@clawops/cli 0.2.0

package/README.md

@@ -0,0 +1,335 @@
+# clawops
+
+**clawops** is a provider-agnostic CLI for deploying and operating self-hosted [OpenClaw](https://github.com/openclaw/openclaw) instances across AWS, GCP, Azure, and local VMs. It uses the [Pulumi Automation API](https://www.pulumi.com/docs/using-pulumi/automation-api/) (embedded — no `pulumi` binary required) for idempotent infrastructure management and exposes every operation as both a CLI command and an [MCP](https://modelcontextprotocol.io/) tool, so Claude Code, Cursor, and other AI agents can drive deployments deterministically.
+
+```bash
+npm install -g @clawops/cli
+clawops init --provider aws
+clawops plan --out /tmp/my-plan.json   # generate + review
+clawops apply /tmp/my-plan.json        # apply after review
+clawops logs -f
+```
+
+---
+
+## Why clawops?
+
+Every existing OpenClaw deployment path is cloud-specific, Kubernetes-bound, or fully managed SaaS. No open-source tool unifies provisioning + lifecycle management + remote agent interaction across providers under a single CLI with first-class AI agent integration.
+
+| Capability | clawops |
+|---|---|
+| AWS, GCP, Azure, local VM | ✓ |
+| Idempotent infra via Pulumi (embedded) | ✓ |
+| SSH transport (pure Node — no system `ssh`) | ✓ |
+| MCP server (stdio + HTTP) | ✓ |
+| Plan → review → apply discipline | ✓ |
+| JSON output everywhere (`--json`) | ✓ |
+| No credentials in config | ✓ |
+
+---
+
+## Quick Start
+
+### Prerequisites
+
+- **Node.js ≥ 22** (LTS)
+- Cloud credentials available in the environment (see [Configuration](#configuration))
+
+### Install
+
+```bash
+npm install -g @clawops/cli
+# or without a global install:
+npx @clawops/cli
+```
+
+### Provision on AWS
+
+```bash
+# Write ~/.clawops/config.json and generate an SSH key pair
+clawops init --provider aws
+
+# Edit ~/.clawops/config.json — set stateUrl to your S3 bucket:
+#   "stateUrl": "s3://my-clawops-state"
+
+# Generate a deploy plan (runs pulumi preview internally)
+clawops plan --provider aws --stack default --out /tmp/plan.json
+
+# Review the plan JSON, then apply
+clawops apply /tmp/plan.json
+
+# Or preview + apply in one step (no plan file needed)
+clawops up
+```
+
+### Day-to-day operations
+
+```bash
+clawops status              # Show stack outputs: IP, gateway URL, SSH info
+clawops logs -f             # Tail OpenClaw logs over SSH
+clawops ssh                 # Open an interactive SSH session
+clawops ssh --command "docker ps"
+
+clawops config get maxAgents
+clawops config set maxAgents 8
+
+clawops tunnel              # Port-forward gateway UI to localhost
+
+clawops destroy --yes       # Destroy cloud-provider stack (AWS/GCP/Azure)
+clawops down --yes          # Destroy local-provider stack
+```
+
+---
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `init` | Interactive setup wizard — writes config, generates SSH key pair |
+| `up` | Provision or update stack (`--dry-run` for preview) |
+| `down` | Destroy local-provider stack (requires `--yes`; `--dry-run` shows current outputs) |
+| `destroy` | Destroy cloud-provider stack with confirmation prompt (`--dry-run` shows current outputs) |
+| `status` | Show stack outputs: IP, gateway URL, region, provisioned time |
+| `plan` | Generate a Maker deploy-plan JSON artifact (dry-run safe) |
+| `apply` | Apply a previously reviewed plan file (`--dry-run` validates and shows diff without applying) |
+| `ssh` | Interactive SSH session or run a remote command |
+| `logs` | Stream OpenClaw logs (`-f`, `--tail N`, `--since 5m`) |
+| `tunnel` | Local port-forward to gateway UI over SSH |
+| `config` | Get/set remote OpenClaw config values (`--dry-run` shows would-write JSON) |
+| `agents` | List or restart OpenClaw agents |
+| `gateway` | Restart the OpenClaw gateway service |
+| `backup` | Create or restore an OpenClaw state backup |
+| `stacks` | List named stacks and their state |
+| `doctor` | Check Node version, config, SSH key, provider credentials, and Pulumi home |
+| `mcp` | Start the embedded MCP server (`mcp serve`) |
+
+Full flag reference: `clawops <command> --help`
+
+---
+
+## Plan → Apply workflow
+
+For non-local providers, clawops enforces a review-before-apply discipline:
+
+```bash
+# 1. Generate a plan — runs `pulumi preview` internally, produces JSON
+clawops plan --provider aws --region us-east-1 --out /tmp/plan.json
+
+# 2. Review plan.json — it shows exactly which resources will change
+cat /tmp/plan.json | jq .diff
+
+# 3. Apply — reads and validates the plan file, then runs `pulumi up`
+clawops apply /tmp/plan.json
+
+# Without --yes, apply prompts: "Continue? (y/N)"
+clawops apply /tmp/plan.json --yes    # skip prompt in automation
+```
+
+The plan JSON conforms to `spec/deploy-plan.schema.json` (AJV-validated). Plans are portable — generated on one machine, applied on another.
+
+---
+
+## MCP server
+
+clawops ships an embedded [MCP](https://modelcontextprotocol.io/) server. Claude Code, Cursor, and any MCP-compatible agent can drive deployments without leaving the chat interface.
+
+### Stdio mode (Claude Code / VS Code)
+
+Add to your Claude Code MCP config (`~/.claude.json` or project `.mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "clawops": {
+      "command": "clawops",
+      "args": ["mcp", "serve"]
+    }
+  }
+}
+```
+
+### HTTP mode (remote / multi-client)
+
+```bash
+clawops mcp serve --http --port 3333 --bind 127.0.0.1
+# MCP HTTP server listening on 127.0.0.1:3333
+```
+
+Point your MCP client at `http://127.0.0.1:3333`.
+
+### Available tools
+
+| Tool | Toolset | Description |
+|---|---|---|
+| `clawops_up` | cli | Provision or update a stack |
+| `clawops_status` | read | Show stack outputs |
+| `clawops_logs_tail` | read | Tail OpenClaw logs |
+| `clawops_ssh_exec` | cli | Run a command over SSH |
+| `clawops_plan` | cli | Generate a deploy plan |
+| `clawops_apply` | cli | Apply a plan file |
+| `clawops_destroy` | cli | Destroy a stack (elicits confirmation) |
+| `clawops_config_get` | read | Read a remote config value |
+| `clawops_config_set` | cli | Write a remote config value |
+| `clawops_agents_list` | read | List running agents |
+| `clawops_stacks_list` | admin | List all stacks and their state |
+| `clawops_task_status` | read | Poll a long-running task |
+| `clawops_workflow_deploy_app` | workflow | End-to-end deploy: plan → confirm → apply → status |
+
+Destructive tools require explicit confirmation (R19 elicitation) unless `yes: true` is passed.
+
+---
+
+## Configuration
+
+Config lives at `~/.clawops/config.json` (override with `$CLAWOPS_HOME`).
+
+```json
+{
+  "version": 1,
+  "defaults": {
+    "provider": "aws",
+    "stack": "default"
+  },
+  "stacks": {
+    "default": {
+      "provider": "aws",
+      "region": "us-east-1",
+      "stateUrl": "s3://my-clawops-state"
+    }
+  },
+  "ssh": {
+    "keyPath": "~/.clawops/id_ed25519",
+    "knownHostsPath": "~/.clawops/known_hosts"
+  }
+}
+```
+
+**Cloud credentials are never stored in config** — clawops reads them from the environment:
+
+| Provider | Credential source |
+|---|---|
+| AWS | `AWS_PROFILE` or standard AWS credential chain (`~/.aws/credentials`) |
+| GCP | `GOOGLE_APPLICATION_CREDENTIALS` or `gcloud auth application-default login` |
+| Azure | `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET` or `az login` |
+| Local | SSH host + key configured in `stacks[name].localOpts` |
+
+---
+
+## Architecture
+
+```
+clawops
+├── src/cli/          citty-based commands (one file per verb)
+├── src/config/       ~/.clawops/config.json management
+├── src/providers/    Cloud adapters (AWS, GCP, Azure, local)
+│   ├── aws/          Pulumi inline program + ProviderAdapter
+│   ├── gcp/
+│   ├── azure/
+│   └── local/        SSH bootstrap (no Pulumi)
+├── src/pulumi/       Pulumi Automation API wrapper + output helpers
+├── src/transport/    SSH client (ssh2) + connection pool + tunnels
+├── src/mcp/          MCP server, tool handlers, progress tracking
+├── src/plan/         Maker plan generation, AJV validation, apply
+├── src/output/       ASCII table, spinner, JSON, human-readable output
+├── src/errors/       Typed error hierarchy with exit codes
+└── spec/             Machine-readable ground truth (JSON Schema, YAML)
+```
+
+Key design decisions:
+
+- **Pulumi Automation API (embedded):** no `pulumi` binary required; Pulumi home is sandboxed to `~/.clawops/.pulumi`; stack programs are inline TypeScript closures
+- **State in cloud blob storage:** GCS (`gs://`), S3 (`s3://`), Azure Blob — no local state files, no `pulumi.yaml`
+- **SSH via `ssh2`:** never shells out to `/usr/bin/ssh`; TOFU host verification against `~/.clawops/known_hosts`; connection pool with 5-min idle TTL
+- **Plan → apply discipline:** every non-local deployment goes through `generatePlan()` → review → `applyPlan()`; destructive changes always require human review of the plan JSON
+- **MCP-first:** every CLI operation has a typed MCP tool; schemas generated from `spec/mcp-tools.yaml`; all destructive tools use R19 elicitation
+
+See [`docs/architecture.md`](docs/architecture.md) for a full narrative, and [`docs/decisions/`](docs/decisions/) for ADRs.
+
+---
+
+## Development
+
+### Setup
+
+```bash
+git clone https://github.com/dfridkin/clawops.git
+cd clawops
+# Node 22+ required; use nvm: nvm use
+pnpm install
+pnpm dev doctor        # verify toolchain
+```
+
+### Scripts
+
+```bash
+pnpm dev                   # run CLI from src/ via tsx
+pnpm build                 # tsup → dist/
+pnpm test                  # vitest (356 tests, ~2s)
+pnpm test:changed          # vitest --changed (fast edit loop)
+pnpm typecheck             # tsc --noEmit
+pnpm lint                  # eslint src/ tests/ scripts/ (--max-warnings=0)
+pnpm gen:schemas           # regenerate src/providers/types.ts + src/mcp/tools/_generated.ts
+pnpm gen:schemas --check   # CI guard: committed generated files match spec
+pnpm changeset             # record a release note before merging
+```
+
+### Project layout
+
+| Path | Purpose |
+|---|---|
+| `spec/` | Machine-readable ground truth: JSON Schema, YAML. **Treat as source of truth.** |
+| `SPEC.md` | Full technical specification (milestones, rules, schemas) |
+| `DESIGN_RULES.md` | 25 normative rules (R1–R25) referenced throughout the codebase |
+| `docs/architecture.md` | Narrative system overview |
+| `docs/ci.md` | CI integration guide: OIDC, env vars, plan → apply in CI |
+| `docs/decisions/` | Architecture Decision Records |
+| `.claude/skills/` | Invokable procedures: `/add-provider`, `/release`, `/tdd`, `/mcp-tool` |
+| `.claude/rules/` | Path-scoped lint rules loaded by Claude Code |
+
+### Code generation
+
+Two files are generated from `spec/` and must not be hand-edited:
+
+- `src/providers/types.ts` — `ProviderAdapter` interface from `spec/providers.schema.json`
+- `src/mcp/tools/_generated.ts` — Zod schemas and type exports from `spec/mcp-tools.yaml`
+
+Run `pnpm gen:schemas` after modifying either spec file. CI enforces this with `--check`.
+
+### Adding a provider
+
+Use the `/add-provider` skill in Claude Code, or follow [`src/providers/CLAUDE.md`](src/providers/CLAUDE.md). Every adapter must satisfy `ProviderAdapter` in `src/providers/types.ts` — do not relax the schema to fit the adapter.
+
+### Adding an MCP tool
+
+Use the `/mcp-tool` skill. The skill adds the tool to `spec/mcp-tools.yaml`, runs `pnpm gen:schemas`, creates the handler in `src/mcp/tools/<toolset>/<name>.ts`, and wires it into the registry. All four annotation hints (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) are required on every tool.
+
+### Conventional commits
+
+```
+feat(scope): description
+fix(scope): description
+docs / refactor / chore / test / perf / ci
+```
+
+Use `pnpm changeset` to record a release note before merging a `feat` or `fix`.
+
+---
+
+## Milestones
+
+| Milestone | Status | What ships |
+|---|---|---|
+| M0 — Scaffold | ✅ | Tooling, CI, stubs, generated types |
+| M1 — GCP MVP | ✅ | `init` / `up` / `down` / `status` / `ssh` / `logs` on GCP |
+| M2 — Remote Mgmt | ✅ | `tunnel`, `config`, `agents`, `gateway`; SSH connection pool |
+| M3 — AWS + Azure | ✅ | AWS EC2 + Azure VM adapters; `stacks list` |
+| M4 — Local VM | ✅ | Local adapter (SSH bootstrap, no Pulumi); `doctor` |
+| M5 — MCP Layer | ✅ | `mcp serve` (stdio), all CLI ops as MCP tools, progress tracking |
+| M6 — Plan/Apply | ✅ | `plan` + `apply`; deploy-plan schema; MCP HTTP transport; `workflow_deploy_app` |
+| M7 — v1.0 Polish | ✅ | Full `doctor` surface; `destroy` command; `--dry-run` on `up`/`down`/`destroy`/`apply`/`config`; `release.yml`; CI integration guide |
+
+---
+
+## License
+
+MPL-2.0 — see [LICENSE](LICENSE).

package/dist/apply-GTVALBAY.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  applyPlan
+} from "./chunk-RZE35FQF.js";
+import "./chunk-PERSDQMT.js";
+import "./chunk-PRYLTCS4.js";
+import "./chunk-YTH4L2GN.js";
+import "./chunk-ALSUDYA7.js";
+import "./chunk-ZSE4QRKE.js";
+export {
+  applyPlan
+};

package/dist/automation-JG2YBEL7.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import {
+  getConfigDir
+} from "./chunk-ALSUDYA7.js";
+import "./chunk-ZSE4QRKE.js";
+
+// src/pulumi/automation.ts
+import path from "path";
+import { LocalWorkspace } from "@pulumi/pulumi/automation";
+async function getOrCreateStack(opts) {
+  const configDir = opts.configDir ?? getConfigDir();
+  return await LocalWorkspace.createOrSelectStack(
+    {
+      stackName: opts.stack,
+      projectName: "clawops",
+      program: opts.program
+    },
+    {
+      pulumiHome: path.join(configDir, ".pulumi"),
+      envVars: {
+        PULUMI_BACKEND_URL: opts.stateUrl,
+        PULUMI_SKIP_UPDATE_CHECK: "1"
+        // R6: cloud credentials inherited from process.env, never set here
+      }
+    }
+  );
+}
+export {
+  getOrCreateStack
+};

package/dist/aws-A3323GNM.js

@@ -0,0 +1,285 @@
+#!/usr/bin/env node
+
+// src/providers/aws/index.ts
+import process2 from "process";
+
+// src/providers/aws/program.ts
+var GATEWAY_PORT = 18789;
+var SSH_PORT = 22;
+var awsProgram = async () => {
+  const [pulumi, aws, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+    import("@pulumi/pulumi"),
+    import("@pulumi/aws"),
+    import("./firewall-YYDOWDDP.js")
+  ]);
+  const cfg = new pulumi.Config();
+  const instanceType = cfg.get("instanceType") ?? "t3.small";
+  const region = cfg.get("region") ?? "us-east-1";
+  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const accessMode = cfg.get("accessMode") ?? "restricted";
+  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
+  const sshCidrs = cfg.get("sshCidrs") ?? "";
+  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
+  const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
+  const sshPublicKey = cfg.get("sshPublicKey");
+  if (!sshPublicKey) {
+    throw new Error(
+      'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
+    );
+  }
+  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  if (accessMode === "open") {
+    process.stderr.write(
+      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
+    );
+  }
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const vpc = new aws.ec2.Vpc("clawops-vpc", {
+    cidrBlock: "10.0.0.0/16",
+    enableDnsHostnames: true,
+    enableDnsSupport: true,
+    tags: { Name: "clawops" }
+  });
+  const igw = new aws.ec2.InternetGateway("clawops-igw", {
+    tags: { Name: "clawops" }
+  });
+  new aws.ec2.InternetGatewayAttachment("clawops-igw-attach", {
+    vpcId: vpc.id,
+    internetGatewayId: igw.id
+  });
+  const subnet = new aws.ec2.Subnet("clawops-subnet", {
+    vpcId: vpc.id,
+    cidrBlock: "10.0.1.0/24",
+    mapPublicIpOnLaunch: false,
+    availabilityZone: pulumi.interpolate`${region}a`,
+    tags: { Name: "clawops" }
+  });
+  const routeTable = new aws.ec2.RouteTable("clawops-rt", {
+    vpcId: vpc.id,
+    tags: { Name: "clawops" }
+  });
+  new aws.ec2.Route("clawops-route", {
+    routeTableId: routeTable.id,
+    destinationCidrBlock: "0.0.0.0/0",
+    gatewayId: igw.id
+  });
+  new aws.ec2.RouteTableAssociation("clawops-rta", {
+    subnetId: subnet.id,
+    routeTableId: routeTable.id
+  });
+  const ingressRules = [
+    ...sshIngressCidrs.map((cidr) => ({
+      protocol: "tcp",
+      fromPort: SSH_PORT,
+      toPort: SSH_PORT,
+      cidrBlocks: [cidr],
+      description: "SSH"
+    })),
+    ...gatewayIngressCidrs.map((cidr) => ({
+      protocol: "tcp",
+      fromPort: GATEWAY_PORT,
+      toPort: GATEWAY_PORT,
+      cidrBlocks: [cidr],
+      description: "OpenClaw gateway"
+    }))
+  ];
+  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
+    vpcId: vpc.id,
+    ingress: ingressRules,
+    egress: [{
+      protocol: "-1",
+      fromPort: 0,
+      toPort: 0,
+      cidrBlocks: ["0.0.0.0/0"],
+      description: "Allow all egress"
+    }],
+    tags: { Name: "clawops" }
+  });
+  const role = new aws.iam.Role("clawops-role", {
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [{
+        Effect: "Allow",
+        Principal: { Service: "ec2.amazonaws.com" },
+        Action: "sts:AssumeRole"
+      }]
+    }),
+    tags: { Name: "clawops" }
+  });
+  new aws.iam.RolePolicyAttachment("clawops-ssm", {
+    role: role.name,
+    policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+  });
+  if (bedrockEnabled) {
+    new aws.iam.RolePolicyAttachment("clawops-bedrock", {
+      role: role.name,
+      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockReadOnly"
+    });
+  }
+  const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
+    role: role.name
+  });
+  const keyPair = new aws.ec2.KeyPair("clawops-keypair", {
+    publicKey: sshPublicKey,
+    tags: { Name: "clawops" }
+  });
+  const ami = await aws.ec2.getAmi({
+    mostRecent: true,
+    owners: ["099720109477"],
+    // Canonical
+    filters: [
+      { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
+      { name: "virtualization-type", values: ["hvm"] }
+    ]
+  });
+  const instance = new aws.ec2.Instance("clawops-instance", {
+    ami: ami.id,
+    instanceType,
+    subnetId: subnet.id,
+    vpcSecurityGroupIds: [sg.id],
+    iamInstanceProfile: instanceProfile.name,
+    keyName: keyPair.keyName,
+    userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    tags: { Name: "clawops" }
+  });
+  const eip = new aws.ec2.Eip("clawops-eip", {
+    domain: "vpc",
+    tags: { Name: "clawops" }
+  });
+  new aws.ec2.EipAssociation("clawops-eip-assoc", {
+    instanceId: instance.id,
+    allocationId: eip.id
+  });
+  return {
+    instanceId: instance.id,
+    publicIp: eip.publicIp,
+    gatewayUrl: pulumi.interpolate`https://${eip.publicIp}:${GATEWAY_PORT}`,
+    sshHost: eip.publicIp,
+    sshPort: SSH_PORT,
+    sshUser: "ubuntu",
+    region,
+    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+};
+function makeStartupScript(openclawVersion, bedrockEnabled) {
+  const bedrockEnvFile = bedrockEnabled ? `
+# Write AWS_PROFILE for Bedrock
+echo "AWS_PROFILE=default" > /etc/openclaw.env
+` : "";
+  return `#!/bin/bash
+set -euo pipefail
+
+# Create clawops user with SSH access
+id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
+mkdir -p /home/clawops/.ssh
+chmod 700 /home/clawops/.ssh
+chown clawops:clawops /home/clawops/.ssh
+
+# Install Docker if not present
+if ! command -v docker &>/dev/null; then
+  apt-get update -q
+  apt-get install -y -q ca-certificates curl gnupg lsb-release
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
+    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  chmod a+r /etc/apt/keyrings/docker.gpg
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
+    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -q
+  apt-get install -y -q docker-ce docker-ce-cli containerd.io
+  systemctl enable --now docker
+fi
+
+usermod -aG docker clawops
+${bedrockEnvFile}
+# Pull OpenClaw image
+OPENCLAW_VERSION="${openclawVersion}"
+docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+
+# Create default openclaw.json if not present
+OPENCLAW_CONFIG=/home/clawops/openclaw.json
+if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
+  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
+{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+OPENCLAWJSON
+  chown clawops:clawops "\${OPENCLAW_CONFIG}"
+fi
+
+# Start OpenClaw container
+docker stop openclaw 2>/dev/null || true
+docker rm   openclaw 2>/dev/null || true
+docker run -d \\
+  --name openclaw \\
+  --restart unless-stopped \\
+  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
+  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
+  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+`;
+}
+
+// src/providers/aws/index.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "t3.micro",
+  small: "t3.small",
+  medium: "t3.medium",
+  large: "t3.large",
+  gpu: "g4dn.xlarge"
+};
+var awsAdapter = {
+  name: "aws",
+  get program() {
+    return awsProgram;
+  },
+  getConnectionInfo(outputs) {
+    return {
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "ubuntu"),
+      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
+      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
+    };
+  },
+  normalizeInstanceType(alias) {
+    const mapped = INSTANCE_TYPE_MAP[alias];
+    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
+    return mapped;
+  },
+  defaultRegion() {
+    return "us-east-1";
+  },
+  stateBackendUrl(bucket) {
+    return `s3://${bucket}`;
+  },
+  async validateConfig() {
+    const errors = [];
+    const hasProfile = Boolean(process2.env["AWS_PROFILE"]);
+    const hasKeyId = Boolean(process2.env["AWS_ACCESS_KEY_ID"]);
+    const hasOidc = Boolean(process2.env["AWS_ROLE_ARN"] && process2.env["AWS_WEB_IDENTITY_TOKEN_FILE"]);
+    if (!hasProfile && !hasKeyId && !hasOidc) {
+      const onAws = await checkImds();
+      if (!onAws) {
+        errors.push(
+          "No AWS credentials found. Set AWS_PROFILE, AWS_ACCESS_KEY_ID, or AWS_ROLE_ARN + AWS_WEB_IDENTITY_TOKEN_FILE, or run on an EC2 instance with an IAM instance role."
+        );
+      }
+    }
+    return { ok: errors.length === 0, errors };
+  }
+};
+async function checkImds() {
+  try {
+    const res = await fetch(
+      "http://169.254.169.254/latest/meta-data/instance-id",
+      { signal: AbortSignal.timeout(1e3) }
+    );
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+var aws_default = awsAdapter;
+export {
+  aws_default as default
+};