@clawops/cli 1.7.0 → 1.7.1

package/README.md

@@ -12,6 +12,68 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.7.0
+
+**`clawops harden`** — run an idempotent set of server-hardening modules against a deployed
+stack over SSH. Each module has a read-only `check()` and an `apply()` step; `check()` runs first
+and `apply()` is skipped when the box is already compliant. Sentinel files under
+`/etc/clawops/hardening/` record what has been applied.
+
+```bash
+clawops harden --list                          # show available modules
+clawops harden --stack prod --dry-run          # preview changes, apply nothing
+clawops harden --stack prod                     # apply the default module set
+clawops harden --stack prod --options ssh,ufw   # apply a specific subset
+```
+
+**Common modules (all providers), ON by default:** `ssh` (hardens `sshd_config`, guards against
+lockout by verifying `authorized_keys` is non-empty before restarting sshd), `ufw` (deny-all
+incoming, allow SSH + gateway 18789), `fail2ban` (SSH jail: 5 failures → 10-minute ban),
+`unattended-upgrades` (security-only auto updates), and `docker-socket` (verify
+`/var/run/docker.sock` is `root:docker 660`). **Opt-in:** `auditd`, `lynis` (CIS Level 1 scan →
+`~/.clawops/reports/`), `sysctl`.
+
+**AWS modules (check-only, ON by default):** `aws-sg-audit` (warns on `0.0.0.0/0` ingress on
+unexpected ports) and `aws-ssm-check` (verifies `AmazonSSMManagedInstanceCore` for emergency SSM
+shell access). **Opt-in:** `aws-flow-logs`, `aws-guardduty`.
+
+`clawops setup` now presents a multi-select hardening step after deploy (skippable with
+`--no-harden`), and `clawops doctor --stack <name>` gains a Hardening section showing which
+modules are applied, missing, or drifted.
+
+---
+
+## What's new in v1.6.0
+
+**`clawops bug`** — open a pre-filled GitHub issue with system context (version, Node, OS,
+provider, stack count, SSH key presence) populated automatically. `--json` emits the URL without
+prompting or opening a browser, suitable for scripting. `clawops doctor` now prints a `clawops bug`
+hint in its footer when it exits with an error.
+
+```bash
+clawops bug              # open a pre-filled issue in the browser
+clawops bug --json       # print the issue URL for scripting
+```
+
+**Cloud deploy bug fixes (AWS, GCP, Azure).** This release fixes 10 bugs found in a deploy audit,
+several deploy-blocking:
+
+- **Azure:** updated deprecated image reference `UbuntuServer/22.04-LTS` →
+  `0001-com-ubuntu-server-jammy/22_04-lts-gen2` — every Azure deployment was broken; and fixed a
+  malformed Key Vault `roleDefinitionId` that broke Key Vault RBAC entirely.
+- **AWS:** Bedrock startup script now uses the IMDSv2 PUT→GET token flow (a plain `curl` to IMDS
+  returned 401, so the region always fell back to `us-east-1`); replaced
+  `AmazonBedrockFullAccess` with a least-privilege inline policy.
+- **AWS (⚠️ migration impact):** migrated from inline Security Group ingress/egress arrays to
+  individual `SecurityGroupIngressRule`/`SecurityGroupEgressRule` resources so CIDR changes no
+  longer replace the whole Security Group. **Existing AWS stacks have their Security Group
+  replaced on the first `clawops up` after this upgrade** — see
+  `docs/decisions/0009-aws-sg-rule-resources.md` for the import-based mitigation.
+- **All providers:** `accessMode=auto` egress-IP detection now returns a `Result` and throws a
+  clear error on failure instead of silently producing a VM with zero ingress rules.
+
+---
+
 ## What's new in v1.5.0
 
 **`clawops mcp wire`** — wire the OpenClaw gateway's own AI as an MCP client of clawops.

package/dist/{chunk-7KLLWDBA.js → chunk-FQ4JXUCR.js}

@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-7WOZMHSO.js");
+  const { version } = await import("./package-OMPI6RMV.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/cli.js

@@ -490,7 +490,7 @@ var plan_default = defineCommand5({
   },
   async run({ args }) {
     const { buildContext } = await import("./context-ALSJMTHE.js");
-    const { generatePlan } = await import("./generate-ZTD4BVVI.js");
+    const { generatePlan } = await import("./generate-SPT7PJKR.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -1862,7 +1862,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-EXBOOIEP.js");
+    const { serveMcp } = await import("./server-RGLKKCCU.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -3473,7 +3473,7 @@ import { accessSync as accessSync2, constants as constants2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "1.7.0" : "dev";
+var VERSION = true ? "1.7.1" : "dev";
 async function collectContext() {
   const nodeVersion = process22.version;
   const os3 = `${process22.platform} ${process22.arch}`;

package/dist/{generate-ZTD4BVVI.js → generate-SPT7PJKR.js}

@@ -2,7 +2,7 @@
 import {
   generatePlan,
   planId
-} from "./chunk-7KLLWDBA.js";
+} from "./chunk-FQ4JXUCR.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-3MFZ7E74.js";
 import "./chunk-A2I76FTA.js";

package/dist/{package-7WOZMHSO.js → package-OMPI6RMV.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.7.0";
+var version = "1.7.1";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {

package/dist/{server-EXBOOIEP.js → server-RGLKKCCU.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-7KLLWDBA.js";
+} from "./chunk-FQ4JXUCR.js";
 import {
   applyPlan
 } from "./chunk-ISFHLA4G.js";
@@ -1306,7 +1306,7 @@ If none of the above resolves the issue:
 
 // src/mcp/server.ts
 async function serveMcp(opts) {
-  const { version } = await import("./package-7WOZMHSO.js");
+  const { version } = await import("./package-OMPI6RMV.js");
   const server = new McpServer({ name: "clawops", version });
   registerTools(server, opts);
   registerResources(server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {