@clawops/cli 1.3.0 → 1.4.0

package/README.md

@@ -9,6 +9,31 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.4.0
+
+**`clawops monitor`** — live dashboard for any deployed stack. Shows gateway health, container
+status, CPU/memory, disk usage, and a rolling log tail. Refreshes on an interval with `[r]`,
+toggles logs with `[l]`, and quits with `[q]`.
+
+Run without `--stack` to get an **interactive stack picker** first — probes all registered stacks
+in parallel, shows only running ones by default, and lets you toggle to a full list (`[a]`) where
+not-deployed stacks can be deleted from the registry with `[d]`. Press `[s]` inside the dashboard
+to go back to the picker.
+
+```bash
+clawops monitor              # interactive stack selection → dashboard
+clawops monitor --stack prod # jump straight to a named stack
+clawops monitor --stack prod | cat  # one-shot snapshot for CI
+```
+
+**`clawops_monitor` MCP tool** — same snapshot as a single structured JSON call, so Claude Code
+and Cursor can check stack health without opening a terminal.
+
+**`clawops stacks delete` guard** — now blocks deletion of a still-deployed stack and requires
+`--force` to remove from the registry without tearing down cloud resources first.
+
+---
+
 ## Who this is for
 
 - **OpenClaw users** who want the simplest path to self-hosting across cloud or local VMs, with
@@ -393,6 +418,78 @@ Key design decisions:
 
 See [`docs/architecture.md`](docs/architecture.md) for a full narrative, and [`docs/decisions/`](docs/decisions/) for ADRs.
 
+### Cloud provider stacks
+
+Each cloud provider is an inline Pulumi program that creates the resources below. All three share the same outputs (`publicIp`, `gatewayUrl`, `sshHost`, `sshPort`, `sshUser`) consumed by the SSH and config-overlay layers.
+
+#### AWS
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        VPC["VPC (10.0.0.0/16)"]
+        IGW[Internet Gateway]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        RT[Route Table]
+        SG["Security Group (ports 22, 18789)"]
+    end
+    subgraph IAM["IAM"]
+        ROLE[IAM Role]
+        SSM[SSM Policy Attachment]
+        BED["Bedrock Policy Attachment (optional)"]
+        IP[Instance Profile]
+    end
+    subgraph COMPUTE["Compute"]
+        KP[EC2 Key Pair]
+        EC2["EC2 Instance (Ubuntu 22.04, IMDSv2)"]
+        EIP[Elastic IP]
+    end
+```
+
+[Detailed diagram →](docs/providers/aws.md#stack-diagram)
+
+#### GCP
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        NW[VPC Network]
+        SN["Subnetwork (10.0.0.0/24)"]
+        FW1["Firewall: SSH port 22 (conditional)"]
+        FW2["Firewall: Gateway port 18789 (conditional)"]
+        ADDR[Static External IP]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["Compute Instance (Debian 12, 20 GB)"]
+    end
+```
+
+[Detailed diagram →](docs/providers/gcp.md#stack-diagram)
+
+#### Azure
+
+```mermaid
+flowchart LR
+    RG[Resource Group]
+    subgraph NET["Networking"]
+        VNET["Virtual Network (10.0.0.0/16)"]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        NSG["Network Security Group (ports 22, 18789)"]
+        PIP["Public IP Address (Static)"]
+        NIC[Network Interface]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["VM (Ubuntu 22.04, managed identity)"]
+    end
+    subgraph KV["Key Vault (optional)"]
+        VAULT["Key Vault (RBAC, name max 24 chars)"]
+        RA["Role Assignment (Secrets User)"]
+        SECRET["Secret: gateway-token"]
+    end
+```
+
+[Detailed diagram →](docs/providers/azure.md#stack-diagram)
+
 ---
 
 ## Development

package/dist/{apply-DLNE2JYZ.js → apply-5RREMN3L.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-JCUZU5BH.js";
+} from "./chunk-ZONXY3C6.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-JDN6PLH2.js";
-import "./chunk-UDNZUSKA.js";
+import "./chunk-T5EX55GP.js";
+import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{aws-KQBWY43W.js → aws-FRE2JVAZ.js}

@@ -142,6 +142,12 @@ var awsProgram = async () => {
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
     userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
+    // and obtain the instance role credentials (required for Bedrock access).
+    metadataOptions: {
+      httpTokens: "required",
+      httpPutResponseHopLimit: 2
+    },
     tags: { Name: "clawops" }
   });
   const eip = new aws.ec2.Eip("clawops-eip", {
@@ -164,8 +170,7 @@ var awsProgram = async () => {
   };
 };
 function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvSetup = bedrockEnabled ? '\n# Write AWS_PROFILE so the container can use the instance role for Bedrock\necho "AWS_PROFILE=default" > /etc/openclaw.env\n' : "";
-  const bedrockEnvFlag = bedrockEnabled ? "  --env-file /etc/openclaw.env \\\\\n" : "";
+  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
   return `#!/bin/bash
 set -euo pipefail
 
@@ -175,7 +180,7 @@ mkdir -p /home/clawops/.ssh
 chmod 700 /home/clawops/.ssh
 chown clawops:clawops /home/clawops/.ssh
 
-# Install Docker if not present (Ubuntu/Debian only; AWS AMI is ubuntu-22.04)
+# Install Docker if not present (AWS AMI is ubuntu-22.04)
 if ! command -v docker &>/dev/null; then
   export DEBIAN_FRONTEND=noninteractive
   apt-get update -q
@@ -193,7 +198,7 @@ if ! command -v docker &>/dev/null; then
 fi
 
 usermod -aG docker clawops
-${bedrockEnvSetup}
+
 # Pull OpenClaw image
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}

package/dist/{azure-4EJFVJZL.js → azure-PVC3AQVC.js}

@@ -4,12 +4,14 @@
 import process2 from "process";
 
 // src/providers/azure/program.ts
+import { createHash } from "crypto";
 var GATEWAY_PORT = 18789;
 var SSH_PORT = 22;
 var azureProgram = async () => {
-  const [pulumi, azure, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+  const [pulumi, azure, random, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
+    import("@pulumi/random"),
     import("./firewall-YYDOWDDP.js")
   ]);
   const cfg = new pulumi.Config();
@@ -138,8 +140,9 @@ var azureProgram = async () => {
     }
   });
   if (keyVaultEnabled) {
-    const rawKvName = `clawops-${stackName}-kv`;
-    const kvName = rawKvName.length > 24 ? rawKvName.slice(0, 24) : rawKvName;
+    const safeName = stackName.replace(/[^a-zA-Z0-9-]/g, "-");
+    const rawKvName = `clawops-${safeName}-kv`;
+    const kvName = rawKvName.length > 24 ? `cl-${createHash("sha256").update(stackName).digest("hex").slice(0, 20)}` : rawKvName;
     const kv = new azure.keyvault.Vault("clawops-kv", {
       resourceGroupName: rg.name,
       location: rg.location,
@@ -157,11 +160,15 @@ var azureProgram = async () => {
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
+    const gatewayToken = new random.RandomPassword("clawops-kv-gateway-token", {
+      length: 32,
+      special: false
+    });
     new azure.keyvault.Secret("clawops-gateway-token", {
       resourceGroupName: rg.name,
       vaultName: kv.name,
       secretName: "gateway-token",
-      properties: { value: "CHANGEME" }
+      properties: { value: gatewayToken.result }
     });
   }
   const resolvedIp = pulumi.output(publicIp.ipAddress).apply((ip) => ip ?? "");