@clawops/cli 1.3.0 → 1.5.0

package/dist/{gcp-SKURG3L6.js → gcp-BXDTC6EK.js}

@@ -1,21 +1,40 @@
 #!/usr/bin/env node
 
 // src/providers/gcp/index.ts
-import process from "process";
+import process2 from "process";
 
 // src/providers/gcp/program.ts
 var GATEWAY_PORT = 18789;
 var SSH_PORT = 22;
 var gcpProgram = async () => {
-  const [pulumi, gcp] = await Promise.all([
+  const [pulumi, gcp, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
-    import("@pulumi/gcp")
+    import("@pulumi/gcp"),
+    import("./firewall-YYDOWDDP.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
   const region = cfg.get("region") ?? "us-central1";
   const openclawVersion = cfg.get("openclawVersion") ?? "latest";
   const zone = cfg.get("zone") ?? `${region}-a`;
+  const accessMode = cfg.get("accessMode") ?? "restricted";
+  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
+  const sshCidrs = cfg.get("sshCidrs") ?? "";
+  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
+  const sshPublicKey = cfg.get("sshPublicKey");
+  if (!sshPublicKey) {
+    throw new Error(
+      'Stack config "sshPublicKey" is required for the GCP adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
+    );
+  }
+  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  if (accessMode === "open") {
+    process.stderr.write(
+      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
+    );
+  }
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
   const network = new gcp.compute.Network("clawops-network", {
     autoCreateSubnetworks: false,
     description: "clawops managed network"
@@ -25,17 +44,22 @@ var gcpProgram = async () => {
     region,
     network: network.id
   });
-  new gcp.compute.Firewall("clawops-firewall", {
-    network: network.selfLink,
-    allows: [
-      {
-        protocol: "tcp",
-        ports: [String(SSH_PORT), String(GATEWAY_PORT)]
-      }
-    ],
-    sourceRanges: ["0.0.0.0/0"],
-    targetTags: ["clawops"]
-  });
+  if (sshIngressCidrs.length > 0) {
+    new gcp.compute.Firewall("clawops-firewall-ssh", {
+      network: network.selfLink,
+      allows: [{ protocol: "tcp", ports: [String(SSH_PORT)] }],
+      sourceRanges: sshIngressCidrs,
+      targetTags: ["clawops"]
+    });
+  }
+  if (gatewayIngressCidrs.length > 0) {
+    new gcp.compute.Firewall("clawops-firewall-gateway", {
+      network: network.selfLink,
+      allows: [{ protocol: "tcp", ports: [String(GATEWAY_PORT)] }],
+      sourceRanges: gatewayIngressCidrs,
+      targetTags: ["clawops"]
+    });
+  }
   const address = new gcp.compute.Address("clawops-address", { region });
   const instance = new gcp.compute.Instance("clawops-instance", {
     machineType: instanceType,
@@ -60,6 +84,8 @@ var gcpProgram = async () => {
       }
     ],
     metadata: {
+      // GCP guest agent reads 'ssh-keys' and populates /home/<user>/.ssh/authorized_keys
+      "ssh-keys": `clawops:${sshPublicKey}`,
       "startup-script": makeStartupScript(openclawVersion)
     },
     serviceAccount: {
@@ -154,6 +180,11 @@ var gcpAdapter = {
     };
   },
   normalizeInstanceType(alias) {
+    if (alias === "gpu") {
+      throw new Error(
+        "GPU instances are not yet supported on GCP. Use --provider aws (g4dn.xlarge) or --provider azure (Standard_NC6s_v3) for GPU workloads."
+      );
+    }
     const mapped = INSTANCE_TYPE_MAP[alias];
     if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
     return mapped;
@@ -166,9 +197,10 @@ var gcpAdapter = {
   },
   async validateConfig() {
     const errors = [];
-    const hasKeyFile = Boolean(process.env["GOOGLE_APPLICATION_CREDENTIALS"]);
-    const hasUserCreds = Boolean(process.env["CLOUDSDK_AUTH_ACCESS_TOKEN"]);
-    if (!hasKeyFile && !hasUserCreds) {
+    const hasKeyFile = Boolean(process2.env["GOOGLE_APPLICATION_CREDENTIALS"]);
+    const hasToken = Boolean(process2.env["GOOGLE_OAUTH_ACCESS_TOKEN"]);
+    const hasAdcFile = await checkAdcFile();
+    if (!hasKeyFile && !hasToken && !hasAdcFile) {
       const onGcp = await checkInstanceMetadata();
       if (!onGcp) {
         errors.push(
@@ -179,6 +211,17 @@ var gcpAdapter = {
     return { ok: errors.length === 0, errors };
   }
 };
+async function checkAdcFile() {
+  try {
+    const { accessSync } = await import("fs");
+    const { join } = await import("path");
+    const home = process2.env["HOME"] ?? process2.env["USERPROFILE"] ?? "";
+    accessSync(join(home, ".config", "gcloud", "application_default_credentials.json"));
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function checkInstanceMetadata() {
   try {
     const res = await fetch(

package/dist/{generate-U7PJ5LRG.js → generate-2QGKYR42.js}

@@ -2,9 +2,9 @@
 import {
   generatePlan,
   planId
-} from "./chunk-ZDPBBYYV.js";
+} from "./chunk-IVX62LFO.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-JDN6PLH2.js";
+import "./chunk-T5EX55GP.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/mcp-wire-ZWIYMLEW.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-ZFNPM2WG.js";
+
+// src/cli/mcp-wire.ts
+var GATEWAY_MCP_MIN_VERSION = "2026.4";
+var GATEWAY_MCP_ENTRY = {
+  command: "clawops",
+  args: ["mcp", "serve"],
+  transport: "stdio"
+};
+function versionAtLeast(version, min) {
+  const [vy = 0, vm = 0] = version.split(".").map(Number);
+  const [my = 0, mm = 0] = min.split(".").map(Number);
+  if (vy !== my) return vy > my;
+  return vm >= mm;
+}
+async function wireGatewayMcp(session, signal, opts = {}) {
+  const cfg = await readRemoteConfig(session, signal);
+  const version = cfg["meta"]?.["lastTouchedVersion"];
+  if (version && !versionAtLeast(version, GATEWAY_MCP_MIN_VERSION) && !opts.force) {
+    return { status: "version-blocked", version };
+  }
+  const mcpClients = cfg["gateway"]?.["mcpClients"];
+  const rewired = !!mcpClients?.["clawops"];
+  const updated = deepMerge(cfg, {
+    gateway: {
+      mcpClients: {
+        clawops: GATEWAY_MCP_ENTRY
+      }
+    }
+  });
+  await atomicWriteConfig(session, updated, signal);
+  await restartGateway(session, signal);
+  return { status: "wired", rewired };
+}
+export {
+  GATEWAY_MCP_ENTRY,
+  GATEWAY_MCP_MIN_VERSION,
+  wireGatewayMcp
+};

package/dist/{package-AFUTH62F.js → package-QLDA65A3.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.3.0";
+var version = "1.5.0";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -48,6 +48,7 @@ var dependencies = {
   "@pulumi/docker": "^4.0.0",
   "@pulumi/gcp": "^7.0.0",
   "@pulumi/pulumi": "^3.0.0",
+  "@pulumi/random": "^4.20.0",
   ajv: "^8.0.0",
   "ajv-formats": "^3.0.0",
   chalk: "^5.0.0",

package/dist/{remote-config-JQ77SRC2.js → remote-config-QF5TT7GU.js}

@@ -8,7 +8,7 @@ import {
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-UDNZUSKA.js";
+} from "./chunk-ZFNPM2WG.js";
 export {
   OPENCLAW_CONFIG,
   OPENCLAW_CONFIG_LINUX,

package/dist/{server-I62UES5V.js → server-LOL2NUJ2.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-ZDPBBYYV.js";
+} from "./chunk-IVX62LFO.js";
 import {
   applyPlan
-} from "./chunk-JCUZU5BH.js";
+} from "./chunk-ZONXY3C6.js";
 import {
   validatePlan
 } from "./chunk-YTH4L2GN.js";
@@ -15,22 +15,24 @@ import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
 import {
   errText,
+  formatUptime,
+  gatherSnapshot,
   handleConfigGet,
   handleConfigSet,
   handleConfigUnset,
   handleConfigValidate,
   okText,
   resolveConn
-} from "./chunk-LVIIYY27.js";
+} from "./chunk-R5S6IXBE.js";
 import {
   buildContext
-} from "./chunk-JDN6PLH2.js";
+} from "./chunk-T5EX55GP.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
-import "./chunk-UDNZUSKA.js";
+import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import {
   getConfig,
@@ -140,7 +142,7 @@ var clawops_statusAnnotations = {
 };
 var clawops_logs_tailSchema = z.object({
   stackName: z.string().optional(),
-  tailLines: z.number().int().default(100),
+  tailLines: z.number().int().optional().default(100),
   sinceMin: z.number().int().optional()
 });
 var clawops_logs_tailAnnotations = {
@@ -151,6 +153,18 @@ var clawops_logs_tailAnnotations = {
   openWorldHint: true,
   toolsets: ["cli", "read"]
 };
+var clawops_monitorSchema = z.object({
+  stackName: z.string().optional(),
+  tailLines: z.number().int().optional().default(5)
+});
+var clawops_monitorAnnotations = {
+  title: "Monitor Stack Health",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
 var clawops_stacks_listSchema = z.object({});
 var clawops_stacks_listAnnotations = {
   title: "List Stacks",
@@ -187,9 +201,9 @@ var clawops_upSchema = z.object({
   stackName: z.string().optional(),
   provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
   region: z.string().optional(),
-  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).default("small"),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small"),
   openclawVersion: z.string().optional(),
-  dryRun: z.boolean().default(false)
+  dryRun: z.boolean().optional().default(false)
 });
 var clawops_upAnnotations = {
   title: "Provision and Deploy Stack",
@@ -201,7 +215,7 @@ var clawops_upAnnotations = {
 };
 var clawops_destroySchema = z.object({
   stackName: z.string(),
-  yes: z.boolean().default(false)
+  yes: z.boolean().optional().default(false)
 });
 var clawops_destroyAnnotations = {
   title: "Destroy Stack (DESTRUCTIVE)",
@@ -213,7 +227,7 @@ var clawops_destroyAnnotations = {
 };
 var clawops_applySchema = z.object({
   planPath: z.string(),
-  yes: z.boolean().default(false)
+  yes: z.boolean().optional().default(false)
 });
 var clawops_applyAnnotations = {
   title: "Apply Maker Plan",
@@ -242,7 +256,7 @@ var clawops_config_setSchema = z.object({
   stackName: z.string().optional(),
   key: z.string(),
   value: z.string(),
-  restart: z.boolean().default(false)
+  restart: z.boolean().optional().default(false)
 });
 var clawops_config_setAnnotations = {
   title: "Set OpenClaw Config Value",
@@ -255,7 +269,7 @@ var clawops_config_setAnnotations = {
 var clawops_config_unsetSchema = z.object({
   stackName: z.string().optional(),
   key: z.string(),
-  restart: z.boolean().default(false)
+  restart: z.boolean().optional().default(false)
 });
 var clawops_config_unsetAnnotations = {
   title: "Unset OpenClaw Config Key",
@@ -302,8 +316,8 @@ var clawops_gateway_restartAnnotations = {
 var clawops_workflow_deploy_appSchema = z.object({
   provider: z.enum(["aws", "gcp", "azure", "local"]),
   region: z.string().optional(),
-  stackName: z.string().default("default"),
-  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).default("small")
+  stackName: z.string().optional().default("default"),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small")
 });
 var clawops_workflow_deploy_appAnnotations = {
   title: "Deploy OpenClaw (End-to-End Workflow)",
@@ -339,6 +353,7 @@ var TOOLSETS = {
   cli: [
     "clawops_status",
     "clawops_logs_tail",
+    "clawops_monitor",
     "clawops_config_get",
     "clawops_agents_list",
     "clawops_up",
@@ -359,6 +374,7 @@ var TOOLSETS = {
   read: [
     "clawops_status",
     "clawops_logs_tail",
+    "clawops_monitor",
     "clawops_stacks_list",
     "clawops_config_get",
     "clawops_agents_list",
@@ -835,6 +851,62 @@ async function handleTaskStatus(input, _server) {
   return { content: [{ type: "text", text: JSON.stringify(record, null, 2) }] };
 }
 
+// src/mcp/tools/cli/monitor.ts
+async function handleMonitor(input, _server) {
+  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
+  const ctx = buildContext({ stack: input.stackName });
+  const tailLines = input.tailLines ?? 5;
+  let conn;
+  if (ctx.adapter.name === "local") {
+    if (!ctx.localState) {
+      return text2(JSON.stringify({ error: "Stack is not bootstrapped. Run `clawops up` first." }));
+    }
+    const ls = ctx.localState;
+    conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
+  } else {
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    if (!outputs["publicIp"]) {
+      return text2(JSON.stringify({ error: "Stack has no outputs. Run `clawops up` first." }));
+    }
+    const base = extractBaseOutputs(outputs);
+    conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+  }
+  const ac = new AbortController();
+  const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
+  try {
+    const snap = await gatherSnapshot(session, ac.signal, tailLines);
+    return text2(JSON.stringify({
+      gateway: snap.gateway,
+      container: {
+        status: snap.container.status,
+        image: snap.container.image,
+        restartCount: snap.container.restartCount,
+        memUsage: snap.container.memUsage,
+        cpuPct: snap.container.cpuPct,
+        uptime: formatUptime(snap.container.startedAt)
+      },
+      disk: snap.disk,
+      logLines: snap.logLines,
+      capturedAt: snap.capturedAt.toISOString()
+    }, null, 2));
+  } finally {
+    release();
+    drainPool2();
+    ac.abort();
+  }
+}
+function text2(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+
 // src/mcp/tools/workflow/deploy_app.ts
 async function handleWorkflowDeployApp(input, server) {
   const parts = [`## Deployment Workflow \u2014 ${input.provider} / ${input.stackName}
@@ -947,6 +1019,7 @@ function makeEntry(schema, annotations, handler) {
 var TOOL_REGISTRY = {
   clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus),
   clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail),
+  clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor),
   clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList),
   clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet),
   clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList),
@@ -1059,19 +1132,19 @@ function registerResources(server) {
     async (uri, { name }) => {
       const stackName = Array.isArray(name) ? name[0] : name;
       const filePath = path3.join(getConfigDir(), "state", `${stackName}.last-run.json`);
-      let text2;
+      let text3;
       try {
         const raw = readFileSync2(filePath, "utf-8");
         const parsed = JSON.parse(raw);
-        text2 = parsed.output ?? "(no output recorded)";
+        text3 = parsed.output ?? "(no output recorded)";
       } catch {
-        text2 = `No last-run output found for stack "${stackName}".`;
+        text3 = `No last-run output found for stack "${stackName}".`;
       }
       return {
         contents: [{
           uri: uri.href,
           mimeType: "text/plain",
-          text: text2
+          text: text3
         }]
       };
     }
@@ -1232,7 +1305,7 @@ If none of the above resolves the issue:
 
 // src/mcp/server.ts
 async function serveMcp(opts) {
-  const { version } = await import("./package-AFUTH62F.js");
+  const { version } = await import("./package-QLDA65A3.js");
   const server = new McpServer({ name: "clawops", version });
   registerTools(server, opts);
   registerResources(server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -24,6 +24,19 @@
   "engines": {
     "node": ">=22"
   },
+  "scripts": {
+    "dev": "tsx src/cli/index.ts",
+    "build": "tsup",
+    "test": "vitest run",
+    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
+    "test:changed": "vitest --changed",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
+    "lint": "eslint --max-warnings=0 src tests scripts",
+    "gen:schemas": "tsx scripts/gen-schemas.ts",
+    "changeset": "changeset",
+    "release": "pnpm build && changeset publish"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@pulumi/aws": "^6.0.0",
@@ -32,6 +45,7 @@
     "@pulumi/docker": "^4.0.0",
     "@pulumi/gcp": "^7.0.0",
     "@pulumi/pulumi": "^3.0.0",
+    "@pulumi/random": "^4.20.0",
     "ajv": "^8.0.0",
     "ajv-formats": "^3.0.0",
     "chalk": "^5.0.0",
@@ -59,17 +73,16 @@
     "typescript-eslint": "^8.0.0",
     "vitest": "^2.0.0"
   },
-  "scripts": {
-    "dev": "tsx src/cli/index.ts",
-    "build": "tsup",
-    "test": "vitest run",
-    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
-    "test:changed": "vitest --changed",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
-    "lint": "eslint --max-warnings=0 src tests scripts",
-    "gen:schemas": "tsx scripts/gen-schemas.ts",
-    "changeset": "changeset",
-    "release": "pnpm build && changeset publish"
+  "pnpm": {
+    "overrides": {
+      "@pulumi/pulumi": "^3.0.0"
+    },
+    "onlyBuiltDependencies": [
+      "@pulumi/command",
+      "cpu-features",
+      "esbuild",
+      "protobufjs",
+      "ssh2"
+    ]
   }
-}
+}