@clawops/cli 1.3.0 → 1.5.0

package/README.md

@@ -1,5 +1,8 @@
 # clawops
 
+[![npm version](https://img.shields.io/npm/v/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+[![npm downloads](https://img.shields.io/npm/dm/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+
 MCP-native infrastructure ops for OpenClaw — with read-only mode, destructive-action confirmation, and audit logs built in.
 
 **clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
@@ -9,6 +12,52 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.5.0
+
+**`clawops mcp wire`** — wire the OpenClaw gateway's own AI as an MCP client of clawops.
+Once wired, in-conversation commands like "check if my stack is healthy" or "show me the last 20
+log lines" invoke the real `clawops` CLI rather than having the gateway AI guess.
+
+```bash
+clawops mcp wire                   # wire the default stack
+clawops mcp wire --stack prod      # target a named stack
+clawops mcp wire --force           # bypass gateway version check
+```
+
+Version-gated: requires OpenClaw ≥ 2026.4 on the gateway side. If the version is older, the
+command surfaces a clear upgrade prompt and exits cleanly.
+
+The `clawops setup` wizard now also asks at the end of a successful deploy:
+*"Should the OpenClaw gateway's AI also be able to manage this stack?"* — accepting wires the
+client automatically over the same SSH session.
+
+---
+
+## What's new in v1.4.0
+
+**`clawops monitor`** — live dashboard for any deployed stack. Shows gateway health, container
+status, CPU/memory, disk usage, and a rolling log tail. Refreshes on an interval with `[r]`,
+toggles logs with `[l]`, and quits with `[q]`.
+
+Run without `--stack` to get an **interactive stack picker** first — probes all registered stacks
+in parallel, shows only running ones by default, and lets you toggle to a full list (`[a]`) where
+not-deployed stacks can be deleted from the registry with `[d]`. Press `[s]` inside the dashboard
+to go back to the picker.
+
+```bash
+clawops monitor              # interactive stack selection → dashboard
+clawops monitor --stack prod # jump straight to a named stack
+clawops monitor --stack prod | cat  # one-shot snapshot for CI
+```
+
+**`clawops_monitor` MCP tool** — same snapshot as a single structured JSON call, so Claude Code
+and Cursor can check stack health without opening a terminal.
+
+**`clawops stacks delete` guard** — now blocks deletion of a still-deployed stack and requires
+`--force` to remove from the registry without tearing down cloud resources first.
+
+---
+
 ## Who this is for
 
 - **OpenClaw users** who want the simplest path to self-hosting across cloud or local VMs, with
@@ -222,8 +271,11 @@ clawops down --yes          # Destroy local-provider stack
 | `backup` | Create or restore an OpenClaw state backup |
 | `stacks` | List named stacks and their state |
 | `doctor` | Check Node version, config, SSH key, provider credentials, and Pulumi home |
+| `secret` | Manage secrets: `list`, `set`, `delete`, `rotate`, `audit` |
+| `monitor` | Live dashboard: gateway health, container stats, log tail, stack picker |
 | `mcp serve` | Start the embedded MCP server (stdio or HTTP) |
 | `mcp install` | Interactively wire clawops into AI editors |
+| `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
 
 Full flag reference: `clawops <command> --help`
@@ -272,6 +324,18 @@ The wizard resolves the absolute binary path automatically so app launchers can
 without inheriting your shell's `PATH`. See [Connect an AI editor](#connect-an-ai-editor) above
 for manual config paths.
 
+### Wire the gateway AI
+
+The OpenClaw gateway runs its own AI agent. Once wired, that agent can call clawops directly
+instead of guessing at infrastructure state:
+
+```bash
+clawops mcp wire --stack prod   # write MCP client entry into gateway config + restart
+```
+
+Requires OpenClaw ≥ 2026.4 on the gateway. The `clawops setup` wizard offers this step
+automatically after a successful deploy.
+
 ### Stdio mode (Claude Code / Cursor / VS Code)
 
 Start the server manually or confirm your config is correct:
@@ -393,6 +457,78 @@ Key design decisions:
 
 See [`docs/architecture.md`](docs/architecture.md) for a full narrative, and [`docs/decisions/`](docs/decisions/) for ADRs.
 
+### Cloud provider stacks
+
+Each cloud provider is an inline Pulumi program that creates the resources below. All three share the same outputs (`publicIp`, `gatewayUrl`, `sshHost`, `sshPort`, `sshUser`) consumed by the SSH and config-overlay layers.
+
+#### AWS
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        VPC["VPC (10.0.0.0/16)"]
+        IGW[Internet Gateway]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        RT[Route Table]
+        SG["Security Group (ports 22, 18789)"]
+    end
+    subgraph IAM["IAM"]
+        ROLE[IAM Role]
+        SSM[SSM Policy Attachment]
+        BED["Bedrock Policy Attachment (optional)"]
+        IP[Instance Profile]
+    end
+    subgraph COMPUTE["Compute"]
+        KP[EC2 Key Pair]
+        EC2["EC2 Instance (Ubuntu 22.04, IMDSv2)"]
+        EIP[Elastic IP]
+    end
+```
+
+[Detailed diagram →](docs/providers/aws.md#stack-diagram)
+
+#### GCP
+
+```mermaid
+flowchart LR
+    subgraph NET["Networking"]
+        NW[VPC Network]
+        SN["Subnetwork (10.0.0.0/24)"]
+        FW1["Firewall: SSH port 22 (conditional)"]
+        FW2["Firewall: Gateway port 18789 (conditional)"]
+        ADDR[Static External IP]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["Compute Instance (Debian 12, 20 GB)"]
+    end
+```
+
+[Detailed diagram →](docs/providers/gcp.md#stack-diagram)
+
+#### Azure
+
+```mermaid
+flowchart LR
+    RG[Resource Group]
+    subgraph NET["Networking"]
+        VNET["Virtual Network (10.0.0.0/16)"]
+        SUBNET["Subnet (10.0.1.0/24)"]
+        NSG["Network Security Group (ports 22, 18789)"]
+        PIP["Public IP Address (Static)"]
+        NIC[Network Interface]
+    end
+    subgraph COMPUTE["Compute"]
+        VM["VM (Ubuntu 22.04, managed identity)"]
+    end
+    subgraph KV["Key Vault (optional)"]
+        VAULT["Key Vault (RBAC, name max 24 chars)"]
+        RA["Role Assignment (Secrets User)"]
+        SECRET["Secret: gateway-token"]
+    end
+```
+
+[Detailed diagram →](docs/providers/azure.md#stack-diagram)
+
 ---
 
 ## Development

package/dist/{apply-DLNE2JYZ.js → apply-5RREMN3L.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-JCUZU5BH.js";
+} from "./chunk-ZONXY3C6.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-JDN6PLH2.js";
-import "./chunk-UDNZUSKA.js";
+import "./chunk-T5EX55GP.js";
+import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{aws-KQBWY43W.js → aws-FRE2JVAZ.js}

@@ -142,6 +142,12 @@ var awsProgram = async () => {
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
     userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
+    // and obtain the instance role credentials (required for Bedrock access).
+    metadataOptions: {
+      httpTokens: "required",
+      httpPutResponseHopLimit: 2
+    },
     tags: { Name: "clawops" }
   });
   const eip = new aws.ec2.Eip("clawops-eip", {
@@ -164,8 +170,7 @@ var awsProgram = async () => {
   };
 };
 function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvSetup = bedrockEnabled ? '\n# Write AWS_PROFILE so the container can use the instance role for Bedrock\necho "AWS_PROFILE=default" > /etc/openclaw.env\n' : "";
-  const bedrockEnvFlag = bedrockEnabled ? "  --env-file /etc/openclaw.env \\\\\n" : "";
+  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
   return `#!/bin/bash
 set -euo pipefail
 
@@ -175,7 +180,7 @@ mkdir -p /home/clawops/.ssh
 chmod 700 /home/clawops/.ssh
 chown clawops:clawops /home/clawops/.ssh
 
-# Install Docker if not present (Ubuntu/Debian only; AWS AMI is ubuntu-22.04)
+# Install Docker if not present (AWS AMI is ubuntu-22.04)
 if ! command -v docker &>/dev/null; then
   export DEBIAN_FRONTEND=noninteractive
   apt-get update -q
@@ -193,7 +198,7 @@ if ! command -v docker &>/dev/null; then
 fi
 
 usermod -aG docker clawops
-${bedrockEnvSetup}
+
 # Pull OpenClaw image
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}

package/dist/{azure-4EJFVJZL.js → azure-PVC3AQVC.js}

@@ -4,12 +4,14 @@
 import process2 from "process";
 
 // src/providers/azure/program.ts
+import { createHash } from "crypto";
 var GATEWAY_PORT = 18789;
 var SSH_PORT = 22;
 var azureProgram = async () => {
-  const [pulumi, azure, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+  const [pulumi, azure, random, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
+    import("@pulumi/random"),
     import("./firewall-YYDOWDDP.js")
   ]);
   const cfg = new pulumi.Config();
@@ -138,8 +140,9 @@ var azureProgram = async () => {
     }
   });
   if (keyVaultEnabled) {
-    const rawKvName = `clawops-${stackName}-kv`;
-    const kvName = rawKvName.length > 24 ? rawKvName.slice(0, 24) : rawKvName;
+    const safeName = stackName.replace(/[^a-zA-Z0-9-]/g, "-");
+    const rawKvName = `clawops-${safeName}-kv`;
+    const kvName = rawKvName.length > 24 ? `cl-${createHash("sha256").update(stackName).digest("hex").slice(0, 20)}` : rawKvName;
     const kv = new azure.keyvault.Vault("clawops-kv", {
       resourceGroupName: rg.name,
       location: rg.location,
@@ -157,11 +160,15 @@ var azureProgram = async () => {
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
+    const gatewayToken = new random.RandomPassword("clawops-kv-gateway-token", {
+      length: 32,
+      special: false
+    });
     new azure.keyvault.Secret("clawops-gateway-token", {
       resourceGroupName: rg.name,
       vaultName: kv.name,
       secretName: "gateway-token",
-      properties: { value: "CHANGEME" }
+      properties: { value: gatewayToken.result }
     });
   }
   const resolvedIp = pulumi.output(publicIp.ipAddress).apply((ip) => ip ?? "");

package/dist/{chunk-ZDPBBYYV.js → chunk-IVX62LFO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-JDN6PLH2.js";
+} from "./chunk-T5EX55GP.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-AFUTH62F.js");
+  const { version } = await import("./package-QLDA65A3.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";