@clawops/cli 1.4.0 → 1.6.0

package/dist/firewall-XQGO7HWK.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/providers/firewall.ts
+function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult) {
+  if (portOverride.trim()) {
+    return portOverride.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  switch (accessMode) {
+    case "restricted": {
+      if (!allowedCidrs.trim()) return [];
+      return allowedCidrs.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    case "auto": {
+      if (!egressResult.ok) {
+        throw new Error(
+          `accessMode=auto: egress IP detection failed \u2014 ${egressResult.error}. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      const ip = egressResult.ip.trim();
+      if (!ip) {
+        throw new Error(
+          `accessMode=auto: egress IP detection returned an empty address. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      return [ip.includes("/") ? ip : `${ip}/32`];
+    }
+    case "open":
+      return ["0.0.0.0/0"];
+    default:
+      return [];
+  }
+}
+async function detectEgressIp(checkUrl) {
+  try {
+    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(3e3) });
+    if (!res.ok) {
+      return { ok: false, error: `HTTP ${res.status} from ${checkUrl}` };
+    }
+    const ip = (await res.text()).trim();
+    if (!ip) {
+      return { ok: false, error: `empty response from ${checkUrl}` };
+    }
+    return { ok: true, ip };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+export {
+  detectEgressIp,
+  resolveIngressCidrs
+};

package/dist/{gcp-BXDTC6EK.js → gcp-6FT2A45S.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/gcp/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var gcpProgram = async () => {
   const [pulumi, gcp, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/gcp"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
@@ -27,14 +30,14 @@ var gcpProgram = async () => {
       'Stack config "sshPublicKey" is required for the GCP adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const network = new gcp.compute.Network("clawops-network", {
     autoCreateSubnetworks: false,
     description: "clawops managed network"
@@ -42,7 +45,7 @@ var gcpProgram = async () => {
   const subnet = new gcp.compute.Subnetwork("clawops-subnet", {
     ipCidrRange: "10.0.0.0/24",
     region,
-    network: network.id
+    network: network.selfLink
   });
   if (sshIngressCidrs.length > 0) {
     new gcp.compute.Firewall("clawops-firewall-ssh", {
@@ -73,8 +76,8 @@ var gcpProgram = async () => {
     },
     networkInterfaces: [
       {
-        network: network.id,
-        subnetwork: subnet.id,
+        network: network.selfLink,
+        subnetwork: subnet.selfLink,
         accessConfigs: [
           {
             natIp: address.address,
@@ -86,7 +89,7 @@ var gcpProgram = async () => {
     metadata: {
       // GCP guest agent reads 'ssh-keys' and populates /home/<user>/.ssh/authorized_keys
       "ssh-keys": `clawops:${sshPublicKey}`,
-      "startup-script": makeStartupScript(openclawVersion)
+      "startup-script": makeStartupScript({ openclawVersion, os: "debian" })
     },
     serviceAccount: {
       scopes: ["https://www.googleapis.com/auth/cloud-platform"]
@@ -103,58 +106,6 @@ var gcpProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/debian/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/debian $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/gcp/index.ts
 var INSTANCE_TYPE_MAP = {
@@ -172,9 +123,9 @@ var gcpAdapter = {
   },
   getConnectionInfo(outputs) {
     return {
-      host: String(outputs["sshHost"]),
-      port: Number(outputs["sshPort"]),
-      user: String(outputs["sshUser"]),
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "clawops"),
       privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
       knownHostsPath: String(outputs["knownHostsPath"] ?? "")
     };

package/dist/{generate-Z7DBMANX.js → generate-YV7226Q7.js}

@@ -2,9 +2,9 @@
 import {
   generatePlan,
   planId
-} from "./chunk-UAA6YOOP.js";
+} from "./chunk-72FF7IK2.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-T5EX55GP.js";
+import "./chunk-QI75OVJK.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/mcp-wire-ZWIYMLEW.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-ZFNPM2WG.js";
+
+// src/cli/mcp-wire.ts
+var GATEWAY_MCP_MIN_VERSION = "2026.4";
+var GATEWAY_MCP_ENTRY = {
+  command: "clawops",
+  args: ["mcp", "serve"],
+  transport: "stdio"
+};
+function versionAtLeast(version, min) {
+  const [vy = 0, vm = 0] = version.split(".").map(Number);
+  const [my = 0, mm = 0] = min.split(".").map(Number);
+  if (vy !== my) return vy > my;
+  return vm >= mm;
+}
+async function wireGatewayMcp(session, signal, opts = {}) {
+  const cfg = await readRemoteConfig(session, signal);
+  const version = cfg["meta"]?.["lastTouchedVersion"];
+  if (version && !versionAtLeast(version, GATEWAY_MCP_MIN_VERSION) && !opts.force) {
+    return { status: "version-blocked", version };
+  }
+  const mcpClients = cfg["gateway"]?.["mcpClients"];
+  const rewired = !!mcpClients?.["clawops"];
+  const updated = deepMerge(cfg, {
+    gateway: {
+      mcpClients: {
+        clawops: GATEWAY_MCP_ENTRY
+      }
+    }
+  });
+  await atomicWriteConfig(session, updated, signal);
+  await restartGateway(session, signal);
+  return { status: "wired", rewired };
+}
+export {
+  GATEWAY_MCP_ENTRY,
+  GATEWAY_MCP_MIN_VERSION,
+  wireGatewayMcp
+};

package/dist/{package-WAJRGBBM.js → package-EW3FS257.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.4.0";
+var version = "1.6.0";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {

package/dist/{pool-FBFHATDG.js → pool-JZGKPP6K.js}

@@ -2,8 +2,8 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import "./chunk-KGXPLI7W.js";
 export {
   acquireSession,

package/dist/{server-IWLZJ4EU.js → server-3DEZHUWB.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-UAA6YOOP.js";
+} from "./chunk-72FF7IK2.js";
 import {
   applyPlan
-} from "./chunk-ZONXY3C6.js";
+} from "./chunk-QHGFENYR.js";
 import {
   validatePlan
 } from "./chunk-YTH4L2GN.js";
@@ -23,15 +23,15 @@ import {
   handleConfigValidate,
   okText,
   resolveConn
-} from "./chunk-JYQZJMD3.js";
+} from "./chunk-C5NDLOK2.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import {
@@ -630,7 +630,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
+    const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -853,7 +853,7 @@ async function handleTaskStatus(input, _server) {
 
 // src/mcp/tools/cli/monitor.ts
 async function handleMonitor(input, _server) {
-  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
+  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
   const ctx = buildContext({ stack: input.stackName });
   const tailLines = input.tailLines ?? 5;
   let conn;
@@ -1305,7 +1305,7 @@ If none of the above resolves the issue:
 
 // src/mcp/server.ts
 async function serveMcp(opts) {
-  const { version } = await import("./package-WAJRGBBM.js");
+  const { version } = await import("./package-EW3FS257.js");
   const server = new McpServer({ name: "clawops", version });
   registerTools(server, opts);
   registerResources(server);

package/dist/{ssh-IQXNME3D.js → ssh-E2AMBPZY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-4U3LTLWZ.js";
+} from "./chunk-GJEF6UQA.js";
 import "./chunk-KGXPLI7W.js";
 export {
   connect

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -24,6 +24,19 @@
   "engines": {
     "node": ">=22"
   },
+  "scripts": {
+    "dev": "tsx src/cli/index.ts",
+    "build": "tsup",
+    "test": "vitest run",
+    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
+    "test:changed": "vitest --changed",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
+    "lint": "eslint --max-warnings=0 src tests scripts",
+    "gen:schemas": "tsx scripts/gen-schemas.ts",
+    "changeset": "changeset",
+    "release": "pnpm build && changeset publish"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@pulumi/aws": "^6.0.0",
@@ -60,17 +73,16 @@
     "typescript-eslint": "^8.0.0",
     "vitest": "^2.0.0"
   },
-  "scripts": {
-    "dev": "tsx src/cli/index.ts",
-    "build": "tsup",
-    "test": "vitest run",
-    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
-    "test:changed": "vitest --changed",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
-    "lint": "eslint --max-warnings=0 src tests scripts",
-    "gen:schemas": "tsx scripts/gen-schemas.ts",
-    "changeset": "changeset",
-    "release": "pnpm build && changeset publish"
+  "pnpm": {
+    "overrides": {
+      "@pulumi/pulumi": "^3.0.0"
+    },
+    "onlyBuiltDependencies": [
+      "@pulumi/command",
+      "cpu-features",
+      "esbuild",
+      "protobufjs",
+      "ssh2"
+    ]
   }
-}
+}

package/dist/firewall-YYDOWDDP.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-
-// src/providers/firewall.ts
-function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, detectedIp) {
-  if (portOverride.trim()) {
-    return portOverride.split(",").map((s) => s.trim()).filter(Boolean);
-  }
-  switch (accessMode) {
-    case "restricted": {
-      if (!allowedCidrs.trim()) return [];
-      return allowedCidrs.split(",").map((s) => s.trim()).filter(Boolean);
-    }
-    case "auto": {
-      if (!detectedIp.trim()) return [];
-      const ip = detectedIp.trim();
-      return [ip.includes("/") ? ip : `${ip}/32`];
-    }
-    case "open":
-      return ["0.0.0.0/0"];
-    default:
-      return [];
-  }
-}
-async function detectEgressIp(checkUrl) {
-  try {
-    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(5e3) });
-    if (!res.ok) return "";
-    return (await res.text()).trim();
-  } catch {
-    return "";
-  }
-}
-export {
-  detectEgressIp,
-  resolveIngressCidrs
-};