@clawops/cli 1.5.0 → 1.6.0

package/dist/cli.js

@@ -5,6 +5,7 @@ import {
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
 import {
+  REPO_URL,
   chalk,
   failure,
   info,
@@ -14,10 +15,10 @@ import {
   success,
   validateOpenclawConfig,
   warn
-} from "./chunk-R5S6IXBE.js";
-import "./chunk-T5EX55GP.js";
-import "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-C5NDLOK2.js";
+import "./chunk-QI75OVJK.js";
+import "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import {
@@ -32,7 +33,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand21, runMain } from "citty";
+import { defineCommand as defineCommand22, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -204,7 +205,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -215,7 +216,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
+      const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -308,7 +309,7 @@ var up_default = defineCommand2({
   }
 });
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   let overlay;
@@ -350,7 +351,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -414,7 +415,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -486,8 +487,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { generatePlan } = await import("./generate-2QGKYR42.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { generatePlan } = await import("./generate-YV7226Q7.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -577,7 +578,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-5RREMN3L.js");
+    const { applyPlan } = await import("./apply-SI3JKS4Z.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -693,7 +694,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -760,8 +761,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -847,9 +848,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-FBFHATDG.js");
+    const { acquireSession } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -915,9 +916,9 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -1032,9 +1033,9 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1158,9 +1159,9 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, name] = args._ ?? [];
     if (!action || !["list", "restart", "logs"].includes(action)) {
       failure("Usage: clawops agents <list | restart [name] | logs <name>>");
@@ -1262,9 +1263,9 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
@@ -1375,8 +1376,8 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1548,7 +1549,7 @@ var stacks_default = defineCommand15({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-PSGEX2D7.js");
+        const { buildContext } = await import("./context-KPKBOWOP.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -1669,9 +1670,9 @@ var doctor_default = defineCommand16({
       info("Credential checks skipped \u2014 no config");
     } else {
       const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-FRE2JVAZ.js");
-      await import("./gcp-BXDTC6EK.js");
-      await import("./azure-PVC3AQVC.js");
+      await import("./aws-D7Y6LCGK.js");
+      await import("./gcp-6FT2A45S.js");
+      await import("./azure-JQAMNVHN.js");
       await import("./local-DXBEVZ5C.js");
       const checkedProviders = /* @__PURE__ */ new Set();
       for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -1706,9 +1707,9 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-PSGEX2D7.js");
+          const { buildContext } = await import("./context-KPKBOWOP.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-          const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+          const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
           const ctx = buildContext({ stack: args.stack });
           const stack = await ctx.getStack();
           const outputMap = await stack.outputs();
@@ -1793,7 +1794,14 @@ var doctor_default = defineCommand16({
       }
     }
     process18.stdout.write("\n");
-    if (!nodeOk) process18.exit(1);
+    if (!nodeOk) {
+      process18.stdout.write(
+        `Run \`clawops bug\` to open a pre-filled issue at ${REPO_URL}/issues
+
+`
+      );
+      process18.exit(1);
+    }
   }
 });
 
@@ -1814,7 +1822,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-LOL2NUJ2.js");
+    const { serveMcp } = await import("./server-3DEZHUWB.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1889,8 +1897,8 @@ var wireCmd = defineCommand17({
     force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
     const ac = new AbortController();
@@ -2404,7 +2412,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-5RREMN3L.js");
+        const { applyPlan } = await import("./apply-SI3JKS4Z.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2427,8 +2435,8 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2510,7 +2518,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-FBFHATDG.js");
+  const { drainPool } = await import("./pool-JZGKPP6K.js");
   drainPool();
   const tokenPath = path3.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -2648,7 +2656,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { acquireSession } = await import("./pool-JZGKPP6K.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -2695,7 +2703,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { acquireSession } = await import("./pool-JZGKPP6K.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -2899,7 +2907,7 @@ async function maybeWireGatewayMcp(opts) {
   process20.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
   const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -3164,10 +3172,10 @@ var rotateCmd = defineCommand19({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-PSGEX2D7.js");
+      const { buildContext } = await import("./context-KPKBOWOP.js");
       const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+      const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
       const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3344,26 +3352,133 @@ ${dim("Run `clawops <command> --help` for command-specific flags.")}
   }
 });
 
-// src/cli/error-handler.ts
+// src/cli/commands/bug.ts
+import { defineCommand as defineCommand21 } from "citty";
 import process22 from "process";
+import { accessSync as accessSync2, constants as constants2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+var ISSUES_URL = `${REPO_URL}/issues/new`;
+var BODY_CAP = 2e3;
+var VERSION = true ? "1.6.0" : "dev";
+async function collectContext() {
+  const nodeVersion = process22.version;
+  const os3 = `${process22.platform} ${process22.arch}`;
+  let provider = "unknown";
+  let stackCount = 0;
+  let sshKey = "unknown";
+  try {
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const config = getConfig2();
+    if (config) {
+      const stacks = Object.values(config.stacks);
+      stackCount = stacks.length;
+      provider = stacks[0]?.provider ?? "none";
+      const keyPath = config.ssh.keyPath.replace(/^~/, process22.env["HOME"] ?? "~");
+      try {
+        accessSync2(keyPath, constants2.R_OK);
+        sshKey = "present";
+      } catch {
+        sshKey = "missing";
+      }
+    } else {
+      provider = "not configured";
+      sshKey = "not configured";
+    }
+  } catch {
+  }
+  return [
+    `**clawops version:** ${VERSION}`,
+    `**Node:** ${nodeVersion}`,
+    `**OS:** ${os3}`,
+    `**Provider:** ${provider}`,
+    `**Stacks:** ${stackCount}`,
+    `**SSH key:** ${sshKey}`
+  ].join("\n");
+}
+function buildIssueUrl(title, command, context) {
+  const body = [
+    context,
+    "",
+    "**Description:**",
+    title,
+    "",
+    command ? `**Command:**
+\`${command}\`` : "",
+    "",
+    "**Steps to reproduce:**",
+    "<!-- Please describe what you did -->\n"
+  ].filter((l) => l !== void 0).join("\n").slice(0, BODY_CAP);
+  const params = new URLSearchParams({ title, body });
+  return `${ISSUES_URL}?${params.toString()}`;
+}
+function openBrowser2(url) {
+  try {
+    const cmd = process22.platform === "darwin" ? "open" : "xdg-open";
+    execSync2(`${cmd} "${url}"`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var bug_default = defineCommand21({
+  meta: {
+    name: "bug",
+    description: "Open a pre-filled GitHub issue with system context from clawops doctor"
+  },
+  args: {
+    json: { type: "boolean", description: "Emit issue URL as JSON without opening a browser" }
+  },
+  async run({ args }) {
+    const context = await collectContext();
+    let title = "";
+    let command = "";
+    if (!args.json) {
+      const { createInterface: createInterface3 } = await import("readline/promises");
+      const rl = createInterface3({ input: process22.stdin, output: process22.stdout });
+      try {
+        title = (await rl.question("Describe the issue in one line: ")).trim();
+        command = (await rl.question("Which command triggered it? (optional): ")).trim();
+      } finally {
+        rl.close();
+      }
+    }
+    const url = buildIssueUrl(title, command, context);
+    if (args.json) {
+      printJson(jsonOk({ url }));
+      return;
+    }
+    process22.stdout.write("\n");
+    info(`Opening: ${url}`);
+    process22.stdout.write("\n");
+    const opened = openBrowser2(url);
+    if (!opened) {
+      process22.stdout.write(`Open this URL to file the issue:
+${url}
+`);
+    }
+  }
+});
+
+// src/cli/error-handler.ts
+import process23 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process22.exit(err.exitCode);
+    process23.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process22.env["DEBUG"]) {
-      process22.stderr.write(err.stack ?? "\n");
+    if (process23.env["DEBUG"]) {
+      process23.stderr.write(err.stack ?? "\n");
     }
-    process22.exit(1);
+    process23.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process22.exit(1);
+  process23.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand21({
+var main = defineCommand22({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -3399,7 +3514,8 @@ var main = defineCommand21({
     setup: setup_default,
     secret: secret_default,
     monitor: monitor_default,
-    help: help_default
+    help: help_default,
+    bug: bug_default
   }
 });
 try {

package/dist/{context-PSGEX2D7.js → context-KPKBOWOP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/firewall-XQGO7HWK.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/providers/firewall.ts
+function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult) {
+  if (portOverride.trim()) {
+    return portOverride.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  switch (accessMode) {
+    case "restricted": {
+      if (!allowedCidrs.trim()) return [];
+      return allowedCidrs.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    case "auto": {
+      if (!egressResult.ok) {
+        throw new Error(
+          `accessMode=auto: egress IP detection failed \u2014 ${egressResult.error}. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      const ip = egressResult.ip.trim();
+      if (!ip) {
+        throw new Error(
+          `accessMode=auto: egress IP detection returned an empty address. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      return [ip.includes("/") ? ip : `${ip}/32`];
+    }
+    case "open":
+      return ["0.0.0.0/0"];
+    default:
+      return [];
+  }
+}
+async function detectEgressIp(checkUrl) {
+  try {
+    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(3e3) });
+    if (!res.ok) {
+      return { ok: false, error: `HTTP ${res.status} from ${checkUrl}` };
+    }
+    const ip = (await res.text()).trim();
+    if (!ip) {
+      return { ok: false, error: `empty response from ${checkUrl}` };
+    }
+    return { ok: true, ip };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+export {
+  detectEgressIp,
+  resolveIngressCidrs
+};

package/dist/{gcp-BXDTC6EK.js → gcp-6FT2A45S.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/gcp/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var gcpProgram = async () => {
   const [pulumi, gcp, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/gcp"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
@@ -27,14 +30,14 @@ var gcpProgram = async () => {
       'Stack config "sshPublicKey" is required for the GCP adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const network = new gcp.compute.Network("clawops-network", {
     autoCreateSubnetworks: false,
     description: "clawops managed network"
@@ -42,7 +45,7 @@ var gcpProgram = async () => {
   const subnet = new gcp.compute.Subnetwork("clawops-subnet", {
     ipCidrRange: "10.0.0.0/24",
     region,
-    network: network.id
+    network: network.selfLink
   });
   if (sshIngressCidrs.length > 0) {
     new gcp.compute.Firewall("clawops-firewall-ssh", {
@@ -73,8 +76,8 @@ var gcpProgram = async () => {
     },
     networkInterfaces: [
       {
-        network: network.id,
-        subnetwork: subnet.id,
+        network: network.selfLink,
+        subnetwork: subnet.selfLink,
         accessConfigs: [
           {
             natIp: address.address,
@@ -86,7 +89,7 @@ var gcpProgram = async () => {
     metadata: {
       // GCP guest agent reads 'ssh-keys' and populates /home/<user>/.ssh/authorized_keys
       "ssh-keys": `clawops:${sshPublicKey}`,
-      "startup-script": makeStartupScript(openclawVersion)
+      "startup-script": makeStartupScript({ openclawVersion, os: "debian" })
     },
     serviceAccount: {
       scopes: ["https://www.googleapis.com/auth/cloud-platform"]
@@ -103,58 +106,6 @@ var gcpProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/debian/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/debian $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/gcp/index.ts
 var INSTANCE_TYPE_MAP = {
@@ -172,9 +123,9 @@ var gcpAdapter = {
   },
   getConnectionInfo(outputs) {
     return {
-      host: String(outputs["sshHost"]),
-      port: Number(outputs["sshPort"]),
-      user: String(outputs["sshUser"]),
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "clawops"),
       privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
       knownHostsPath: String(outputs["knownHostsPath"] ?? "")
     };

package/dist/{generate-2QGKYR42.js → generate-YV7226Q7.js}

@@ -2,9 +2,9 @@
 import {
   generatePlan,
   planId
-} from "./chunk-IVX62LFO.js";
+} from "./chunk-72FF7IK2.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-T5EX55GP.js";
+import "./chunk-QI75OVJK.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";