@clawops/cli 0.2.0

package/dist/azure-LNWBK2ZI.js

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+
+// src/providers/azure/index.ts
+import process2 from "process";
+
+// src/providers/azure/program.ts
+var GATEWAY_PORT = 18789;
+var SSH_PORT = 22;
+var azureProgram = async () => {
+  const [pulumi, azure, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+    import("@pulumi/pulumi"),
+    import("@pulumi/azure-native"),
+    import("./firewall-YYDOWDDP.js")
+  ]);
+  const cfg = new pulumi.Config();
+  const stackName = pulumi.getStack();
+  const instanceType = cfg.get("instanceType") ?? "Standard_B2s";
+  const location = cfg.get("region") ?? "eastus";
+  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const accessMode = cfg.get("accessMode") ?? "restricted";
+  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
+  const sshCidrs = cfg.get("sshCidrs") ?? "";
+  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
+  const keyVaultEnabled = cfg.get("keyVaultEnabled") === "true";
+  const resourceGroupName = cfg.get("resourceGroupName") ?? `clawops-${stackName}`;
+  const sshPublicKey = cfg.get("sshPublicKey");
+  if (!sshPublicKey) {
+    throw new Error(
+      'Stack config "sshPublicKey" is required for the Azure adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
+    );
+  }
+  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : "";
+  if (accessMode === "open") {
+    process.stderr.write(
+      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
+    );
+  }
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const rg = new azure.resources.ResourceGroup("clawops-rg", {
+    resourceGroupName,
+    location
+  });
+  const vnet = new azure.network.VirtualNetwork("clawops-vnet", {
+    resourceGroupName: rg.name,
+    location: rg.location,
+    addressSpace: { addressPrefixes: ["10.0.0.0/16"] }
+  });
+  const subnet = new azure.network.Subnet("clawops-subnet", {
+    resourceGroupName: rg.name,
+    virtualNetworkName: vnet.name,
+    addressPrefix: "10.0.1.0/24"
+  });
+  const securityRules = [];
+  let priority = 100;
+  for (const cidr of sshIngressCidrs) {
+    securityRules.push({
+      name: `allow-ssh-${priority}`,
+      priority: priority++,
+      direction: "Inbound",
+      access: "Allow",
+      protocol: "Tcp",
+      sourceAddressPrefix: cidr,
+      sourcePortRange: "*",
+      destinationAddressPrefix: "*",
+      destinationPortRange: String(SSH_PORT)
+    });
+  }
+  for (const cidr of gatewayIngressCidrs) {
+    securityRules.push({
+      name: `allow-gateway-${priority}`,
+      priority: priority++,
+      direction: "Inbound",
+      access: "Allow",
+      protocol: "Tcp",
+      sourceAddressPrefix: cidr,
+      sourcePortRange: "*",
+      destinationAddressPrefix: "*",
+      destinationPortRange: String(GATEWAY_PORT)
+    });
+  }
+  const nsg = new azure.network.NetworkSecurityGroup("clawops-nsg", {
+    resourceGroupName: rg.name,
+    location: rg.location,
+    securityRules
+  });
+  const publicIp = new azure.network.PublicIPAddress("clawops-pip", {
+    resourceGroupName: rg.name,
+    location: rg.location,
+    publicIPAllocationMethod: "Static",
+    sku: { name: "Standard" }
+  });
+  const nic = new azure.network.NetworkInterface("clawops-nic", {
+    resourceGroupName: rg.name,
+    location: rg.location,
+    networkSecurityGroup: { id: nsg.id },
+    ipConfigurations: [{
+      name: "clawops-ipconfig",
+      subnet: { id: subnet.id },
+      publicIPAddress: { id: publicIp.id },
+      privateIPAllocationMethod: "Dynamic"
+    }]
+  });
+  const vm = new azure.compute.VirtualMachine("clawops-vm", {
+    resourceGroupName: rg.name,
+    location: rg.location,
+    hardwareProfile: { vmSize: instanceType },
+    identity: { type: "SystemAssigned" },
+    osProfile: {
+      adminUsername: "clawops",
+      computerName: "clawops",
+      customData: Buffer.from(makeStartupScript(openclawVersion)).toString("base64"),
+      linuxConfiguration: {
+        disablePasswordAuthentication: true,
+        ssh: {
+          publicKeys: [{
+            keyData: sshPublicKey,
+            path: "/home/clawops/.ssh/authorized_keys"
+          }]
+        }
+      }
+    },
+    storageProfile: {
+      imageReference: {
+        publisher: "Canonical",
+        offer: "UbuntuServer",
+        sku: "22.04-LTS",
+        version: "latest"
+      },
+      osDisk: {
+        createOption: "FromImage",
+        managedDisk: { storageAccountType: "Premium_LRS" },
+        diskSizeGB: 30
+      }
+    },
+    networkProfile: {
+      networkInterfaces: [{ id: nic.id, primary: true }]
+    }
+  });
+  if (keyVaultEnabled) {
+    const rawKvName = `clawops-${stackName}-kv`;
+    const kvName = rawKvName.length > 24 ? rawKvName.slice(0, 24) : rawKvName;
+    const kv = new azure.keyvault.Vault("clawops-kv", {
+      resourceGroupName: rg.name,
+      location: rg.location,
+      vaultName: kvName,
+      properties: {
+        sku: { family: "A", name: "standard" },
+        tenantId: pulumi.output(vm.identity).apply((i) => i?.tenantId ?? ""),
+        enableRbacAuthorization: true
+      }
+    });
+    new azure.authorization.RoleAssignment("clawops-kv-role", {
+      scope: kv.id,
+      roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6",
+      // Key Vault Secrets User
+      principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
+      principalType: "ServicePrincipal"
+    });
+    new azure.keyvault.Secret("clawops-gateway-token", {
+      resourceGroupName: rg.name,
+      vaultName: kv.name,
+      secretName: "gateway-token",
+      properties: { value: "CHANGEME" }
+    });
+  }
+  const resolvedIp = pulumi.output(publicIp.ipAddress).apply((ip) => ip ?? "");
+  return {
+    instanceId: vm.id,
+    publicIp: resolvedIp,
+    gatewayUrl: pulumi.interpolate`https://${resolvedIp}:${GATEWAY_PORT}`,
+    sshHost: resolvedIp,
+    sshPort: SSH_PORT,
+    sshUser: "clawops",
+    region: location,
+    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+};
+function makeStartupScript(openclawVersion) {
+  return `#!/bin/bash
+set -euo pipefail
+
+# Install Docker if not present
+if ! command -v docker &>/dev/null; then
+  apt-get update -q
+  apt-get install -y -q ca-certificates curl gnupg lsb-release
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
+    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  chmod a+r /etc/apt/keyrings/docker.gpg
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
+    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -q
+  apt-get install -y -q docker-ce docker-ce-cli containerd.io
+  systemctl enable --now docker
+fi
+
+usermod -aG docker clawops
+
+# Pull OpenClaw image
+OPENCLAW_VERSION="${openclawVersion}"
+docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+
+# Create default openclaw.json if not present
+OPENCLAW_CONFIG=/home/clawops/openclaw.json
+if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
+  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
+{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+OPENCLAWJSON
+  chown clawops:clawops "\${OPENCLAW_CONFIG}"
+fi
+
+# Start OpenClaw container
+docker stop openclaw 2>/dev/null || true
+docker rm   openclaw 2>/dev/null || true
+docker run -d \\
+  --name openclaw \\
+  --restart unless-stopped \\
+  -p 18789:18789 \\
+  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
+  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+`;
+}
+
+// src/providers/azure/index.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "Standard_B1s",
+  small: "Standard_B2s",
+  medium: "Standard_B4ms",
+  large: "Standard_B8ms",
+  gpu: "Standard_NC6s_v3"
+};
+var azureAdapter = {
+  name: "azure",
+  get program() {
+    return azureProgram;
+  },
+  getConnectionInfo(outputs) {
+    return {
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "clawops"),
+      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
+      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
+    };
+  },
+  normalizeInstanceType(alias) {
+    const mapped = INSTANCE_TYPE_MAP[alias];
+    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
+    return mapped;
+  },
+  defaultRegion() {
+    return "eastus";
+  },
+  stateBackendUrl(bucket) {
+    return `azblob://${bucket}`;
+  },
+  async validateConfig() {
+    const errors = [];
+    const clientId = process2.env["AZURE_CLIENT_ID"];
+    const tenantId = process2.env["AZURE_TENANT_ID"];
+    const clientSecret = process2.env["AZURE_CLIENT_SECRET"];
+    const federatedToken = process2.env["AZURE_FEDERATED_TOKEN_FILE"];
+    const hasServicePrincipal = Boolean(clientId && tenantId && clientSecret);
+    const hasOidc = Boolean(clientId && tenantId && federatedToken);
+    if (!hasServicePrincipal && !hasOidc) {
+      const onAzure = await checkImds();
+      if (!onAzure) {
+        errors.push(
+          "No Azure credentials found. Set AZURE_CLIENT_ID + AZURE_TENANT_ID + AZURE_CLIENT_SECRET (service principal), or AZURE_CLIENT_ID + AZURE_TENANT_ID + AZURE_FEDERATED_TOKEN_FILE (OIDC), or run on an Azure VM with a managed identity."
+        );
+      }
+    }
+    return { ok: errors.length === 0, errors };
+  }
+};
+async function checkImds() {
+  try {
+    const res = await fetch(
+      "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
+      {
+        headers: { Metadata: "true" },
+        signal: AbortSignal.timeout(1e3)
+      }
+    );
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+var azure_default = azureAdapter;
+export {
+  azure_default as default
+};

package/dist/bootstrap-NRIDVS5F.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+import {
+  acquireSession
+} from "./chunk-5XEZAU7V.js";
+import {
+  writeLocalState
+} from "./chunk-PRYLTCS4.js";
+import "./chunk-ALSUDYA7.js";
+import {
+  ProviderError
+} from "./chunk-ZSE4QRKE.js";
+
+// src/providers/local/bootstrap.ts
+import { readFileSync } from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var GATEWAY_PORT = 18789;
+var HEALTH_POLL_INTERVAL_MS = 3e3;
+var HEALTH_TIMEOUT_MS = 12e4;
+function loadTemplate() {
+  const dir = path.dirname(fileURLToPath(import.meta.url));
+  return readFileSync(path.join(dir, "bootstrap.sh.tmpl"), "utf-8");
+}
+function renderScript(openclawVersion) {
+  return loadTemplate().replace(/\{\{OPENCLAW_VERSION\}\}/g, openclawVersion);
+}
+async function localBootstrap(opts) {
+  const script = renderScript(opts.openclawVersion);
+  const b64 = Buffer.from(script, "utf-8").toString("base64");
+  const command = `echo '${b64}' | base64 -d | sudo bash`;
+  const { session, release } = await acquireSession({
+    host: opts.host,
+    port: opts.port,
+    user: opts.user,
+    privateKeyPath: opts.privateKeyPath,
+    knownHostsPath: opts.knownHostsPath,
+    signal: opts.signal
+  });
+  try {
+    const result = await session.exec(command, opts.signal);
+    if (result.code !== 0) {
+      throw new ProviderError(
+        `Bootstrap script failed (exit ${result.code}):
+${result.stderr || result.stdout}`
+      );
+    }
+  } finally {
+    release();
+  }
+  const state = {
+    instanceId: `local:${opts.host}`,
+    publicIp: opts.host,
+    gatewayUrl: `http://${opts.host}:${GATEWAY_PORT}`,
+    sshHost: opts.host,
+    sshPort: opts.port,
+    sshUser: opts.user,
+    region: "local",
+    provisionedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    privateKeyPath: opts.privateKeyPath,
+    knownHostsPath: opts.knownHostsPath
+  };
+  writeLocalState(opts.stackName, state);
+  if (!opts.noWait) {
+    await waitForGateway(opts.host, GATEWAY_PORT, opts.signal);
+  }
+  return state;
+}
+async function waitForGateway(host, port, signal) {
+  const url = `http://${host}:${port}/health`;
+  const deadline = Date.now() + HEALTH_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) {
+      throw new ProviderError("Bootstrap aborted while waiting for gateway");
+    }
+    try {
+      const res = await fetch(url, { signal });
+      if (res.ok) return;
+    } catch {
+    }
+    await sleep(HEALTH_POLL_INTERVAL_MS);
+  }
+  throw new ProviderError(
+    `Gateway at ${url} did not become healthy within ${HEALTH_TIMEOUT_MS / 1e3}s`
+  );
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export {
+  localBootstrap
+};

package/dist/chunk-5XEZAU7V.js

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+import {
+  NetworkError
+} from "./chunk-ZSE4QRKE.js";
+
+// src/transport/ssh.ts
+import { readFileSync, appendFileSync, mkdirSync } from "fs";
+import { createServer } from "net";
+import path from "path";
+import { Client } from "ssh2";
+var Ssh2Session = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  exec(command, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new NetworkError("Operation aborted"));
+        return;
+      }
+      this.client.exec(command, (err, channel) => {
+        if (err) {
+          reject(new NetworkError(`SSH exec failed: ${err.message}`));
+          return;
+        }
+        let stdout = "";
+        let stderr = "";
+        const onAbort = () => {
+          channel.destroy();
+          reject(new NetworkError("Operation aborted"));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        channel.on("data", (data) => {
+          stdout += data.toString("utf-8");
+        });
+        channel.stderr.on("data", (data) => {
+          stderr += data.toString("utf-8");
+        });
+        channel.on("close", (code) => {
+          signal?.removeEventListener("abort", onAbort);
+          resolve({ stdout, stderr, code: code ?? 0 });
+        });
+        channel.on("error", (chanErr) => {
+          signal?.removeEventListener("abort", onAbort);
+          reject(new NetworkError(`SSH channel error: ${chanErr.message}`));
+        });
+      });
+    });
+  }
+  stream(command, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new NetworkError("Operation aborted"));
+        return;
+      }
+      this.client.exec(command, (err, channel) => {
+        if (err) {
+          reject(new NetworkError(`SSH exec failed: ${err.message}`));
+          return;
+        }
+        if (signal) {
+          signal.addEventListener("abort", () => channel.destroy(), { once: true });
+        }
+        resolve(channel);
+      });
+    });
+  }
+  tunnel(localPort, remoteHost, remotePort, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new NetworkError("Operation aborted"));
+        return;
+      }
+      const sockets = /* @__PURE__ */ new Set();
+      const server = createServer((socket) => {
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+        this.client.forwardOut("127.0.0.1", localPort, remoteHost, remotePort, (err, channel) => {
+          if (err) {
+            socket.destroy();
+            return;
+          }
+          socket.pipe(channel);
+          channel.pipe(socket);
+          channel.on("close", () => socket.destroy());
+          socket.on("close", () => channel.destroy());
+        });
+      });
+      const closeAll = () => {
+        for (const s of sockets) s.destroy();
+        server.close();
+      };
+      server.on("error", (err) => {
+        const msg = err.code === "EADDRINUSE" ? `Port ${localPort} is already in use` : `Tunnel server error: ${err.message}`;
+        reject(new NetworkError(msg));
+      });
+      server.listen(localPort, "127.0.0.1", () => {
+        const handle = { localPort, close: closeAll };
+        signal?.addEventListener("abort", closeAll, { once: true });
+        resolve(handle);
+      });
+    });
+  }
+  close() {
+    this.client.end();
+  }
+};
+async function connect(opts) {
+  let privateKey;
+  try {
+    privateKey = readFileSync(opts.privateKeyPath);
+  } catch (err) {
+    throw new NetworkError(
+      `Cannot read SSH private key at ${opts.privateKeyPath}: ${err.message}`
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+    const onAbort = () => {
+      client.destroy();
+      reject(new NetworkError("Connection aborted"));
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    client.on("ready", () => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      resolve(new Ssh2Session(client));
+    });
+    client.on("error", (err) => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      reject(new NetworkError(`SSH connection failed: ${err.message}`));
+    });
+    const config = {
+      host: opts.host,
+      port: opts.port,
+      username: opts.user,
+      privateKey,
+      readyTimeout: 3e4,
+      hostVerifier: (keyHash) => verifyHostKey(opts.host, opts.port, keyHash, opts.knownHostsPath)
+    };
+    client.connect(config);
+  });
+}
+function verifyHostKey(host, port, keyHash, knownHostsPath) {
+  const keyHex = keyHash.toString("hex");
+  const hostEntry = port === 22 ? host : `[${host}]:${port}`;
+  let existing = null;
+  try {
+    const content = readFileSync(knownHostsPath, "utf-8");
+    for (const line of content.split("\n")) {
+      const parts = line.trim().split(/\s+/);
+      if (parts[0] === hostEntry && parts.length >= 2) {
+        existing = parts[1] ?? null;
+        break;
+      }
+    }
+  } catch {
+  }
+  if (existing !== null) {
+    return existing === keyHex;
+  }
+  try {
+    mkdirSync(path.dirname(knownHostsPath), { recursive: true });
+    appendFileSync(knownHostsPath, `${hostEntry} ${keyHex}
+`, "utf-8");
+  } catch {
+  }
+  return true;
+}
+
+// src/transport/pool.ts
+var IDLE_TTL_MS = 5 * 60 * 1e3;
+var MAX_PER_HOST = 4;
+var CLEANUP_INTERVAL_MS = 3e4;
+var pool = /* @__PURE__ */ new Map();
+var cleanupTimer = null;
+function poolKey(opts) {
+  return `${opts.user}@${opts.host}:${opts.port}`;
+}
+function startCleanupTimer() {
+  if (cleanupTimer) return;
+  cleanupTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entries] of pool) {
+      const active = entries.filter((e) => {
+        if (!e.inUse && now - e.lastUsed > IDLE_TTL_MS) {
+          e.session.close();
+          return false;
+        }
+        return true;
+      });
+      if (active.length === 0) {
+        pool.delete(key);
+      } else {
+        pool.set(key, active);
+      }
+    }
+    if (pool.size === 0 && cleanupTimer) {
+      clearInterval(cleanupTimer);
+      cleanupTimer = null;
+    }
+  }, CLEANUP_INTERVAL_MS);
+  cleanupTimer.unref();
+}
+async function acquireSession(opts) {
+  const key = poolKey(opts);
+  const entries = pool.get(key) ?? [];
+  const idle = entries.find((e) => !e.inUse);
+  if (idle) {
+    idle.inUse = true;
+    idle.lastUsed = Date.now();
+    return {
+      session: idle.session,
+      release() {
+        idle.inUse = false;
+        idle.lastUsed = Date.now();
+      }
+    };
+  }
+  if (entries.length >= MAX_PER_HOST) {
+    throw new NetworkError(
+      `SSH connection pool exhausted for ${key} (max ${MAX_PER_HOST} concurrent connections).`
+    );
+  }
+  const session = await connect(opts);
+  const entry = { session, hostKey: key, lastUsed: Date.now(), inUse: true };
+  entries.push(entry);
+  pool.set(key, entries);
+  startCleanupTimer();
+  return {
+    session,
+    release() {
+      entry.inUse = false;
+      entry.lastUsed = Date.now();
+    }
+  };
+}
+function drainPool() {
+  for (const entries of pool.values()) {
+    for (const e of entries) {
+      e.session.close();
+    }
+  }
+  pool.clear();
+  if (cleanupTimer) {
+    clearInterval(cleanupTimer);
+    cleanupTimer = null;
+  }
+}
+
+export {
+  acquireSession,
+  drainPool
+};