0.6.0: quoted previews; --open prefilled add form (#26)

[edimarlnx]

Fixes #26. Entry point for tui-tools/tui-tailscale#32.

Release notes (0.6.0)

Every command preview is now shell-quoted (tui-kit v0.4.3): a rule whose comment carries a space or a parenthesis previews as ufw allow 19443/tcp comment 'headscale control (tailnet)', and the line pasted into a shell runs the same argv. On iptables a comment is no longer limited to one word. A new --open <port>/<proto>[,<port>/<proto>...] flag, with an optional --comment <text>, starts the UI in the add-rule form prefilled to allow each port in turn, one form and one confirm per port, still previewed; it is the hand-off target for another tool that has just found a port closed. Every screenshot is re-rendered with the kit's fixed box borders.

What changed

• tui-kit v0.4.3 (go get -u ./... only moved the kit). The UI tests expect the quoted previews; the nftables builder tests compare the raw nft words, since they pin nft syntax rather than shell quoting. runner.Fake.Outputs is not used anywhere in this repo, so no fake needed rekeying.
• iptables comments: the one-word limit existed only because the preview could not show a space. Now any single printable line up to 255 bytes is accepted, except " and \, which go through iptables-restore in the staged batch and the save.
• --open / --comment (cmd/tui-firewall/open.go):
  • Validated at start: a single port 1-65535, tcp or udp, no duplicates, the flag may be repeated; the comment is one line of at most 128 characters. --comment without --open, and --open with --check or --report, are refused. --check itself is unchanged.
  • Sequence, not a batch: one form and one confirm per port on every backend. esc skips a port, n declines it, and the next form follows after whatever closed the last one (yes, no, a staged change, a failed command).
  • Target group: ufw rule list; firewalld default zone (no rule comments there, so the form says --comment is not used); nftables inet tui / input, else the first input-hooked chain, and on an empty ruleset the forms wait until the chains are created with x; iptables filter INPUT of each family (v4 then v6 for each port).
  • --demo supports it (every demo backend).
• Tests: TestPreviewPastesAsTheSameArgv builds a rule on each of the four backends with a comment containing spaces, parentheses, ', $ and backticks (a rich rule with quotes for firewalld), feeds the preview to sh, and checks that the words match the argv the runner executes. There are also UI flow tests per backend and a restore round-trip test for the spaced iptables comment.
• README: --open section, install snippet rendered for 0.6.0, "stability": "beta" explicit in tool.json, new tui-firewall-open.png, and all PNGs re-rendered with kit v0.4.3.

Lab evidence (podman, driving the TUI in tmux)

tui-firewall --sudo '' --open 19443/tcp,41641/udp --comment 'headscale control (tailnet)', Enter + y per form:

• ubuntu:24.04, ufw 0.36.2: previews $ ufw allow 19443/tcp comment 'headscale control (tailnet)' and the same for 41641/udp. ufw status shows both rules, v4 and v6, # headscale control (tailnet). --check reads all four with the comment. Pasting the preview into bash gives Skipping adding existing rule, so it is the same argv.
• fedora:42 (systemd), firewalld 2.3.2: previews firewall-cmd --zone=public --add-port=19443/tcp + --permanent. firewall-cmd --list-ports and --permanent --list-ports both show 19443/tcp 41641/udp, and --check reads both in public.
• ubuntu:24.04, nftables 1.0.9 (empty ruleset): the status line says there is no input chain yet; x creates inet tui and its chains, with the quoted preview nft add chain inet tui input '{' type filter hook input priority 0 ';' policy accept ';' '}'. Then the forms open with previews nft add rule inet tui input tcp dport 19443 counter accept comment '"headscale control (tailnet)"'. nft list chain inet tui input shows both rules with the comment, the pasted preview adds an identical rule, and --check reads both.
• same container, iptables 1.8.10 (nf_tables) with a trailing REJECT: four forms (v4 and v6 per port), for example iptables -I INPUT 3 -p tcp -m tcp --dport 19443 -m comment --comment 'headscale control (tailnet)' -j ACCEPT, inserted before the REJECT. iptables -S and ip6tables -S show them with the comment, the pasted preview works, and --check reads all four. iptables-restore accepts a staged-style line with "staged (it's) fine".

make check (fmt, vet, exec boundary, golangci-lint 0 issues, tests) and make manifest pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MbCfX3T8khyd9hsrN5kMo3