@clawops/cli 1.6.0 → 1.7.1

package/README.md

@@ -12,6 +12,68 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.7.0
+
+**`clawops harden`** — run an idempotent set of server-hardening modules against a deployed
+stack over SSH. Each module has a read-only `check()` and an `apply()` step; `check()` runs first
+and `apply()` is skipped when the box is already compliant. Sentinel files under
+`/etc/clawops/hardening/` record what has been applied.
+
+```bash
+clawops harden --list                          # show available modules
+clawops harden --stack prod --dry-run          # preview changes, apply nothing
+clawops harden --stack prod                     # apply the default module set
+clawops harden --stack prod --options ssh,ufw   # apply a specific subset
+```
+
+**Common modules (all providers), ON by default:** `ssh` (hardens `sshd_config`, guards against
+lockout by verifying `authorized_keys` is non-empty before restarting sshd), `ufw` (deny-all
+incoming, allow SSH + gateway 18789), `fail2ban` (SSH jail: 5 failures → 10-minute ban),
+`unattended-upgrades` (security-only auto updates), and `docker-socket` (verify
+`/var/run/docker.sock` is `root:docker 660`). **Opt-in:** `auditd`, `lynis` (CIS Level 1 scan →
+`~/.clawops/reports/`), `sysctl`.
+
+**AWS modules (check-only, ON by default):** `aws-sg-audit` (warns on `0.0.0.0/0` ingress on
+unexpected ports) and `aws-ssm-check` (verifies `AmazonSSMManagedInstanceCore` for emergency SSM
+shell access). **Opt-in:** `aws-flow-logs`, `aws-guardduty`.
+
+`clawops setup` now presents a multi-select hardening step after deploy (skippable with
+`--no-harden`), and `clawops doctor --stack <name>` gains a Hardening section showing which
+modules are applied, missing, or drifted.
+
+---
+
+## What's new in v1.6.0
+
+**`clawops bug`** — open a pre-filled GitHub issue with system context (version, Node, OS,
+provider, stack count, SSH key presence) populated automatically. `--json` emits the URL without
+prompting or opening a browser, suitable for scripting. `clawops doctor` now prints a `clawops bug`
+hint in its footer when it exits with an error.
+
+```bash
+clawops bug              # open a pre-filled issue in the browser
+clawops bug --json       # print the issue URL for scripting
+```
+
+**Cloud deploy bug fixes (AWS, GCP, Azure).** This release fixes 10 bugs found in a deploy audit,
+several deploy-blocking:
+
+- **Azure:** updated deprecated image reference `UbuntuServer/22.04-LTS` →
+  `0001-com-ubuntu-server-jammy/22_04-lts-gen2` — every Azure deployment was broken; and fixed a
+  malformed Key Vault `roleDefinitionId` that broke Key Vault RBAC entirely.
+- **AWS:** Bedrock startup script now uses the IMDSv2 PUT→GET token flow (a plain `curl` to IMDS
+  returned 401, so the region always fell back to `us-east-1`); replaced
+  `AmazonBedrockFullAccess` with a least-privilege inline policy.
+- **AWS (⚠️ migration impact):** migrated from inline Security Group ingress/egress arrays to
+  individual `SecurityGroupIngressRule`/`SecurityGroupEgressRule` resources so CIDR changes no
+  longer replace the whole Security Group. **Existing AWS stacks have their Security Group
+  replaced on the first `clawops up` after this upgrade** — see
+  `docs/decisions/0009-aws-sg-rule-resources.md` for the import-based mitigation.
+- **All providers:** `accessMode=auto` egress-IP detection now returns a `Result` and throws a
+  clear error on failure instead of silently producing a VM with zero ingress rules.
+
+---
+
 ## What's new in v1.5.0
 
 **`clawops mcp wire`** — wire the OpenClaw gateway's own AI as an MCP client of clawops.
@@ -277,6 +339,7 @@ clawops down --yes          # Destroy local-provider stack
 | `mcp install` | Interactively wire clawops into AI editors |
 | `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
+| `harden` | Apply security hardening to a deployed stack (SSH, UFW, fail2ban, unattended-upgrades, Docker socket; AWS: SG audit, SSM check, Flow Logs, GuardDuty) |
 | `bug` | Open a pre-filled GitHub issue with system context from `doctor` |
 
 Full flag reference: `clawops <command> --help`

package/dist/{apply-SI3JKS4Z.js → apply-BTZFFGAD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-QHGFENYR.js";
+} from "./chunk-ISFHLA4G.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-QI75OVJK.js";
 import "./chunk-ZFNPM2WG.js";
+import "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{chunk-C5NDLOK2.js → chunk-CG3Y7Y2R.js}

@@ -1,50 +1,27 @@
 #!/usr/bin/env node
+import {
+  OPENCLAW_CONFIG,
+  atomicWriteConfig,
+  restartGateway
+} from "./chunk-ZFNPM2WG.js";
 import {
   buildContext
-} from "./chunk-QI75OVJK.js";
+} from "./chunk-3MFZ7E74.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-LCKD7L7X.js";
 import {
-  OPENCLAW_CONFIG,
-  atomicWriteConfig,
-  restartGateway
-} from "./chunk-ZFNPM2WG.js";
+  chalk,
+  failure
+} from "./chunk-Q7NQY5HV.js";
 import {
   StateError
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
-import process2 from "process";
-
-// src/output/human.ts
-import chalk from "chalk";
-import ora from "ora";
-function success(msg) {
-  console.log(chalk.green("\u2713") + "  " + msg);
-}
-function failure(msg) {
-  console.error(chalk.red("\u2717") + "  " + msg);
-}
-function warn(msg) {
-  console.warn(chalk.yellow("\u26A0") + "  " + msg);
-}
-function info(msg) {
-  console.log(chalk.blue("\u2139") + "  " + msg);
-}
-function spinner(text) {
-  return ora(text).start();
-}
-var REPO_URL = "https://github.com/dfridkin/clawops";
-function printCta() {
-  process.stdout.write(
-    "\n" + chalk.dim("  Thank you for using clawops! If it has been useful, star the project:") + "\n" + chalk.dim("  " + REPO_URL) + "\n\n" + chalk.dim("  Found a bug? Open an issue:") + "\n" + chalk.dim("  " + REPO_URL + "/issues") + "\n\n"
-  );
-}
-
-// src/cli/commands/monitor.ts
+import process from "process";
 var GATEWAY_PORT = 18789;
 function formatUptime(startedAt) {
   if (!startedAt) return "\u2014";
@@ -154,7 +131,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
+  const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -234,7 +211,7 @@ async function deleteFromRegistry(name) {
   setConfig(updated);
 }
 async function runStackMenu(ac, setKeyHandler, noColor) {
-  process2.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
+  process.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
   const entries = await probeEntries();
   if (ac.signal.aborted) return null;
   let selectedIdx = 0;
@@ -244,7 +221,7 @@ async function runStackMenu(ac, setKeyHandler, noColor) {
     return showAll ? entries : entries.filter((e) => e.deployed);
   }
   function redraw() {
-    process2.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
+    process.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
   }
   redraw();
   return new Promise((resolve) => {
@@ -323,7 +300,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       noColor: opts.noColor,
       menuMode
     });
-    process2.stdout.write("\x1B[2J\x1B[H" + out + "\n");
+    process.stdout.write("\x1B[2J\x1B[H" + out + "\n");
   }
   async function doRefresh() {
     cancelRefresh();
@@ -333,7 +310,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       redraw();
     } catch (err) {
       if (!ac.signal.aborted) {
-        process2.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
+        process.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
       }
     }
     if (!ac.signal.aborted) scheduleRefresh();
@@ -379,20 +356,20 @@ var monitor_default = defineCommand({
   async run({ args }) {
     const intervalSec = Math.max(2, parseInt(String(args.interval ?? "10"), 10) || 10);
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
-    const isTTY = Boolean(process2.stdout.isTTY);
+    const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
+    const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
     const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
     const ac = new AbortController();
-    process2.on("SIGINT", () => ac.abort());
-    process2.on("SIGTERM", () => ac.abort());
+    process.on("SIGINT", () => ac.abort());
+    process.on("SIGTERM", () => ac.abort());
     if (args.stack) {
       const ctx = buildContext2(args);
       let conn;
       if (ctx.adapter.name === "local") {
         if (!ctx.localState) {
           failure("Stack is not bootstrapped. Run `clawops up` first.");
-          process2.exit(4);
+          process.exit(4);
         }
         const ls = ctx.localState;
         conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
@@ -405,7 +382,7 @@ var monitor_default = defineCommand({
         );
         if (!outputs["publicIp"]) {
           failure("Stack has no outputs. Run `clawops up` first.");
-          process2.exit(4);
+          process.exit(4);
         }
         const base = extractBaseOutputs(outputs);
         conn = ctx.adapter.getConnectionInfo({
@@ -418,7 +395,7 @@ var monitor_default = defineCommand({
         const { session: session2, release: release2 } = await acquireSession2({ ...conn, signal: ac.signal });
         try {
           const snap = await gatherSnapshot(session2, ac.signal, tailLines);
-          process2.stdout.write(
+          process.stdout.write(
             renderSnapshot(snap, { stackName: ctx.stackName, intervalSec, showLogs: true, noColor }) + "\n"
           );
         } finally {
@@ -428,21 +405,21 @@ var monitor_default = defineCommand({
         return;
       }
       const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
-      process2.stdin.setRawMode(true);
-      process2.stdin.resume();
-      process2.stdin.setEncoding("utf8");
-      process2.stdout.write("\x1B[?25l");
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding("utf8");
+      process.stdout.write("\x1B[?25l");
       let keyHandler2 = () => {
       };
-      process2.stdin.on("data", (key) => keyHandler2(key));
+      process.stdin.on("data", (key) => keyHandler2(key));
       try {
         await runDashboard(session, ctx.stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
           keyHandler2 = fn;
         }, false);
       } finally {
-        process2.stdin.setRawMode(false);
-        process2.stdin.pause();
-        process2.stdout.write("\x1B[?25h\n");
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdout.write("\x1B[?25h\n");
         release();
         drainPool2();
       }
@@ -450,15 +427,15 @@ var monitor_default = defineCommand({
     }
     if (!isTTY) {
       failure("Pass --stack <name> or run in a TTY for interactive stack selection.");
-      process2.exit(2);
+      process.exit(2);
     }
-    process2.stdin.setRawMode(true);
-    process2.stdin.resume();
-    process2.stdin.setEncoding("utf8");
-    process2.stdout.write("\x1B[?25l");
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    process.stdout.write("\x1B[?25l");
     let keyHandler = () => {
     };
-    process2.stdin.on("data", (key) => keyHandler(key));
+    process.stdin.on("data", (key) => keyHandler(key));
     try {
       while (!ac.signal.aborted) {
         const stackName = await runStackMenu(ac, (fn) => {
@@ -503,9 +480,9 @@ var monitor_default = defineCommand({
         }
       }
     } finally {
-      process2.stdin.setRawMode(false);
-      process2.stdin.pause();
-      process2.stdout.write("\x1B[?25h\n");
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdout.write("\x1B[?25h\n");
     }
   }
 });
@@ -750,14 +727,6 @@ function validateOpenclawConfig(cfg) {
 }
 
 export {
-  chalk,
-  success,
-  failure,
-  warn,
-  info,
-  spinner,
-  REPO_URL,
-  printCta,
   resolveConn,
   errText,
   okText,

package/dist/{chunk-72FF7IK2.js → chunk-FQ4JXUCR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-QI75OVJK.js";
+} from "./chunk-3MFZ7E74.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-EW3FS257.js");
+  const { version } = await import("./package-OMPI6RMV.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/{chunk-QHGFENYR.js → chunk-ISFHLA4G.js}

@@ -8,15 +8,15 @@ import {
 import {
   resolveSecrets
 } from "./chunk-BOPSG2LI.js";
-import {
-  buildContext
-} from "./chunk-QI75OVJK.js";
 import {
   atomicWriteConfig,
   deepMerge,
   readRemoteConfig,
   restartGateway
 } from "./chunk-ZFNPM2WG.js";
+import {
+  buildContext
+} from "./chunk-3MFZ7E74.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";

package/dist/chunk-Q7NQY5HV.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+// src/output/human.ts
+import chalk from "chalk";
+import ora from "ora";
+function success(msg) {
+  console.log(chalk.green("\u2713") + "  " + msg);
+}
+function failure(msg) {
+  console.error(chalk.red("\u2717") + "  " + msg);
+}
+function warn(msg) {
+  console.warn(chalk.yellow("\u26A0") + "  " + msg);
+}
+function info(msg) {
+  console.log(chalk.blue("\u2139") + "  " + msg);
+}
+function spinner(text) {
+  return ora(text).start();
+}
+var REPO_URL = "https://github.com/dfridkin/clawops";
+function printCta() {
+  process.stdout.write(
+    "\n" + chalk.dim("  Thank you for using clawops! If it has been useful, star the project:") + "\n" + chalk.dim("  " + REPO_URL) + "\n\n" + chalk.dim("  Found a bug? Open an issue:") + "\n" + chalk.dim("  " + REPO_URL + "/issues") + "\n\n"
+  );
+}
+
+export {
+  chalk,
+  success,
+  failure,
+  warn,
+  info,
+  spinner,
+  REPO_URL,
+  printCta
+};