@clawops/cli 1.7.1 → 1.7.3

package/dist/{chunk-GJEF6UQA.js → chunk-3XK66DKK.js}

@@ -8,6 +8,98 @@ import { readFileSync, appendFileSync, mkdirSync } from "fs";
 import { createServer } from "net";
 import path from "path";
 import { Client } from "ssh2";
+
+// src/transport/known-hosts.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function hostEntryFor(host, port) {
+  return port === 22 ? host : `[${host}]:${port}`;
+}
+function parseKnownHosts(content) {
+  const entries = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    let parts = line.split(/\s+/);
+    let marker;
+    if (parts[0]?.startsWith("@")) {
+      marker = parts[0];
+      parts = parts.slice(1);
+    }
+    const hostField = parts[0];
+    if (!hostField) continue;
+    const hosts = hostField.split(",");
+    if (parts.length >= 3) {
+      entries.push({ hosts, keyType: parts[1], base64Key: parts[2], ...marker ? { marker } : {} });
+    } else if (parts.length === 2 && /^[0-9a-f]+$/i.test(parts[1] ?? "")) {
+      entries.push({ hosts, hexKey: parts[1], ...marker ? { marker } : {} });
+    }
+  }
+  return entries;
+}
+function hashedHostMatches(token, hostEntry) {
+  const parts = token.split("|");
+  if (parts.length !== 4 || parts[1] !== "1") return false;
+  const salt = parts[2];
+  const expected = parts[3];
+  if (!salt || !expected) return false;
+  try {
+    const actual = createHmac("sha1", Buffer.from(salt, "base64")).update(hostEntry).digest("base64");
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var isPattern = (host) => host.includes("*") || host.includes("?");
+function entryMatchesHost(entry, hostEntry) {
+  let matched = false;
+  for (const host of entry.hosts) {
+    if (host.startsWith("|1|")) {
+      if (hashedHostMatches(host, hostEntry)) matched = true;
+      continue;
+    }
+    const negated = host.startsWith("!");
+    const pattern = negated ? host.slice(1) : host;
+    const hit = isPattern(pattern) ? patternToRegExp(pattern).test(hostEntry) : pattern === hostEntry;
+    if (hit) {
+      if (negated) return false;
+      matched = true;
+    }
+  }
+  return matched;
+}
+function verifyAgainstKnownHosts(content, host, port, key) {
+  const hostEntry = hostEntryFor(host, port);
+  const base64Key = key.toString("base64");
+  const hexKey = key.toString("hex");
+  let sawHost = false;
+  for (const entry of parseKnownHosts(content)) {
+    if (!entryMatchesHost(entry, hostEntry)) continue;
+    if (entry.marker === "@cert-authority") continue;
+    sawHost = true;
+    const matches = entry.base64Key ? entry.base64Key === base64Key : entry.hexKey?.toLowerCase() === hexKey.toLowerCase();
+    if (matches) return entry.marker === "@revoked" ? "mismatch" : "match";
+  }
+  return sawHost ? "mismatch" : "unknown";
+}
+function formatKnownHostsLine(host, port, keyType, key) {
+  return `${hostEntryFor(host, port)} ${keyType} ${key.toString("base64")}
+`;
+}
+function keyTypeFromBlob(key) {
+  if (key.length < 4) return void 0;
+  const len = key.readUInt32BE(0);
+  if (len === 0 || len > 64 || key.length < 4 + len) return void 0;
+  const type = key.subarray(4, 4 + len).toString("utf-8");
+  return /^[\x20-\x7e]+$/.test(type) ? type : void 0;
+}
+
+// src/transport/ssh.ts
 var Ssh2Session = class {
   constructor(client) {
     this.client = client;
@@ -147,27 +239,19 @@ async function connect(opts) {
   });
 }
 function verifyHostKey(host, port, keyHash, knownHostsPath) {
-  const keyHex = keyHash.toString("hex");
-  const hostEntry = port === 22 ? host : `[${host}]:${port}`;
-  let existing = null;
+  let content = "";
   try {
-    const content = readFileSync(knownHostsPath, "utf-8");
-    for (const line of content.split("\n")) {
-      const parts = line.trim().split(/\s+/);
-      if (parts[0] === hostEntry && parts.length >= 2) {
-        existing = parts[1] ?? null;
-        break;
-      }
-    }
+    content = readFileSync(knownHostsPath, "utf-8");
   } catch {
   }
-  if (existing !== null) {
-    return existing === keyHex;
-  }
+  const verdict = verifyAgainstKnownHosts(content, host, port, keyHash);
+  if (verdict === "match") return true;
+  if (verdict === "mismatch") return false;
+  const keyType = keyTypeFromBlob(keyHash);
+  if (!keyType) return false;
   try {
     mkdirSync(path.dirname(knownHostsPath), { recursive: true });
-    appendFileSync(knownHostsPath, `${hostEntry} ${keyHex}
-`, "utf-8");
+    appendFileSync(knownHostsPath, formatKnownHostsLine(host, port, keyType, keyHash), "utf-8");
   } catch {
   }
   return true;

package/dist/{chunk-ISFHLA4G.js → chunk-5SPESD5N.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
-import {
-  validatePlan
-} from "./chunk-YTH4L2GN.js";
 import {
   saveOverlay
 } from "./chunk-6ZFIFDBJ.js";
 import {
   resolveSecrets
 } from "./chunk-BOPSG2LI.js";
+import {
+  validatePlan
+} from "./chunk-6X45DDGH.js";
 import {
   atomicWriteConfig,
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-ZFNPM2WG.js";
+} from "./chunk-O3F7OGH7.js";
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
+} from "./chunk-P5LKWRPL.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -35,6 +35,8 @@ ${validation.errors.join("\n")}`
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
+  const { guardOpenclawVersion } = await import("./version-guard-MZAO4KHS.js");
+  await guardOpenclawVersion(plan.spec.openclaw.version);
   const ctx = buildContext({
     stack: plan.spec.stackName,
     provider: plan.spec.provider
@@ -86,7 +88,7 @@ The diff you reviewed may no longer reflect what will be applied.
   };
 }
 async function applyConfigOverlay(plan, outputs, ctx, signal) {
-  const { connect } = await import("./ssh-E2AMBPZY.js");
+  const { connect } = await import("./ssh-CNJNLM3E.js");
   const connInfo = ctx.adapter.getConnectionInfo(outputs);
   const session = await connect({
     host: connInfo.host,

package/dist/{chunk-YTH4L2GN.js → chunk-6X45DDGH.js}

@@ -1,19 +1,20 @@
 #!/usr/bin/env node
+import {
+  resolveSpecDir
+} from "./chunk-PVUVI35Y.js";
 
 // src/plan/validate.ts
 import Ajv from "ajv/dist/2020";
 import addFormats from "ajv-formats";
 import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-import { join, dirname } from "path";
-var __dirname = dirname(fileURLToPath(import.meta.url));
+import { join } from "path";
 var _validate;
 function getValidator() {
   if (_validate) return _validate;
   const ajv = new Ajv({ strict: false });
   addFormats(ajv);
   const schema = JSON.parse(
-    readFileSync(join(__dirname, "../../spec/deploy-plan.schema.json"), "utf-8")
+    readFileSync(join(resolveSpecDir(), "deploy-plan.schema.json"), "utf-8")
   );
   _validate = ajv.compile(schema);
   return _validate;

package/dist/{chunk-XKT42M34.js → chunk-C5X375RO.js}

@@ -42,6 +42,17 @@ usermod -aG docker clawops
 OPENCLAW_VERSION="${openclawVersion}"
 docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
 
+# \u2500\u2500 Gateway auth token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# OpenClaw refuses a non-loopback bind without auth, and in a container it always
+# binds 0.0.0.0. Without a token the gateway exits 78 and restart-loops.
+OPENCLAW_ENV_FILE=/home/clawops/openclaw.env
+if [ ! -s "\${OPENCLAW_ENV_FILE}" ]; then
+  OPENCLAW_TOKEN=$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \\n')
+  printf 'OPENCLAW_GATEWAY_TOKEN=%s\\n' "\${OPENCLAW_TOKEN}" > "\${OPENCLAW_ENV_FILE}"
+  chmod 600 "\${OPENCLAW_ENV_FILE}"
+  chown clawops:clawops "\${OPENCLAW_ENV_FILE}"
+fi
+
 # \u2500\u2500 Default config (apply.ts will overwrite with plan overlay) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
@@ -58,9 +69,11 @@ docker run -d \\
   --name openclaw \\
   --restart unless-stopped \\
   -p 18789:18789 \\
+  -e OPENCLAW_CONFIG_PATH=/app/config.json --add-host=host.docker.internal:host-gateway \\
+  --env-file "\${OPENCLAW_ENV_FILE}" \\
   -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
 ${bedrockEnvBlock}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
+  node openclaw.mjs gateway run --allow-unconfigured --port 18789
 `;
 }
 function makeBedrockEnvBlock() {

package/dist/{chunk-LCKD7L7X.js → chunk-DQDAWNGB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-GJEF6UQA.js";
+} from "./chunk-3XK66DKK.js";
 import {
   NetworkError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-CG3Y7Y2R.js → chunk-FSUWPL7Q.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-DQDAWNGB.js";
 import {
   OPENCLAW_CONFIG,
   atomicWriteConfig,
   restartGateway
-} from "./chunk-ZFNPM2WG.js";
+} from "./chunk-O3F7OGH7.js";
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
-import {
-  acquireSession,
-  drainPool
-} from "./chunk-LCKD7L7X.js";
+} from "./chunk-P5LKWRPL.js";
 import {
   chalk,
   failure
@@ -131,7 +131,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
+  const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -358,8 +358,8 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-ALSJMTHE.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
+    const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
+    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-QGFQRMGU.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
     process.on("SIGTERM", () => ac.abort());

package/dist/{chunk-FQ4JXUCR.js → chunk-NESXDU5F.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-YTH4L2GN.js";
+} from "./chunk-6X45DDGH.js";
 import {
   buildContext
-} from "./chunk-3MFZ7E74.js";
+} from "./chunk-P5LKWRPL.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,10 +45,13 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-OMPI6RMV.js");
+  const { version } = await import("./package-QE7V2JAT.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
-  const openclawVersion = intent.openclawVersion ?? "latest";
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-MZAO4KHS.js");
+  const openclawVersion = await guardOpenclawVersion(
+    intent.openclawVersion ?? await defaultOpenclawVersion()
+  );
   const network = intent.network ?? {
     allowedSshCidrs: [],
     allowedGatewayCidrs: []

package/dist/{chunk-ZFNPM2WG.js → chunk-O3F7OGH7.js}

@@ -1,5 +1,13 @@
 #!/usr/bin/env node
 
+// src/openclaw/run-flags.ts
+var CONFIG_MOUNT_PATH = "/app/config.json";
+var GATEWAY_PORT = 18789;
+var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
+var PORT_PIN = `--port ${GATEWAY_PORT}`;
+var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
+
 // src/plan/remote-config.ts
 var OPENCLAW_CONFIG_LINUX = "/home/clawops/openclaw.json";
 var OPENCLAW_CONFIG_MACOS = "~/.config/openclaw/config.json";
@@ -30,6 +38,18 @@ async function readRemoteConfig(session, signal) {
     throw new Error(`Cannot parse ${configPath}: invalid JSON`);
   }
 }
+function normaliseGatewayPort(cfg) {
+  const gateway = cfg["gateway"];
+  if (!gateway || typeof gateway !== "object" || Array.isArray(gateway)) return void 0;
+  const g = gateway;
+  const current = g["port"];
+  if (typeof current === "number" && current !== GATEWAY_PORT) {
+    g["port"] = GATEWAY_PORT;
+    return current;
+  }
+  if (current === void 0) g["port"] = GATEWAY_PORT;
+  return void 0;
+}
 async function atomicWriteConfig(session, cfg, signal) {
   const os = await detectOS(session, signal);
   const configPath = configPathForOS(os);
@@ -50,25 +70,41 @@ async function restartGateway(session, signal) {
   const imgResult = os === "Darwin" ? await session.exec(imgCmd, signal) : await execWithFallbackSudo(session, imgCmd, signal);
   const image = imgResult.stdout.trim();
   const cfgResult = await session.exec(`cat ${configPath}`, signal);
-  let gatewayCmd = "node openclaw.mjs gateway run --allow-unconfigured";
+  let gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured ${PORT_PIN}`;
   try {
     const cfg = JSON.parse(cfgResult.stdout);
     const token = cfg?.["gateway"]?.["auth"];
     const tokenVal = token?.["token"];
     if (tokenVal) {
-      gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured --token '${tokenVal}'`;
+      gatewayCmd = `node openclaw.mjs gateway run --allow-unconfigured ${PORT_PIN} --token '${tokenVal}'`;
     }
   } catch {
   }
   const restartCmd = pathPrefix + [
     "docker stop openclaw 2>/dev/null || true",
     "docker rm openclaw 2>/dev/null || true",
-    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${configPath}:/app/config.json:ro ${image} ${gatewayCmd}`
+    `docker run -d --name openclaw --restart unless-stopped -p ${GATEWAY_PORT}:${GATEWAY_PORT} ${COMMON_RUN_FLAGS} -v ${configPath}:/app/config.json:ro ${image} ${gatewayCmd}`
   ].join(" && ");
   const result = os === "Darwin" ? await session.exec(restartCmd, signal) : await execWithFallbackSudo(session, restartCmd, signal);
   if (result.code !== 0) {
     throw new Error(`Gateway restart failed: ${result.stderr}`);
   }
+  const healthy = await waitForGateway(session, pathPrefix, signal);
+  if (!healthy) {
+    throw new Error(
+      `Gateway restarted but did not become healthy on port ${GATEWAY_PORT}. The previous container has already been replaced; inspect it with \`docker logs openclaw\`. If the newly-applied config is at fault, revert it and restart \u2014 before v1.7.2 this config was never applied, so a value that has sat unused may now be taking effect.`
+    );
+  }
+}
+async function waitForGateway(session, pathPrefix, signal, attempts = 15) {
+  const probe = `${pathPrefix}curl -fsS -m 3 http://127.0.0.1:${GATEWAY_PORT}/healthz >/dev/null 2>&1 && echo ok || echo waiting`;
+  for (let i = 0; i < attempts; i++) {
+    if (signal?.aborted) return false;
+    const r = await session.exec(probe, signal);
+    if (r.stdout.trim().endsWith("ok")) return true;
+    await new Promise((resolve) => setTimeout(resolve, 2e3));
+  }
+  return false;
 }
 function deepMerge(base, overlay) {
   const result = { ...base };
@@ -91,6 +127,7 @@ export {
   OPENCLAW_CONFIG,
   OPENCLAW_TMP,
   readRemoteConfig,
+  normaliseGatewayPort,
   atomicWriteConfig,
   restartGateway,
   deepMerge

package/dist/{chunk-3MFZ7E74.js → chunk-P5LKWRPL.js}

@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-6FT2A45S.js");
+        const mod = await import("./gcp-UG6AWPIZ.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-D7Y6LCGK.js");
+        const mod = await import("./aws-L4RR2LSE.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-JQAMNVHN.js");
+        const mod = await import("./azure-7OXQENQL.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/chunk-PVUVI35Y.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+
+// src/spec-path.ts
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join, parse } from "path";
+var MARKER = "openclaw-versions.yaml";
+var _cached;
+function resolveSpecDir(startUrl = import.meta.url) {
+  if (_cached) return _cached;
+  let dir = dirname(fileURLToPath(startUrl));
+  const { root } = parse(dir);
+  while (true) {
+    const candidate = join(dir, "spec");
+    if (existsSync(join(candidate, MARKER))) {
+      _cached = candidate;
+      return candidate;
+    }
+    if (dir === root) break;
+    dir = dirname(dir);
+  }
+  throw new Error(
+    `Cannot locate the spec/ directory (searched upward from ${dirname(fileURLToPath(startUrl))}). If this is an installed package, spec/ may be missing from the published files.`
+  );
+}
+
+export {
+  resolveSpecDir
+};