talos-deploy 0.0.3

package/dist/api/client.js

@@ -0,0 +1,28 @@
+import { loadConfig, getPortalUrl } from "../config/index.js";
+/**
+ * Authenticated API client.
+ * Loads token from config and attaches Bearer header.
+ */
+export async function api(path, options = {}) {
+    const config = loadConfig();
+    if (!config) {
+        console.error("Not logged in. Run: tt login");
+        process.exit(1);
+    }
+    const portalUrl = getPortalUrl();
+    const headers = {
+        Authorization: `Bearer ${config.token}`,
+    };
+    if (options.body) {
+        headers["Content-Type"] = "application/json";
+    }
+    const resp = await fetch(`${portalUrl}${path}`, {
+        ...options,
+        headers,
+    });
+    if (resp.status === 401) {
+        console.error("Session expired. Run: tt login");
+        process.exit(1);
+    }
+    return resp;
+}

package/dist/api/progress.js

@@ -0,0 +1,49 @@
+import { EventSource } from "eventsource";
+import { loadConfig, getPortalUrl } from "../config/index.js";
+/**
+ * Subscribe to sandbox operation progress via SSE.
+ *
+ * @param sandboxId - The sandbox ID
+ * @param operationId - The operation ID returned from POST /api/sandboxes
+ * @param onProgress - Callback for each progress event
+ * @param onDone - Callback when operation completes
+ * @returns A cleanup function to close the SSE connection
+ */
+export function streamProgress(sandboxId, operationId, onProgress, onDone) {
+    const config = loadConfig();
+    const portalUrl = getPortalUrl();
+    const url = `${portalUrl}/api/sandboxes/${sandboxId}/progress?operationId=${operationId}`;
+    const token = config?.token ?? "";
+    const es = new EventSource(url, {
+        // Use custom fetch to inject Authorization header
+        fetch: async (inputUrl, init) => {
+            return globalThis.fetch(inputUrl, {
+                ...init,
+                headers: {
+                    ...init.headers,
+                    Authorization: `Bearer ${token}`,
+                },
+            });
+        },
+    });
+    es.addEventListener("progress", (e) => {
+        try {
+            const event = JSON.parse(e.data);
+            onProgress(event);
+        }
+        catch (err) {
+            console.error("Failed to parse SSE progress event:", err);
+        }
+    });
+    es.addEventListener("done", () => {
+        es.close();
+        onDone();
+    });
+    es.addEventListener("error", () => {
+        // EventSource auto-reconnects. If the operation is done,
+        // the server will replay events and send "done" on reconnect.
+    });
+    return () => {
+        es.close();
+    };
+}

package/dist/commands/auth.js

@@ -0,0 +1,156 @@
+import http from "http";
+import crypto from "crypto";
+import { execSync } from "child_process";
+import { loadConfig, saveConfig, clearConfig, getPortalUrl } from "../config/index.js";
+// ── auth login ──────────────────────────────────────────────
+export async function authLoginCommand() {
+    const config = loadConfig();
+    const portalUrl = getPortalUrl();
+    // Already logged in?
+    if (config?.token) {
+        try {
+            const resp = await fetch(`${portalUrl}/api/auth/status`, {
+                headers: { Authorization: `Bearer ${config.token}` },
+            });
+            if (resp.ok) {
+                const data = (await resp.json());
+                if (data.user?.email) {
+                    console.log(`Already logged in as ${data.user.email}`);
+                    console.log(`To switch accounts, run: tt auth login --force`);
+                    return;
+                }
+            }
+        }
+        catch {
+            // Token invalid, proceed to fresh login
+        }
+    }
+    // Fresh login via browser authorization
+    const state = crypto.randomBytes(16).toString("hex");
+    const callbackServer = await startCallbackServer(state);
+    const authUrl = `${portalUrl}/auth/cli?port=${callbackServer.port}&state=${state}`;
+    console.log("Opening browser for authorization...");
+    console.log(`If browser doesn't open, visit: ${authUrl}`);
+    openBrowser(authUrl);
+    try {
+        const token = await callbackServer.tokenPromise;
+        // Fetch user info
+        try {
+            const resp = await fetch(`${portalUrl}/api/auth/status`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (resp.ok) {
+                const data = (await resp.json());
+                saveConfig({
+                    token,
+                    serverUrl: portalUrl,
+                    email: data.user?.email ?? "",
+                    userId: data.user?.userId ?? 0,
+                });
+                console.log(`Logged in as ${data.user?.email ?? "unknown"}`);
+            }
+            else {
+                saveConfig({ token, serverUrl: portalUrl });
+                console.log("Logged in successfully!");
+            }
+        }
+        catch {
+            saveConfig({ token, serverUrl: portalUrl });
+            console.log("Logged in successfully!");
+        }
+    }
+    catch (err) {
+        console.error(err.message);
+        process.exit(1);
+    }
+}
+// ── auth status ─────────────────────────────────────────────
+export async function authStatusCommand() {
+    const config = loadConfig();
+    const portalUrl = getPortalUrl();
+    if (!config?.token) {
+        console.log("Not logged in.");
+        console.log("Run: tt auth login");
+        return;
+    }
+    try {
+        const resp = await fetch(`${portalUrl}/api/auth/status`, {
+            headers: { Authorization: `Bearer ${config.token}` },
+        });
+        if (resp.ok) {
+            const data = (await resp.json());
+            console.log(`${data.user.email} (${data.user.role})`);
+            console.log(`Server: ${portalUrl}`);
+        }
+        else {
+            console.log("Session expired. Run: tt auth login");
+        }
+    }
+    catch {
+        console.log(`Config: ${config.email || "unknown user"}`);
+        console.log(`Server: ${portalUrl} (unreachable)`);
+    }
+}
+// ── auth logout ─────────────────────────────────────────────
+export function authLogoutCommand() {
+    const config = loadConfig();
+    if (!config?.token) {
+        console.log("Not logged in.");
+        return;
+    }
+    clearConfig();
+    console.log(`Logged out${config.email ? ` (${config.email})` : ""}.`);
+}
+function startCallbackServer(expectedState) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer();
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                reject(new Error("Failed to bind local server"));
+                return;
+            }
+            const port = addr.port;
+            const tokenPromise = new Promise((resolveToken, rejectToken) => {
+                const timeout = setTimeout(() => {
+                    server.close();
+                    rejectToken(new Error("Login timed out (120s). Please try again."));
+                }, 120_000);
+                server.on("request", (req, httpRes) => {
+                    httpRes.setHeader("Access-Control-Allow-Origin", "*");
+                    if (req.method === "OPTIONS") {
+                        httpRes.writeHead(204);
+                        httpRes.end();
+                        return;
+                    }
+                    const url = new URL(req.url || "/", "http://localhost");
+                    const reqState = url.searchParams.get("state");
+                    const reqToken = url.searchParams.get("token");
+                    if (reqState === expectedState && reqToken) {
+                        clearTimeout(timeout);
+                        httpRes.writeHead(200, { "Content-Type": "text/html" });
+                        httpRes.end("<html><body><h2>Authorized!</h2><p>You can close this tab.</p></body></html>");
+                        server.close();
+                        resolveToken(reqToken);
+                    }
+                    else {
+                        httpRes.writeHead(400, { "Content-Type": "text/plain" });
+                        httpRes.end("Invalid callback");
+                    }
+                });
+            });
+            resolve({ port, tokenPromise });
+        });
+    });
+}
+function openBrowser(url) {
+    const openCmd = process.platform === "darwin" ? "open"
+        : process.platform === "win32" ? "start"
+            : "xdg-open";
+    try {
+        execSync(`${openCmd} "${url}"`, { stdio: "ignore" });
+    }
+    catch {
+        // Browser may not be available
+    }
+}

package/dist/commands/ssh-proxy.js

@@ -0,0 +1,67 @@
+import { loadConfig as defaultLoadConfig, getPortalUrl } from "../config/index.js";
+import { api } from "../api/client.js";
+import WS from "ws";
+const defaultDeps = () => ({
+    loadConfig: defaultLoadConfig,
+    apiFetch: api,
+    createWebSocket: (url) => new WS(url),
+    stdin: process.stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    exit: process.exit,
+});
+export async function sshProxyCommand(project, deps) {
+    const { loadConfig, apiFetch, createWebSocket, stdin, stdout, stderr, exit } = { ...defaultDeps(), ...deps };
+    const config = loadConfig();
+    if (!config?.token) {
+        stderr.write("Not logged in. Run: talosd auth login\n");
+        exit(1);
+    }
+    const portalUrl = config.serverUrl || getPortalUrl();
+    // Find sandbox
+    const resp = await apiFetch(`/api/sandboxes?project=${encodeURIComponent(project)}`);
+    const data = await resp.json();
+    const sandboxes = data.sandboxes ?? [];
+    const sandbox = sandboxes[0];
+    if (!sandbox) {
+        stderr.write(`No sandbox found for project "${project}". Run: talosd up --project ${project}\n`);
+        exit(1);
+    }
+    // Wake if sleeping
+    if (sandbox.status === "sleeping") {
+        stderr.write("Sandbox is sleeping, waking...\n");
+        await apiFetch(`/api/sandboxes/${sandbox.id}/wake`, { method: "POST" });
+    }
+    const wsBaseUrl = portalUrl.replace(/^http/, "ws");
+    const wsUrl = `${wsBaseUrl}/api/sandboxes/${sandbox.id}/ssh?token=${encodeURIComponent(config.token)}`;
+    return new Promise((resolve) => {
+        const ws = createWebSocket(wsUrl);
+        const pendingData = [];
+        stdin.on("data", (chunk) => {
+            if (ws.readyState === 1 /* OPEN */) {
+                ws.send(chunk);
+            }
+            else {
+                pendingData.push(chunk);
+            }
+        });
+        stdin.on("end", () => {
+            ws.close();
+        });
+        ws.on("open", () => {
+            while (pendingData.length > 0) {
+                ws.send(pendingData.shift());
+            }
+        });
+        ws.on("message", (msg) => {
+            stdout.write(msg);
+        });
+        ws.on("close", (_code, _reason) => {
+            resolve();
+        });
+        ws.on("error", (err) => {
+            stderr.write(`Connection error: ${err.message}\n`);
+            resolve();
+        });
+    });
+}

package/dist/commands/up.js

@@ -0,0 +1,120 @@
+import { ensureSshKey, uploadSshKey, updateSshConfig, sshIntoSandbox, resolveTalosBinaryPath } from "../lib/ssh.js";
+import { api } from "../api/client.js";
+import { streamProgress } from "../api/progress.js";
+// ANSI escape codes for terminal output
+const GREEN = "\x1b[32m";
+const RED = "\x1b[31m";
+const YELLOW = "\x1b[33m";
+const GRAY = "\x1b[90m";
+const BOLD = "\x1b[1m";
+const RESET = "\x1b[0m";
+const CLEAR_LINE = "\r\x1b[2K";
+// Friendly step names for display
+const STEP_LABELS = {
+    create_claim: "Creating sandbox",
+    wake: "Waking sandbox",
+    wait_ready: "Waiting for sandbox pod",
+    inject_env: "Injecting environment",
+    activate: "Activating sandbox",
+    ready: "Ready for connection",
+    error: "Error",
+};
+/**
+ * Up command — create or wake a sandbox with progress display, then SSH into it.
+ */
+export async function upCommand(opts) {
+    console.log(`\n${BOLD}Talos — Starting your environment${RESET}\n`);
+    // Step 1: SSH key
+    process.stdout.write("  Checking SSH key...");
+    ensureSshKey();
+    process.stdout.write(`${CLEAR_LINE}  ${GREEN}✓${RESET} SSH key ready\n`);
+    // Step 2: Upload SSH key
+    process.stdout.write("  Uploading SSH key...");
+    await uploadSshKey();
+    process.stdout.write(`${CLEAR_LINE}  ${GREEN}✓${RESET} SSH key uploaded\n`);
+    // Step 3: Create or wake sandbox
+    process.stdout.write("  Creating sandbox...");
+    const resp = await api("/api/sandboxes", {
+        method: "POST",
+        body: JSON.stringify({ project: opts.project }),
+    });
+    const data = (await resp.json());
+    if (!resp.ok) {
+        process.stdout.write(`${CLEAR_LINE}  ${RED}✗${RESET} ${data.error || "Failed to create sandbox"}\n`);
+        process.exit(1);
+    }
+    const sandbox = data.sandbox;
+    // If sandbox is already active (no operation needed)
+    if (!data.operationId || sandbox.status === "active") {
+        process.stdout.write(`${CLEAR_LINE}  ${GREEN}✓${RESET} Sandbox ready (${sandbox.sandboxclaim_name})\n`);
+    }
+    else {
+        // Stream progress via SSE
+        process.stdout.write(`${CLEAR_LINE}  ${YELLOW}⠋${RESET} Sandbox ${sandbox.status === "sleeping" ? "waking" : "creating"}...\n`);
+        await showProgress(sandbox.id, data.operationId);
+    }
+    // Step 4: Write SSH config with ProxyCommand
+    const binaryPath = resolveTalosBinaryPath();
+    updateSshConfig(opts.project, binaryPath);
+    process.stdout.write(`${CLEAR_LINE}  ${GREEN}✓${RESET} SSH config updated (host: tt-${opts.project})\n`);
+    // Step 5: SSH via host alias
+    console.log(`\n  ${BOLD}Connecting via SSH...${RESET}\n`);
+    await sshIntoSandbox(opts.project);
+}
+/**
+ * Display progress from SSE stream with step-by-step updates.
+ */
+function showProgress(sandboxId, operationId) {
+    return new Promise((resolve, reject) => {
+        const stepStates = new Map();
+        const render = () => {
+            // Move cursor up to rewrite progress lines
+            const lines = [];
+            const seen = new Set();
+            // Sort by step number and render
+            const sorted = Array.from(stepStates.values()).sort((a, b) => a.step - b.step);
+            for (const evt of sorted) {
+                if (seen.has(evt.stepName))
+                    continue;
+                seen.add(evt.stepName);
+                const label = STEP_LABELS[evt.stepName] || evt.stepName;
+                const indent = "    ";
+                if (evt.status === "completed") {
+                    lines.push(`${indent}${GREEN}  ├ ✓${RESET} ${label}`);
+                }
+                else if (evt.status === "in_progress") {
+                    lines.push(`${indent}${YELLOW}⠋${RESET} ${label}... ${GRAY}${evt.message || ""}${RESET}`);
+                }
+                else if (evt.status === "failed") {
+                    lines.push(`${indent}${RED}  ├ ✗${RESET} ${label}: ${evt.error || evt.message || "failed"}`);
+                }
+            }
+            // Write all lines
+            for (const line of lines) {
+                process.stdout.write(`${CLEAR_LINE}${line}\n`);
+            }
+        };
+        const cleanup = streamProgress(sandboxId, operationId, (event) => {
+            stepStates.set(event.stepName, event);
+            // If this is a failed event, reject
+            if (event.status === "failed" && event.stepName === "error") {
+                cleanup();
+                console.error(`\n  ${RED}Error: ${event.message}${RESET}`);
+                reject(new Error(event.message));
+                return;
+            }
+            // Re-render for in_progress events (live updating)
+            if (event.status === "in_progress") {
+                // Just print the message inline for simple display
+                const label = STEP_LABELS[event.stepName] || event.stepName;
+                process.stdout.write(`${CLEAR_LINE}  ${YELLOW}⠋${RESET} ${label}... ${GRAY}${event.message || ""}${RESET}`);
+            }
+            else if (event.status === "completed") {
+                const label = STEP_LABELS[event.stepName] || event.stepName;
+                process.stdout.write(`${CLEAR_LINE}  ${GREEN}✓${RESET} ${label}\n`);
+            }
+        }, () => {
+            resolve();
+        });
+    });
+}

package/dist/config/index.js

@@ -0,0 +1,66 @@
+import fs from "fs";
+import path from "path";
+import os from "os";
+import dotenv from "dotenv";
+export const CONFIG_DIR = path.join(os.homedir(), ".talos");
+export const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+// Load .env from current directory or project root
+dotenv.config({ path: path.resolve(process.cwd(), ".env") }) ||
+    dotenv.config({ path: path.resolve(process.cwd(), "../..", ".env") });
+// ── Config loading ─────────────────────────────────────
+export function loadConfig() {
+    if (!fs.existsSync(CONFIG_FILE))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
+        // v1 → treat as legacy (no email/userId), still usable for token
+        if (raw.token && !raw.version) {
+            return { version: 2, token: raw.token, email: "", userId: 0, serverUrl: "" };
+        }
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveConfig(config) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    const existing = loadConfig();
+    const merged = {
+        version: 2,
+        token: config.token,
+        email: config.email ?? existing?.email ?? "",
+        userId: config.userId ?? existing?.userId ?? 0,
+        serverUrl: config.serverUrl ?? existing?.serverUrl ?? "",
+        expiresAt: config.expiresAt ?? existing?.expiresAt,
+    };
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2));
+}
+export function clearConfig() {
+    if (fs.existsSync(CONFIG_FILE)) {
+        fs.unlinkSync(CONFIG_FILE);
+    }
+}
+// ── Server URL resolution ──────────────────────────────
+export function getPortalUrl() {
+    // Priority: env var > config file > code default
+    if (process.env.TALOS_SERVER_URL) {
+        return process.env.TALOS_SERVER_URL;
+    }
+    const config = loadConfig();
+    if (config?.serverUrl) {
+        return config.serverUrl;
+    }
+    if (process.env.ENV === "PRODUCTION") {
+        if (!process.env.PORTAL_DOMAIN) {
+            console.error("Please set PORTAL_DOMAIN for production");
+            process.exit(1);
+        }
+        return `https://${process.env.PORTAL_DOMAIN}`;
+    }
+    return `http://localhost:${process.env.PORTAL_PORT || "3080"}`;
+}
+// ── SSH key path ───────────────────────────────────────
+export function getSshKeyPath() {
+    return path.join(os.homedir(), ".ssh/id_ed25519");
+}

package/dist/config/profiles.js

@@ -0,0 +1,53 @@
+/**
+ * Deployment profiles determine how the CLI interacts with the server
+ * and sandbox infrastructure.
+ */
+export const PROFILES = {
+    mock: {
+        name: "mock",
+        sandboxMode: "mock",
+        requiresKubectl: false,
+        sshAvailable: false,
+    },
+    "local-k3d": {
+        name: "local-k3d",
+        sandboxMode: "k8s",
+        requiresKubectl: true,
+        sshAvailable: true,
+    },
+    "remote-k3d": {
+        name: "remote-k3d",
+        sandboxMode: "k8s",
+        requiresKubectl: false,
+        sshAvailable: true,
+    },
+};
+/**
+ * Detect the active deployment profile.
+ * Priority: TALOS_PROFILE env > SANDBOX_MODE env > auto-detect
+ */
+export function detectProfile() {
+    const profileName = process.env.TALOS_PROFILE;
+    if (profileName && PROFILES[profileName]) {
+        return PROFILES[profileName];
+    }
+    const sandboxMode = process.env.SANDBOX_MODE;
+    if (sandboxMode === "mock")
+        return PROFILES.mock;
+    if (sandboxMode === "k8s")
+        return PROFILES["local-k3d"];
+    // Auto-detect: check if kubectl has a current context
+    try {
+        const { execSync } = require("node:child_process");
+        const ctx = execSync("kubectl config current-context 2>/dev/null", {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        if (ctx)
+            return PROFILES["local-k3d"];
+    }
+    catch {
+        // kubectl not available or no context
+    }
+    return PROFILES.mock;
+}

package/dist/index.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { authLoginCommand, authStatusCommand, authLogoutCommand } from "./commands/auth.js";
+import { upCommand } from "./commands/up.js";
+import { sshProxyCommand } from "./commands/ssh-proxy.js";
+const program = new Command();
+program
+    .name("talosd")
+    .description("Talos Deploy CLI — sandbox environments for Claude Code")
+    .version("0.1.0");
+// ── auth ──────────────────────────────────────────────────
+const authCmd = program
+    .command("auth")
+    .description("Manage authentication")
+    .action(async () => {
+    // Default: show status (like `gh auth`)
+    await authStatusCommand();
+});
+authCmd
+    .command("login")
+    .description("Login via browser")
+    .option("--force", "Force re-login even if already authenticated")
+    .action(async (opts) => {
+    if (opts.force)
+        clearConfigForced();
+    await authLoginCommand();
+});
+authCmd
+    .command("status")
+    .description("Show current auth status")
+    .action(async () => {
+    await authStatusCommand();
+});
+authCmd
+    .command("logout")
+    .description("Logout")
+    .action(() => {
+    authLogoutCommand();
+});
+// Backward compat: `talosd login` → `talosd auth login`
+program
+    .command("login")
+    .description("Login via browser (alias for auth login)")
+    .action(async () => {
+    await authLoginCommand();
+});
+// ── up ────────────────────────────────────────────────────
+program
+    .command("up")
+    .description("Create or wake your sandbox and connect via SSH")
+    .option("-p, --project <name>", "Project name", "default")
+    .action(async (opts) => {
+    await upCommand({ project: opts.project });
+});
+// ── ssh-proxy ─────────────────────────────────────────────
+// Used as SSH ProxyCommand: SSH client spawns this to relay traffic via WebSocket
+program
+    .command("ssh-proxy")
+    .description("SSH ProxyCommand relay — connect stdin/stdout to sandbox via WebSocket")
+    .requiredOption("--project <name>", "Project name")
+    .action(async (opts) => {
+    await sshProxyCommand(opts.project);
+});
+program.parse();
+// Helper for --force
+function clearConfigForced() {
+    const { clearConfig } = require("./config/index.js");
+    clearConfig();
+}

package/dist/lib/ssh.js

@@ -0,0 +1,185 @@
+import fs from "fs";
+import net from "net";
+import path from "path";
+import os from "os";
+import { execSync, spawn } from "child_process";
+import WebSocket from "ws";
+import { getSshKeyPath, loadConfig, getPortalUrl } from "../config/index.js";
+import { api } from "../api/client.js";
+// ── SSH key management ─────────────────────────────────
+export function ensureSshKey() {
+    const keyPath = getSshKeyPath();
+    if (!fs.existsSync(keyPath)) {
+        console.log("No SSH key found, generating one...");
+        execSync(`ssh-keygen -t ed25519 -f ${keyPath} -N ""`, { stdio: "pipe" });
+        console.log("SSH key generated.");
+    }
+}
+export async function uploadSshKey() {
+    const pubKeyPath = getSshKeyPath() + ".pub";
+    const pubKey = fs.readFileSync(pubKeyPath, "utf-8").trim();
+    const resp = await api("/api/ssh-keys", {
+        method: "POST",
+        body: JSON.stringify({ public_key: pubKey, name: "default" }),
+    });
+    return resp.ok;
+}
+// ── SSH relay via WebSocket ─────────────────────────────
+/**
+ * Establish an SSH relay through the Portal's WebSocket endpoint.
+ * Creates a local TCP server; when SSH connects, data is piped through
+ * WebSocket → Portal → Sandbox Manager → pod SSH.
+ */
+export function establishSshRelay(sandboxId) {
+    return new Promise((resolve, reject) => {
+        const config = loadConfig();
+        const portalUrl = getPortalUrl();
+        // Build WebSocket URL with auth token
+        const wsBaseUrl = portalUrl.replace(/^http/, "ws");
+        const tokenParam = config?.token ? `?token=${encodeURIComponent(config.token)}` : "";
+        const wsUrl = `${wsBaseUrl}/api/sandboxes/${sandboxId}/ssh${tokenParam}`;
+        const server = net.createServer();
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                reject(new Error("Failed to bind local server"));
+                return;
+            }
+            const port = addr.port;
+            server.on("connection", (tcpSocket) => {
+                // Connect WebSocket for this SSH session
+                const ws = new WebSocket(wsUrl);
+                let closed = false;
+                // Buffer TCP data until WebSocket is open
+                const pendingData = [];
+                const cleanupSocket = () => {
+                    if (closed)
+                        return;
+                    closed = true;
+                    try {
+                        ws.close();
+                    }
+                    catch { }
+                    try {
+                        tcpSocket.end();
+                    }
+                    catch { }
+                };
+                // Start listening for TCP data immediately (SSH sends handshake right away)
+                tcpSocket.on("data", (data) => {
+                    if (closed)
+                        return;
+                    if (ws.readyState === WebSocket.OPEN) {
+                        ws.send(data);
+                    }
+                    else {
+                        pendingData.push(data);
+                    }
+                });
+                // WebSocket → TCP
+                ws.on("message", (msg) => {
+                    if (!closed) {
+                        tcpSocket.write(msg);
+                    }
+                });
+                ws.on("open", () => {
+                    // Flush any data buffered while connecting
+                    while (pendingData.length > 0) {
+                        const d = pendingData.shift();
+                        ws.send(d);
+                    }
+                });
+                ws.on("error", (err) => {
+                    console.error(`WebSocket error: ${err.message}`);
+                    cleanupSocket();
+                });
+                ws.on("close", () => cleanupSocket());
+                tcpSocket.on("close", () => cleanupSocket());
+                tcpSocket.on("error", () => cleanupSocket());
+            });
+            resolve({
+                port,
+                cleanup: () => {
+                    server.close();
+                },
+            });
+        });
+        server.on("error", (err) => reject(err));
+    });
+}
+// ── Legacy: kubectl port-forward (kept as fallback) ────
+export function establishPortForward(podName, namespace) {
+    return new Promise((resolve, reject) => {
+        const { spawn } = require("child_process");
+        const pf = spawn("kubectl", ["port-forward", podName, "0:22", "-n", namespace], {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const timeout = setTimeout(() => {
+            pf.kill();
+            reject(new Error("port-forward timeout (15s)"));
+        }, 15_000);
+        const onPort = (data) => {
+            const match = data.toString().match(/Forwarding from\s+\d+\.\d+\.\d+\.\d+:(\d+)/);
+            if (match) {
+                clearTimeout(timeout);
+                const port = parseInt(match[1], 10);
+                resolve({
+                    port,
+                    cleanup: () => {
+                        pf.kill();
+                    },
+                });
+            }
+        };
+        pf.stdout.on("data", onPort);
+        pf.stderr.on("data", onPort);
+    });
+}
+// ── Binary path resolution ─────────────────────────────
+export function resolveTalosBinaryPath(execFn = execSync, argv = process.argv) {
+    try {
+        return execFn("which talosd").toString().trim();
+    }
+    catch {
+        return path.resolve(argv[1]);
+    }
+}
+// ── SSH config update ──────────────────────────────────
+export function updateSshConfig(project, binaryPath, sshConfigPath = path.join(os.homedir(), ".ssh/config")) {
+    let content = "";
+    if (fs.existsSync(sshConfigPath)) {
+        content = fs.readFileSync(sshConfigPath, "utf-8");
+    }
+    const hostAlias = `tt-${project}`;
+    const block = `\nHost ${hostAlias}\n` +
+        `  User coder\n` +
+        `  StrictHostKeyChecking no\n` +
+        `  UserKnownHostsFile /dev/null\n` +
+        `  IdentityFile ~/.ssh/id_ed25519\n` +
+        `  ProxyCommand ${binaryPath} ssh-proxy --project ${project}\n`;
+    const regex = new RegExp(`\n?Host ${hostAlias}\n(?:  .*\n)*`);
+    if (regex.test(content)) {
+        content = content.replace(regex, block);
+    }
+    else {
+        content += block;
+    }
+    fs.writeFileSync(sshConfigPath, content);
+}
+// ── SSH session ────────────────────────────────────────
+export function sshIntoSandbox(project, spawnFn = spawn) {
+    return new Promise((resolve, reject) => {
+        const ssh = spawnFn("ssh", [`tt-${project}`], { stdio: "inherit" });
+        ssh.on("close", (code) => {
+            if (code && code !== 0) {
+                reject(new Error(`SSH exited with code ${code}`));
+            }
+            else {
+                resolve();
+            }
+        });
+        ssh.on("error", (err) => {
+            reject(err);
+        });
+    });
+}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "talos-deploy",
+  "version": "0.0.3",
+  "description": "Talos Deploy CLI — sandbox environments for Claude Code",
+  "type": "module",
+  "bin": {
+    "talosd": "./dist/index.js"
+  },
+  "files": [
+    "dist/"
+  ],
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc && chmod +x dist/index.js",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/qiaolei1973/talos-deploy"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "commander": "^12.0.0",
+    "dotenv": "^17.4.2",
+    "eventsource": "^4.1.0",
+    "ws": "^8.21.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "@types/ws": "^8.18.1",
+    "tsx": "^4.0.0",
+    "typescript": "^5.5.0",
+    "vitest": "^3.2.6"
+  }
+}