@clawops/cli 1.6.0 → 1.7.0

package/dist/cli.js

@@ -1,25 +1,27 @@
 #!/usr/bin/env node
+import {
+  monitor_default,
+  validateOpenclawConfig
+} from "./chunk-CG3Y7Y2R.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
+import "./chunk-ZFNPM2WG.js";
+import "./chunk-3MFZ7E74.js";
+import "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import {
   REPO_URL,
   chalk,
   failure,
   info,
-  monitor_default,
   printCta,
   spinner,
   success,
-  validateOpenclawConfig,
   warn
-} from "./chunk-C5NDLOK2.js";
-import "./chunk-QI75OVJK.js";
-import "./chunk-LCKD7L7X.js";
-import "./chunk-GJEF6UQA.js";
-import "./chunk-ZFNPM2WG.js";
+} from "./chunk-Q7NQY5HV.js";
 import "./chunk-A2I76FTA.js";
 import {
   getConfig,
@@ -33,7 +35,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand22, runMain } from "citty";
+import { defineCommand as defineCommand23, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -205,7 +207,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -351,7 +353,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -415,7 +417,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -487,8 +489,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
-    const { generatePlan } = await import("./generate-YV7226Q7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { generatePlan } = await import("./generate-ZTD4BVVI.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -578,7 +580,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-SI3JKS4Z.js");
+    const { applyPlan } = await import("./apply-BTZFFGAD.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -694,7 +696,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -761,7 +763,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     let conn;
@@ -848,7 +850,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
@@ -916,7 +918,7 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
@@ -1033,7 +1035,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, key, value] = args._ ?? [];
@@ -1159,7 +1161,7 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, name] = args._ ?? [];
@@ -1263,7 +1265,7 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, versionArg] = args._ ?? [];
@@ -1376,7 +1378,7 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -1549,7 +1551,7 @@ var stacks_default = defineCommand15({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-KPKBOWOP.js");
+        const { buildContext } = await import("./context-ALSJMTHE.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -1707,7 +1709,7 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-KPKBOWOP.js");
+          const { buildContext } = await import("./context-ALSJMTHE.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
           const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
           const ctx = buildContext({ stack: args.stack });
@@ -1793,6 +1795,44 @@ var doctor_default = defineCommand16({
         }
       }
     }
+    if (args.stack && config) {
+      process18.stdout.write("\nHardening\n");
+      try {
+        const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-BDVYW567.js");
+        const { buildContext } = await import("./context-ALSJMTHE.js");
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const ctx = buildContext({ stack: args.stack });
+        const stackObj = await ctx.getStack();
+        const outputMap = await stackObj.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        const base = extractBaseOutputs(outputs);
+        const conn = ctx.adapter.getConnectionInfo({
+          ...base,
+          privateKeyPath: config.ssh.keyPath,
+          knownHostsPath: config.ssh.knownHostsPath
+        });
+        const hardenAc = new AbortController();
+        process18.on("SIGINT", () => hardenAc.abort());
+        const provider = ctx.adapter.name;
+        const modules = resolveModules(MODULE_CATALOG, void 0, provider);
+        await withRemoteExec(conn, hardenAc.signal, async (exec) => {
+          for (const mod of modules) {
+            const result = await mod.check(exec);
+            if (result.status === "applied") {
+              success(`${mod.label.padEnd(32)} applied`);
+            } else if (result.status === "drifted") {
+              warn(`${mod.label.padEnd(32)} drifted \u2014 ${result.detail}`);
+            } else if (result.status === "missing") {
+              info(`${mod.label.padEnd(32)} not applied \u2014 run \`clawops harden\``);
+            }
+          }
+        });
+      } catch (err) {
+        failure(`Hardening checks failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
     process18.stdout.write("\n");
     if (!nodeOk) {
       process18.stdout.write(
@@ -1822,7 +1862,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-3DEZHUWB.js");
+    const { serveMcp } = await import("./server-EXBOOIEP.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1897,7 +1937,7 @@ var wireCmd = defineCommand17({
     force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KPKBOWOP.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
@@ -2394,6 +2434,12 @@ var setup_default = defineCommand18({
           signal: ac.signal,
           inquirer
         });
+        await maybeHarden({
+          stackName: stackAnswers.stackName,
+          provider: "local",
+          signal: ac.signal,
+          inquirer
+        });
       } else {
         const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
         const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2412,7 +2458,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-SI3JKS4Z.js");
+        const { applyPlan } = await import("./apply-BTZFFGAD.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2426,6 +2472,12 @@ var setup_default = defineCommand18({
           process20.exit(1);
         }
         await maybeWireGatewayMcpCloud({ stackName: stackAnswers.stackName, signal: ac.signal, inquirer });
+        await maybeHarden({
+          stackName: stackAnswers.stackName,
+          provider,
+          signal: ac.signal,
+          inquirer
+        });
       } else {
         info(`
 To deploy later:  clawops apply ${outputPath}`);
@@ -3000,6 +3052,68 @@ function instanceChoices(provider) {
   };
   return table[provider] ?? [];
 }
+async function maybeHarden(opts) {
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
+  const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+  const config = getConfig2();
+  if (!config) return;
+  const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
+  if (availableModules.length === 0) return;
+  process20.stdout.write("\n");
+  const { selectedIds } = await opts.inquirer.prompt([{
+    type: "checkbox",
+    name: "selectedIds",
+    message: "Apply security hardening? (Space to toggle, Enter to confirm)",
+    choices: availableModules.map((m) => ({
+      name: `${m.label}${m.defaultOn ? "" : "  (opt-in)"}`,
+      value: m.id,
+      checked: m.defaultOn
+    }))
+  }]);
+  if (selectedIds.length === 0) {
+    info("Hardening skipped. Run `clawops harden --stack " + opts.stackName + "` later.");
+    return;
+  }
+  const modules = availableModules.filter((m) => selectedIds.includes(m.id));
+  process20.stdout.write("\nApplying hardening modules...\n\n");
+  try {
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const ctx = buildContext({ stack: opts.stackName });
+    const stackObj = await ctx.getStack();
+    const outputMap = await stackObj.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: config.ssh.keyPath,
+      knownHostsPath: config.ssh.knownHostsPath
+    });
+    const { success: ok, failure: fail } = await import("./human-Z44CW7TR.js");
+    const results = await runHardening(conn, {
+      modules,
+      signal: opts.signal,
+      onProgress: (r) => {
+        process20.stdout.write(`  \xB7 ${r.module.label}
+`);
+      }
+    });
+    process20.stdout.write("\n" + formatHardenSummary(results));
+    const errors = results.filter((r) => r.error);
+    if (errors.length > 0) {
+      for (const r of errors) fail(`${r.module.label}: ${r.error}`);
+      info("Some modules failed. Run `clawops harden --stack " + opts.stackName + "` to retry.");
+    } else {
+      ok("Hardening complete.");
+    }
+  } catch (err) {
+    const { failure: fail } = await import("./human-Z44CW7TR.js");
+    fail(`Hardening failed: ${err instanceof Error ? err.message : String(err)}`);
+    info("Run `clawops harden --stack " + opts.stackName + "` to retry.");
+  }
+}
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand19 } from "citty";
@@ -3172,7 +3286,7 @@ var rotateCmd = defineCommand19({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-KPKBOWOP.js");
+      const { buildContext } = await import("./context-ALSJMTHE.js");
       const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
       const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
@@ -3359,7 +3473,7 @@ import { accessSync as accessSync2, constants as constants2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "1.6.0" : "dev";
+var VERSION = true ? "1.7.0" : "dev";
 async function collectContext() {
   const nodeVersion = process22.version;
   const os3 = `${process22.platform} ${process22.arch}`;
@@ -3459,26 +3573,147 @@ ${url}
   }
 });
 
-// src/cli/error-handler.ts
+// src/cli/commands/harden.ts
+import { defineCommand as defineCommand22 } from "citty";
 import process23 from "process";
+var harden_default = defineCommand22({
+  meta: {
+    name: "harden",
+    description: "Apply security hardening modules to a deployed stack"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    options: { type: "string", description: "Comma-separated module IDs to run (default: all defaultOn modules)" },
+    list: { type: "boolean", description: "List available modules and exit" },
+    "dry-run": { type: "boolean", description: "Check current state without applying changes" },
+    yes: { type: "boolean", description: "Skip confirmation prompt" },
+    json: { type: "boolean", description: "Emit structured JSON output" }
+  },
+  async run({ args }) {
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    if (args.list) {
+      process23.stdout.write("\nAvailable hardening modules:\n\n");
+      for (const mod of MODULE_CATALOG) {
+        const on = mod.defaultOn ? chalk.green("ON ") : chalk.dim("off");
+        const providers = mod.providers === "all" ? "all" : mod.providers.join(", ");
+        process23.stdout.write(
+          `  ${on}  ${mod.id.padEnd(28)} ${mod.label}  [${providers}]
+`
+        );
+      }
+      process23.stdout.write("\n");
+      return;
+    }
+    const config = getConfig2();
+    if (!config) {
+      failure("No clawops config found. Run `clawops init` first.");
+      process23.exit(1);
+    }
+    const ctx = buildContext({ stack: args.stack });
+    const provider = ctx.adapter.name;
+    const modules = resolveModules(MODULE_CATALOG, args.options, provider);
+    if (modules.length === 0) {
+      warn("No modules selected for this provider. Use --options to specify modules or --list to see all.");
+      return;
+    }
+    if (!args.json) {
+      process23.stdout.write("\nModules to run:\n");
+      for (const mod of modules) {
+        const flag = mod.defaultOn ? "" : chalk.yellow(" [opt-in]");
+        process23.stdout.write(`  \xB7 ${mod.label}${flag}
+`);
+      }
+      process23.stdout.write("\n");
+    }
+    if (!args["dry-run"] && !args.yes && !args.json) {
+      const { createInterface: createInterface3 } = await import("readline/promises");
+      const rl = createInterface3({ input: process23.stdin, output: process23.stdout });
+      const answer = await rl.question("Apply these hardening modules? [y/N] ");
+      rl.close();
+      if (!answer.toLowerCase().startsWith("y")) {
+        info("Aborted.");
+        return;
+      }
+    }
+    const ac = new AbortController();
+    process23.on("SIGINT", () => ac.abort());
+    process23.on("SIGTERM", () => ac.abort());
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const stackObj = await ctx.getStack();
+    const outputMap = await stackObj.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: config.ssh.keyPath,
+      knownHostsPath: config.ssh.knownHostsPath
+    });
+    if (!args.json) {
+      process23.stdout.write(args["dry-run"] ? "Checking hardening state...\n\n" : "Applying hardening...\n\n");
+    }
+    const results = await runHardening(conn, {
+      modules,
+      dryRun: args["dry-run"],
+      signal: ac.signal,
+      onProgress: args.json ? void 0 : (r) => {
+        const icon = r.error ? chalk.red("\u2717") : r.applyResult?.changed ? chalk.green("\u2713") : chalk.dim("\xB7");
+        process23.stdout.write(`  ${icon}  ${r.module.label}
+`);
+      }
+    });
+    if (args.json) {
+      printJson(jsonOk({
+        dryRun: args["dry-run"] ?? false,
+        results: results.map((r) => ({
+          id: r.module.id,
+          status: r.checkResult.status,
+          changed: r.applyResult?.changed ?? false,
+          detail: r.applyResult?.detail ?? r.checkResult.detail,
+          error: r.error,
+          durationMs: r.durationMs
+        }))
+      }));
+      return;
+    }
+    process23.stdout.write("\n" + formatHardenSummary(results));
+    const errors = results.filter((r) => r.error);
+    if (errors.length > 0) {
+      process23.stdout.write("\n");
+      for (const r of errors) {
+        failure(`${r.module.label}: ${r.error}`);
+      }
+      process23.exit(1);
+    }
+    if (!args["dry-run"]) {
+      success("Hardening complete.");
+    }
+  }
+});
+
+// src/cli/error-handler.ts
+import process24 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process23.exit(err.exitCode);
+    process24.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process23.env["DEBUG"]) {
-      process23.stderr.write(err.stack ?? "\n");
+    if (process24.env["DEBUG"]) {
+      process24.stderr.write(err.stack ?? "\n");
     }
-    process23.exit(1);
+    process24.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process23.exit(1);
+  process24.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand22({
+var main = defineCommand23({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -3515,7 +3750,8 @@ var main = defineCommand22({
     secret: secret_default,
     monitor: monitor_default,
     help: help_default,
-    bug: bug_default
+    bug: bug_default,
+    harden: harden_default
   }
 });
 try {

package/dist/{context-KPKBOWOP.js → context-ALSJMTHE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-QI75OVJK.js";
+} from "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{generate-YV7226Q7.js → generate-ZTD4BVVI.js}

@@ -2,9 +2,9 @@
 import {
   generatePlan,
   planId
-} from "./chunk-72FF7IK2.js";
+} from "./chunk-7KLLWDBA.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-QI75OVJK.js";
+import "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";