@clawops/cli 1.5.0 → 1.7.0

package/dist/{context-PSGEX2D7.js → context-ALSJMTHE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/firewall-XQGO7HWK.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/providers/firewall.ts
+function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult) {
+  if (portOverride.trim()) {
+    return portOverride.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  switch (accessMode) {
+    case "restricted": {
+      if (!allowedCidrs.trim()) return [];
+      return allowedCidrs.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    case "auto": {
+      if (!egressResult.ok) {
+        throw new Error(
+          `accessMode=auto: egress IP detection failed \u2014 ${egressResult.error}. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      const ip = egressResult.ip.trim();
+      if (!ip) {
+        throw new Error(
+          `accessMode=auto: egress IP detection returned an empty address. Set allowedCidrs explicitly or use accessMode=restricted.`
+        );
+      }
+      return [ip.includes("/") ? ip : `${ip}/32`];
+    }
+    case "open":
+      return ["0.0.0.0/0"];
+    default:
+      return [];
+  }
+}
+async function detectEgressIp(checkUrl) {
+  try {
+    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(3e3) });
+    if (!res.ok) {
+      return { ok: false, error: `HTTP ${res.status} from ${checkUrl}` };
+    }
+    const ip = (await res.text()).trim();
+    if (!ip) {
+      return { ok: false, error: `empty response from ${checkUrl}` };
+    }
+    return { ok: true, ip };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+export {
+  detectEgressIp,
+  resolveIngressCidrs
+};

package/dist/{gcp-BXDTC6EK.js → gcp-6FT2A45S.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/gcp/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var gcpProgram = async () => {
   const [pulumi, gcp, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/gcp"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
@@ -27,14 +30,14 @@ var gcpProgram = async () => {
       'Stack config "sshPublicKey" is required for the GCP adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const network = new gcp.compute.Network("clawops-network", {
     autoCreateSubnetworks: false,
     description: "clawops managed network"
@@ -42,7 +45,7 @@ var gcpProgram = async () => {
   const subnet = new gcp.compute.Subnetwork("clawops-subnet", {
     ipCidrRange: "10.0.0.0/24",
     region,
-    network: network.id
+    network: network.selfLink
   });
   if (sshIngressCidrs.length > 0) {
     new gcp.compute.Firewall("clawops-firewall-ssh", {
@@ -73,8 +76,8 @@ var gcpProgram = async () => {
     },
     networkInterfaces: [
       {
-        network: network.id,
-        subnetwork: subnet.id,
+        network: network.selfLink,
+        subnetwork: subnet.selfLink,
         accessConfigs: [
           {
             natIp: address.address,
@@ -86,7 +89,7 @@ var gcpProgram = async () => {
     metadata: {
       // GCP guest agent reads 'ssh-keys' and populates /home/<user>/.ssh/authorized_keys
       "ssh-keys": `clawops:${sshPublicKey}`,
-      "startup-script": makeStartupScript(openclawVersion)
+      "startup-script": makeStartupScript({ openclawVersion, os: "debian" })
     },
     serviceAccount: {
       scopes: ["https://www.googleapis.com/auth/cloud-platform"]
@@ -103,58 +106,6 @@ var gcpProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/debian/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/debian $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/gcp/index.ts
 var INSTANCE_TYPE_MAP = {
@@ -172,9 +123,9 @@ var gcpAdapter = {
   },
   getConnectionInfo(outputs) {
     return {
-      host: String(outputs["sshHost"]),
-      port: Number(outputs["sshPort"]),
-      user: String(outputs["sshUser"]),
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "clawops"),
       privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
       knownHostsPath: String(outputs["knownHostsPath"] ?? "")
     };

package/dist/{generate-2QGKYR42.js → generate-ZTD4BVVI.js}

@@ -2,9 +2,9 @@
 import {
   generatePlan,
   planId
-} from "./chunk-IVX62LFO.js";
+} from "./chunk-7KLLWDBA.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-T5EX55GP.js";
+import "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";