertSafeHostName, assertSafeOperatorId, assertSafeSecretName } from "./lib/identifiers.js";
+import { assertSafeHostName, assertSafeOperatorId, assertSafeSecretName, BotIdSchema } from "@clawdlets/shared/lib/identifiers";
 export function getRepoLayout(repoRoot, runtimeDir) {
     const resolvedRuntimeDir = runtimeDir ?? path.join(repoRoot, ".clawdlets");
     const envFilePath = path.join(resolvedRuntimeDir, "env");
@@ -9,6 +9,9 @@ export function getRepoLayout(repoRoot, runtimeDir) {
     const opentofuDir = path.join(runtimeInfraDir, "opentofu");
     const pluginsDir = path.join(resolvedRuntimeDir, "plugins");
     const fleetDir = path.join(repoRoot, "fleet");
+    const fleetWorkspacesDir = path.join(fleetDir, "workspaces");
+    const fleetWorkspacesCommonDir = path.join(fleetWorkspacesDir, "common");
+    const fleetWorkspacesBotsDir = path.join(fleetWorkspacesDir, "bots");
     const clawdletsConfigPath = path.join(fleetDir, "clawdlets.json");
     const bundledSkillsPath = path.join(fleetDir, "bundled-skills.json");
     const secretsDir = path.join(repoRoot, "secrets");
@@ -29,6 +32,9 @@ export function getRepoLayout(repoRoot, runtimeDir) {
         opentofuDir,
         pluginsDir,
         fleetDir,
+        fleetWorkspacesDir,
+        fleetWorkspacesCommonDir,
+        fleetWorkspacesBotsDir,
         clawdletsConfigPath,
         bundledSkillsPath,
         secretsDir,
@@ -45,6 +51,10 @@ export function getHostOpenTofuDir(layout, host) {
     assertSafeHostName(host);
     return path.join(layout.opentofuDir, host);
 }
+export function getBotWorkspaceDir(layout, botId) {
+    void BotIdSchema.parse(botId);
+    return path.join(layout.fleetWorkspacesBotsDir, botId);
+}
 export function getHostSecretsDir(layout, host) {
     assertSafeHostName(host);
     return path.join(layout.secretsHostsDir, host);

package/{node_modules → vendor}/@clawdlets/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawdlets/core",
-  "version": "0.3.4",
+  "version": "0.4.1",
   "private": true,
   "type": "module",
   "exports": {
@@ -24,7 +24,11 @@
     "coverage": "vitest run --coverage"
   },
   "dependencies": {
+    "@clawdlets/cattle-core": "file:../cattle-core",
+    "@clawdlets/shared": "file:../shared",
+    "ajv": "^8.17.1",
     "dotenv": "^17.2.3",
+    "giget": "^2.0.0",
     "zod": "^4.3.5",
     "yaml": "^2.8.0"
   },