@clawops/cli 1.7.0 → 1.7.2

package/dist/{chunk-XKT42M34.js → chunk-C5X375RO.js}

@@ -42,6 +42,17 @@ usermod -aG docker clawops
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 
+# \u2500\u2500 Gateway auth token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# OpenClaw refuses a non-loopback bind without auth, and in a container it always
+# binds 0.0.0.0. Without a token the gateway exits 78 and restart-loops.
+OPENCLAW_ENV_FILE=/home/clawops/openclaw.env
+if [ ! -s "\${OPENCLAW_ENV_FILE}" ]; then
+  OPENCLAW_TOKEN=$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \\n')
+  printf 'OPENCLAW_GATEWAY_TOKEN=%s\\n' "\${OPENCLAW_TOKEN}" > "\${OPENCLAW_ENV_FILE}"
+  chmod 600 "\${OPENCLAW_ENV_FILE}"
+  chown clawops:clawops "\${OPENCLAW_ENV_FILE}"
+fi
+
 # \u2500\u2500 Default config (apply.ts will overwrite with plan overlay) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
@@ -58,9 +69,11 @@ docker run -d \\
   --name openclaw \\
   --restart unless-stopped \\
   -p 18789:18789 \\
+  -e OPENCLAW_CONFIG_PATH=/app/config.json --add-host=host.docker.internal:host-gateway \\
+  --env-file "\${OPENCLAW_ENV_FILE}" \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
 ${bedrockEnvBlock}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
+  node openclaw.mjs gateway run --allow-unconfigured --port 18789
 `;
 }
 function makeBedrockEnvBlock() {

package/dist/{chunk-LCKD7L7X.js → chunk-DQDAWNGB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-GJEF6UQA.js";
+} from "./chunk-3XK66DKK.js";
 import {
   NetworkError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-CG3Y7Y2R.js → chunk-FSUWPL7Q.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-DQDAWNGB.js";
 import {
   OPENCLAW_CONFIG,
   atomicWriteConfig,
   restartGateway
-} from "./chunk-ZFNPM2WG.js";
+} from "./chunk-O3F7OGH7.js";
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
-import {
-  acquireSession,
-  drainPool
-} from "./chunk-LCKD7L7X.js";
+} from "./chunk-P5LKWRPL.js";
 import {
   chalk,
   failure
@@ -131,7 +131,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
+  const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -358,8 +358,8 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
+    const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
+    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-QGFQRMGU.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
     process.on("SIGTERM", () => ac.abort());

package/dist/{chunk-ZFNPM2WG.js → chunk-O3F7OGH7.js}

@@ -1,5 +1,13 @@
 #!/usr/bin/env node
 
+// src/openclaw/run-flags.ts
+var CONFIG_MOUNT_PATH = "/app/config.json";
+var GATEWAY_PORT = 18789;
+var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
+var PORT_PIN = `--port ${GATEWAY_PORT}`;
+var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
+
 // src/plan/remote-config.ts
 var OPENCLAW_CONFIG_LINUX = "/home/clawops/openclaw.json";
 var OPENCLAW_CONFIG_MACOS = "~/.config/openclaw/config.json";
@@ -30,6 +38,18 @@ async function readRemoteConfig(session, signal) {
     throw new Error(`Cannot parse ${configPath}: invalid JSON`);
   }
 }
+function normaliseGatewayPort(cfg) {
+  const gateway = cfg["gateway"];
+  if (!gateway || typeof gateway !== "object" || Array.isArray(gateway)) return void 0;
+  const g = gateway;
+  const current = g["port"];
+  if (typeof current === "number" && current !== GATEWAY_PORT) {
+    g["port"] = GATEWAY_PORT;
+    return current;
+  }
+  if (current === void 0) g["port"] = GATEWAY_PORT;
+  return void 0;
+}
 async function atomicWriteConfig(session, cfg, signal) {
   const os = await detectOS(session, signal);
   const configPath = configPathForOS(os);
@@ -50,25 +70,41 @@ async function restartGateway(session, signal) {
   const imgResult = os === "Darwin" ? await session.exec(imgCmd, signal) : await execWithFallbackSudo(session, imgCmd, signal);
   const image = imgResult.stdout.trim();
   const cfgResult = await session.exec(`cat ${configPath}`, signal);
-  let gatewayCmd = "node openclaw.mjs gateway run --allow-unconfigured";
+  let gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured ${PORT_PIN}`;
   try {
     const cfg = JSON.parse(cfgResult.stdout);
     const token = cfg?.["gateway"]?.["auth"];
     const tokenVal = token?.["token"];
     if (tokenVal) {
-      gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured --token '${tokenVal}'`;
+      gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured ${PORT_PIN} --token '${tokenVal}'`;
     }
   } catch {
   }
   const restartCmd = pathPrefix + [
     "docker stop openclaw 2>/dev/null || true",
     "docker rm openclaw 2>/dev/null || true",
-    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${configPath}:/app/config.json:ro ${image} ${gatewayCmd}`
+    `docker run -d --name openclaw --restart unless-stopped -p ${GATEWAY_PORT}:${GATEWAY_PORT} ${COMMON_RUN_FLAGS} -v ${configPath}:/app/config.json:ro ${image} ${gatewayCmd}`
   ].join(" && ");
   const result = os === "Darwin" ? await session.exec(restartCmd, signal) : await execWithFallbackSudo(session, restartCmd, signal);
   if (result.code !== 0) {
     throw new Error(`Gateway restart failed: ${result.stderr}`);
   }
+  const healthy = await waitForGateway(session, pathPrefix, signal);
+  if (!healthy) {
+    throw new Error(
+      `Gateway restarted but did not become healthy on port ${GATEWAY_PORT}. The previous container has already been replaced; inspect it with \`docker logs openclaw\`. If the newly-applied config is at fault, revert it and restart \u2014 before v1.7.2 this config was never applied, so a value that has sat unused may now be taking effect.`
+    );
+  }
+}
+async function waitForGateway(session, pathPrefix, signal, attempts = 15) {
+  const probe = `${pathPrefix}curl -fsS -m 3 http://127.0.0.1:${GATEWAY_PORT}/healthz >/dev/null 2>&1 && echo ok || echo waiting`;
+  for (let i = 0; i < attempts; i++) {
+    if (signal?.aborted) return false;
+    const r = await session.exec(probe, signal);
+    if (r.stdout.trim().endsWith("ok")) return true;
+    await new Promise((resolve) => setTimeout(resolve, 2e3));
+  }
+  return false;
 }
 function deepMerge(base, overlay) {
   const result = { ...base };
@@ -91,6 +127,7 @@ export {
   OPENCLAW_CONFIG,
   OPENCLAW_TMP,
   readRemoteConfig,
+  normaliseGatewayPort,
   atomicWriteConfig,
   restartGateway,
   deepMerge

package/dist/{chunk-3MFZ7E74.js → chunk-P5LKWRPL.js}

@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-6FT2A45S.js");
+        const mod = await import("./gcp-UG6AWPIZ.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-D7Y6LCGK.js");
+        const mod = await import("./aws-L4RR2LSE.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-JQAMNVHN.js");
+        const mod = await import("./azure-7OXQENQL.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/chunk-PVUVI35Y.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+
+// src/spec-path.ts
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join, parse } from "path";
+var MARKER = "openclaw-versions.yaml";
+var _cached;
+function resolveSpecDir(startUrl = import.meta.url) {
+  if (_cached) return _cached;
+  let dir = dirname(fileURLToPath(startUrl));
+  const { root } = parse(dir);
+  while (true) {
+    const candidate = join(dir, "spec");
+    if (existsSync(join(candidate, MARKER))) {
+      _cached = candidate;
+      return candidate;
+    }
+    if (dir === root) break;
+    dir = dirname(dir);
+  }
+  throw new Error(
+    `Cannot locate the spec/ directory (searched upward from ${dirname(fileURLToPath(startUrl))}). If this is an installed package, spec/ may be missing from the published files.`
+  );
+}
+
+export {
+  resolveSpecDir
+};

package/dist/{chunk-7KLLWDBA.js → chunk-SEABO2UU.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-YTH4L2GN.js";
+} from "./chunk-6X45DDGH.js";
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
+} from "./chunk-P5LKWRPL.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,10 +45,13 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-7WOZMHSO.js");
+  const { version } = await import("./package-TZ2HYF5C.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
-  const openclawVersion = intent.openclawVersion ?? "latest";
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-MZAO4KHS.js");
+  const openclawVersion = await guardOpenclawVersion(
+    intent.openclawVersion ?? await defaultOpenclawVersion()
+  );
   const network = intent.network ?? {
     allowedSshCidrs: [],
     allowedGatewayCidrs: []