remoteclaw 0.1.0-next.cd6ddde → 0.1.0-next.cf9ccbe

package/dist/qr-cli-DSURqD0D.js

@@ -1,353 +0,0 @@
-import "./paths-BTaH3rLn.js";
-import { L as theme } from "./utils-C5daYcFn.js";
-import "./subsystem-PQ64_nsu.js";
-import { i as defaultRuntime } from "./ansi-DtaiOnt1.js";
-import "./agent-scope-_ND_-bJy.js";
-import { i as loadConfig } from "./config-CAa0rZSx.js";
-import "./env-B3zr72vQ.js";
-import "./host-env-security-BGibnCbS.js";
-import "./shell-env-DYZq9PqC.js";
-import "./version-CVMnqdzu.js";
-import "./env-vars-a7S70ba7.js";
-import "./zod-schema-CbqZAIYy.js";
-import "./logger-B8yHnzPl.js";
-import { i as isCarrierGradeNatIpv4Address, u as isRfc1918Ipv4Address } from "./ip-BAhS4rY2.js";
-import { t as runCommandWithTimeout } from "./exec-Zz6eJ6YU.js";
-import { t as formatDocsLink } from "./links-D5vtq30Q.js";
-import os from "node:os";
-import qrcode from "qrcode-terminal";
-
-//#region src/shared/gateway-bind-url.ts
-function resolveGatewayBindUrl(params) {
-	const bind = params.bind ?? "loopback";
-	if (bind === "custom") {
-		const host = params.customBindHost?.trim();
-		if (host) return {
-			url: `${params.scheme}://${host}:${params.port}`,
-			source: "gateway.bind=custom"
-		};
-		return { error: "gateway.bind=custom requires gateway.customBindHost." };
-	}
-	if (bind === "tailnet") {
-		const host = params.pickTailnetHost();
-		if (host) return {
-			url: `${params.scheme}://${host}:${params.port}`,
-			source: "gateway.bind=tailnet"
-		};
-		return { error: "gateway.bind=tailnet set, but no tailnet IP was found." };
-	}
-	if (bind === "lan") {
-		const host = params.pickLanHost();
-		if (host) return {
-			url: `${params.scheme}://${host}:${params.port}`,
-			source: "gateway.bind=lan"
-		};
-		return { error: "gateway.bind=lan set, but no private LAN IP was found." };
-	}
-	return null;
-}
-
-//#endregion
-//#region src/shared/tailscale-status.ts
-const TAILSCALE_STATUS_COMMAND_CANDIDATES = ["tailscale", "/Applications/Tailscale.app/Contents/MacOS/Tailscale"];
-function parsePossiblyNoisyJsonObject(raw) {
-	const start = raw.indexOf("{");
-	const end = raw.lastIndexOf("}");
-	if (start === -1 || end <= start) return {};
-	try {
-		return JSON.parse(raw.slice(start, end + 1));
-	} catch {
-		return {};
-	}
-}
-function extractTailnetHostFromStatusJson(raw) {
-	const parsed = parsePossiblyNoisyJsonObject(raw);
-	const self = typeof parsed.Self === "object" && parsed.Self !== null ? parsed.Self : void 0;
-	const dns = typeof self?.DNSName === "string" ? self.DNSName : void 0;
-	if (dns && dns.length > 0) return dns.replace(/\.$/, "");
-	const ips = Array.isArray(self?.TailscaleIPs) ? self.TailscaleIPs : [];
-	return ips.length > 0 ? ips[0] ?? null : null;
-}
-async function resolveTailnetHostWithRunner(runCommandWithTimeout) {
-	if (!runCommandWithTimeout) return null;
-	for (const candidate of TAILSCALE_STATUS_COMMAND_CANDIDATES) try {
-		const result = await runCommandWithTimeout([
-			candidate,
-			"status",
-			"--json"
-		], { timeoutMs: 5e3 });
-		if (result.code !== 0) continue;
-		const raw = result.stdout.trim();
-		if (!raw) continue;
-		const host = extractTailnetHostFromStatusJson(raw);
-		if (host) return host;
-	} catch {
-		continue;
-	}
-	return null;
-}
-
-//#endregion
-//#region src/pairing/setup-code.ts
-const DEFAULT_GATEWAY_PORT = 18789;
-function normalizeUrl(raw, schemeFallback) {
-	const trimmed = raw.trim();
-	if (!trimmed) return null;
-	try {
-		const parsed = new URL(trimmed);
-		const scheme = parsed.protocol.replace(":", "");
-		if (!scheme) return null;
-		const resolvedScheme = scheme === "http" ? "ws" : scheme === "https" ? "wss" : scheme;
-		if (resolvedScheme !== "ws" && resolvedScheme !== "wss") return null;
-		const host = parsed.hostname;
-		if (!host) return null;
-		return `${resolvedScheme}://${host}${parsed.port ? `:${parsed.port}` : ""}`;
-	} catch {}
-	const withoutPath = trimmed.split("/")[0] ?? "";
-	if (!withoutPath) return null;
-	return `${schemeFallback}://${withoutPath}`;
-}
-function resolveGatewayPort(cfg, env) {
-	const envRaw = env.REMOTECLAW_GATEWAY_PORT?.trim() || env.CLAWDBOT_GATEWAY_PORT?.trim();
-	if (envRaw) {
-		const parsed = Number.parseInt(envRaw, 10);
-		if (Number.isFinite(parsed) && parsed > 0) return parsed;
-	}
-	const configPort = cfg.gateway?.port;
-	if (typeof configPort === "number" && Number.isFinite(configPort) && configPort > 0) return configPort;
-	return DEFAULT_GATEWAY_PORT;
-}
-function resolveScheme(cfg, opts) {
-	if (opts?.forceSecure) return "wss";
-	return cfg.gateway?.tls?.enabled === true ? "wss" : "ws";
-}
-function isPrivateIPv4(address) {
-	return isRfc1918Ipv4Address(address);
-}
-function isTailnetIPv4(address) {
-	return isCarrierGradeNatIpv4Address(address);
-}
-function pickIPv4Matching(networkInterfaces, matches) {
-	const nets = networkInterfaces();
-	for (const entries of Object.values(nets)) {
-		if (!entries) continue;
-		for (const entry of entries) {
-			const isIpv4 = entry?.family === "IPv4";
-			if (!entry || entry.internal || !isIpv4) continue;
-			const address = entry.address?.trim() ?? "";
-			if (!address) continue;
-			if (matches(address)) return address;
-		}
-	}
-	return null;
-}
-function pickLanIPv4(networkInterfaces) {
-	return pickIPv4Matching(networkInterfaces, isPrivateIPv4);
-}
-function pickTailnetIPv4(networkInterfaces) {
-	return pickIPv4Matching(networkInterfaces, isTailnetIPv4);
-}
-function resolveAuth(cfg, env) {
-	const mode = cfg.gateway?.auth?.mode;
-	const token = env.REMOTECLAW_GATEWAY_TOKEN?.trim() || env.CLAWDBOT_GATEWAY_TOKEN?.trim() || cfg.gateway?.auth?.token?.trim();
-	const password = env.REMOTECLAW_GATEWAY_PASSWORD?.trim() || env.CLAWDBOT_GATEWAY_PASSWORD?.trim() || cfg.gateway?.auth?.password?.trim();
-	if (mode === "password") {
-		if (!password) return { error: "Gateway auth is set to password, but no password is configured." };
-		return {
-			password,
-			label: "password"
-		};
-	}
-	if (mode === "token") {
-		if (!token) return { error: "Gateway auth is set to token, but no token is configured." };
-		return {
-			token,
-			label: "token"
-		};
-	}
-	if (token) return {
-		token,
-		label: "token"
-	};
-	if (password) return {
-		password,
-		label: "password"
-	};
-	return { error: "Gateway auth is not configured (no token or password)." };
-}
-async function resolveGatewayUrl(cfg, opts) {
-	const scheme = resolveScheme(cfg, { forceSecure: opts.forceSecure });
-	const port = resolveGatewayPort(cfg, opts.env);
-	if (typeof opts.publicUrl === "string" && opts.publicUrl.trim()) {
-		const url = normalizeUrl(opts.publicUrl, scheme);
-		if (url) return {
-			url,
-			source: "plugins.entries.device-pair.config.publicUrl"
-		};
-		return { error: "Configured publicUrl is invalid." };
-	}
-	const remoteUrlRaw = cfg.gateway?.remote?.url;
-	const remoteUrl = typeof remoteUrlRaw === "string" && remoteUrlRaw.trim() ? normalizeUrl(remoteUrlRaw, scheme) : null;
-	if (opts.preferRemoteUrl && remoteUrl) return {
-		url: remoteUrl,
-		source: "gateway.remote.url"
-	};
-	const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
-	if (tailscaleMode === "serve" || tailscaleMode === "funnel") {
-		const host = await resolveTailnetHostWithRunner(opts.runCommandWithTimeout);
-		if (!host) return { error: "Tailscale Serve is enabled, but MagicDNS could not be resolved." };
-		return {
-			url: `wss://${host}`,
-			source: `gateway.tailscale.mode=${tailscaleMode}`
-		};
-	}
-	if (remoteUrl) return {
-		url: remoteUrl,
-		source: "gateway.remote.url"
-	};
-	const bindResult = resolveGatewayBindUrl({
-		bind: cfg.gateway?.bind,
-		customBindHost: cfg.gateway?.customBindHost,
-		scheme,
-		port,
-		pickTailnetHost: () => pickTailnetIPv4(opts.networkInterfaces),
-		pickLanHost: () => pickLanIPv4(opts.networkInterfaces)
-	});
-	if (bindResult) return bindResult;
-	return { error: "Gateway is only bound to loopback. Set gateway.bind=lan, enable tailscale serve, or configure plugins.entries.device-pair.config.publicUrl." };
-}
-function encodePairingSetupCode(payload) {
-	const json = JSON.stringify(payload);
-	return Buffer.from(json, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-async function resolvePairingSetupFromConfig(cfg, options = {}) {
-	const env = options.env ?? process.env;
-	const auth = resolveAuth(cfg, env);
-	if (auth.error) return {
-		ok: false,
-		error: auth.error
-	};
-	const urlResult = await resolveGatewayUrl(cfg, {
-		env,
-		publicUrl: options.publicUrl,
-		preferRemoteUrl: options.preferRemoteUrl,
-		forceSecure: options.forceSecure,
-		runCommandWithTimeout: options.runCommandWithTimeout,
-		networkInterfaces: options.networkInterfaces ?? os.networkInterfaces
-	});
-	if (!urlResult.url) return {
-		ok: false,
-		error: urlResult.error ?? "Gateway URL unavailable."
-	};
-	if (!auth.label) return {
-		ok: false,
-		error: "Gateway auth is not configured (no token or password)."
-	};
-	return {
-		ok: true,
-		payload: {
-			url: urlResult.url,
-			token: auth.token,
-			password: auth.password
-		},
-		authLabel: auth.label,
-		urlSource: urlResult.source ?? "unknown"
-	};
-}
-
-//#endregion
-//#region src/cli/qr-cli.ts
-function renderQrAscii(data) {
-	return new Promise((resolve) => {
-		qrcode.generate(data, { small: true }, (output) => {
-			resolve(output);
-		});
-	});
-}
-function readDevicePairPublicUrlFromConfig(cfg) {
-	const value = cfg.plugins?.entries?.["device-pair"]?.config?.["publicUrl"];
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : void 0;
-}
-function registerQrCli(program) {
-	program.command("qr").description("Generate an iOS pairing QR code and setup code").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/qr", "docs.remoteclaw.org/cli/qr")}\n`).option("--remote", "Use gateway.remote.url and gateway.remote token/password (ignores device-pair publicUrl)", false).option("--url <url>", "Override gateway URL used in the setup payload").option("--public-url <url>", "Override gateway public URL used in the setup payload").option("--token <token>", "Override gateway token for setup payload").option("--password <password>", "Override gateway password for setup payload").option("--setup-code-only", "Print only the setup code", false).option("--no-ascii", "Skip ASCII QR rendering").option("--json", "Output JSON", false).action(async (opts) => {
-		try {
-			if (opts.token && opts.password) throw new Error("Use either --token or --password, not both.");
-			const loaded = loadConfig();
-			const cfg = {
-				...loaded,
-				gateway: {
-					...loaded.gateway,
-					auth: { ...loaded.gateway?.auth }
-				}
-			};
-			const token = typeof opts.token === "string" ? opts.token.trim() : "";
-			const password = typeof opts.password === "string" ? opts.password.trim() : "";
-			const wantsRemote = opts.remote === true;
-			if (token) {
-				cfg.gateway.auth.mode = "token";
-				cfg.gateway.auth.token = token;
-			}
-			if (password) {
-				cfg.gateway.auth.mode = "password";
-				cfg.gateway.auth.password = password;
-			}
-			if (wantsRemote && !token && !password) {
-				const remoteToken = typeof cfg.gateway?.remote?.token === "string" ? cfg.gateway.remote.token.trim() : "";
-				const remotePassword = typeof cfg.gateway?.remote?.password === "string" ? cfg.gateway.remote.password.trim() : "";
-				if (remoteToken) {
-					cfg.gateway.auth.mode = "token";
-					cfg.gateway.auth.token = remoteToken;
-					cfg.gateway.auth.password = void 0;
-				} else if (remotePassword) {
-					cfg.gateway.auth.mode = "password";
-					cfg.gateway.auth.password = remotePassword;
-					cfg.gateway.auth.token = void 0;
-				}
-			}
-			if (wantsRemote && !opts.url && !opts.publicUrl) {
-				const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
-				const remoteUrl = cfg.gateway?.remote?.url;
-				if (!(typeof remoteUrl === "string" && remoteUrl.trim().length > 0) && !(tailscaleMode === "serve" || tailscaleMode === "funnel")) throw new Error("qr --remote requires gateway.remote.url (or gateway.tailscale.mode=serve/funnel).");
-			}
-			const resolved = await resolvePairingSetupFromConfig(cfg, {
-				publicUrl: (typeof opts.url === "string" && opts.url.trim() ? opts.url.trim() : typeof opts.publicUrl === "string" && opts.publicUrl.trim() ? opts.publicUrl.trim() : void 0) ?? (wantsRemote ? void 0 : readDevicePairPublicUrlFromConfig(cfg)),
-				preferRemoteUrl: wantsRemote,
-				runCommandWithTimeout: async (argv, runOpts) => await runCommandWithTimeout(argv, { timeoutMs: runOpts.timeoutMs })
-			});
-			if (!resolved.ok) throw new Error(resolved.error);
-			const setupCode = encodePairingSetupCode(resolved.payload);
-			if (opts.setupCodeOnly) {
-				defaultRuntime.log(setupCode);
-				return;
-			}
-			if (opts.json) {
-				defaultRuntime.log(JSON.stringify({
-					setupCode,
-					gatewayUrl: resolved.payload.url,
-					auth: resolved.authLabel,
-					urlSource: resolved.urlSource
-				}, null, 2));
-				return;
-			}
-			const lines = [
-				theme.heading("Pairing QR"),
-				"Scan this with the RemoteClaw iOS app (Onboarding -> Scan QR).",
-				""
-			];
-			if (opts.ascii !== false) {
-				const qrAscii = await renderQrAscii(setupCode);
-				lines.push(qrAscii.trimEnd(), "");
-			}
-			lines.push(`${theme.muted("Setup code:")} ${setupCode}`, `${theme.muted("Gateway:")} ${resolved.payload.url}`, `${theme.muted("Auth:")} ${resolved.authLabel}`, `${theme.muted("Source:")} ${resolved.urlSource}`, "", "Approve after scan with:", `  ${theme.command("remoteclaw devices list")}`, `  ${theme.command("remoteclaw devices approve <requestId>")}`);
-			defaultRuntime.log(lines.join("\n"));
-		} catch (err) {
-			defaultRuntime.error(String(err));
-			defaultRuntime.exit(1);
-		}
-	});
-}
-
-//#endregion
-export { registerQrCli };

package/dist/redact-gXuh8MFk.js

@@ -1,191 +0,0 @@
-import { U as resolveNodeRequireFromMeta } from "./utils-C5daYcFn.js";
-
-//#region src/security/safe-regex.ts
-const SAFE_REGEX_CACHE_MAX = 256;
-const safeRegexCache = /* @__PURE__ */ new Map();
-function hasNestedRepetition(source) {
-	const frames = [{
-		lastToken: null,
-		containsRepetition: false
-	}];
-	let inCharClass = false;
-	const emitToken = (token) => {
-		const frame = frames[frames.length - 1];
-		frame.lastToken = token;
-		if (token.containsRepetition) frame.containsRepetition = true;
-	};
-	for (let i = 0; i < source.length; i += 1) {
-		const ch = source[i];
-		if (ch === "\\") {
-			i += 1;
-			emitToken({ containsRepetition: false });
-			continue;
-		}
-		if (inCharClass) {
-			if (ch === "]") inCharClass = false;
-			continue;
-		}
-		if (ch === "[") {
-			inCharClass = true;
-			emitToken({ containsRepetition: false });
-			continue;
-		}
-		if (ch === "(") {
-			frames.push({
-				lastToken: null,
-				containsRepetition: false
-			});
-			continue;
-		}
-		if (ch === ")") {
-			if (frames.length > 1) emitToken({ containsRepetition: frames.pop().containsRepetition });
-			continue;
-		}
-		if (ch === "|") {
-			const frame = frames[frames.length - 1];
-			frame.lastToken = null;
-			continue;
-		}
-		const quantifier = readQuantifier(source, i);
-		if (quantifier) {
-			const frame = frames[frames.length - 1];
-			const token = frame.lastToken;
-			if (!token) continue;
-			if (token.containsRepetition) return true;
-			token.containsRepetition = true;
-			frame.containsRepetition = true;
-			i += quantifier.consumed - 1;
-			continue;
-		}
-		emitToken({ containsRepetition: false });
-	}
-	return false;
-}
-function readQuantifier(source, index) {
-	const ch = source[index];
-	if (ch === "*" || ch === "+" || ch === "?") return { consumed: source[index + 1] === "?" ? 2 : 1 };
-	if (ch !== "{") return null;
-	let i = index + 1;
-	while (i < source.length && /\d/.test(source[i])) i += 1;
-	if (i === index + 1) return null;
-	if (source[i] === ",") {
-		i += 1;
-		while (i < source.length && /\d/.test(source[i])) i += 1;
-	}
-	if (source[i] !== "}") return null;
-	i += 1;
-	if (source[i] === "?") i += 1;
-	return { consumed: i - index };
-}
-function compileSafeRegex(source, flags = "") {
-	const trimmed = source.trim();
-	if (!trimmed) return null;
-	const cacheKey = `${flags}::${trimmed}`;
-	if (safeRegexCache.has(cacheKey)) return safeRegexCache.get(cacheKey) ?? null;
-	let compiled = null;
-	if (!hasNestedRepetition(trimmed)) try {
-		compiled = new RegExp(trimmed, flags);
-	} catch {
-		compiled = null;
-	}
-	safeRegexCache.set(cacheKey, compiled);
-	if (safeRegexCache.size > SAFE_REGEX_CACHE_MAX) {
-		const oldestKey = safeRegexCache.keys().next().value;
-		if (oldestKey) safeRegexCache.delete(oldestKey);
-	}
-	return compiled;
-}
-
-//#endregion
-//#region src/logging/redact.ts
-const requireConfig = resolveNodeRequireFromMeta(import.meta.url);
-const DEFAULT_REDACT_MODE = "tools";
-const DEFAULT_REDACT_MIN_LENGTH = 18;
-const DEFAULT_REDACT_KEEP_START = 6;
-const DEFAULT_REDACT_KEEP_END = 4;
-const DEFAULT_REDACT_PATTERNS = [
-	String.raw`\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1`,
-	String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"`,
-	String.raw`--(?:api[-_]?key|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1`,
-	String.raw`Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)`,
-	String.raw`\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b`,
-	String.raw`-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----`,
-	String.raw`\b(sk-[A-Za-z0-9_-]{8,})\b`,
-	String.raw`\b(ghp_[A-Za-z0-9]{20,})\b`,
-	String.raw`\b(github_pat_[A-Za-z0-9_]{20,})\b`,
-	String.raw`\b(xox[baprs]-[A-Za-z0-9-]{10,})\b`,
-	String.raw`\b(xapp-[A-Za-z0-9-]{10,})\b`,
-	String.raw`\b(gsk_[A-Za-z0-9_-]{10,})\b`,
-	String.raw`\b(AIza[0-9A-Za-z\-_]{20,})\b`,
-	String.raw`\b(pplx-[A-Za-z0-9_-]{10,})\b`,
-	String.raw`\b(npm_[A-Za-z0-9]{10,})\b`,
-	String.raw`\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
-	String.raw`\b(\d{6,}:[A-Za-z0-9_-]{20,})\b`
-];
-function normalizeMode(value) {
-	return value === "off" ? "off" : DEFAULT_REDACT_MODE;
-}
-function parsePattern(raw) {
-	if (!raw.trim()) return null;
-	const match = raw.match(/^\/(.+)\/([gimsuy]*)$/);
-	if (match) {
-		const flags = match[2].includes("g") ? match[2] : `${match[2]}g`;
-		return compileSafeRegex(match[1], flags);
-	}
-	return compileSafeRegex(raw, "gi");
-}
-function resolvePatterns(value) {
-	return (value?.length ? value : DEFAULT_REDACT_PATTERNS).map(parsePattern).filter((re) => Boolean(re));
-}
-function maskToken(token) {
-	if (token.length < DEFAULT_REDACT_MIN_LENGTH) return "***";
-	return `${token.slice(0, DEFAULT_REDACT_KEEP_START)}…${token.slice(-DEFAULT_REDACT_KEEP_END)}`;
-}
-function redactPemBlock(block) {
-	const lines = block.split(/\r?\n/).filter(Boolean);
-	if (lines.length < 2) return "***";
-	return `${lines[0]}\n…redacted…\n${lines[lines.length - 1]}`;
-}
-function redactMatch(match, groups) {
-	if (match.includes("PRIVATE KEY-----")) return redactPemBlock(match);
-	const token = groups.filter((value) => typeof value === "string" && value.length > 0).at(-1) ?? match;
-	const masked = maskToken(token);
-	if (token === match) return masked;
-	return match.replace(token, masked);
-}
-function redactText(text, patterns) {
-	let next = text;
-	for (const pattern of patterns) next = next.replace(pattern, (...args) => redactMatch(args[0], args.slice(1, args.length - 2)));
-	return next;
-}
-function resolveConfigRedaction() {
-	let cfg;
-	try {
-		cfg = (requireConfig?.("../config/config.js"))?.loadConfig?.().logging;
-	} catch {
-		cfg = void 0;
-	}
-	return {
-		mode: normalizeMode(cfg?.redactSensitive),
-		patterns: cfg?.redactPatterns
-	};
-}
-function redactSensitiveText(text, options) {
-	if (!text) return text;
-	const resolved = options ?? resolveConfigRedaction();
-	if (normalizeMode(resolved.mode) === "off") return text;
-	const patterns = resolvePatterns(resolved.patterns);
-	if (!patterns.length) return text;
-	return redactText(text, patterns);
-}
-function redactToolDetail(detail) {
-	const resolved = resolveConfigRedaction();
-	if (normalizeMode(resolved.mode) !== "tools") return detail;
-	return redactSensitiveText(detail, resolved);
-}
-function getDefaultRedactPatterns() {
-	return [...DEFAULT_REDACT_PATTERNS];
-}
-
-//#endregion
-export { redactSensitiveText as n, redactToolDetail as r, getDefaultRedactPatterns as t };