@clawops/cli 1.2.1 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # clawops
 
-Deploy OpenClaw once. Operate it from your terminal or Claude Code.
+MCP-native infrastructure ops for OpenClaw — with read-only mode, destructive-action confirmation, and audit logs built in.
 
 **clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
 self-hosted [OpenClaw](https://github.com/openclaw/openclaw) instances. Provision on AWS, GCP,
@@ -9,6 +9,31 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.4.0
+
+**`clawops monitor`** — live dashboard for any deployed stack. Shows gateway health, container
+status, CPU/memory, disk usage, and a rolling log tail. Refreshes on an interval with `[r]`,
+toggles logs with `[l]`, and quits with `[q]`.
+
+Run without `--stack` to get an **interactive stack picker** first — probes all registered stacks
+in parallel, shows only running ones by default, and lets you toggle to a full list (`[a]`) where
+not-deployed stacks can be deleted from the registry with `[d]`. Press `[s]` inside the dashboard
+to go back to the picker.
+
+```bash
+clawops monitor              # interactive stack selection → dashboard
+clawops monitor --stack prod # jump straight to a named stack
+clawops monitor --stack prod | cat  # one-shot snapshot for CI
+```
+
+**`clawops_monitor` MCP tool** — same snapshot as a single structured JSON call, so Claude Code
+and Cursor can check stack health without opening a terminal.
+
+**`clawops stacks delete` guard** — now blocks deletion of a still-deployed stack and requires
+`--force` to remove from the registry without tearing down cloud resources first.
+
+---
+
 ## Who this is for
 
 - **OpenClaw users** who want the simplest path to self-hosting across cloud or local VMs, with
@@ -393,6 +418,78 @@ Key design decisions:
 
 See [`docs/architecture.md`](docs/architecture.md) for a full narrative, and [`docs/decisions/`](docs/decisions/) for ADRs.
 
+### Cloud provider stacks
+
+Each cloud provider is an inline Pulumi program that creates the resources below. All three share the same outputs (`publicIp`, `gatewayUrl`, `sshHost`, `sshPort`, `sshUser`) consumed by the SSH and config-overlay layers.
+
+#### AWS
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        VPC["VPC (10.0.0.0/16)"]
+        IGW[Internet Gateway]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        RT[Route Table]
+        SG["Security Group (ports 22, 18789)"]
+    end
+    subgraph IAM["IAM"]
+        ROLE[IAM Role]
+        SSM[SSM Policy Attachment]
+        BED["Bedrock Policy Attachment (optional)"]
+        IP[Instance Profile]
+    end
+    subgraph COMPUTE["Compute"]
+        KP[EC2 Key Pair]
+        EC2["EC2 Instance (Ubuntu 22.04, IMDSv2)"]
+        EIP[Elastic IP]
+    end
+```
+
+[Detailed diagram →](docs/providers/aws.md#stack-diagram)
+
+#### GCP
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        NW[VPC Network]
+        SN["Subnetwork (10.0.0.0/24)"]
+        FW1["Firewall: SSH port 22 (conditional)"]
+        FW2["Firewall: Gateway port 18789 (conditional)"]
+        ADDR[Static External IP]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["Compute Instance (Debian 12, 20 GB)"]
+    end
+```
+
+[Detailed diagram →](docs/providers/gcp.md#stack-diagram)
+
+#### Azure
+
+```mermaid
+flowchart LR
+    RG[Resource Group]
+    subgraph NET["Networking"]
+        VNET["Virtual Network (10.0.0.0/16)"]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        NSG["Network Security Group (ports 22, 18789)"]
+        PIP["Public IP Address (Static)"]
+        NIC[Network Interface]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["VM (Ubuntu 22.04, managed identity)"]
+    end
+    subgraph KV["Key Vault (optional)"]
+        VAULT["Key Vault (RBAC, name max 24 chars)"]
+        RA["Role Assignment (Secrets User)"]
+        SECRET["Secret: gateway-token"]
+    end
+```
+
+[Detailed diagram →](docs/providers/azure.md#stack-diagram)
+
 ---
 
 ## Development

package/dist/{apply-KBF7OPWL.js → apply-5RREMN3L.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-LU63NZD3.js";
+} from "./chunk-ZONXY3C6.js";
 import "./chunk-YTH4L2GN.js";
+import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
-import "./chunk-UDNZUSKA.js";
+import "./chunk-T5EX55GP.js";
+import "./chunk-ZFNPM2WG.js";
+import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
 export {

package/dist/{aws-KQBWY43W.js → aws-FRE2JVAZ.js}

@@ -142,6 +142,12 @@ var awsProgram = async () => {
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
     userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
+    // and obtain the instance role credentials (required for Bedrock access).
+    metadataOptions: {
+      httpTokens: "required",
+      httpPutResponseHopLimit: 2
+    },
     tags: { Name: "clawops" }
   });
   const eip = new aws.ec2.Eip("clawops-eip", {
@@ -164,8 +170,7 @@ var awsProgram = async () => {
   };
 };
 function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvSetup = bedrockEnabled ? '\n# Write AWS_PROFILE so the container can use the instance role for Bedrock\necho "AWS_PROFILE=default" > /etc/openclaw.env\n' : "";
-  const bedrockEnvFlag = bedrockEnabled ? "  --env-file /etc/openclaw.env \\\\\n" : "";
+  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
   return `#!/bin/bash
 set -euo pipefail
 
@@ -175,7 +180,7 @@ mkdir -p /home/clawops/.ssh
 chmod 700 /home/clawops/.ssh
 chown clawops:clawops /home/clawops/.ssh
 
-# Install Docker if not present (Ubuntu/Debian only; AWS AMI is ubuntu-22.04)
+# Install Docker if not present (AWS AMI is ubuntu-22.04)
 if ! command -v docker &>/dev/null; then
   export DEBIAN_FRONTEND=noninteractive
   apt-get update -q
@@ -193,7 +198,7 @@ if ! command -v docker &>/dev/null; then
 fi
 
 usermod -aG docker clawops
-${bedrockEnvSetup}
+
 # Pull OpenClaw image
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}

package/dist/{azure-4EJFVJZL.js → azure-PVC3AQVC.js}

@@ -4,12 +4,14 @@
 import process2 from "process";
 
 // src/providers/azure/program.ts
+import { createHash } from "crypto";
 var GATEWAY_PORT = 18789;
 var SSH_PORT = 22;
 var azureProgram = async () => {
-  const [pulumi, azure, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+  const [pulumi, azure, random, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
+    import("@pulumi/random"),
     import("./firewall-YYDOWDDP.js")
   ]);
   const cfg = new pulumi.Config();
@@ -138,8 +140,9 @@ var azureProgram = async () => {
     }
   });
   if (keyVaultEnabled) {
-    const rawKvName = `clawops-${stackName}-kv`;
-    const kvName = rawKvName.length > 24 ? rawKvName.slice(0, 24) : rawKvName;
+    const safeName = stackName.replace(/[^a-zA-Z0-9-]/g, "-");
+    const rawKvName = `clawops-${safeName}-kv`;
+    const kvName = rawKvName.length > 24 ? `cl-${createHash("sha256").update(stackName).digest("hex").slice(0, 20)}` : rawKvName;
     const kv = new azure.keyvault.Vault("clawops-kv", {
       resourceGroupName: rg.name,
       location: rg.location,
@@ -157,11 +160,15 @@ var azureProgram = async () => {
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
+    const gatewayToken = new random.RandomPassword("clawops-kv-gateway-token", {
+      length: 32,
+      special: false
+    });
     new azure.keyvault.Secret("clawops-gateway-token", {
       resourceGroupName: rg.name,
       vaultName: kv.name,
       secretName: "gateway-token",
-      properties: { value: "CHANGEME" }
+      properties: { value: gatewayToken.result }
     });
   }
   const resolvedIp = pulumi.output(publicIp.ipAddress).apply((ip) => ip ?? "");

package/dist/{bootstrap-UYCOEJQX.js → bootstrap-G4UZ2FKH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import {
-  writeLocalState
-} from "./chunk-BRPU7AQC.js";
 import {
   acquireSession
 } from "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
+import {
+  writeLocalState
+} from "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import {
   ProviderError

package/dist/chunk-6ZFIFDBJ.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+// src/plan/overlay-store.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from "fs";
+import path from "path";
+import os from "os";
+function overlayPath(stackName) {
+  return path.join(os.homedir(), ".clawops", "overlays", `${stackName}.json`);
+}
+function saveOverlay(stackName, overlay, secrets) {
+  const dir = path.join(os.homedir(), ".clawops", "overlays");
+  mkdirSync(dir, { recursive: true });
+  const data = { stackName, savedAt: (/* @__PURE__ */ new Date()).toISOString(), overlay, secrets };
+  writeFileSync(overlayPath(stackName), JSON.stringify(data, null, 2) + "\n", "utf-8");
+}
+function loadOverlay(stackName) {
+  const p = overlayPath(stackName);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function listOverlays() {
+  const dir = path.join(os.homedir(), ".clawops", "overlays");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
+    try {
+      return [JSON.parse(readFileSync(path.join(dir, f), "utf-8"))];
+    } catch {
+      return [];
+    }
+  });
+}
+
+export {
+  saveOverlay,
+  loadOverlay,
+  listOverlays
+};

package/dist/{chunk-BRPU7AQC.js → chunk-A2I76FTA.js}

@@ -30,8 +30,20 @@ function writeLocalState(stackName, state) {
   writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf-8");
   renameSync(tmp, dest);
 }
+function localStateToConnectionInfo(state) {
+  return {
+    host: state.sshHost,
+    port: state.sshPort,
+    user: state.sshUser,
+    privateKeyPath: state.privateKeyPath,
+    knownHostsPath: state.knownHostsPath
+  };
+}
 
 export {
+  stateDir,
+  statePath,
   readLocalState,
-  writeLocalState
+  writeLocalState,
+  localStateToConnectionInfo
 };