clawdlets 0.3.4 → 0.4.1

package/vendor/@clawdlets/core/dist/lib/fleet-secrets-plan.js

@@ -0,0 +1,418 @@
+import { findEnvVarRefs } from "./env-var-refs.js";
+import { applyChannelEnvRequirements, applyHookEnvRequirements, applySkillEnvRequirements, ENV_VAR_HELP, buildBaseSecretEnv, buildDerivedSecretEnv, buildEnvVarAliasMap, canonicalizeEnvVar, collectBotModels, collectDerivedSecretEnvEntries, extractEnvVarRef, isPlainObject, isWhatsAppEnabled, normalizeSecretFiles, normalizeEnvVarPaths, pickPrimarySource, recordSecretSpec, } from "./fleet-secrets-plan-helpers.js";
+import { getLlmProviderFromModelId, getProviderAuthMode, getProviderCredentials, } from "@clawdlets/shared/lib/llm-provider-env";
+const isUnsafeTargetPath = (targetPath) => targetPath.includes("/../") || targetPath.endsWith("/..") || targetPath.includes("\u0000");
+export function buildFleetSecretsPlan(params) {
+    const hostName = params.hostName.trim();
+    const hostCfg = params.config.hosts?.[hostName];
+    if (!hostCfg)
+        throw new Error(`missing host in config.hosts: ${hostName}`);
+    const bots = params.config.fleet.botOrder || [];
+    const botConfigs = (params.config.fleet.bots || {});
+    const secretNamesAll = new Set();
+    const secretNamesRequired = new Set();
+    const missingSecretConfig = [];
+    const warnings = [];
+    const secretSpecs = new Map();
+    const secretEnvMetaByName = new Map();
+    const envVarHelpOverrides = new Map();
+    const hostSecretNamesRequired = new Set(["admin_password_hash"]);
+    const tailnetMode = String(hostCfg?.tailnet?.mode || "none");
+    if (tailnetMode === "tailscale")
+        hostSecretNamesRequired.add("tailscale_auth_key");
+    const garnixPrivate = hostCfg?.cache?.garnix?.private;
+    if (garnixPrivate?.enable) {
+        const secretName = String(garnixPrivate?.netrcSecret || "garnix_netrc").trim();
+        if (secretName)
+            hostSecretNamesRequired.add(secretName);
+    }
+    const resticEnabled = Boolean(params.config.fleet.backups?.restic?.enable);
+    if (resticEnabled)
+        hostSecretNamesRequired.add("restic_password");
+    for (const secretName of hostSecretNamesRequired) {
+        recordSecretSpec(secretSpecs, {
+            name: secretName,
+            kind: "extra",
+            scope: "host",
+            source: "custom",
+            optional: false,
+        });
+    }
+    const byBot = {};
+    const hostSecretFiles = normalizeSecretFiles(params.config.fleet?.secretFiles);
+    for (const [fileId, spec] of Object.entries(hostSecretFiles)) {
+        if (!spec?.secretName)
+            continue;
+        secretNamesAll.add(spec.secretName);
+        secretNamesRequired.add(spec.secretName);
+        recordSecretSpec(secretSpecs, {
+            name: spec.secretName,
+            kind: "file",
+            scope: "host",
+            source: "custom",
+            optional: false,
+            fileId,
+        });
+        const targetPath = String(spec.targetPath || "");
+        if (isUnsafeTargetPath(targetPath)) {
+            missingSecretConfig.push({
+                kind: "secretFile",
+                scope: "host",
+                fileId,
+                targetPath,
+                message: "fleet.secretFiles targetPath must not contain /../, end with /.., or include NUL",
+            });
+            continue;
+        }
+        if (!targetPath.startsWith("/var/lib/clawdlets/")) {
+            missingSecretConfig.push({
+                kind: "secretFile",
+                scope: "host",
+                fileId,
+                targetPath,
+                message: "fleet.secretFiles targetPath must be under /var/lib/clawdlets/",
+            });
+        }
+    }
+    const fleetSecretEnv = params.config.fleet?.secretEnv;
+    const recordSecretEnvMeta = (secretName, envVar, bot) => {
+        if (!secretName)
+            return;
+        const existing = secretEnvMetaByName.get(secretName);
+        if (!existing) {
+            secretEnvMetaByName.set(secretName, {
+                envVars: new Set(envVar ? [envVar] : []),
+                bots: new Set(bot ? [bot] : []),
+            });
+            return;
+        }
+        if (envVar)
+            existing.envVars.add(envVar);
+        if (bot)
+            existing.bots.add(bot);
+    };
+    const envVarAliasMap = buildEnvVarAliasMap();
+    for (const bot of bots) {
+        const botCfg = botConfigs?.[bot] || {};
+        const profile = botCfg?.profile || {};
+        const clawdbot = botCfg?.clawdbot || {};
+        const baseSecretEnv = buildBaseSecretEnv({
+            globalEnv: fleetSecretEnv,
+            botEnv: profile?.secretEnv,
+            aliasMap: envVarAliasMap,
+            warnings,
+            bot,
+        });
+        const derivedEntries = collectDerivedSecretEnvEntries(profile);
+        const derivedSecretEnv = buildDerivedSecretEnv(profile);
+        const secretEnv = { ...baseSecretEnv, ...derivedSecretEnv };
+        const derivedDupes = derivedEntries
+            .map((entry) => entry.envVar)
+            .filter((envVar) => Object.prototype.hasOwnProperty.call(baseSecretEnv, envVar));
+        for (const entry of derivedEntries) {
+            if (entry.help && !envVarHelpOverrides.has(entry.envVar)) {
+                envVarHelpOverrides.set(entry.envVar, entry.help);
+            }
+        }
+        if (derivedDupes.length > 0) {
+            warnings.push({
+                kind: "config",
+                bot,
+                message: `secretEnv conflicts with derived hooks/skill env vars: ${derivedDupes.join(",")}`,
+            });
+        }
+        for (const [envVar, secretNameRaw] of Object.entries(secretEnv)) {
+            const secretName = String(secretNameRaw || "").trim();
+            if (!secretName)
+                continue;
+            secretNamesAll.add(secretName);
+            recordSecretEnvMeta(secretName, envVar, bot);
+        }
+        const envVarRefsRaw = findEnvVarRefs(clawdbot);
+        const envVarPathsByVar = {};
+        for (const [envVar, paths] of Object.entries(envVarRefsRaw.pathsByVar)) {
+            const canonical = canonicalizeEnvVar(envVar, envVarAliasMap);
+            if (!canonical)
+                continue;
+            envVarPathsByVar[canonical] = (envVarPathsByVar[canonical] || []).concat(paths);
+        }
+        const envVarRefs = {
+            vars: Object.keys(envVarPathsByVar).sort(),
+            pathsByVar: envVarPathsByVar,
+        };
+        const requiredEnvBySource = new Map();
+        const addRequiredEnv = (envVar, source, path) => {
+            const key = canonicalizeEnvVar(envVar, envVarAliasMap);
+            if (!key)
+                return;
+            const set = requiredEnvBySource.get(key) ?? new Set();
+            set.add(source);
+            requiredEnvBySource.set(key, set);
+            if (path) {
+                envVarPathsByVar[key] = envVarPathsByVar[key] || [];
+                envVarPathsByVar[key].push(path);
+            }
+        };
+        for (const envVar of envVarRefs.vars)
+            addRequiredEnv(envVar, "custom");
+        for (const entry of derivedEntries)
+            addRequiredEnv(entry.envVar, "custom", entry.path);
+        applyChannelEnvRequirements({ bot, clawdbot, warnings, addRequiredEnv });
+        applyHookEnvRequirements({ bot, clawdbot, warnings, addRequiredEnv });
+        applySkillEnvRequirements({ bot, clawdbot, warnings, addRequiredEnv, envVarHelpOverrides });
+        const models = collectBotModels({ clawdbot, hostDefaultModel: String(hostCfg.agentModelPrimary || "") });
+        const providersFromModels = new Set();
+        for (const model of models) {
+            const provider = getLlmProviderFromModelId(model);
+            if (provider)
+                providersFromModels.add(provider);
+        }
+        const providersFromConfig = new Set();
+        const providers = clawdbot?.models?.providers;
+        if (isPlainObject(providers)) {
+            for (const [providerIdRaw, providerCfg] of Object.entries(providers)) {
+                const providerId = String(providerIdRaw || "").trim();
+                if (!providerId)
+                    continue;
+                providersFromConfig.add(providerId);
+                if (!isPlainObject(providerCfg))
+                    continue;
+                const apiKey = providerCfg.apiKey;
+                if (typeof apiKey === "string") {
+                    const envVar = extractEnvVarRef(apiKey);
+                    if (envVar) {
+                        addRequiredEnv(envVar, "provider", `models.providers.${providerId}.apiKey`);
+                    }
+                    else if (apiKey.trim()) {
+                        const known = getProviderCredentials(providerId)
+                            .map((slot) => slot.anyOfEnv[0])
+                            .filter(Boolean);
+                        const suggested = known.length === 1 ? `\${${known[0]}}` : "\${PROVIDER_API_KEY}";
+                        warnings.push({
+                            kind: "inlineApiKey",
+                            path: `models.providers.${providerId}.apiKey`,
+                            bot,
+                            message: `Inline API key detected at models.providers.${providerId}.apiKey`,
+                            suggestion: `Replace with ${suggested} and wire it in fleet.secretEnv or fleet.bots.${bot}.profile.secretEnv.`,
+                        });
+                    }
+                }
+            }
+        }
+        const usedProviders = new Set([...providersFromModels, ...providersFromConfig]);
+        const hasMappingForAnyOf = (anyOfEnv) => {
+            for (const envVar of anyOfEnv) {
+                const canonical = canonicalizeEnvVar(envVar, envVarAliasMap);
+                if (!canonical)
+                    continue;
+                if (secretEnv[canonical])
+                    return true;
+            }
+            return false;
+        };
+        for (const provider of usedProviders) {
+            const auth = getProviderAuthMode(provider);
+            const credentials = getProviderCredentials(provider);
+            const sourcesForProvider = [];
+            if (providersFromModels.has(provider))
+                sourcesForProvider.push("model");
+            if (providersFromConfig.has(provider))
+                sourcesForProvider.push("provider");
+            if (credentials.length === 0) {
+                if (auth === "oauth") {
+                    warnings.push({
+                        kind: "auth",
+                        provider,
+                        bot,
+                        message: `Provider ${provider} requires OAuth login (no env vars required).`,
+                    });
+                }
+                continue;
+            }
+            let hasAnyMapping = false;
+            for (const slot of credentials) {
+                if (slot.anyOfEnv.length === 0)
+                    continue;
+                const canonical = slot.anyOfEnv[0];
+                const mapped = hasMappingForAnyOf(slot.anyOfEnv);
+                if (mapped) {
+                    hasAnyMapping = true;
+                }
+                if (auth === "apiKey") {
+                    for (const source of sourcesForProvider)
+                        addRequiredEnv(canonical, source);
+                }
+                else if (auth === "mixed" && mapped) {
+                    for (const source of sourcesForProvider)
+                        addRequiredEnv(canonical, source);
+                }
+            }
+            if ((auth === "oauth" || auth === "mixed") && !hasAnyMapping) {
+                warnings.push({
+                    kind: "auth",
+                    provider,
+                    bot,
+                    message: auth === "mixed"
+                        ? `Provider ${provider} supports OAuth or API key; no env wiring found (manual login required).`
+                        : `Provider ${provider} requires OAuth login (no env wiring found).`,
+                });
+            }
+        }
+        const whatsappEnabled = isWhatsAppEnabled(clawdbot);
+        if (whatsappEnabled) {
+            warnings.push({
+                kind: "statefulChannel",
+                channel: "whatsapp",
+                bot,
+                message: "WhatsApp enabled; requires stateful login on the gateway host.",
+            });
+        }
+        normalizeEnvVarPaths(envVarPathsByVar);
+        const envVarsRequired = Array.from(requiredEnvBySource.keys()).sort();
+        const envVarToSecretName = {};
+        for (const envVar of envVarsRequired) {
+            const secretName = String(secretEnv[envVar] || "").trim();
+            const sources = requiredEnvBySource.get(envVar) ?? new Set();
+            if (!secretName) {
+                missingSecretConfig.push({
+                    kind: "envVar",
+                    bot,
+                    envVar,
+                    sources: Array.from(sources).sort(),
+                    paths: envVarPathsByVar[envVar] || [],
+                });
+                continue;
+            }
+            envVarToSecretName[envVar] = secretName;
+            secretNamesRequired.add(secretName);
+            const help = envVarHelpOverrides.get(envVar) ?? ENV_VAR_HELP[envVar];
+            recordSecretSpec(secretSpecs, {
+                name: secretName,
+                kind: "env",
+                scope: "bot",
+                source: pickPrimarySource(sources),
+                optional: false,
+                envVar,
+                bot,
+                help,
+            });
+        }
+        const botSecretFiles = normalizeSecretFiles(profile?.secretFiles);
+        for (const [fileId, spec] of Object.entries(botSecretFiles)) {
+            if (!spec?.secretName)
+                continue;
+            secretNamesAll.add(spec.secretName);
+            secretNamesRequired.add(spec.secretName);
+            recordSecretSpec(secretSpecs, {
+                name: spec.secretName,
+                kind: "file",
+                scope: "bot",
+                source: "custom",
+                optional: false,
+                bot,
+                fileId,
+            });
+            const expectedPrefix = `/var/lib/clawdlets/secrets/bots/${bot}/`;
+            const targetPath = String(spec.targetPath || "");
+            if (isUnsafeTargetPath(targetPath)) {
+                missingSecretConfig.push({
+                    kind: "secretFile",
+                    scope: "bot",
+                    bot,
+                    fileId,
+                    targetPath,
+                    message: `fleet.bots.${bot}.profile.secretFiles targetPath must not contain /../, end with /.., or include NUL`,
+                });
+                continue;
+            }
+            if (!targetPath.startsWith(expectedPrefix)) {
+                missingSecretConfig.push({
+                    kind: "secretFile",
+                    scope: "bot",
+                    bot,
+                    fileId,
+                    targetPath,
+                    message: `fleet.bots.${bot}.profile.secretFiles targetPath must be under ${expectedPrefix}`,
+                });
+            }
+        }
+        const statefulChannels = whatsappEnabled ? ["whatsapp"] : [];
+        byBot[bot] = {
+            envVarsRequired,
+            envVarRefs,
+            secretEnv,
+            envVarToSecretName,
+            secretFiles: botSecretFiles,
+            statefulChannels,
+        };
+    }
+    for (const secretName of secretNamesAll) {
+        if (secretNamesRequired.has(secretName))
+            continue;
+        const meta = secretEnvMetaByName.get(secretName);
+        if (!meta) {
+            recordSecretSpec(secretSpecs, {
+                name: secretName,
+                kind: "env",
+                scope: "bot",
+                source: "custom",
+                optional: true,
+            });
+            continue;
+        }
+        for (const envVar of meta.envVars) {
+            const help = envVarHelpOverrides.get(envVar) ?? ENV_VAR_HELP[envVar];
+            recordSecretSpec(secretSpecs, {
+                name: secretName,
+                kind: "env",
+                scope: "bot",
+                source: "custom",
+                optional: true,
+                envVar,
+                help,
+            });
+        }
+        for (const botId of meta.bots) {
+            recordSecretSpec(secretSpecs, {
+                name: secretName,
+                kind: "env",
+                scope: "bot",
+                source: "custom",
+                optional: true,
+                bot: botId,
+            });
+        }
+    }
+    const specList = Array.from(secretSpecs.values()).map((spec) => {
+        const envVars = Array.from(spec.envVars).sort();
+        const bots = Array.from(spec.bots).sort();
+        return {
+            name: spec.name,
+            kind: spec.kind,
+            scope: spec.scope,
+            source: pickPrimarySource(spec.sources),
+            optional: spec.optional || undefined,
+            help: spec.help,
+            envVars: envVars.length ? envVars : undefined,
+            bots: bots.length ? bots : undefined,
+            fileId: spec.fileId,
+        };
+    });
+    const byName = (a, b) => a.name.localeCompare(b.name);
+    const required = specList.filter((spec) => !spec.optional).sort(byName);
+    const optional = specList.filter((spec) => spec.optional).sort(byName);
+    return {
+        bots,
+        hostSecretNamesRequired: Array.from(hostSecretNamesRequired).sort(),
+        secretNamesAll: Array.from(secretNamesAll).sort(),
+        secretNamesRequired: Array.from(secretNamesRequired).sort(),
+        required,
+        optional,
+        missing: missingSecretConfig,
+        warnings,
+        missingSecretConfig,
+        byBot,
+        hostSecretFiles,
+    };
+}
+//# sourceMappingURL=fleet-secrets-plan.js.map

package/vendor/@clawdlets/core/dist/lib/fleet-workspaces.d.ts

@@ -0,0 +1,8 @@
+export declare const FLEET_WORKSPACE_MANAGED_DOCS: readonly ["AGENTS.md", "SOUL.md", "IDENTITY.md", "TOOLS.md", "USER.md", "HEARTBEAT.md"];
+export type FleetWorkspaceManagedDoc = (typeof FLEET_WORKSPACE_MANAGED_DOCS)[number];
+export declare const FLEET_WORKSPACE_OPTIONAL_DOCS: readonly ["BOOT.md", "BOOTSTRAP.md", "MEMORY.md"];
+export type FleetWorkspaceOptionalDoc = (typeof FLEET_WORKSPACE_OPTIONAL_DOCS)[number];
+export declare const FLEET_WORKSPACE_EDITABLE_DOCS: readonly ["AGENTS.md", "SOUL.md", "IDENTITY.md", "TOOLS.md", "USER.md", "HEARTBEAT.md", "BOOT.md", "BOOTSTRAP.md", "MEMORY.md"];
+export type FleetWorkspaceEditableDoc = (typeof FLEET_WORKSPACE_EDITABLE_DOCS)[number];
+export declare function isFleetWorkspaceEditableDoc(name: string): name is FleetWorkspaceEditableDoc;
+//# sourceMappingURL=fleet-workspaces.d.ts.map

package/vendor/@clawdlets/core/dist/lib/fleet-workspaces.js

@@ -0,0 +1,17 @@
+export const FLEET_WORKSPACE_MANAGED_DOCS = [
+    "AGENTS.md",
+    "SOUL.md",
+    "IDENTITY.md",
+    "TOOLS.md",
+    "USER.md",
+    "HEARTBEAT.md",
+];
+export const FLEET_WORKSPACE_OPTIONAL_DOCS = ["BOOT.md", "BOOTSTRAP.md", "MEMORY.md"];
+export const FLEET_WORKSPACE_EDITABLE_DOCS = [
+    ...FLEET_WORKSPACE_MANAGED_DOCS,
+    ...FLEET_WORKSPACE_OPTIONAL_DOCS,
+];
+export function isFleetWorkspaceEditableDoc(name) {
+    return FLEET_WORKSPACE_EDITABLE_DOCS.includes(name);
+}
+//# sourceMappingURL=fleet-workspaces.js.map

package/vendor/@clawdlets/core/dist/lib/object-path.d.ts

@@ -0,0 +1,4 @@
+export declare function getAtPath(obj: unknown, parts: string[]): unknown;
+export declare function setAtPath(obj: any, parts: string[], value: unknown): void;
+export declare function deleteAtPath(obj: any, parts: string[]): boolean;
+//# sourceMappingURL=object-path.d.ts.map

package/vendor/@clawdlets/core/dist/lib/object-path.js

@@ -0,0 +1,55 @@
+const DISALLOWED_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+function assertSafeParts(parts) {
+    if (parts.length === 0)
+        throw new Error("empty path");
+    for (const part of parts) {
+        const p = part.trim();
+        if (!p)
+            throw new Error("empty path segment");
+        if (DISALLOWED_SEGMENTS.has(p))
+            throw new Error(`invalid path segment: ${p}`);
+    }
+}
+export function getAtPath(obj, parts) {
+    assertSafeParts(parts);
+    let cur = obj;
+    for (const k of parts) {
+        if (cur == null || typeof cur !== "object")
+            return undefined;
+        cur = cur[k];
+    }
+    return cur;
+}
+export function setAtPath(obj, parts, value) {
+    assertSafeParts(parts);
+    let cur = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const k = parts[i];
+        if (cur == null || typeof cur !== "object")
+            throw new Error("cannot set path on non-object");
+        if (cur[k] == null || typeof cur[k] !== "object" || Array.isArray(cur[k]))
+            cur[k] = {};
+        cur = cur[k];
+    }
+    const last = parts[parts.length - 1];
+    if (cur == null || typeof cur !== "object")
+        throw new Error("cannot set path on non-object");
+    cur[last] = value;
+}
+export function deleteAtPath(obj, parts) {
+    assertSafeParts(parts);
+    let cur = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const k = parts[i];
+        if (cur == null || typeof cur !== "object")
+            return false;
+        cur = cur[k];
+    }
+    const last = parts[parts.length - 1];
+    if (cur && typeof cur === "object" && Object.prototype.hasOwnProperty.call(cur, last)) {
+        delete cur[last];
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=object-path.js.map

package/{node_modules → vendor}/@clawdlets/core/dist/lib/opentofu.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { ensureHcloudSshKeyId } from "./hcloud.js";
+import { ensureHcloudSshKeyId } from "@clawdlets/cattle-core/lib/hcloud";
 import { run } from "./run.js";
 import { withFlakesEnv } from "./nix-flakes.js";
 function resolveBundledOpenTofuDir() {
@@ -70,8 +70,6 @@ export async function applyOpenTofuVars(params) {
         "-var",
         `host_name=${hostName}`,
         "-var",
-        `hcloud_token=${env.HCLOUD_TOKEN}`,
-        "-var",
         `admin_cidr=${env.ADMIN_CIDR}`,
         "-var",
         `admin_cidr_is_world_open=${params.vars.adminCidrIsWorldOpen ? "true" : "false"}`,
@@ -145,8 +143,6 @@ export async function destroyOpenTofuVars(params) {
         "-var",
         `host_name=${hostName}`,
         "-var",
-        `hcloud_token=${env.HCLOUD_TOKEN}`,
-        "-var",
         `admin_cidr=${env.ADMIN_CIDR}`,
         "-var",
         `admin_cidr_is_world_open=${params.vars.adminCidrIsWorldOpen ? "true" : "false"}`,

package/vendor/@clawdlets/core/dist/lib/project-init.d.ts

@@ -0,0 +1,26 @@
+export type ProjectInitPlan = {
+    destDir: string;
+    host: string;
+    templateSpec: string;
+    plannedFiles: string[];
+};
+export declare function planProjectInit(params: {
+    destDir: string;
+    host: string;
+    templateSpec: string;
+}): Promise<ProjectInitPlan>;
+export type ProjectInitResult = {
+    destDir: string;
+    host: string;
+    plannedFiles: string[];
+    gitInitialized: boolean;
+    hasHooks: boolean;
+    nextSteps: string[];
+};
+export declare function initProject(params: {
+    destDir: string;
+    host: string;
+    templateSpec: string;
+    gitInit?: boolean;
+}): Promise<ProjectInitResult>;
+//# sourceMappingURL=project-init.d.ts.map