* Validate rendered cloud-init templates against official schema
Add jsonschema dev dependency and two new tests that render the Jinja2
cloud-init template (with and without Tailscale) then validate the
output against canonical/cloud-init's JSON schema. Tests skip gracefully
when the network is unavailable.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Pin cloud-init schema to 22.4.2 and load from local test data
Replace the network-fetched schema (from cloud-init main) with a local
copy pinned to version 22.4.2 — the oldest cloud-init shipped by any
currently supported DigitalOcean image (Debian 12 bookworm). This
addresses review feedback to avoid validating against a schema newer
than what target distros actually support, and removes the network
dependency so tests work offline.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Auto power-on after resize and add 'nodisk' confirmation option
DigitalOcean leaves droplets powered off after resize, with no API flag
to auto-restart. Previously, `dropkit resize` completed silently with
the droplet off — users had to discover this and run `dropkit on`
manually.
Now the resize command:
1. Automatically powers the droplet back on after resize completes,
using the same pattern as `dropkit on` (with status polling and
progress messages).
2. Offers a "nodisk" answer in the confirmation prompt when disk resize
would increase disk size. This supports the common workflow of
temporarily scaling up CPU/RAM for heavy builds or benchmarks and
scaling back down later — which requires NOT resizing the disk
(disk resize is permanent and prevents future downsizing).
The prompt changes from:
Are you sure? [yes/no]
to:
Are you sure? [yes/nodisk/no]
with a tip explaining the option. The "nodisk" choice only appears
when relevant (disk flag is true AND new size has larger disk).
Expected terminal experience after resize:
✓ Resize completed successfully
Powering on droplet...
✓ Power on action started (ID: 3105287233)
Waiting for droplet to power on...
✓ Droplet powered on successfully
Droplet claude-code-box has been resized to s-2vcpu-4gb and is now active
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Make disk resize an interactive option when not specified via flag
Per reviewer feedback, instead of a "nodisk" escape hatch in the
confirmation prompt, make --disk/--no-disk a tri-state (True/False/None).
When neither flag is passed, the user is asked interactively — consistent
with how region, size, and image are already handled.
The interactive question only appears when the new size has a different
disk size. It defaults to "no" (skip disk resize) since disk resize
is permanent and prevents future downsizing.
Flow with no flags:
Changes:
Disk: 25 GB → 80 GB (+55 GB)
Disk resize is PERMANENT and cannot be undone.
Skipping disk resize keeps the option to downsize later.
Resize disk too? [yes/no] (no):
Flow with --no-disk: skips the question, shows "not resized"
Flow with --disk: skips the question, proceeds with disk resize
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Move interactive disk question before table display and drop isinstance guards
Address ret2libc's review feedback:
- Ask the interactive disk question BEFORE building the changes table,
so the displayed disk row reflects the user's actual choice
- Remove unnecessary isinstance(disk_diff, int) guards since disk_diff
is always int (computed with an isinstance ternary that defaults to 0)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The cloud-init template hardcoded the Docker APT repo URL for Ubuntu,
which breaks on Debian images (e.g. Debian 13 "trixie"). Replace the
static apt.sources block with a runcmd script that detects the distro
via /etc/os-release and configures the correct Docker repo dynamically.
Also uses dpkg --print-architecture instead of hardcoding amd64.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add E2E lifecycle test for create/destroy workflow
Bash script that exercises the full droplet lifecycle: create (no
Tailscale), verify SSH config, run commands over SSH, destroy, and
verify cleanup
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dm <alexis.challande@trailofbits.com>
* Show actual disk size instead of size spec in resize command
After a --no-disk resize, `dropkit resize` showed the size spec's disk
(e.g. 80 GB for s-2vcpu-4gb) instead of the droplet's actual disk
(25 GB). This is confusing for users planning temporary scale-ups —
they need to see their real disk to know if they can scale back down.
Read disk from `droplet["disk"]` (actual allocation) instead of
`droplet["size"]["disk"]` (what the size tier offers). When the two
differ, show an inline hint: "25 GB (size spec: 80 GB, disk was not
resized)" so the situation is immediately clear.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Use actual droplet vcpus and memory, not just disk
Read all three resource fields from the droplet object directly
(droplet["vcpus"], droplet["memory"], droplet["disk"]) instead of
from the size spec (droplet["size"]["vcpus"], etc.). After a
--no-disk resize these can diverge — the size spec reflects the
new tier while the droplet retains its original resources.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Show per-resource and total monthly costs in the list/ls command so
engineers can see at a glance what their infrastructure is costing.
* Droplet cost from DO API size object (price_monthly field)
* Snapshot cost calculated at $0.06/GB/month (DO standard rate)
* Total cost shown in summary line at the bottom
* --cost/--no-cost flag to toggle the column (shown by default)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Offer to delete leftover hibernation snapshot on droplet destroy
When a user hibernates a droplet then wakes it up but declines to delete
the snapshot, the snapshot is left behind. If they later `dropkit destroy`
the droplet, the orphaned snapshot persists silently, incurring storage
costs. After destroying the droplet, check for a matching hibernation
snapshot and prompt the user to delete it.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Change snapshot deletion default to 'no' in destroy command
Respect the user's earlier choice: if they declined to delete the
snapshot during wakeup, defaulting to 'yes' here would second-guess
that decision. Default to 'no' so the prompt is informational rather
than presumptive.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update default Ubuntu image from 25.04 to 25.10
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Extract default region/size/image slugs into constants
Replace duplicated hardcoded strings across config.py, main.py, and
tests with DEFAULT_REGION, DEFAULT_SIZE, and DEFAULT_IMAGE constants
defined in config.py.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Remove escaped chars in comments
* Add Jinja2 template validation test and pre-commit hook
Catch template syntax errors early with a unit test that parses and
renders the default cloud-init template, and a pre-commit hook that
validates all templates in dropkit/templates/ on change.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Jinja2 escaping of zsh PROMPT in cloud-init template
The zsh PROMPT string contains `%` sequences that Jinja2 interprets
as template syntax. Wrap in {% raw %}...{% endraw %} to preserve
the literal prompt definition.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add a warning to the cloud-init jinja template
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Ran /claude-md-management:revise-claude-md to audit CLAUDE.md against
the actual codebase. The file-level tree was stale (missing lock.py,
ui.py, version_check.py and several test files). Replace with a
directory-only layout that won't drift when files are added.
Also document the --cov-fail-under=29 threshold from pyproject.toml.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a Tailscale IP column to `dropkit ls` output. The IP is read from
the SSH config — if the configured hostname is a Tailscale IP (100.x.x.x),
it's displayed; otherwise shows "—".
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Update both `prepare_for_hibernate` and `destroy` to switch SSH config
to the droplet's public IP before logging out of Tailscale. Previously,
the Tailscale logout happened first, which killed the Tailscale IP route
that SSH was using — causing the logout command itself to hang or fail.
Also adds `--verbose` flag to the `hibernate` command.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* allow resizing hibernated droplets by modifying the size tag
* Prevent removal of protected tags (owner, firewall) in untag_resource
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Fix macOS Tailscale CLI discovery for App Store installs
On macOS, Tailscale installed via the App Store places its CLI at
/Applications/Tailscale.app/Contents/MacOS/Tailscale, which is not in
PATH. Add find_tailscale_cli() helper that checks PATH first, then
falls back to the macOS App Store location on darwin.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Address PR feedback: better error message, remove excessive test
Distinguish "Tailscale not found" from "not running" when the local
check fails, so users know whether to install or start Tailscale.
Remove the overly comprehensive binary_vanishes race condition test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Rename .claude/settings.local.json to .claude/settings.json
- Add .claude/settings.local.json to .gitignore
- Replace uv run tobcloud with uv run dropkit in permissions
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Generalize email domain handling in documentation and tests
- Add .worktrees/ to .gitignore for git worktree support
- Update _sanitize_email_for_username docstring to be domain-agnostic
- Change CLAUDE.md example from trailofbits.com to example.com
- Add tests for google.com, gmail.com, corporate, and plus addressing
The code already supported any email domain; this updates docs and
tests to reflect that capability.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Address PR review comments
- Remove redundant trailofbits.com regex, simplify to split("@")[0]
- Rename test to clarify backwards compatibility intent
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
Replace manual file parsing with ssh-keygen -R which properly handles
both hashed (|1|...) and unhashed entries. macOS and many Linux systems
use HashKnownHosts by default, making the previous implementation unable
to remove entries.
Changes:
- Use ssh-keygen -R for each hostname instead of parsing the file
- Detect successful removal via "updated" in stdout
- Backup files are now .old (ssh-keygen default) instead of .bak
- Bracketed entries ([host]:port) now require exact format
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Rename tobcloud references to dropkit in tests
Update test data and test method names to use the new project name.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Format test_ssh_config.py
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
dependabot[bot]