@clawops/cli 1.5.0 → 1.6.0

package/README.md

@@ -277,6 +277,7 @@ clawops down --yes          # Destroy local-provider stack
 | `mcp install` | Interactively wire clawops into AI editors |
 | `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
+| `bug` | Open a pre-filled GitHub issue with system context from `doctor` |
 
 Full flag reference: `clawops <command> --help`
 

package/dist/{apply-5RREMN3L.js → apply-SI3JKS4Z.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-ZONXY3C6.js";
+} from "./chunk-QHGFENYR.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-T5EX55GP.js";
+import "./chunk-QI75OVJK.js";
 import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";

package/dist/{aws-FRE2JVAZ.js → aws-D7Y6LCGK.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/aws/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var awsProgram = async () => {
   const [pulumi, aws, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/aws"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "t3.small";
@@ -21,20 +24,21 @@ var awsProgram = async () => {
   const sshCidrs = cfg.get("sshCidrs") ?? "";
   const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
   const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
+  const pinnedAmiId = cfg.get("amiId");
   const sshPublicKey = cfg.get("sshPublicKey");
   if (!sshPublicKey) {
     throw new Error(
       'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const vpc = new aws.ec2.Vpc("clawops-vpc", {
     cidrBlock: "10.0.0.0/16",
     enableDnsHostnames: true,
@@ -68,33 +72,36 @@ var awsProgram = async () => {
     subnetId: subnet.id,
     routeTableId: routeTable.id
   });
-  const ingressRules = [
-    ...sshIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
+    vpcId: vpc.id,
+    description: "clawops managed security group",
+    tags: { Name: "clawops" }
+  });
+  sshIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-ssh-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: SSH_PORT,
       toPort: SSH_PORT,
-      cidrBlocks: [cidr],
-      description: "SSH"
-    })),
-    ...gatewayIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-ssh-${i}` }
+    });
+  });
+  gatewayIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-gw-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: GATEWAY_PORT,
       toPort: GATEWAY_PORT,
-      cidrBlocks: [cidr],
-      description: "OpenClaw gateway"
-    }))
-  ];
-  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
-    vpcId: vpc.id,
-    ingress: ingressRules,
-    egress: [{
-      protocol: "-1",
-      fromPort: 0,
-      toPort: 0,
-      cidrBlocks: ["0.0.0.0/0"],
-      description: "Allow all egress"
-    }],
-    tags: { Name: "clawops" }
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-gateway-${i}` }
+    });
+  });
+  new aws.vpc.SecurityGroupEgressRule("clawops-sg-egress", {
+    securityGroupId: sg.id,
+    ipProtocol: "-1",
+    cidrIpv4: "0.0.0.0/0",
+    tags: { Name: "clawops-egress" }
   });
   const role = new aws.iam.Role("clawops-role", {
     assumeRolePolicy: JSON.stringify({
@@ -112,10 +119,19 @@ var awsProgram = async () => {
     policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
   });
   if (bedrockEnabled) {
-    new aws.iam.RolePolicyAttachment("clawops-bedrock", {
+    new aws.iam.RolePolicy("clawops-bedrock-invoke", {
       role: role.name,
-      // FullAccess required for bedrock:InvokeModel — ReadOnly only covers describe/list.
-      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
+      policy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+          Effect: "Allow",
+          Action: [
+            "bedrock:InvokeModel",
+            "bedrock:InvokeModelWithResponseStream"
+          ],
+          Resource: "*"
+        }]
+      })
     });
   }
   const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
@@ -125,7 +141,7 @@ var awsProgram = async () => {
     publicKey: sshPublicKey,
     tags: { Name: "clawops" }
   });
-  const ami = await aws.ec2.getAmi({
+  const amiId = pinnedAmiId ?? (await aws.ec2.getAmi({
     mostRecent: true,
     owners: ["099720109477"],
     // Canonical
@@ -133,15 +149,17 @@ var awsProgram = async () => {
       { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
       { name: "virtualization-type", values: ["hvm"] }
     ]
-  });
+  })).id;
+  process.stderr.write(`[clawops] Using AMI: ${amiId}
+`);
   const instance = new aws.ec2.Instance("clawops-instance", {
-    ami: ami.id,
+    ami: amiId,
     instanceType,
     subnetId: subnet.id,
     vpcSecurityGroupIds: [sg.id],
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
-    userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    userData: makeStartupScript({ openclawVersion, os: "ubuntu", bedrockEnabled }),
     // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
     // and obtain the instance role credentials (required for Bedrock access).
     metadataOptions: {
@@ -169,62 +187,6 @@ var awsProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-chown clawops:clawops /home/clawops/.ssh
-
-# Install Docker if not present (AWS AMI is ubuntu-22.04)
-if ! command -v docker &>/dev/null; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-# apply.ts will overwrite this with the plan's config overlay post-provisioning.
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-${bedrockEnvFlag}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/aws/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{azure-PVC3AQVC.js → azure-JQAMNVHN.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/azure/index.ts
 import process2 from "process";
@@ -12,7 +15,7 @@ var azureProgram = async () => {
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
     import("@pulumi/random"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const stackName = pulumi.getStack();
@@ -31,14 +34,15 @@ var azureProgram = async () => {
       'Stack config "sshPublicKey" is required for the Azure adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : "";
+  const clientConfig = await azure.authorization.getClientConfig({});
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const rg = new azure.resources.ResourceGroup("clawops-rg", {
     resourceGroupName,
     location
@@ -111,7 +115,7 @@ var azureProgram = async () => {
     osProfile: {
       adminUsername: "clawops",
       computerName: "clawops",
-      customData: Buffer.from(makeStartupScript(openclawVersion)).toString("base64"),
+      customData: Buffer.from(makeStartupScript({ openclawVersion, os: "ubuntu" })).toString("base64"),
       linuxConfiguration: {
         disablePasswordAuthentication: true,
         ssh: {
@@ -125,8 +129,10 @@ var azureProgram = async () => {
     storageProfile: {
       imageReference: {
         publisher: "Canonical",
-        offer: "UbuntuServer",
-        sku: "22.04-LTS",
+        // Ubuntu 22.04 LTS — Canonical migrated from the legacy 'UbuntuServer'
+        // offer to this naming scheme. 22_04-lts-gen2 is available in all regions.
+        offer: "0001-com-ubuntu-server-jammy",
+        sku: "22_04-lts-gen2",
         version: "latest"
       },
       osDisk: {
@@ -153,10 +159,10 @@ var azureProgram = async () => {
         enableRbacAuthorization: true
       }
     });
+    const kvSecretsUserRoleId = `/subscriptions/${clientConfig.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`;
     new azure.authorization.RoleAssignment("clawops-kv-role", {
       scope: kv.id,
-      roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6",
-      // Key Vault Secrets User
+      roleDefinitionId: kvSecretsUserRoleId,
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
@@ -183,53 +189,6 @@ var azureProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p 18789:18789 \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/azure/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{bootstrap-G4UZ2FKH.js → bootstrap-RY4VOSDJ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   acquireSession
-} from "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import {
   writeLocalState
 } from "./chunk-A2I76FTA.js";

package/dist/{chunk-IVX62LFO.js → chunk-72FF7IK2.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-QLDA65A3.js");
+  const { version } = await import("./package-EW3FS257.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/{chunk-R5S6IXBE.js → chunk-C5NDLOK2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-ZVOEQCNW.js";
+} from "./chunk-LCKD7L7X.js";
 import {
   OPENCLAW_CONFIG,
   atomicWriteConfig,
@@ -154,7 +154,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
+  const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -381,8 +381,8 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process2.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
+    const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
+    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
     const ac = new AbortController();
     process2.on("SIGINT", () => ac.abort());
     process2.on("SIGTERM", () => ac.abort());
@@ -756,6 +756,7 @@ export {
   warn,
   info,
   spinner,
+  REPO_URL,
   printCta,
   resolveConn,
   errText,

package/dist/{chunk-4U3LTLWZ.js → chunk-GJEF6UQA.js}

@@ -92,6 +92,7 @@ var Ssh2Session = class {
         server.close();
       };
       server.on("error", (err) => {
+        closeAll();
         const msg = err.code === "EADDRINUSE" ? `Port ${localPort} is already in use` : `Tunnel server error: ${err.message}`;
         reject(new NetworkError(msg));
       });

package/dist/{chunk-ZVOEQCNW.js → chunk-LCKD7L7X.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-4U3LTLWZ.js";
+} from "./chunk-GJEF6UQA.js";
 import {
   NetworkError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-ZONXY3C6.js → chunk-QHGFENYR.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-BOPSG2LI.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   atomicWriteConfig,
   deepMerge,
@@ -86,7 +86,7 @@ The diff you reviewed may no longer reflect what will be applied.
   };
 }
 async function applyConfigOverlay(plan, outputs, ctx, signal) {
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const connInfo = ctx.adapter.getConnectionInfo(outputs);
   const session = await connect({
     host: connInfo.host,

package/dist/{chunk-T5EX55GP.js → chunk-QI75OVJK.js}

@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-BXDTC6EK.js");
+        const mod = await import("./gcp-6FT2A45S.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-FRE2JVAZ.js");
+        const mod = await import("./aws-D7Y6LCGK.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-PVC3AQVC.js");
+        const mod = await import("./azure-JQAMNVHN.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/chunk-XKT42M34.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+// src/providers/startup.ts
+function makeStartupScript(opts) {
+  const { openclawVersion, os, bedrockEnabled = false } = opts;
+  const dockerDistro = os === "ubuntu" ? "ubuntu" : "debian";
+  const bedrockEnvBlock = bedrockEnabled ? makeBedrockEnvBlock() : "";
+  return `#!/bin/bash
+set -euo pipefail
+
+# \u2500\u2500 User setup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
+mkdir -p /home/clawops/.ssh
+chmod 700 /home/clawops/.ssh
+chown clawops:clawops /home/clawops/.ssh
+
+# \u2500\u2500 Docker installation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+if ! command -v docker &>/dev/null; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -q
+  apt-get install -y -q ca-certificates curl gnupg lsb-release
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/${dockerDistro}/gpg \\
+    -o /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \\
+    https://download.docker.com/linux/${dockerDistro} $(lsb_release -cs) stable" \\
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -q
+  apt-get install -y -q \\
+    docker-ce \\
+    docker-ce-cli \\
+    containerd.io \\
+    docker-buildx-plugin \\
+    docker-compose-plugin
+  systemctl enable --now docker
+fi
+
+usermod -aG docker clawops
+
+# \u2500\u2500 OpenClaw image \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+OPENCLAW_VERSION="${openclawVersion}"
+docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+
+# \u2500\u2500 Default config (apply.ts will overwrite with plan overlay) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+OPENCLAW_CONFIG=/home/clawops/openclaw.json
+if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
+  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
+{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
+OPENCLAWJSON
+  chown clawops:clawops "\${OPENCLAW_CONFIG}"
+fi
+
+# \u2500\u2500 Start OpenClaw container \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+docker stop openclaw 2>/dev/null || true
+docker rm   openclaw 2>/dev/null || true
+docker run -d \\
+  --name openclaw \\
+  --restart unless-stopped \\
+  -p 18789:18789 \\
+  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
+${bedrockEnvBlock}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+  node openclaw.mjs gateway run --allow-unconfigured
+`;
+}
+function makeBedrockEnvBlock() {
+  return '  -e AWS_DEFAULT_REGION=$( \\\n      IMDS_TOKEN=$(curl -sf -X PUT \\\n        "http://169.254.169.254/latest/api/token" \\\n        -H "X-aws-ec2-metadata-token-ttl-seconds: 60") && \\\n      curl -sf \\\n        -H "X-aws-ec2-metadata-token: ${IMDS_TOKEN}" \\\n        "http://169.254.169.254/latest/meta-data/placement/region" \\\n      || echo us-east-1) \\\n';
+}
+
+export {
+  makeStartupScript
+};