@clawops/cli 1.1.0 → 1.2.1

package/dist/chunk-BOPSG2LI.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// src/plan/secrets.ts
+import { readFileSync } from "fs";
+var UNRESOLVED_SOURCES = /* @__PURE__ */ new Set(["aws-sm", "aws-ssm", "gcp-sm", "azure-kv"]);
+function resolveSecrets(config, secrets) {
+  const resolved = buildSecretMap(secrets);
+  return walkResolve(config, resolved);
+}
+function buildSecretMap(secrets) {
+  const map = /* @__PURE__ */ new Map();
+  for (const secret of secrets) {
+    if (UNRESOLVED_SOURCES.has(secret.source)) {
+      process.stderr.write(
+        `[clawops] Warning: secret "${secret.name}" uses source "${secret.source}" which is not yet resolved automatically. Set the value manually after deployment with: clawops config set
+`
+      );
+      continue;
+    }
+    if (secret.source === "env") {
+      const ref = secret.ref ?? secret.name;
+      const val = process.env[ref];
+      if (val === void 0) {
+        process.stderr.write(
+          `[clawops] Warning: secret "${secret.name}" references env var "${ref}" which is not set. The $secret: ref will remain unresolved in the config.
+`
+        );
+        continue;
+      }
+      map.set(secret.name, val);
+    } else if (secret.source === "file") {
+      if (!secret.ref) {
+        process.stderr.write(
+          `[clawops] Warning: secret "${secret.name}" has source "file" but no ref path.
+`
+        );
+        continue;
+      }
+      try {
+        map.set(secret.name, readFileSync(secret.ref, "utf-8").trim());
+      } catch (err) {
+        process.stderr.write(
+          `[clawops] Warning: cannot read secret "${secret.name}" from file "${secret.ref}": ${err.message}
+`
+        );
+      }
+    }
+  }
+  return map;
+}
+function walkResolve(value, secrets) {
+  if (typeof value === "string") {
+    const match = /^\$secret:(.+)$/.exec(value);
+    if (match) {
+      const name = match[1];
+      const resolved = secrets.get(name);
+      if (resolved !== void 0) return resolved;
+      return value;
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => walkResolve(item, secrets));
+  }
+  if (value !== null && typeof value === "object") {
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+      result[k] = walkResolve(v, secrets);
+    }
+    return result;
+  }
+  return value;
+}
+
+export {
+  resolveSecrets
+};

package/dist/{chunk-PRYLTCS4.js → chunk-BRPU7AQC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-ALSUDYA7.js";
+} from "./chunk-CX5SL5HP.js";
 
 // src/providers/local/state.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";

package/dist/{chunk-ALSUDYA7.js → chunk-CX5SL5HP.js}

@@ -2,7 +2,7 @@
 import {
   StateError,
   UsageError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/config/store.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";

package/dist/{chunk-ZSE4QRKE.js → chunk-KGXPLI7W.js}

@@ -19,6 +19,11 @@ var UsageError = class extends ClawopsError {
     super(message, "UsageError", 2, false);
   }
 };
+var AuthError = class extends ClawopsError {
+  constructor(message) {
+    super(message, "AuthError", 3, false);
+  }
+};
 var StateError = class extends ClawopsError {
   constructor(message) {
     super(message, "StateError", 4, false);
@@ -34,11 +39,24 @@ var NetworkError = class extends ClawopsError {
     super(message, "NetworkError", 6, true);
   }
 };
+var OperationalError = class extends ClawopsError {
+  constructor(message, retryable = false) {
+    super(message, "OperationalError", 1, retryable);
+  }
+};
+var CancelledError = class extends ClawopsError {
+  constructor(message = "Operation cancelled") {
+    super(message, "CancelledError", 130, true);
+  }
+};
 
 export {
   ClawopsError,
   UsageError,
+  AuthError,
   StateError,
   ProviderError,
-  NetworkError
+  NetworkError,
+  OperationalError,
+  CancelledError
 };

package/dist/chunk-LU63NZD3.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import {
+  validatePlan
+} from "./chunk-YTH4L2GN.js";
+import {
+  resolveSecrets
+} from "./chunk-BOPSG2LI.js";
+import {
+  buildContext
+} from "./chunk-ACYJBSLJ.js";
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-UDNZUSKA.js";
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/apply.ts
+async function applyPlan(plan, opts) {
+  const validation = validatePlan(plan);
+  if (!validation.ok) {
+    throw new UsageError(
+      `Invalid deploy plan:
+${validation.errors.join("\n")}`
+    );
+  }
+  if (plan.spec.provider === "local") {
+    throw new UsageError(
+      "plan/apply is not supported for the local provider. Use `clawops up` directly."
+    );
+  }
+  const ctx = buildContext({
+    stack: plan.spec.stackName,
+    provider: plan.spec.provider
+  });
+  const stack = await ctx.getStack();
+  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
+  if (plan.spec.region) {
+    await stack.setConfig("region", { value: plan.spec.region });
+  }
+  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
+  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
+  if (modelProvider === "bedrock") {
+    await stack.setConfig("bedrockEnabled", { value: "true" });
+  }
+  if (plan.metadata.stackVersion !== void 0) {
+    const currentInfo = await stack.info();
+    if (currentInfo !== void 0 && currentInfo.version !== plan.metadata.stackVersion) {
+      process.stderr.write(
+        `
+Warning: stack "${plan.spec.stackName}" has changed since this plan was generated (plan version: ${plan.metadata.stackVersion}, current: ${currentInfo.version}).
+The diff you reviewed may no longer reflect what will be applied.
+
+`
+      );
+      if (opts?.confirmDrift) {
+        await opts.confirmDrift();
+      }
+    }
+  }
+  const start = Date.now();
+  const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
+  const outputs = Object.fromEntries(
+    Object.entries(result.outputs).map(([k, v]) => [k, v.value])
+  );
+  const changeSummary = {};
+  if (result.summary.resourceChanges) {
+    for (const [op, count] of Object.entries(result.summary.resourceChanges)) {
+      changeSummary[op] = count;
+    }
+  }
+  const hasOverlay = plan.spec.openclaw.config !== void 0 || plan.spec.openclaw.channels !== void 0;
+  if (hasOverlay) {
+    await applyConfigOverlay(plan, outputs, ctx, opts?.signal);
+  }
+  return {
+    outputs,
+    changeSummary,
+    durationMs: Date.now() - start
+  };
+}
+async function applyConfigOverlay(plan, outputs, ctx, signal) {
+  const { connect } = await import("./ssh-IQXNME3D.js");
+  const connInfo = ctx.adapter.getConnectionInfo(outputs);
+  const session = await connect({
+    host: connInfo.host,
+    port: connInfo.port,
+    user: connInfo.user,
+    privateKeyPath: connInfo.privateKeyPath,
+    knownHostsPath: connInfo.knownHostsPath,
+    signal
+  });
+  try {
+    const remote = await readRemoteConfig(session, signal);
+    const configOverlay = plan.spec.openclaw.config ?? {};
+    const resolvedOverlay = resolveSecrets(
+      configOverlay,
+      plan.spec.secrets ?? []
+    );
+    const merged = deepMerge(remote, {
+      ...resolvedOverlay,
+      ...plan.spec.openclaw.channels !== void 0 ? { channels: plan.spec.openclaw.channels } : {}
+    });
+    await atomicWriteConfig(session, merged, signal);
+    await restartGateway(session, signal);
+  } finally {
+    session.close();
+  }
+}
+
+export {
+  applyPlan
+};

package/dist/chunk-OIGTOLB3.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+// src/cli/mcp-apps.ts
+import { execSync } from "child_process";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import path from "path";
+import os from "os";
+var MCP_APPS = [
+  {
+    id: "claude-desktop",
+    name: "Claude Desktop",
+    configPath: () => process.platform === "darwin" ? path.join(os.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json") : path.join(os.homedir(), ".config", "Claude", "claude_desktop_config.json"),
+    isInstalled: () => existsSync(
+      process.platform === "darwin" ? path.join(os.homedir(), "Library", "Application Support", "Claude") : path.join(os.homedir(), ".config", "Claude")
+    )
+  },
+  {
+    id: "claude-code",
+    name: "Claude Code",
+    configPath: () => path.join(os.homedir(), ".claude.json"),
+    isInstalled: () => {
+      if (existsSync(path.join(os.homedir(), ".claude.json"))) return true;
+      try {
+        execSync("claude --version", { stdio: "ignore" });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  },
+  {
+    id: "cursor",
+    name: "Cursor",
+    configPath: () => path.join(os.homedir(), ".cursor", "mcp.json"),
+    isInstalled: () => existsSync(path.join(os.homedir(), ".cursor"))
+  },
+  {
+    id: "windsurf",
+    name: "Windsurf",
+    configPath: () => path.join(os.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+    isInstalled: () => existsSync(path.join(os.homedir(), ".codeium", "windsurf"))
+  },
+  {
+    id: "vscode",
+    name: "VS Code",
+    configPath: () => process.platform === "linux" ? path.join(os.homedir(), ".config", "Code", "User", "mcp.json") : path.join(os.homedir(), "Library", "Application Support", "Code", "User", "mcp.json"),
+    isInstalled: () => existsSync(
+      process.platform === "linux" ? path.join(os.homedir(), ".config", "Code") : path.join(os.homedir(), "Library", "Application Support", "Code")
+    )
+  },
+  {
+    id: "zed",
+    name: "Zed",
+    configPath: () => path.join(os.homedir(), ".config", "zed", "settings.json"),
+    isInstalled: () => existsSync(path.join(os.homedir(), ".config", "zed")),
+    configKey: "context_servers",
+    entryExtra: { type: "stdio" }
+  }
+];
+function buildMcpEntry() {
+  try {
+    const bin = execSync("which clawops", {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (bin) return { command: bin, args: ["mcp", "serve", "--read-only"], resolved: true };
+  } catch {
+  }
+  return { command: "clawops", args: ["mcp", "serve", "--read-only"], resolved: false };
+}
+function writeAppConfigs(apps, entry) {
+  return apps.map((app) => {
+    const cfgPath = app.configPath();
+    try {
+      let config = {};
+      if (existsSync(cfgPath)) {
+        try {
+          config = JSON.parse(readFileSync(cfgPath, "utf-8"));
+        } catch {
+        }
+      }
+      mkdirSync(path.dirname(cfgPath), { recursive: true });
+      const key = app.configKey ?? "mcpServers";
+      const servers = config[key] ?? {};
+      servers["clawops"] = { ...entry, ...app.entryExtra ?? {} };
+      config[key] = servers;
+      writeFileSync(cfgPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+      return { app, configPath: cfgPath, ok: true };
+    } catch (err) {
+      return { app, configPath: cfgPath, ok: false, error: err.message };
+    }
+  });
+}
+
+export {
+  MCP_APPS,
+  buildMcpEntry,
+  writeAppConfigs
+};

package/dist/chunk-QJ6ERXHN.js

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+import {
+  buildContext
+} from "./chunk-ACYJBSLJ.js";
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-ZVOEQCNW.js";
+import {
+  OPENCLAW_CONFIG,
+  atomicWriteConfig,
+  restartGateway
+} from "./chunk-UDNZUSKA.js";
+import {
+  StateError
+} from "./chunk-KGXPLI7W.js";
+
+// src/mcp/tools/_conn.ts
+async function resolveConn(ctx) {
+  if (ctx.adapter.name === "local") {
+    const state = ctx.localState;
+    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
+    return {
+      host: state.sshHost,
+      port: state.sshPort,
+      user: state.sshUser,
+      privateKeyPath: state.privateKeyPath,
+      knownHostsPath: state.knownHostsPath
+    };
+  }
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
+  }
+  const base = extractBaseOutputs(outputs);
+  return ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
+function errText(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function okText(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+
+// src/mcp/tools/cli/config.ts
+var VALID_AUTH_MODES = /* @__PURE__ */ new Set(["none", "token", "password", "trusted-proxy"]);
+async function handleConfigGet(input, _server) {
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
+    let cfg;
+    try {
+      cfg = JSON.parse(result.stdout);
+    } catch {
+      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${result.stderr || result.stdout}`);
+    }
+    const value = input.key ? getPath(cfg, input.key) : cfg;
+    return okText(JSON.stringify(value, null, 2));
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigSet(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm config change" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Config change cancelled.");
+  }
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
+    let cfg;
+    try {
+      cfg = JSON.parse(readResult.stdout);
+    } catch {
+      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr}`);
+    }
+    let parsedValue = input.value;
+    try {
+      parsedValue = JSON.parse(input.value);
+    } catch {
+    }
+    setPath(cfg, input.key, parsedValue);
+    try {
+      await atomicWriteConfig(session, cfg, ac.signal);
+    } catch (err) {
+      return errText(`Failed to write config: ${err.message}`);
+    }
+    let note = "";
+    if (input.restart) {
+      try {
+        await restartGateway(session, ac.signal);
+        note = " (gateway restarted)";
+      } catch (err) {
+        return errText(`Gateway restart failed: ${err.message}`);
+      }
+    }
+    return okText(`Config set: ${input.key}${note}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigUnset(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Remove config key "${input.key}" on stack "${input.stackName ?? "default"}"?`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm key removal" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Config unset cancelled.");
+  }
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
+    let cfg;
+    try {
+      cfg = JSON.parse(readResult.stdout);
+    } catch {
+      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr}`);
+    }
+    deletePath(cfg, input.key);
+    try {
+      await atomicWriteConfig(session, cfg, ac.signal);
+    } catch (err) {
+      return errText(`Failed to write config: ${err.message}`);
+    }
+    let note = "";
+    if (input.restart) {
+      try {
+        await restartGateway(session, ac.signal);
+        note = " (gateway restarted)";
+      } catch (err) {
+        return errText(`Gateway restart failed: ${err.message}`);
+      }
+    }
+    return okText(`Config key removed: ${input.key}${note}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigValidate(input, _server) {
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
+    let cfg;
+    try {
+      cfg = JSON.parse(result.stdout);
+    } catch {
+      return okText(JSON.stringify({ valid: false, issues: [`Invalid JSON: ${result.stderr || result.stdout}`] }));
+    }
+    const issues = validateOpenclawConfig(cfg);
+    return okText(JSON.stringify({ valid: issues.length === 0, issues }));
+  } finally {
+    release();
+    drainPool();
+  }
+}
+function getPath(obj, dotKey) {
+  return dotKey.split(".").reduce((cur, k) => {
+    if (cur !== null && typeof cur === "object") return cur[k];
+    return void 0;
+  }, obj);
+}
+function setPath(obj, dotKey, value) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
+    cur = cur[k];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+function deletePath(obj, dotKey) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) return;
+    cur = cur[k];
+  }
+  delete cur[keys[keys.length - 1]];
+}
+function validateOpenclawConfig(cfg) {
+  const issues = [];
+  if ("version" in cfg) {
+    issues.push(
+      "Top-level 'version' is not a valid OpenClaw config key. Use 'meta.lastTouchedVersion' (string) instead."
+    );
+  }
+  if ("channels" in cfg && Array.isArray(cfg["channels"])) {
+    issues.push(
+      `'channels' must be an object keyed by provider name (e.g. {"discord":{...}}), not an array.`
+    );
+  }
+  const meta = cfg["meta"];
+  if (meta !== void 0 && (typeof meta !== "object" || Array.isArray(meta) || meta === null)) {
+    issues.push("'meta' must be an object.");
+  } else if (meta && typeof meta === "object") {
+    const ltv = meta["lastTouchedVersion"];
+    if (ltv !== void 0 && typeof ltv !== "string") {
+      issues.push("'meta.lastTouchedVersion' must be a string.");
+    }
+  }
+  const gateway = cfg["gateway"];
+  if (gateway !== void 0 && typeof gateway === "object" && !Array.isArray(gateway) && gateway !== null) {
+    const gw = gateway;
+    if ("port" in gw && typeof gw["port"] !== "number") {
+      issues.push("'gateway.port' must be a number.");
+    }
+    const auth = gw["auth"];
+    if (auth !== void 0 && typeof auth === "object" && !Array.isArray(auth) && auth !== null) {
+      const mode = auth["mode"];
+      if (mode !== void 0 && !VALID_AUTH_MODES.has(mode)) {
+        issues.push(
+          `'gateway.auth.mode' must be one of: ${[...VALID_AUTH_MODES].join(", ")}. Got: "${mode}".`
+        );
+      }
+    }
+  }
+  return issues;
+}
+
+export {
+  resolveConn,
+  errText,
+  okText,
+  handleConfigGet,
+  handleConfigSet,
+  handleConfigUnset,
+  handleConfigValidate,
+  validateOpenclawConfig
+};

package/dist/{chunk-D4UAHAKI.js → chunk-SSB6SGPQ.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import {
-  buildContext
-} from "./chunk-PERSDQMT.js";
 import {
   validatePlan
 } from "./chunk-YTH4L2GN.js";
+import {
+  buildContext
+} from "./chunk-ACYJBSLJ.js";
 import {
   getConfig
-} from "./chunk-ALSUDYA7.js";
+} from "./chunk-CX5SL5HP.js";
 import {
   UsageError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/plan/generate.ts
 import { randomUUID } from "crypto";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-FA6UOG2I.js");
+  const { version } = await import("./package-SE3M4NJA.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";
@@ -90,6 +90,10 @@ async function generatePlan(intent, _opts) {
       diff.totalChanges = (summary["create"] ?? 0) + (summary["update"] ?? 0) + (summary["delete"] ?? 0);
     }
     plan.diff = diff;
+    const info = await stack.info();
+    if (info !== void 0) {
+      plan.metadata.stackVersion = info.version;
+    }
   } catch (err) {
     process.stderr.write(
       `[clawops] Warning: preview failed, diff section omitted: ${err instanceof Error ? err.message : String(err)}