@clawops/cli 1.1.0 → 1.2.0

package/README.md

@@ -143,7 +143,8 @@ clawops down --yes          # Destroy local-provider stack
 
 | Command | Description |
 |---|---|
-| `init` | Interactive setup wizard — writes config, generates SSH key pair |
+| `setup` | First-run wizard — guided LLM, integrations, and deploy-plan generation |
+| `init` | Register a stack in `~/.clawops/config.json` without provisioning |
 | `up` | Provision or update stack (`--dry-run` for preview) |
 | `down` | Destroy local-provider stack (requires `--yes`; `--dry-run` shows current outputs) |
 | `destroy` | Destroy cloud-provider stack with confirmation prompt (`--dry-run` shows current outputs) |
@@ -341,7 +342,7 @@ pnpm dev doctor        # verify toolchain
 ```bash
 pnpm dev                   # run CLI from src/ via tsx
 pnpm build                 # tsup → dist/
-pnpm test                  # vitest (476 tests, ~2s)
+pnpm test                  # vitest (493 tests, ~3s)
 pnpm test:changed          # vitest --changed (fast edit loop)
 pnpm test:integration      # Docker-based SSH integration tests
 pnpm typecheck             # tsc --noEmit

package/dist/apply-KBF7OPWL.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  applyPlan
+} from "./chunk-LU63NZD3.js";
+import "./chunk-YTH4L2GN.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-ACYJBSLJ.js";
+import "./chunk-BRPU7AQC.js";
+import "./chunk-UDNZUSKA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  applyPlan
+};

package/dist/{automation-JG2YBEL7.js → automation-RULUSJBW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-ALSUDYA7.js";
-import "./chunk-ZSE4QRKE.js";
+} from "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
 
 // src/pulumi/automation.ts
 import path from "path";

package/dist/{aws-A3323GNM.js → aws-KQBWY43W.js}

@@ -15,7 +15,7 @@ var awsProgram = async () => {
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "t3.small";
   const region = cfg.get("region") ?? "us-east-1";
-  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
   const accessMode = cfg.get("accessMode") ?? "restricted";
   const allowedCidrs = cfg.get("allowedCidrs") ?? "";
   const sshCidrs = cfg.get("sshCidrs") ?? "";
@@ -114,7 +114,8 @@ var awsProgram = async () => {
   if (bedrockEnabled) {
     new aws.iam.RolePolicyAttachment("clawops-bedrock", {
       role: role.name,
-      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockReadOnly"
+      // FullAccess required for bedrock:InvokeModel — ReadOnly only covers describe/list.
+      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
     });
   }
   const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
@@ -163,10 +164,8 @@ var awsProgram = async () => {
   };
 };
 function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvFile = bedrockEnabled ? `
-# Write AWS_PROFILE for Bedrock
-echo "AWS_PROFILE=default" > /etc/openclaw.env
-` : "";
+  const bedrockEnvSetup = bedrockEnabled ? '\n# Write AWS_PROFILE so the container can use the instance role for Bedrock\necho "AWS_PROFILE=default" > /etc/openclaw.env\n' : "";
+  const bedrockEnvFlag = bedrockEnabled ? "  --env-file /etc/openclaw.env \\\\\n" : "";
   return `#!/bin/bash
 set -euo pipefail
 
@@ -176,8 +175,9 @@ mkdir -p /home/clawops/.ssh
 chmod 700 /home/clawops/.ssh
 chown clawops:clawops /home/clawops/.ssh
 
-# Install Docker if not present
+# Install Docker if not present (Ubuntu/Debian only; AWS AMI is ubuntu-22.04)
 if ! command -v docker &>/dev/null; then
+  export DEBIAN_FRONTEND=noninteractive
   apt-get update -q
   apt-get install -y -q ca-certificates curl gnupg lsb-release
   install -m 0755 -d /etc/apt/keyrings
@@ -193,16 +193,17 @@ if ! command -v docker &>/dev/null; then
 fi
 
 usermod -aG docker clawops
-${bedrockEnvFile}
+${bedrockEnvSetup}
 # Pull OpenClaw image
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 
 # Create default openclaw.json if not present
+# apply.ts will overwrite this with the plan's config overlay post-provisioning.
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
   cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
 OPENCLAWJSON
   chown clawops:clawops "\${OPENCLAW_CONFIG}"
 fi
@@ -215,7 +216,8 @@ docker run -d \\
   --restart unless-stopped \\
   -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+${bedrockEnvFlag}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+  node openclaw.mjs gateway run --allow-unconfigured
 `;
 }
 

package/dist/{azure-LNWBK2ZI.js → azure-4EJFVJZL.js}

@@ -16,7 +16,7 @@ var azureProgram = async () => {
   const stackName = pulumi.getStack();
   const instanceType = cfg.get("instanceType") ?? "Standard_B2s";
   const location = cfg.get("region") ?? "eastus";
-  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
   const accessMode = cfg.get("accessMode") ?? "restricted";
   const allowedCidrs = cfg.get("allowedCidrs") ?? "";
   const sshCidrs = cfg.get("sshCidrs") ?? "";
@@ -206,7 +206,7 @@ docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
   cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
 OPENCLAWJSON
   chown clawops:clawops "\${OPENCLAW_CONFIG}"
 fi
@@ -219,7 +219,8 @@ docker run -d \\
   --restart unless-stopped \\
   -p 18789:18789 \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+  node openclaw.mjs gateway run --allow-unconfigured
 `;
 }
 

package/dist/{bootstrap-7ZS2GLFJ.js → bootstrap-UYCOEJQX.js}

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import {
-  acquireSession
-} from "./chunk-BA6MDFZK.js";
 import {
   writeLocalState
-} from "./chunk-PRYLTCS4.js";
-import "./chunk-ALSUDYA7.js";
+} from "./chunk-BRPU7AQC.js";
+import {
+  acquireSession
+} from "./chunk-ZVOEQCNW.js";
+import "./chunk-4U3LTLWZ.js";
+import "./chunk-CX5SL5HP.js";
 import {
   ProviderError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/providers/local/bootstrap.ts
 import { readFileSync } from "fs";
@@ -27,7 +28,8 @@ function renderScript(openclawVersion) {
 async function localBootstrap(opts) {
   const script = renderScript(opts.openclawVersion);
   const b64 = Buffer.from(script, "utf-8").toString("base64");
-  const command = `echo '${b64}' | base64 -d | sudo bash`;
+  const command = opts.sudoPassword ? `printf '%s
+' ${shellQuote(opts.sudoPassword)} | sudo -S -p '' bash -c "echo '${b64}' | base64 -d | bash"` : `echo '${b64}' | base64 -d | sudo bash`;
   const { session, release } = await acquireSession({
     host: opts.host,
     port: opts.port,
@@ -37,12 +39,16 @@ async function localBootstrap(opts) {
     signal: opts.signal
   });
   try {
-    const result = await session.exec(command, opts.signal);
-    if (result.code !== 0) {
-      throw new ProviderError(
-        `Bootstrap script failed (exit ${result.code}):
+    if (opts.onOutput) {
+      await execStreaming(session, command, opts.onOutput, opts.signal);
+    } else {
+      const result = await session.exec(command, opts.signal);
+      if (result.code !== 0) {
+        throw new ProviderError(
+          `Bootstrap script failed (exit ${result.code}):
 ${result.stderr || result.stdout}`
-      );
+        );
+      }
     }
   } finally {
     release();
@@ -86,6 +92,36 @@ async function waitForGateway(host, port, signal) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function shellQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+async function execStreaming(session, command, onOutput, signal) {
+  const ch = await session.stream(command, signal);
+  let leftover = "";
+  let stderr = "";
+  ch.on("data", (chunk) => {
+    const text = leftover + chunk.toString("utf-8");
+    const lines = text.split("\n");
+    leftover = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.trim()) onOutput(line);
+    }
+  });
+  ch.stderr.on("data", (chunk) => {
+    stderr += chunk.toString("utf-8");
+  });
+  const exitCode = await new Promise((resolve, reject) => {
+    ch.on("close", (code) => {
+      if (leftover.trim()) onOutput(leftover);
+      resolve(code ?? 0);
+    });
+    ch.on("error", reject);
+  });
+  if (exitCode !== 0) {
+    throw new ProviderError(`Bootstrap script failed (exit ${exitCode}):
+${stderr}`);
+  }
+}
 export {
   localBootstrap
 };

package/dist/{chunk-LT24GUUO.js → chunk-3QJBNAHW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   StateError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/pulumi/outputs.ts
 function extractBaseOutputs(raw) {

package/dist/{chunk-BA6MDFZK.js → chunk-4U3LTLWZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   NetworkError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/transport/ssh.ts
 import { readFileSync, appendFileSync, mkdirSync } from "fs";
@@ -172,87 +172,6 @@ function verifyHostKey(host, port, keyHash, knownHostsPath) {
   return true;
 }
 
-// src/transport/pool.ts
-var IDLE_TTL_MS = 5 * 60 * 1e3;
-var MAX_PER_HOST = 4;
-var CLEANUP_INTERVAL_MS = 3e4;
-var pool = /* @__PURE__ */ new Map();
-var cleanupTimer = null;
-function poolKey(opts) {
-  return `${opts.user}@${opts.host}:${opts.port}`;
-}
-function startCleanupTimer() {
-  if (cleanupTimer) return;
-  cleanupTimer = setInterval(() => {
-    const now = Date.now();
-    for (const [key, entries] of pool) {
-      const active = entries.filter((e) => {
-        if (!e.inUse && now - e.lastUsed > IDLE_TTL_MS) {
-          e.session.close();
-          return false;
-        }
-        return true;
-      });
-      if (active.length === 0) {
-        pool.delete(key);
-      } else {
-        pool.set(key, active);
-      }
-    }
-    if (pool.size === 0 && cleanupTimer) {
-      clearInterval(cleanupTimer);
-      cleanupTimer = null;
-    }
-  }, CLEANUP_INTERVAL_MS);
-  cleanupTimer.unref();
-}
-async function acquireSession(opts) {
-  const key = poolKey(opts);
-  const entries = pool.get(key) ?? [];
-  const idle = entries.find((e) => !e.inUse);
-  if (idle) {
-    idle.inUse = true;
-    idle.lastUsed = Date.now();
-    return {
-      session: idle.session,
-      release() {
-        idle.inUse = false;
-        idle.lastUsed = Date.now();
-      }
-    };
-  }
-  if (entries.length >= MAX_PER_HOST) {
-    throw new NetworkError(
-      `SSH connection pool exhausted for ${key} (max ${MAX_PER_HOST} concurrent connections).`
-    );
-  }
-  const session = await connect(opts);
-  const entry = { session, hostKey: key, lastUsed: Date.now(), inUse: true };
-  entries.push(entry);
-  pool.set(key, entries);
-  startCleanupTimer();
-  return {
-    session,
-    release() {
-      entry.inUse = false;
-      entry.lastUsed = Date.now();
-    }
-  };
-}
-function drainPool() {
-  for (const entries of pool.values()) {
-    for (const e of entries) {
-      e.session.close();
-    }
-  }
-  pool.clear();
-  if (cleanupTimer) {
-    clearInterval(cleanupTimer);
-    cleanupTimer = null;
-  }
-}
-
 export {
-  acquireSession,
-  drainPool
+  connect
 };

package/dist/{chunk-PERSDQMT.js → chunk-ACYJBSLJ.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   readLocalState
-} from "./chunk-PRYLTCS4.js";
+} from "./chunk-BRPU7AQC.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-ALSUDYA7.js";
+} from "./chunk-CX5SL5HP.js";
 import {
   UsageError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/cli/context.ts
 function buildContext(args) {
@@ -36,7 +36,7 @@ function buildContext(args) {
           `Stack "${stackName}" not found in config. Run \`clawops init\` or use \`--stack\` to specify a different stack.`
         );
       }
-      const { getOrCreateStack } = await import("./automation-JG2YBEL7.js");
+      const { getOrCreateStack } = await import("./automation-RULUSJBW.js");
       stackCache = await getOrCreateStack({
         stack: stackName,
         stateUrl: stackConfig.stateUrl,
@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-OHWCTFLL.js");
+        const mod = await import("./gcp-SKURG3L6.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-A3323GNM.js");
+        const mod = await import("./aws-KQBWY43W.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-LNWBK2ZI.js");
+        const mod = await import("./azure-4EJFVJZL.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/chunk-BOPSG2LI.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// src/plan/secrets.ts
+import { readFileSync } from "fs";
+var UNRESOLVED_SOURCES = /* @__PURE__ */ new Set(["aws-sm", "aws-ssm", "gcp-sm", "azure-kv"]);
+function resolveSecrets(config, secrets) {
+  const resolved = buildSecretMap(secrets);
+  return walkResolve(config, resolved);
+}
+function buildSecretMap(secrets) {
+  const map = /* @__PURE__ */ new Map();
+  for (const secret of secrets) {
+    if (UNRESOLVED_SOURCES.has(secret.source)) {
+      process.stderr.write(
+        `[clawops] Warning: secret "${secret.name}" uses source "${secret.source}" which is not yet resolved automatically. Set the value manually after deployment with: clawops config set
+`
+      );
+      continue;
+    }
+    if (secret.source === "env") {
+      const ref = secret.ref ?? secret.name;
+      const val = process.env[ref];
+      if (val === void 0) {
+        process.stderr.write(
+          `[clawops] Warning: secret "${secret.name}" references env var "${ref}" which is not set. The $secret: ref will remain unresolved in the config.
+`
+        );
+        continue;
+      }
+      map.set(secret.name, val);
+    } else if (secret.source === "file") {
+      if (!secret.ref) {
+        process.stderr.write(
+          `[clawops] Warning: secret "${secret.name}" has source "file" but no ref path.
+`
+        );
+        continue;
+      }
+      try {
+        map.set(secret.name, readFileSync(secret.ref, "utf-8").trim());
+      } catch (err) {
+        process.stderr.write(
+          `[clawops] Warning: cannot read secret "${secret.name}" from file "${secret.ref}": ${err.message}
+`
+        );
+      }
+    }
+  }
+  return map;
+}
+function walkResolve(value, secrets) {
+  if (typeof value === "string") {
+    const match = /^\$secret:(.+)$/.exec(value);
+    if (match) {
+      const name = match[1];
+      const resolved = secrets.get(name);
+      if (resolved !== void 0) return resolved;
+      return value;
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => walkResolve(item, secrets));
+  }
+  if (value !== null && typeof value === "object") {
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+      result[k] = walkResolve(v, secrets);
+    }
+    return result;
+  }
+  return value;
+}
+
+export {
+  resolveSecrets
+};

package/dist/{chunk-PRYLTCS4.js → chunk-BRPU7AQC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-ALSUDYA7.js";
+} from "./chunk-CX5SL5HP.js";
 
 // src/providers/local/state.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";

package/dist/{chunk-ALSUDYA7.js → chunk-CX5SL5HP.js}

@@ -2,7 +2,7 @@
 import {
   StateError,
   UsageError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/config/store.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";

package/dist/{chunk-ZSE4QRKE.js → chunk-KGXPLI7W.js}

@@ -19,6 +19,11 @@ var UsageError = class extends ClawopsError {
     super(message, "UsageError", 2, false);
   }
 };
+var AuthError = class extends ClawopsError {
+  constructor(message) {
+    super(message, "AuthError", 3, false);
+  }
+};
 var StateError = class extends ClawopsError {
   constructor(message) {
     super(message, "StateError", 4, false);
@@ -34,11 +39,24 @@ var NetworkError = class extends ClawopsError {
     super(message, "NetworkError", 6, true);
   }
 };
+var OperationalError = class extends ClawopsError {
+  constructor(message, retryable = false) {
+    super(message, "OperationalError", 1, retryable);
+  }
+};
+var CancelledError = class extends ClawopsError {
+  constructor(message = "Operation cancelled") {
+    super(message, "CancelledError", 130, true);
+  }
+};
 
 export {
   ClawopsError,
   UsageError,
+  AuthError,
   StateError,
   ProviderError,
-  NetworkError
+  NetworkError,
+  OperationalError,
+  CancelledError
 };

package/dist/chunk-LU63NZD3.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import {
+  validatePlan
+} from "./chunk-YTH4L2GN.js";
+import {
+  resolveSecrets
+} from "./chunk-BOPSG2LI.js";
+import {
+  buildContext
+} from "./chunk-ACYJBSLJ.js";
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-UDNZUSKA.js";
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/apply.ts
+async function applyPlan(plan, opts) {
+  const validation = validatePlan(plan);
+  if (!validation.ok) {
+    throw new UsageError(
+      `Invalid deploy plan:
+${validation.errors.join("\n")}`
+    );
+  }
+  if (plan.spec.provider === "local") {
+    throw new UsageError(
+      "plan/apply is not supported for the local provider. Use `clawops up` directly."
+    );
+  }
+  const ctx = buildContext({
+    stack: plan.spec.stackName,
+    provider: plan.spec.provider
+  });
+  const stack = await ctx.getStack();
+  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
+  if (plan.spec.region) {
+    await stack.setConfig("region", { value: plan.spec.region });
+  }
+  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
+  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
+  if (modelProvider === "bedrock") {
+    await stack.setConfig("bedrockEnabled", { value: "true" });
+  }
+  if (plan.metadata.stackVersion !== void 0) {
+    const currentInfo = await stack.info();
+    if (currentInfo !== void 0 && currentInfo.version !== plan.metadata.stackVersion) {
+      process.stderr.write(
+        `
+Warning: stack "${plan.spec.stackName}" has changed since this plan was generated (plan version: ${plan.metadata.stackVersion}, current: ${currentInfo.version}).
+The diff you reviewed may no longer reflect what will be applied.
+
+`
+      );
+      if (opts?.confirmDrift) {
+        await opts.confirmDrift();
+      }
+    }
+  }
+  const start = Date.now();
+  const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
+  const outputs = Object.fromEntries(
+    Object.entries(result.outputs).map(([k, v]) => [k, v.value])
+  );
+  const changeSummary = {};
+  if (result.summary.resourceChanges) {
+    for (const [op, count] of Object.entries(result.summary.resourceChanges)) {
+      changeSummary[op] = count;
+    }
+  }
+  const hasOverlay = plan.spec.openclaw.config !== void 0 || plan.spec.openclaw.channels !== void 0;
+  if (hasOverlay) {
+    await applyConfigOverlay(plan, outputs, ctx, opts?.signal);
+  }
+  return {
+    outputs,
+    changeSummary,
+    durationMs: Date.now() - start
+  };
+}
+async function applyConfigOverlay(plan, outputs, ctx, signal) {
+  const { connect } = await import("./ssh-IQXNME3D.js");
+  const connInfo = ctx.adapter.getConnectionInfo(outputs);
+  const session = await connect({
+    host: connInfo.host,
+    port: connInfo.port,
+    user: connInfo.user,
+    privateKeyPath: connInfo.privateKeyPath,
+    knownHostsPath: connInfo.knownHostsPath,
+    signal
+  });
+  try {
+    const remote = await readRemoteConfig(session, signal);
+    const configOverlay = plan.spec.openclaw.config ?? {};
+    const resolvedOverlay = resolveSecrets(
+      configOverlay,
+      plan.spec.secrets ?? []
+    );
+    const merged = deepMerge(remote, {
+      ...resolvedOverlay,
+      ...plan.spec.openclaw.channels !== void 0 ? { channels: plan.spec.openclaw.channels } : {}
+    });
+    await atomicWriteConfig(session, merged, signal);
+    await restartGateway(session, signal);
+  } finally {
+    session.close();
+  }
+}
+
+export {
+  applyPlan
+};