@clawops/cli 1.0.0 → 1.2.0

package/README.md

@@ -1,52 +1,85 @@
 # clawops
 
-**clawops** is a provider-agnostic CLI for deploying and operating self-hosted [OpenClaw](https://github.com/openclaw/openclaw) instances across AWS, GCP, Azure, and local VMs. It uses the [Pulumi Automation API](https://www.pulumi.com/docs/using-pulumi/automation-api/) (embedded — no `pulumi` binary required) for idempotent infrastructure management and exposes every operation as both a CLI command and an [MCP](https://modelcontextprotocol.io/) tool, so Claude Code, Cursor, and other AI agents can drive deployments deterministically.
+Deploy OpenClaw once. Operate it from your terminal or Claude Code.
 
-```bash
-npm install -g @clawops/cli
-clawops init --provider aws
-clawops plan --out /tmp/my-plan.json   # generate + review
-clawops apply /tmp/my-plan.json        # apply after review
-clawops logs -f
-```
+**clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
+self-hosted [OpenClaw](https://github.com/openclaw/openclaw) instances. Provision on AWS, GCP,
+Azure, or any Linux VM — then manage day-to-day operations from the terminal, or let Claude Code
+and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
-## Why clawops?
+## Who this is for
 
-Every existing OpenClaw deployment path is cloud-specific, Kubernetes-bound, or fully managed SaaS. No open-source tool unifies provisioning + lifecycle management + remote agent interaction across providers under a single CLI with first-class AI agent integration.
-
-| Capability | clawops |
-|---|---|
-| AWS, GCP, Azure, local VM | ✓ |
-| Idempotent infra via Pulumi (embedded) | ✓ |
-| SSH transport (pure Node — no system `ssh`) | ✓ |
-| MCP server (stdio + HTTP) | ✓ |
-| Plan → review → apply discipline | ✓ |
-| JSON output everywhere (`--json`) | ✓ |
-| No credentials in config | ✓ |
+- **OpenClaw users** who want the simplest path to self-hosting across cloud or local VMs, with
+  reliable deploy, status checks, logs, backups, and upgrades in a single CLI.
+- **Claude Code / Cursor / MCP users** looking for a real-world reference implementation of safe
+  infrastructure operations through MCP — typed tool schemas, read-only mode, destructive-action
+  confirmation, and audit logs.
+- **Self-hosted AI and local-first developers** who want to run their own AI assistant without
+  committing to Kubernetes, a managed SaaS platform, or a single cloud provider.
 
 ---
 
-## Quick Start
+## What clawops does
+
+- Provisions and tears down OpenClaw infrastructure on **AWS, GCP, Azure, and local VMs** using
+  the Pulumi Automation API (embedded — no `pulumi` binary required).
+- Manages day-to-day operations: status, logs, SSH, tunnels, config, agents, gateway, backups.
+- Exposes every operation as a **typed MCP tool** so AI agents can drive ops safely.
+- Enforces a **plan → review → apply** discipline for cloud deployments.
+- Emits **JSON output everywhere** (`--json`) for scripting and automation.
+- Never stores cloud credentials — reads them from your environment's existing CLI profiles.
+
+## What clawops does not do
 
-### Prerequisites
+- **No high availability or clustering.** Optimized for single-node deployments.
+- **No Kubernetes.** It deploys to VMs, not container orchestration platforms.
+- **No OpenClaw skill/agent authoring.** clawops manages infrastructure; what runs on it is up to
+  you and OpenClaw.
+- **No TLS or domain automation** (yet). Bring your own reverse proxy or see
+  [`docs/limitations.md`](docs/limitations.md) for the manual path.
+- **No credential storage.** Cloud credentials must be configured in your environment before using
+  clawops. They are never written to `~/.clawops/config.json`.
+- **No native Windows.** WSL2 is fully supported; see [`docs/support-matrix.md`](docs/support-matrix.md).
 
-- **Node.js ≥ 22** (LTS)
-- Cloud credentials available in the environment (see [Configuration](#configuration))
+---
+
+## Quick Start — local VM (fastest path)
 
-### Install
+The local provider needs only a Linux host reachable over SSH — no cloud account required.
+
+**Prerequisites:** Node.js ≥ 22, an SSH key, a Linux host (Ubuntu/Debian/RHEL) you can reach.
 
 ```bash
 npm install -g @clawops/cli
-# or without a global install:
-npx @clawops/cli
+
+# Check your environment
+clawops doctor
+
+# Configure clawops for a local host
+clawops init --provider local --host 192.168.1.50 --user ubuntu --key-path ~/.ssh/id_ed25519
+
+# Bootstrap OpenClaw on the host (installs Docker + OpenClaw over SSH)
+clawops up
+
+# Verify it's running
+clawops status
+
+# Start the MCP server for Claude Code
+clawops mcp serve
 ```
 
-### Provision on AWS
+See [`docs/examples/local-vm.md`](docs/examples/local-vm.md) for the full walkthrough including
+SSH prerequisites, firewall setup, and troubleshooting.
+
+## Quick Start — cloud (AWS)
 
 ```bash
-# Write ~/.clawops/config.json and generate an SSH key pair
+npm install -g @clawops/cli
+# or: npx @clawops/cli
+
+# Requires AWS credentials in your environment (AWS_PROFILE or ~/.aws/credentials)
 clawops init --provider aws
 
 # Edit ~/.clawops/config.json — set stateUrl to your S3 bucket:
@@ -55,19 +88,44 @@ clawops init --provider aws
 # Generate a deploy plan (runs pulumi preview internally)
 clawops plan --provider aws --stack default --out /tmp/plan.json
 
-# Review the plan JSON, then apply
+# Review the plan, then apply
 clawops apply /tmp/plan.json
+```
 
-# Or preview + apply in one step (no plan file needed)
-clawops up
+---
+
+## Connect Claude Code
+
+Add to your Claude Code MCP config (`~/.claude.json` or project `.mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "clawops": {
+      "command": "clawops",
+      "args": ["mcp", "serve", "--read-only"]
+    }
+  }
+}
 ```
 
-### Day-to-day operations
+**Start with `--read-only`** — it enables status, logs, config reads, and diagnostics while
+blocking any operation that mutates infrastructure. Remove `--read-only` only once you understand
+which tools are destructive and have reviewed [`docs/security/mcp-safety.md`](docs/security/mcp-safety.md).
+
+Destructive tools (`clawops_destroy`, `clawops_up`, `clawops_config_set`, etc.) require explicit
+confirmation from the agent before executing — they will never run silently.
+
+For Cursor, VS Code, or HTTP mode setup see [`docs/mcp/`](docs/mcp/).
+
+---
+
+## Day-to-day operations
 
 ```bash
-clawops status              # Show stack outputs: IP, gateway URL, SSH info
+clawops status              # Stack outputs: IP, gateway URL, SSH info
 clawops logs -f             # Tail OpenClaw logs over SSH
-clawops ssh                 # Open an interactive SSH session
+clawops ssh                 # Interactive SSH session
 clawops ssh --command "docker ps"
 
 clawops config get maxAgents
@@ -75,7 +133,7 @@ clawops config set maxAgents 8
 
 clawops tunnel              # Port-forward gateway UI to localhost
 
-clawops destroy --yes       # Destroy cloud-provider stack (AWS/GCP/Azure)
+clawops destroy --yes       # Destroy cloud-provider stack
 clawops down --yes          # Destroy local-provider stack
 ```
 
@@ -85,12 +143,13 @@ clawops down --yes          # Destroy local-provider stack
 
 | Command | Description |
 |---|---|
-| `init` | Interactive setup wizard — writes config, generates SSH key pair |
+| `setup` | First-run wizard — guided LLM, integrations, and deploy-plan generation |
+| `init` | Register a stack in `~/.clawops/config.json` without provisioning |
 | `up` | Provision or update stack (`--dry-run` for preview) |
 | `down` | Destroy local-provider stack (requires `--yes`; `--dry-run` shows current outputs) |
 | `destroy` | Destroy cloud-provider stack with confirmation prompt (`--dry-run` shows current outputs) |
 | `status` | Show stack outputs: IP, gateway URL, region, provisioned time |
-| `plan` | Generate a Maker deploy-plan JSON artifact (dry-run safe) |
+| `plan` | Generate a deploy-plan JSON artifact (dry-run safe) |
 | `apply` | Apply a previously reviewed plan file (`--dry-run` validates and shows diff without applying) |
 | `ssh` | Interactive SSH session or run a remote command |
 | `logs` | Stream OpenClaw logs (`-f`, `--tail N`, `--since 5m`) |
@@ -115,7 +174,7 @@ For non-local providers, clawops enforces a review-before-apply discipline:
 # 1. Generate a plan — runs `pulumi preview` internally, produces JSON
 clawops plan --provider aws --region us-east-1 --out /tmp/plan.json
 
-# 2. Review plan.json — it shows exactly which resources will change
+# 2. Review plan.json — the `diff` field shows projected changes at plan-generation time
 cat /tmp/plan.json | jq .diff
 
 # 3. Apply — reads and validates the plan file, then runs `pulumi up`
@@ -125,24 +184,28 @@ clawops apply /tmp/plan.json
 clawops apply /tmp/plan.json --yes    # skip prompt in automation
 ```
 
-The plan JSON conforms to `spec/deploy-plan.schema.json` (AJV-validated). Plans are portable — generated on one machine, applied on another.
+The plan JSON conforms to `spec/deploy-plan.schema.json` (AJV-validated) and captures reviewed
+intent: provider, region, instance type, CIDR ranges, and OpenClaw version. `apply` re-runs
+`pulumi up` using those parameters against the current live state — it does not replay a locked
+execution artifact. Review and apply in the same session to minimize drift risk.
+
+See [`docs/plan-apply.md`](docs/plan-apply.md) for full semantics, drift guidance, and the safe CI pattern.
 
 ---
 
 ## MCP server
 
-clawops ships an embedded [MCP](https://modelcontextprotocol.io/) server. Claude Code, Cursor, and any MCP-compatible agent can drive deployments without leaving the chat interface.
+clawops ships an embedded [MCP](https://modelcontextprotocol.io/) server. Claude Code, Cursor, and
+any MCP-compatible agent can drive deployments without leaving the chat interface.
 
 ### Stdio mode (Claude Code / VS Code)
 
-Add to your Claude Code MCP config (`~/.claude.json` or project `.mcp.json`):
-
 ```json
 {
   "mcpServers": {
     "clawops": {
       "command": "clawops",
-      "args": ["mcp", "serve"]
+      "args": ["mcp", "serve", "--read-only"]
     }
   }
 }
@@ -155,27 +218,31 @@ clawops mcp serve --http --port 3333 --bind 127.0.0.1
 # MCP HTTP server listening on 127.0.0.1:3333
 ```
 
-Point your MCP client at `http://127.0.0.1:3333`.
+Do not bind to a non-loopback address without additional authentication controls in front of it.
 
 ### Available tools
 
 | Tool | Toolset | Description |
 |---|---|---|
-| `clawops_up` | cli | Provision or update a stack |
 | `clawops_status` | read | Show stack outputs |
 | `clawops_logs_tail` | read | Tail OpenClaw logs |
-| `clawops_ssh_exec` | cli | Run a command over SSH |
-| `clawops_plan` | cli | Generate a deploy plan |
-| `clawops_apply` | cli | Apply a plan file |
-| `clawops_destroy` | cli | Destroy a stack (elicits confirmation) |
 | `clawops_config_get` | read | Read a remote config value |
-| `clawops_config_set` | cli | Write a remote config value |
 | `clawops_agents_list` | read | List running agents |
-| `clawops_stacks_list` | admin | List all stacks and their state |
 | `clawops_task_status` | read | Poll a long-running task |
+| `clawops_stacks_list` | admin | List all stacks and their state |
+| `clawops_up` | cli | Provision or update a stack |
+| `clawops_plan` | cli | Generate a deploy plan |
+| `clawops_apply` | cli | Apply a plan file |
+| `clawops_ssh_exec` | cli | Run a command over SSH |
+| `clawops_config_set` | cli | Write a remote config value |
+| `clawops_destroy` | cli | Destroy a stack (elicits confirmation) |
 | `clawops_workflow_deploy_app` | workflow | End-to-end deploy: plan → confirm → apply → status |
 
-Destructive tools require explicit confirmation (R19 elicitation) unless `yes: true` is passed.
+`read` toolset tools are available in `--read-only` mode. All other toolsets require full mode.
+Destructive tools require explicit confirmation (elicitation) unless `yes: true` is passed.
+
+See [`docs/security/tool-risk-matrix.md`](docs/security/tool-risk-matrix.md) for the full risk
+classification of every tool.
 
 ---
 
@@ -215,6 +282,17 @@ Config lives at `~/.clawops/config.json` (override with `$CLAWOPS_HOME`).
 
 ---
 
+## Known limitations
+
+See [`docs/limitations.md`](docs/limitations.md) for the full list. Key points:
+
+- **Single-node deployments only** — not a high-availability or clustering platform.
+- **`clawops apply` is not an immutable plan execution** — see [`docs/plan-apply.md`](docs/plan-apply.md).
+- **No TLS/domain automation** in the current release.
+- **MCP tools execute privileged operations** — use `--read-only` for first evaluation.
+
+---
+
 ## Architecture
 
 ```
@@ -241,7 +319,7 @@ Key design decisions:
 - **State in cloud blob storage:** GCS (`gs://`), S3 (`s3://`), Azure Blob — no local state files, no `pulumi.yaml`
 - **SSH via `ssh2`:** never shells out to `/usr/bin/ssh`; TOFU host verification against `~/.clawops/known_hosts`; connection pool with 5-min idle TTL
 - **Plan → apply discipline:** every non-local deployment goes through `generatePlan()` → review → `applyPlan()`; destructive changes always require human review of the plan JSON
-- **MCP-first:** every CLI operation has a typed MCP tool; schemas generated from `spec/mcp-tools.yaml`; all destructive tools use R19 elicitation
+- **MCP-first:** every CLI operation has a typed MCP tool; schemas generated from `spec/mcp-tools.yaml`; all destructive tools use elicitation
 
 See [`docs/architecture.md`](docs/architecture.md) for a full narrative, and [`docs/decisions/`](docs/decisions/) for ADRs.
 
@@ -264,8 +342,9 @@ pnpm dev doctor        # verify toolchain
 ```bash
 pnpm dev                   # run CLI from src/ via tsx
 pnpm build                 # tsup → dist/
-pnpm test                  # vitest (356 tests, ~2s)
+pnpm test                  # vitest (493 tests, ~3s)
 pnpm test:changed          # vitest --changed (fast edit loop)
+pnpm test:integration      # Docker-based SSH integration tests
 pnpm typecheck             # tsc --noEmit
 pnpm lint                  # eslint src/ tests/ scripts/ (--max-warnings=0)
 pnpm gen:schemas           # regenerate src/providers/types.ts + src/mcp/tools/_generated.ts
@@ -281,7 +360,10 @@ pnpm changeset             # record a release note before merging
 | `SPEC.md` | Full technical specification (milestones, rules, schemas) |
 | `DESIGN_RULES.md` | 25 normative rules (R1–R25) referenced throughout the codebase |
 | `docs/architecture.md` | Narrative system overview |
+| `docs/plan-apply.md` | Plan/apply semantics, drift guidance, CI pattern |
 | `docs/ci.md` | CI integration guide: OIDC, env vars, plan → apply in CI |
+| `docs/security/` | MCP safety model, tool risk matrix, redaction, audit logs |
+| `docs/providers/matrix.md` | Per-provider capability matrix |
 | `docs/decisions/` | Architecture Decision Records |
 | `.claude/skills/` | Invokable procedures: `/add-provider`, `/release`, `/tdd`, `/mcp-tool` |
 | `.claude/rules/` | Path-scoped lint rules loaded by Claude Code |
@@ -326,7 +408,9 @@ Use `pnpm changeset` to record a release note before merging a `feat` or `fix`.
 | M4 — Local VM | ✅ | Local adapter (SSH bootstrap, no Pulumi); `doctor` |
 | M5 — MCP Layer | ✅ | `mcp serve` (stdio), all CLI ops as MCP tools, progress tracking |
 | M6 — Plan/Apply | ✅ | `plan` + `apply`; deploy-plan schema; MCP HTTP transport; `workflow_deploy_app` |
-| M7 — v1.0 Polish | ✅ | Full `doctor` surface; `destroy` command; `--dry-run` on `up`/`down`/`destroy`/`apply`/`config`; `release.yml`; CI integration guide |
+| M7 — v1.0 Polish | ✅ | Full `doctor` surface; `destroy` command; `--dry-run` across commands; CI guide |
+
+See [`docs/roadmap.md`](docs/roadmap.md) for the public roadmap and upcoming work.
 
 ---
 

package/dist/apply-KBF7OPWL.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  applyPlan
+} from "./chunk-LU63NZD3.js";
+import "./chunk-YTH4L2GN.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-ACYJBSLJ.js";
+import "./chunk-BRPU7AQC.js";
+import "./chunk-UDNZUSKA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  applyPlan
+};

package/dist/{automation-JG2YBEL7.js → automation-RULUSJBW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-ALSUDYA7.js";
-import "./chunk-ZSE4QRKE.js";
+} from "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
 
 // src/pulumi/automation.ts
 import path from "path";

package/dist/{aws-A3323GNM.js → aws-KQBWY43W.js}

@@ -15,7 +15,7 @@ var awsProgram = async () => {
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "t3.small";
   const region = cfg.get("region") ?? "us-east-1";
-  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
   const accessMode = cfg.get("accessMode") ?? "restricted";
   const allowedCidrs = cfg.get("allowedCidrs") ?? "";
   const sshCidrs = cfg.get("sshCidrs") ?? "";
@@ -114,7 +114,8 @@ var awsProgram = async () => {
   if (bedrockEnabled) {
     new aws.iam.RolePolicyAttachment("clawops-bedrock", {
       role: role.name,
-      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockReadOnly"
+      // FullAccess required for bedrock:InvokeModel — ReadOnly only covers describe/list.
+      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
     });
   }
   const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
@@ -163,10 +164,8 @@ var awsProgram = async () => {
   };
 };
 function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvFile = bedrockEnabled ? `
-# Write AWS_PROFILE for Bedrock
-echo "AWS_PROFILE=default" > /etc/openclaw.env
-` : "";
+  const bedrockEnvSetup = bedrockEnabled ? '\n# Write AWS_PROFILE so the container can use the instance role for Bedrock\necho "AWS_PROFILE=default" > /etc/openclaw.env\n' : "";
+  const bedrockEnvFlag = bedrockEnabled ? "  --env-file /etc/openclaw.env \\\\\n" : "";
   return `#!/bin/bash
 set -euo pipefail
 
@@ -176,8 +175,9 @@ mkdir -p /home/clawops/.ssh
 chmod 700 /home/clawops/.ssh
 chown clawops:clawops /home/clawops/.ssh
 
-# Install Docker if not present
+# Install Docker if not present (Ubuntu/Debian only; AWS AMI is ubuntu-22.04)
 if ! command -v docker &>/dev/null; then
+  export DEBIAN_FRONTEND=noninteractive
   apt-get update -q
   apt-get install -y -q ca-certificates curl gnupg lsb-release
   install -m 0755 -d /etc/apt/keyrings
@@ -193,16 +193,17 @@ if ! command -v docker &>/dev/null; then
 fi
 
 usermod -aG docker clawops
-${bedrockEnvFile}
+${bedrockEnvSetup}
 # Pull OpenClaw image
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 
 # Create default openclaw.json if not present
+# apply.ts will overwrite this with the plan's config overlay post-provisioning.
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
   cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
 OPENCLAWJSON
   chown clawops:clawops "\${OPENCLAW_CONFIG}"
 fi
@@ -215,7 +216,8 @@ docker run -d \\
   --restart unless-stopped \\
   -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+${bedrockEnvFlag}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+  node openclaw.mjs gateway run --allow-unconfigured
 `;
 }
 

package/dist/{azure-LNWBK2ZI.js → azure-4EJFVJZL.js}

@@ -16,7 +16,7 @@ var azureProgram = async () => {
   const stackName = pulumi.getStack();
   const instanceType = cfg.get("instanceType") ?? "Standard_B2s";
   const location = cfg.get("region") ?? "eastus";
-  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
   const accessMode = cfg.get("accessMode") ?? "restricted";
   const allowedCidrs = cfg.get("allowedCidrs") ?? "";
   const sshCidrs = cfg.get("sshCidrs") ?? "";
@@ -206,7 +206,7 @@ docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
   cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
 OPENCLAWJSON
   chown clawops:clawops "\${OPENCLAW_CONFIG}"
 fi
@@ -219,7 +219,8 @@ docker run -d \\
   --restart unless-stopped \\
   -p 18789:18789 \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+  node openclaw.mjs gateway run --allow-unconfigured
 `;
 }
 

package/dist/{bootstrap-NRIDVS5F.js → bootstrap-UYCOEJQX.js}

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import {
-  acquireSession
-} from "./chunk-5XEZAU7V.js";
 import {
   writeLocalState
-} from "./chunk-PRYLTCS4.js";
-import "./chunk-ALSUDYA7.js";
+} from "./chunk-BRPU7AQC.js";
+import {
+  acquireSession
+} from "./chunk-ZVOEQCNW.js";
+import "./chunk-4U3LTLWZ.js";
+import "./chunk-CX5SL5HP.js";
 import {
   ProviderError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/providers/local/bootstrap.ts
 import { readFileSync } from "fs";
@@ -27,7 +28,8 @@ function renderScript(openclawVersion) {
 async function localBootstrap(opts) {
   const script = renderScript(opts.openclawVersion);
   const b64 = Buffer.from(script, "utf-8").toString("base64");
-  const command = `echo '${b64}' | base64 -d | sudo bash`;
+  const command = opts.sudoPassword ? `printf '%s
+' ${shellQuote(opts.sudoPassword)} | sudo -S -p '' bash -c "echo '${b64}' | base64 -d | bash"` : `echo '${b64}' | base64 -d | sudo bash`;
   const { session, release } = await acquireSession({
     host: opts.host,
     port: opts.port,
@@ -37,12 +39,16 @@ async function localBootstrap(opts) {
     signal: opts.signal
   });
   try {
-    const result = await session.exec(command, opts.signal);
-    if (result.code !== 0) {
-      throw new ProviderError(
-        `Bootstrap script failed (exit ${result.code}):
+    if (opts.onOutput) {
+      await execStreaming(session, command, opts.onOutput, opts.signal);
+    } else {
+      const result = await session.exec(command, opts.signal);
+      if (result.code !== 0) {
+        throw new ProviderError(
+          `Bootstrap script failed (exit ${result.code}):
 ${result.stderr || result.stdout}`
-      );
+        );
+      }
     }
   } finally {
     release();
@@ -86,6 +92,36 @@ async function waitForGateway(host, port, signal) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function shellQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+async function execStreaming(session, command, onOutput, signal) {
+  const ch = await session.stream(command, signal);
+  let leftover = "";
+  let stderr = "";
+  ch.on("data", (chunk) => {
+    const text = leftover + chunk.toString("utf-8");
+    const lines = text.split("\n");
+    leftover = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.trim()) onOutput(line);
+    }
+  });
+  ch.stderr.on("data", (chunk) => {
+    stderr += chunk.toString("utf-8");
+  });
+  const exitCode = await new Promise((resolve, reject) => {
+    ch.on("close", (code) => {
+      if (leftover.trim()) onOutput(leftover);
+      resolve(code ?? 0);
+    });
+    ch.on("error", reject);
+  });
+  if (exitCode !== 0) {
+    throw new ProviderError(`Bootstrap script failed (exit ${exitCode}):
+${stderr}`);
+  }
+}
 export {
   localBootstrap
 };

package/dist/{chunk-LT24GUUO.js → chunk-3QJBNAHW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   StateError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/pulumi/outputs.ts
 function extractBaseOutputs(raw) {

package/dist/{chunk-5XEZAU7V.js → chunk-4U3LTLWZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   NetworkError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/transport/ssh.ts
 import { readFileSync, appendFileSync, mkdirSync } from "fs";
@@ -116,6 +116,10 @@ async function connect(opts) {
     );
   }
   return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new NetworkError("Connection aborted"));
+      return;
+    }
     const client = new Client();
     const onAbort = () => {
       client.destroy();
@@ -168,87 +172,6 @@ function verifyHostKey(host, port, keyHash, knownHostsPath) {
   return true;
 }
 
-// src/transport/pool.ts
-var IDLE_TTL_MS = 5 * 60 * 1e3;
-var MAX_PER_HOST = 4;
-var CLEANUP_INTERVAL_MS = 3e4;
-var pool = /* @__PURE__ */ new Map();
-var cleanupTimer = null;
-function poolKey(opts) {
-  return `${opts.user}@${opts.host}:${opts.port}`;
-}
-function startCleanupTimer() {
-  if (cleanupTimer) return;
-  cleanupTimer = setInterval(() => {
-    const now = Date.now();
-    for (const [key, entries] of pool) {
-      const active = entries.filter((e) => {
-        if (!e.inUse && now - e.lastUsed > IDLE_TTL_MS) {
-          e.session.close();
-          return false;
-        }
-        return true;
-      });
-      if (active.length === 0) {
-        pool.delete(key);
-      } else {
-        pool.set(key, active);
-      }
-    }
-    if (pool.size === 0 && cleanupTimer) {
-      clearInterval(cleanupTimer);
-      cleanupTimer = null;
-    }
-  }, CLEANUP_INTERVAL_MS);
-  cleanupTimer.unref();
-}
-async function acquireSession(opts) {
-  const key = poolKey(opts);
-  const entries = pool.get(key) ?? [];
-  const idle = entries.find((e) => !e.inUse);
-  if (idle) {
-    idle.inUse = true;
-    idle.lastUsed = Date.now();
-    return {
-      session: idle.session,
-      release() {
-        idle.inUse = false;
-        idle.lastUsed = Date.now();
-      }
-    };
-  }
-  if (entries.length >= MAX_PER_HOST) {
-    throw new NetworkError(
-      `SSH connection pool exhausted for ${key} (max ${MAX_PER_HOST} concurrent connections).`
-    );
-  }
-  const session = await connect(opts);
-  const entry = { session, hostKey: key, lastUsed: Date.now(), inUse: true };
-  entries.push(entry);
-  pool.set(key, entries);
-  startCleanupTimer();
-  return {
-    session,
-    release() {
-      entry.inUse = false;
-      entry.lastUsed = Date.now();
-    }
-  };
-}
-function drainPool() {
-  for (const entries of pool.values()) {
-    for (const e of entries) {
-      e.session.close();
-    }
-  }
-  pool.clear();
-  if (cleanupTimer) {
-    clearInterval(cleanupTimer);
-    cleanupTimer = null;
-  }
-}
-
 export {
-  acquireSession,
-  drainPool
+  connect
 };