@clawops/cli 1.5.0 → 1.7.0

package/README.md

@@ -277,6 +277,8 @@ clawops down --yes          # Destroy local-provider stack
 | `mcp install` | Interactively wire clawops into AI editors |
 | `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
+| `harden` | Apply security hardening to a deployed stack (SSH, UFW, fail2ban, unattended-upgrades, Docker socket; AWS: SG audit, SSM check, Flow Logs, GuardDuty) |
+| `bug` | Open a pre-filled GitHub issue with system context from `doctor` |
 
 Full flag reference: `clawops <command> --help`
 

package/dist/{apply-5RREMN3L.js → apply-BTZFFGAD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-ZONXY3C6.js";
+} from "./chunk-ISFHLA4G.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-T5EX55GP.js";
 import "./chunk-ZFNPM2WG.js";
+import "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{aws-FRE2JVAZ.js → aws-D7Y6LCGK.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/aws/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var awsProgram = async () => {
   const [pulumi, aws, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/aws"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "t3.small";
@@ -21,20 +24,21 @@ var awsProgram = async () => {
   const sshCidrs = cfg.get("sshCidrs") ?? "";
   const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
   const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
+  const pinnedAmiId = cfg.get("amiId");
   const sshPublicKey = cfg.get("sshPublicKey");
   if (!sshPublicKey) {
     throw new Error(
       'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const vpc = new aws.ec2.Vpc("clawops-vpc", {
     cidrBlock: "10.0.0.0/16",
     enableDnsHostnames: true,
@@ -68,33 +72,36 @@ var awsProgram = async () => {
     subnetId: subnet.id,
     routeTableId: routeTable.id
   });
-  const ingressRules = [
-    ...sshIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
+    vpcId: vpc.id,
+    description: "clawops managed security group",
+    tags: { Name: "clawops" }
+  });
+  sshIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-ssh-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: SSH_PORT,
       toPort: SSH_PORT,
-      cidrBlocks: [cidr],
-      description: "SSH"
-    })),
-    ...gatewayIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-ssh-${i}` }
+    });
+  });
+  gatewayIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-gw-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: GATEWAY_PORT,
       toPort: GATEWAY_PORT,
-      cidrBlocks: [cidr],
-      description: "OpenClaw gateway"
-    }))
-  ];
-  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
-    vpcId: vpc.id,
-    ingress: ingressRules,
-    egress: [{
-      protocol: "-1",
-      fromPort: 0,
-      toPort: 0,
-      cidrBlocks: ["0.0.0.0/0"],
-      description: "Allow all egress"
-    }],
-    tags: { Name: "clawops" }
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-gateway-${i}` }
+    });
+  });
+  new aws.vpc.SecurityGroupEgressRule("clawops-sg-egress", {
+    securityGroupId: sg.id,
+    ipProtocol: "-1",
+    cidrIpv4: "0.0.0.0/0",
+    tags: { Name: "clawops-egress" }
   });
   const role = new aws.iam.Role("clawops-role", {
     assumeRolePolicy: JSON.stringify({
@@ -112,10 +119,19 @@ var awsProgram = async () => {
     policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
   });
   if (bedrockEnabled) {
-    new aws.iam.RolePolicyAttachment("clawops-bedrock", {
+    new aws.iam.RolePolicy("clawops-bedrock-invoke", {
       role: role.name,
-      // FullAccess required for bedrock:InvokeModel — ReadOnly only covers describe/list.
-      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
+      policy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+          Effect: "Allow",
+          Action: [
+            "bedrock:InvokeModel",
+            "bedrock:InvokeModelWithResponseStream"
+          ],
+          Resource: "*"
+        }]
+      })
     });
   }
   const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
@@ -125,7 +141,7 @@ var awsProgram = async () => {
     publicKey: sshPublicKey,
     tags: { Name: "clawops" }
   });
-  const ami = await aws.ec2.getAmi({
+  const amiId = pinnedAmiId ?? (await aws.ec2.getAmi({
     mostRecent: true,
     owners: ["099720109477"],
     // Canonical
@@ -133,15 +149,17 @@ var awsProgram = async () => {
       { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
       { name: "virtualization-type", values: ["hvm"] }
     ]
-  });
+  })).id;
+  process.stderr.write(`[clawops] Using AMI: ${amiId}
+`);
   const instance = new aws.ec2.Instance("clawops-instance", {
-    ami: ami.id,
+    ami: amiId,
     instanceType,
     subnetId: subnet.id,
     vpcSecurityGroupIds: [sg.id],
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
-    userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    userData: makeStartupScript({ openclawVersion, os: "ubuntu", bedrockEnabled }),
     // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
     // and obtain the instance role credentials (required for Bedrock access).
     metadataOptions: {
@@ -169,62 +187,6 @@ var awsProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-chown clawops:clawops /home/clawops/.ssh
-
-# Install Docker if not present (AWS AMI is ubuntu-22.04)
-if ! command -v docker &>/dev/null; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-# apply.ts will overwrite this with the plan's config overlay post-provisioning.
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-${bedrockEnvFlag}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/aws/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{azure-PVC3AQVC.js → azure-JQAMNVHN.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/azure/index.ts
 import process2 from "process";
@@ -12,7 +15,7 @@ var azureProgram = async () => {
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
     import("@pulumi/random"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const stackName = pulumi.getStack();
@@ -31,14 +34,15 @@ var azureProgram = async () => {
       'Stack config "sshPublicKey" is required for the Azure adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : "";
+  const clientConfig = await azure.authorization.getClientConfig({});
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const rg = new azure.resources.ResourceGroup("clawops-rg", {
     resourceGroupName,
     location
@@ -111,7 +115,7 @@ var azureProgram = async () => {
     osProfile: {
       adminUsername: "clawops",
       computerName: "clawops",
-      customData: Buffer.from(makeStartupScript(openclawVersion)).toString("base64"),
+      customData: Buffer.from(makeStartupScript({ openclawVersion, os: "ubuntu" })).toString("base64"),
       linuxConfiguration: {
         disablePasswordAuthentication: true,
         ssh: {
@@ -125,8 +129,10 @@ var azureProgram = async () => {
     storageProfile: {
       imageReference: {
         publisher: "Canonical",
-        offer: "UbuntuServer",
-        sku: "22.04-LTS",
+        // Ubuntu 22.04 LTS — Canonical migrated from the legacy 'UbuntuServer'
+        // offer to this naming scheme. 22_04-lts-gen2 is available in all regions.
+        offer: "0001-com-ubuntu-server-jammy",
+        sku: "22_04-lts-gen2",
         version: "latest"
       },
       osDisk: {
@@ -153,10 +159,10 @@ var azureProgram = async () => {
         enableRbacAuthorization: true
       }
     });
+    const kvSecretsUserRoleId = `/subscriptions/${clientConfig.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`;
     new azure.authorization.RoleAssignment("clawops-kv-role", {
       scope: kv.id,
-      roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6",
-      // Key Vault Secrets User
+      roleDefinitionId: kvSecretsUserRoleId,
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
@@ -183,53 +189,6 @@ var azureProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p 18789:18789 \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/azure/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{bootstrap-G4UZ2FKH.js → bootstrap-RY4VOSDJ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   acquireSession
-} from "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import {
   writeLocalState
 } from "./chunk-A2I76FTA.js";

package/dist/{chunk-T5EX55GP.js → chunk-3MFZ7E74.js}

@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-BXDTC6EK.js");
+        const mod = await import("./gcp-6FT2A45S.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-FRE2JVAZ.js");
+        const mod = await import("./aws-D7Y6LCGK.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-PVC3AQVC.js");
+        const mod = await import("./azure-JQAMNVHN.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/{chunk-IVX62LFO.js → chunk-7KLLWDBA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-3MFZ7E74.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-QLDA65A3.js");
+  const { version } = await import("./package-7WOZMHSO.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/{chunk-R5S6IXBE.js → chunk-CG3Y7Y2R.js}

@@ -1,50 +1,27 @@
 #!/usr/bin/env node
+import {
+  OPENCLAW_CONFIG,
+  atomicWriteConfig,
+  restartGateway
+} from "./chunk-ZFNPM2WG.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-3MFZ7E74.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-ZVOEQCNW.js";
+} from "./chunk-LCKD7L7X.js";
 import {
-  OPENCLAW_CONFIG,
-  atomicWriteConfig,
-  restartGateway
-} from "./chunk-ZFNPM2WG.js";
+  chalk,
+  failure
+} from "./chunk-Q7NQY5HV.js";
 import {
   StateError
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
-import process2 from "process";
-
-// src/output/human.ts
-import chalk from "chalk";
-import ora from "ora";
-function success(msg) {
-  console.log(chalk.green("\u2713") + "  " + msg);
-}
-function failure(msg) {
-  console.error(chalk.red("\u2717") + "  " + msg);
-}
-function warn(msg) {
-  console.warn(chalk.yellow("\u26A0") + "  " + msg);
-}
-function info(msg) {
-  console.log(chalk.blue("\u2139") + "  " + msg);
-}
-function spinner(text) {
-  return ora(text).start();
-}
-var REPO_URL = "https://github.com/dfridkin/clawops";
-function printCta() {
-  process.stdout.write(
-    "\n" + chalk.dim("  Thank you for using clawops! If it has been useful, star the project:") + "\n" + chalk.dim("  " + REPO_URL) + "\n\n" + chalk.dim("  Found a bug? Open an issue:") + "\n" + chalk.dim("  " + REPO_URL + "/issues") + "\n\n"
-  );
-}
-
-// src/cli/commands/monitor.ts
+import process from "process";
 var GATEWAY_PORT = 18789;
 function formatUptime(startedAt) {
   if (!startedAt) return "\u2014";
@@ -154,7 +131,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
+  const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -234,7 +211,7 @@ async function deleteFromRegistry(name) {
   setConfig(updated);
 }
 async function runStackMenu(ac, setKeyHandler, noColor) {
-  process2.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
+  process.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
   const entries = await probeEntries();
   if (ac.signal.aborted) return null;
   let selectedIdx = 0;
@@ -244,7 +221,7 @@ async function runStackMenu(ac, setKeyHandler, noColor) {
     return showAll ? entries : entries.filter((e) => e.deployed);
   }
   function redraw() {
-    process2.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
+    process.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
   }
   redraw();
   return new Promise((resolve) => {
@@ -323,7 +300,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       noColor: opts.noColor,
       menuMode
     });
-    process2.stdout.write("\x1B[2J\x1B[H" + out + "\n");
+    process.stdout.write("\x1B[2J\x1B[H" + out + "\n");
   }
   async function doRefresh() {
     cancelRefresh();
@@ -333,7 +310,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       redraw();
     } catch (err) {
       if (!ac.signal.aborted) {
-        process2.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
+        process.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
       }
     }
     if (!ac.signal.aborted) scheduleRefresh();
@@ -379,20 +356,20 @@ var monitor_default = defineCommand({
   async run({ args }) {
     const intervalSec = Math.max(2, parseInt(String(args.interval ?? "10"), 10) || 10);
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
-    const isTTY = Boolean(process2.stdout.isTTY);
+    const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
+    const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
+    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
     const ac = new AbortController();
-    process2.on("SIGINT", () => ac.abort());
-    process2.on("SIGTERM", () => ac.abort());
+    process.on("SIGINT", () => ac.abort());
+    process.on("SIGTERM", () => ac.abort());
     if (args.stack) {
       const ctx = buildContext2(args);
       let conn;
       if (ctx.adapter.name === "local") {
         if (!ctx.localState) {
           failure("Stack is not bootstrapped. Run `clawops up` first.");
-          process2.exit(4);
+          process.exit(4);
         }
         const ls = ctx.localState;
         conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
@@ -405,7 +382,7 @@ var monitor_default = defineCommand({
         );
         if (!outputs["publicIp"]) {
           failure("Stack has no outputs. Run `clawops up` first.");
-          process2.exit(4);
+          process.exit(4);
         }
         const base = extractBaseOutputs(outputs);
         conn = ctx.adapter.getConnectionInfo({
@@ -418,7 +395,7 @@ var monitor_default = defineCommand({
         const { session: session2, release: release2 } = await acquireSession2({ ...conn, signal: ac.signal });
         try {
           const snap = await gatherSnapshot(session2, ac.signal, tailLines);
-          process2.stdout.write(
+          process.stdout.write(
             renderSnapshot(snap, { stackName: ctx.stackName, intervalSec, showLogs: true, noColor }) + "\n"
           );
         } finally {
@@ -428,21 +405,21 @@ var monitor_default = defineCommand({
         return;
       }
       const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
-      process2.stdin.setRawMode(true);
-      process2.stdin.resume();
-      process2.stdin.setEncoding("utf8");
-      process2.stdout.write("\x1B[?25l");
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding("utf8");
+      process.stdout.write("\x1B[?25l");
       let keyHandler2 = () => {
       };
-      process2.stdin.on("data", (key) => keyHandler2(key));
+      process.stdin.on("data", (key) => keyHandler2(key));
       try {
         await runDashboard(session, ctx.stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
           keyHandler2 = fn;
         }, false);
       } finally {
-        process2.stdin.setRawMode(false);
-        process2.stdin.pause();
-        process2.stdout.write("\x1B[?25h\n");
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdout.write("\x1B[?25h\n");
         release();
         drainPool2();
       }
@@ -450,15 +427,15 @@ var monitor_default = defineCommand({
     }
     if (!isTTY) {
       failure("Pass --stack <name> or run in a TTY for interactive stack selection.");
-      process2.exit(2);
+      process.exit(2);
     }
-    process2.stdin.setRawMode(true);
-    process2.stdin.resume();
-    process2.stdin.setEncoding("utf8");
-    process2.stdout.write("\x1B[?25l");
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    process.stdout.write("\x1B[?25l");
     let keyHandler = () => {
     };
-    process2.stdin.on("data", (key) => keyHandler(key));
+    process.stdin.on("data", (key) => keyHandler(key));
     try {
       while (!ac.signal.aborted) {
         const stackName = await runStackMenu(ac, (fn) => {
@@ -503,9 +480,9 @@ var monitor_default = defineCommand({
         }
       }
     } finally {
-      process2.stdin.setRawMode(false);
-      process2.stdin.pause();
-      process2.stdout.write("\x1B[?25h\n");
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdout.write("\x1B[?25h\n");
     }
   }
 });
@@ -750,13 +727,6 @@ function validateOpenclawConfig(cfg) {
 }
 
 export {
-  chalk,
-  success,
-  failure,
-  warn,
-  info,
-  spinner,
-  printCta,
   resolveConn,
   errText,
   okText,

package/dist/{chunk-4U3LTLWZ.js → chunk-GJEF6UQA.js}

@@ -92,6 +92,7 @@ var Ssh2Session = class {
         server.close();
       };
       server.on("error", (err) => {
+        closeAll();
         const msg = err.code === "EADDRINUSE" ? `Port ${localPort} is already in use` : `Tunnel server error: ${err.message}`;
         reject(new NetworkError(msg));
       });