@clawops/cli 1.7.1 → 1.7.2

package/dist/cli.js

@@ -2,16 +2,19 @@
 import {
   monitor_default,
   validateOpenclawConfig
-} from "./chunk-CG3Y7Y2R.js";
+} from "./chunk-FSUWPL7Q.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
-import "./chunk-ZFNPM2WG.js";
-import "./chunk-3MFZ7E74.js";
-import "./chunk-LCKD7L7X.js";
-import "./chunk-GJEF6UQA.js";
+import "./chunk-DQDAWNGB.js";
+import "./chunk-O3F7OGH7.js";
+import "./chunk-P5LKWRPL.js";
+import {
+  resolveSpecDir
+} from "./chunk-PVUVI35Y.js";
+import "./chunk-3XK66DKK.js";
 import {
   REPO_URL,
   chalk,
@@ -202,14 +205,16 @@ var up_default = defineCommand2({
     "instance-type": { type: "string", description: "Instance size alias (micro|small|medium|large|gpu)" },
     "dry-run": { type: "boolean", description: "Preview without applying" },
     "no-wait": { type: "boolean", description: "Return immediately without waiting for healthy state" },
-    "openclaw-version": { type: "string", description: "semver or 'stable'/'dev'" },
+    "openclaw-version": { type: "string", description: "OpenClaw release (e.g. 2026.7.1-2). Moving tags are resolved and range-checked" },
     stack: { type: "string", description: "Target stack name" },
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-MZAO4KHS.js");
     const ctx = buildContext(args);
-    const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
+    const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
+    const openclawVersion = await guardOpenclawVersion(requestedVersion);
     if (ctx.adapter.name === "local") {
       const stackConfig = ctx.config.stacks[ctx.stackName];
       if (!stackConfig?.localOpts) {
@@ -218,7 +223,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
+      const { localBootstrap } = await import("./bootstrap-HL4DNUNG.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -311,9 +316,9 @@ var up_default = defineCommand2({
   }
 });
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-E2AMBPZY.js");
+  const { connect } = await import("./ssh-CNJNLM3E.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-PFB66RPY.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -353,7 +358,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -417,7 +422,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -489,8 +494,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
-    const { generatePlan } = await import("./generate-SPT7PJKR.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { generatePlan } = await import("./generate-NIF6IBZC.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -579,8 +584,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-BTZFFGAD.js");
+    const { validatePlan } = await import("./validate-CFQ4FH2T.js");
+    const { applyPlan } = await import("./apply-PZ5IIU7Z.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -696,7 +701,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -763,8 +768,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -850,9 +855,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-JZGKPP6K.js");
+    const { acquireSession } = await import("./pool-QGFQRMGU.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -918,9 +923,9 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -994,7 +999,7 @@ function dockerRunCmd(image) {
   return [
     "docker stop openclaw 2>/dev/null || true",
     "docker rm   openclaw 2>/dev/null || true",
-    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG}:/app/config.json:ro ${image}`
+    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -e OPENCLAW_CONFIG_PATH=/app/config.json --add-host=host.docker.internal:host-gateway -v ${OPENCLAW_CONFIG}:/app/config.json:ro ${image}`
   ].join(" && ");
 }
 function getPath(obj, dotKey) {
@@ -1035,9 +1040,9 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1161,9 +1166,9 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const [action, name] = args._ ?? [];
     if (!action || !["list", "restart", "logs"].includes(action)) {
       failure("Usage: clawops agents <list | restart [name] | logs <name>>");
@@ -1252,7 +1257,7 @@ import { defineCommand as defineCommand13 } from "citty";
 import process15 from "process";
 var OPENCLAW_CONFIG2 = "/home/clawops/openclaw.json";
 function dockerRunCmd2(version) {
-  return `docker stop openclaw 2>/dev/null || true && docker rm   openclaw 2>/dev/null || true && docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG2}:/app/config.json:ro ghcr.io/openclaw/openclaw:${version}`;
+  return `docker stop openclaw 2>/dev/null || true && docker rm   openclaw 2>/dev/null || true && docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -e OPENCLAW_CONFIG_PATH=/app/config.json --add-host=host.docker.internal:host-gateway -v ${OPENCLAW_CONFIG2}:/app/config.json:ro ghcr.io/openclaw/openclaw:${version}`;
 }
 var gateway_default = defineCommand13({
   meta: {
@@ -1265,9 +1270,9 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
@@ -1378,8 +1383,8 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1551,7 +1556,7 @@ var stacks_default = defineCommand15({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-ALSJMTHE.js");
+        const { buildContext } = await import("./context-5LCUG2QR.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -1672,9 +1677,9 @@ var doctor_default = defineCommand16({
       info("Credential checks skipped \u2014 no config");
     } else {
       const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-D7Y6LCGK.js");
-      await import("./gcp-6FT2A45S.js");
-      await import("./azure-JQAMNVHN.js");
+      await import("./aws-L4RR2LSE.js");
+      await import("./gcp-UG6AWPIZ.js");
+      await import("./azure-7OXQENQL.js");
       await import("./local-DXBEVZ5C.js");
       const checkedProviders = /* @__PURE__ */ new Set();
       for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -1703,15 +1708,27 @@ var doctor_default = defineCommand16({
         warn("No stacks configured \u2014 run `clawops init`");
       }
     }
+    process18.stdout.write("\nOpenClaw\n");
+    try {
+      const yaml = await import("./js-yaml-PTEEG4FO.js");
+      const { loadVersionSpec, describeRange } = await import("./versions-OEPAS2EL.js");
+      const support = loadVersionSpec(yaml).support;
+      success(`Supported range  ${describeRange(support)}  (recommended ${support.recommended})`);
+      if (!support.max) {
+        warn("No upper bound declared \u2014 this line would accept any OpenClaw release");
+      }
+    } catch (e) {
+      failure(`Version matrix   ${e.message}`);
+    }
     if (args.stack) {
       process18.stdout.write("\nRemote health\n");
       if (!config) {
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-ALSJMTHE.js");
+          const { buildContext } = await import("./context-5LCUG2QR.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-          const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+          const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
           const ctx = buildContext({ stack: args.stack });
           const stack = await ctx.getStack();
           const outputMap = await stack.outputs();
@@ -1746,6 +1763,34 @@ var doctor_default = defineCommand16({
             } else {
               failure(`Container    ${containerStatus || "unknown"}`);
             }
+            const imageResult = await session.exec(
+              `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo ''`,
+              ac.signal
+            );
+            const image = imageResult.stdout.trim();
+            const deployedVersion = image.includes(":") ? image.slice(image.lastIndexOf(":") + 1) : "";
+            if (deployedVersion) {
+              const yaml = await import("./js-yaml-PTEEG4FO.js");
+              const { loadVersionSpec, checkVersion, isMovingTag } = await import("./versions-OEPAS2EL.js");
+              const support = loadVersionSpec(yaml).support;
+              if (isMovingTag(deployedVersion)) {
+                warn(
+                  `Deployed     ${image}  (moving tag \u2014 pin an explicit version; "${deployedVersion}" now resolves to OpenClaw 2.0)`
+                );
+              } else {
+                const check = checkVersion(deployedVersion, support);
+                if (check.ok) {
+                  success(`Deployed     OpenClaw ${deployedVersion}`);
+                } else {
+                  failure(`Deployed     OpenClaw ${deployedVersion} is not supported by this clawops line`);
+                  if (check.error.reason === "too-new") {
+                    warn(
+                      "  This gateway is running OpenClaw 2.0 or later. Session state may already have been lost: 2.0 stores sessions and credentials in SQLite under a directory this clawops line does not mount, so every container restart discards them. Upgrade to clawops 2.x before making changes."
+                    );
+                  }
+                }
+              }
+            }
             const healthResult = await session.exec(
               `docker inspect openclaw --format '{{.State.Health.Status}}' 2>/dev/null || echo 'none'`,
               ac.signal
@@ -1798,8 +1843,8 @@ var doctor_default = defineCommand16({
     if (args.stack && config) {
       process18.stdout.write("\nHardening\n");
       try {
-        const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-BDVYW567.js");
-        const { buildContext } = await import("./context-ALSJMTHE.js");
+        const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-URPXLSVF.js");
+        const { buildContext } = await import("./context-5LCUG2QR.js");
         const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
         const ctx = buildContext({ stack: args.stack });
         const stackObj = await ctx.getStack();
@@ -1862,7 +1907,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-RGLKKCCU.js");
+    const { serveMcp } = await import("./server-WM3AY4PJ.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1937,10 +1982,10 @@ var wireCmd = defineCommand17({
     force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
-    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-SLL4TLSC.js");
     const ac = new AbortController();
     process19.on("SIGINT", () => {
       ac.abort();
@@ -2027,7 +2072,6 @@ import { randomBytes } from "crypto";
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
 import { execSync, spawnSync, spawn as spawn2 } from "child_process";
 import path3 from "path";
-import { fileURLToPath } from "url";
 var setup_default = defineCommand18({
   meta: {
     name: "setup",
@@ -2220,10 +2264,14 @@ var setup_default = defineCommand18({
       const { baseUrl } = await inquirer.prompt([{
         type: "input",
         name: "baseUrl",
-        message: "Ollama address: (the URL where Ollama is running \u2014 usually http://localhost:11434)",
-        default: modelProvider.baseUrlDefault ?? "http://localhost:11434"
+        message: "Ollama address: (OpenClaw runs in a container, so use host.docker.internal rather than localhost to reach Ollama on the host)",
+        default: modelProvider.baseUrlDefault ?? "http://host.docker.internal:11434"
       }]);
-      modelConfig["baseUrl"] = baseUrl;
+      const rewritten = rewriteLocalhostForContainer(baseUrl);
+      if (rewritten !== baseUrl) {
+        info(`  Using ${rewritten} \u2014 inside the container, localhost is the container itself.`);
+      }
+      modelConfig["baseUrl"] = rewritten;
     }
     const builtModelConfig = {
       provider: modelProviderId,
@@ -2458,7 +2506,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-BTZFFGAD.js");
+        const { applyPlan } = await import("./apply-PZ5IIU7Z.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2487,9 +2535,9 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
-  const { connect } = await import("./ssh-E2AMBPZY.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
+  const { localBootstrap } = await import("./bootstrap-HL4DNUNG.js");
+  const { connect } = await import("./ssh-CNJNLM3E.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-PFB66RPY.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
   const existing = getConfig2();
@@ -2570,7 +2618,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-JZGKPP6K.js");
+  const { drainPool } = await import("./pool-QGFQRMGU.js");
   drainPool();
   const tokenPath = path3.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -2708,7 +2756,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-JZGKPP6K.js");
+  const { acquireSession } = await import("./pool-QGFQRMGU.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -2755,7 +2803,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-JZGKPP6K.js");
+  const { acquireSession } = await import("./pool-QGFQRMGU.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -2959,9 +3007,9 @@ async function maybeWireGatewayMcp(opts) {
   process20.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-E2AMBPZY.js");
+  const { connect } = await import("./ssh-CNJNLM3E.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-SLL4TLSC.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3005,7 +3053,7 @@ async function inquirerPromptWire(inquirer) {
   }]);
 }
 function loadCatalogs(yaml) {
-  const specDir = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "../../../spec");
+  const specDir = resolveSpecDir();
   try {
     const modelsRaw = yaml.load(readFileSync3(path3.join(specDir, "models.yaml"), "utf-8"));
     const integrationsRaw = yaml.load(readFileSync3(path3.join(specDir, "integrations.yaml"), "utf-8"));
@@ -3017,6 +3065,12 @@ function loadCatalogs(yaml) {
     throw new Error(`Cannot load wizard catalogs from spec/: ${err.message}`);
   }
 }
+function rewriteLocalhostForContainer(url) {
+  return url.replace(
+    /^(https?:\/\/)(localhost|127\.0\.0\.1|\[::1\])(?=[:/]|$)/i,
+    "$1host.docker.internal"
+  );
+}
 function defaultRegion(provider) {
   if (provider === "aws") return "us-east-1";
   if (provider === "gcp") return "us-central1";
@@ -3053,7 +3107,7 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-URPXLSVF.js");
   const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
   const config = getConfig2();
   if (!config) return;
@@ -3077,7 +3131,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process20.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3286,10 +3340,10 @@ var rotateCmd = defineCommand19({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-ALSJMTHE.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
+      const { buildContext } = await import("./context-5LCUG2QR.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-PFB66RPY.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
+      const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
       const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3473,7 +3527,7 @@ import { accessSync as accessSync2, constants as constants2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "1.7.1" : "dev";
+var VERSION = true ? "1.7.2" : "dev";
 async function collectContext() {
   const nodeVersion = process22.version;
   const os3 = `${process22.platform} ${process22.arch}`;
@@ -3590,8 +3644,8 @@ var harden_default = defineCommand22({
     json: { type: "boolean", description: "Emit structured JSON output" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
-    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-URPXLSVF.js");
+    const { buildContext } = await import("./context-5LCUG2QR.js");
     const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
     if (args.list) {
       process23.stdout.write("\nAvailable hardening modules:\n\n");

package/dist/{context-ALSJMTHE.js → context-5LCUG2QR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
+} from "./chunk-P5LKWRPL.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{gcp-6FT2A45S.js → gcp-UG6AWPIZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   makeStartupScript
-} from "./chunk-XKT42M34.js";
+} from "./chunk-C5X375RO.js";
 
 // src/providers/gcp/index.ts
 import process2 from "process";

package/dist/{generate-SPT7PJKR.js → generate-NIF6IBZC.js}

@@ -2,9 +2,10 @@
 import {
   generatePlan,
   planId
-} from "./chunk-FQ4JXUCR.js";
-import "./chunk-YTH4L2GN.js";
-import "./chunk-3MFZ7E74.js";
+} from "./chunk-SEABO2UU.js";
+import "./chunk-6X45DDGH.js";
+import "./chunk-P5LKWRPL.js";
+import "./chunk-PVUVI35Y.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{harden-BDVYW567.js → harden-URPXLSVF.js}

@@ -2,8 +2,8 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-LCKD7L7X.js";
-import "./chunk-GJEF6UQA.js";
+} from "./chunk-DQDAWNGB.js";
+import "./chunk-3XK66DKK.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/harden/types.ts

package/dist/{mcp-wire-ZWIYMLEW.js → mcp-wire-SLL4TLSC.js}

@@ -4,7 +4,7 @@ import {
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-ZFNPM2WG.js";
+} from "./chunk-O3F7OGH7.js";
 
 // src/cli/mcp-wire.ts
 var GATEWAY_MCP_MIN_VERSION = "2026.4";

package/dist/{package-OMPI6RMV.js → package-TZ2HYF5C.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.7.1";
+var version = "1.7.2";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -12,7 +12,8 @@ var exports = {
   ".": "./dist/index.js"
 };
 var files = [
-  "dist"
+  "dist",
+  "spec"
 ];
 var repository = {
   type: "git",

package/dist/{pool-JZGKPP6K.js → pool-QGFQRMGU.js}

@@ -2,8 +2,8 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-LCKD7L7X.js";
-import "./chunk-GJEF6UQA.js";
+} from "./chunk-DQDAWNGB.js";
+import "./chunk-3XK66DKK.js";
 import "./chunk-KGXPLI7W.js";
 export {
   acquireSession,

package/dist/{remote-config-QF5TT7GU.js → remote-config-PFB66RPY.js}

@@ -6,9 +6,10 @@ import {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
+  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
-} from "./chunk-ZFNPM2WG.js";
+} from "./chunk-O3F7OGH7.js";
 export {
   OPENCLAW_CONFIG,
   OPENCLAW_CONFIG_LINUX,
@@ -16,6 +17,7 @@ export {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
+  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
 };