Полный продовый фикс fix22: DNS preflight, inet firewall, idempotent bootstrap, auth-semantics и redact-config

orchestrator/src/cli.ts

@@ -3,6 +3,7 @@ import { reconfigure, repair } from "./commands/reconfigure";
 import { doctor } from "./commands/doctor";
 import { status } from "./commands/status";
 import { diagnosticsCollect } from "./commands/diagnostics";
+import { redactConfig, type RedactConfigFormat } from "./commands/redact-config";
 import type { InstallOptions, ReconfigureOptions } from "./types/context";
 
 function usage(): never {
@@ -13,10 +14,65 @@ function usage(): never {
   console.error("  hy2xs-orchestrator doctor --package-dir <path> [--config <path>] [--skip-firewall] [--skip-service-start] [--skip-smoke]");
   console.error("  hy2xs-orchestrator status --package-dir <path> [--config <path>] [--skip-firewall] [--skip-service-start] [--skip-smoke]");
   console.error("  hy2xs-orchestrator diagnostics collect --package-dir <path> [--config <path>] [--skip-firewall] [--skip-service-start] [--skip-smoke]");
+  console.error("  hy2xs-orchestrator redact-config --config <path> [--in-place | --out <path>] [--format auto|env|yaml]");
   console.error("  note: --skip-start is deprecated alias for --skip-service-start --skip-smoke");
   process.exit(2);
 }
 
+function parseRedactConfigOptions(args: string[]): {
+  configPath: string;
+  outPath: string;
+  inPlace: boolean;
+  format: RedactConfigFormat;
+} {
+  let configPath = "";
+  let outPath = "";
+  let inPlace = false;
+  let format: RedactConfigFormat = "auto";
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    switch (arg) {
+      case "--config":
+        configPath = takeValue(args, i, arg);
+        i += 1;
+        break;
+      case "--out":
+        outPath = takeValue(args, i, arg);
+        i += 1;
+        break;
+      case "--in-place":
+        inPlace = true;
+        break;
+      case "--format": {
+        const value = takeValue(args, i, arg);
+        if (value !== "auto" && value !== "env" && value !== "yaml") {
+          console.error(`invalid --format value: ${value}`);
+          usage();
+        }
+        format = value;
+        i += 1;
+        break;
+      }
+      default:
+        console.error(`Unknown argument: ${arg}`);
+        usage();
+    }
+  }
+
+  if (!configPath) {
+    console.error("Missing --config");
+    usage();
+  }
+
+  if (inPlace === (outPath !== "")) {
+    console.error("Specify exactly one of --in-place or --out <path>");
+    usage();
+  }
+
+  return { configPath, outPath, inPlace, format };
+}
+
 function takeValue(args: string[], index: number, flag: string): string {
   const value = args[index + 1];
   if (!value || value.startsWith("--")) {
@@ -76,6 +132,11 @@ function parseInstallOptions(args: string[]): InstallOptions {
     usage();
   }
 
+  if (options.skipSmoke && process.env.HY2XS_BREAK_GLASS !== "1") {
+    console.error("--skip-smoke is break-glass only. Set HY2XS_BREAK_GLASS=1 to continue.");
+    usage();
+  }
+
   return options;
 }
 
@@ -139,6 +200,11 @@ function parseReconfigureOptions(args: string[]): ReconfigureOptions {
     usage();
   }
 
+  if (options.skipSmoke && process.env.HY2XS_BREAK_GLASS !== "1") {
+    console.error("--skip-smoke is break-glass only. Set HY2XS_BREAK_GLASS=1 to continue.");
+    usage();
+  }
+
   return options;
 }
 
@@ -178,6 +244,10 @@ async function main(): Promise<void> {
     await diagnosticsCollect(parseCommonOptions(rest));
     return;
   }
+  if (command === "redact-config") {
+    await redactConfig(parseRedactConfigOptions(args));
+    return;
+  }
   usage();
 }