@clawops/cli 1.7.8 → 2.0.0

package/spec/openclaw-versions.yaml

@@ -1,37 +1,117 @@
 # OpenClaw Version Compatibility Matrix
 # Enforced by src/openclaw/versions.ts — `doctor`, `plan`, `up` and `apply` refuse
-# an OpenClaw version outside this range. Update via /openclaw-config skill.
+# an OpenClaw version outside `support`. Update via /openclaw-config skill.
 #
-# This is the clawops 1.x line: it supports the pre-2.0 OpenClaw runtime contract only.
-# OpenClaw 2026.8.1 ("OpenClaw 2.0") changed that contract — state moved into SQLite,
-# config moved to a writable path, and provider plugins became install-gated. Deploying
-# it from this line produces a crash-looping gateway (exit 78). Use clawops 2.x instead.
+# `support.min`, `support.max` and `support.recommended` are LIVE. Nothing reads
+# `runtime`, `quirks`, `incompatible` or `tested`; they are documentation and the
+# machine-readable source WO-38 will build the runtime contract from.
 
 version: 1
 
-# Minimum and maximum versions clawops supports
+# Which release line this checkout is. Flipping this to "2.x" is gated by a test
+# (tests/openclaw/line-interlock.test.ts) that fails until the runtime actually
+# implements the 2.0 contract — see `runtime` below.
+line: "2.x"
+
+# Minimum and maximum versions clawops supports.
+#
+# Flipped to the 2.x range by WO-40, once the runtime could actually honour it: the
+# config directory is mounted writable, provisioning writes gateway.mode, and
+# --allow-unconfigured is gone. tests/openclaw/line-interlock.test.ts holds those
+# together — setting `line: "2.x"` fails until each is true.
+#
+# The floor is 2026.9.2 rather than 2026.9.1 because the official Bedrock provider
+# plugin declares "requires plugin API >=2026.9.2" and refuses to install on 9.1.
 support:
-  min: "2026.4.5"
-  max: "2026.7.1-2"   # last release before the 2.0 runtime contract
-  recommended: "2026.7.1-2"
+  min: "2026.9.2"
+  max: ""              # no upper bound: this line tracks the 2.x runtime contract
+  recommended: "2026.9.2"
+
+# The 2.0 runtime contract, measured against ghcr.io/openclaw/openclaw:2026.9.1.
+# See docs/spikes/SP-10-openclaw-2.0-startup-contract.md for how each was observed.
+# WO-38 consumes this; today nothing reads it.
+runtime:
+  # 2026.9.2, not 2026.9.1: the official Bedrock provider plugin declares
+  # "requires plugin API >=2026.9.2" and refuses to install on 9.1. SP-10b §3.
+  targetMin: "2026.9.2"
+  image: "ghcr.io/openclaw/openclaw"
+  variants: [standard, slim, browser]   # `-slim`, `-browser` tag suffixes
+  # Mount the config DIRECTORY, never the file. OpenClaw writes config by atomic
+  # rename, and renaming over a bind-mounted file fails EBUSY regardless of :ro.
+  # Verified — `plugins install` cannot record a plugin against a file mount. SP-10b §4.
+  configDir: "/cfg"
+  configPath: "/cfg/config.json"        # via OPENCLAW_CONFIG_PATH
+  # The OpenClaw release spec/openclaw-2.0.config.schema.json was captured from.
+  # Validation compares the deployed version against this: a config key the schema
+  # does not know is an ERROR on an older-or-equal runtime and a WARNING on a newer
+  # one, because there it more likely means the schema is stale than the config wrong.
+  configSchemaCapturedFrom: "2026.9.2"
+  configMount: directory
+  gatewayPort: 18789
+  env:
+    configPath: OPENCLAW_CONFIG_PATH
+    token: OPENCLAW_GATEWAY_TOKEN
+    stateDir: OPENCLAW_STATE_DIR
+  startup:
+    # Verified: without gateway.mode the gateway exits 78 unless --allow-unconfigured
+    # is passed. Setting the mode is the supported answer; the flag exists to bypass a
+    # check for "suspicious or clobbered config", so clawops should not rely on it.
+    requiresGatewayMode: true
+    gatewayMode: "local"          # schema accepts local|remote
+    allowUnconfigured: false      # what 2.x should pass — i.e. do not pass it
+    exitCodeOnBlockedStart: 78
+  # Provider plugins are not all bundled. A configured-but-missing plugin is
+  # auto-installed from ClawHub on first boot, after which the gateway refuses to
+  # report ready and exits 1 ("startup convergence"); the next boot succeeds.
+  # The install lands in the container's writable layer, so it is lost — and refetched —
+  # on every container replacement, which is what clawops's restart path does.
+  plugins:
+    bundledSourceRoot: "/app/dist/extensions"
+    # Two different paths, and the difference matters. An explicit
+    # `openclaw plugins install` lands beside the config, so it persists with the
+    # config directory clawops already keeps as host state — no extra volume. The
+    # startup auto-install instead writes to the container's writable layer, which is
+    # lost on every container replacement. Pre-install; do not rely on auto-install.
+    installedPath: "<configDir>/extensions"
+    autoInstallPath: "/app/npm/projects"   # ephemeral — container layer
+    convergenceRestartRequired: true       # only when auto-installing at startup
+    # Reconcile configured providers against loaded plugins. `plugins doctor` is NOT
+    # usable for this: it never names a missing provider and exits 1 on duplicate-id
+    # warnings during normal operation. SP-10b §1-2.
+    verifyCommand: "openclaw plugins list --json"
+    verifyField: providerIds
+    providers:
+      amazon-bedrock:
+        bundled: false
+        package: "@openclaw/amazon-bedrock-provider"
+        install: "openclaw plugins install clawhub:@openclaw/amazon-bedrock-provider"
+        requiresEgress: true
+        # With no egress the gateway starts cleanly WITHOUT the provider — a healthy
+        # deployment missing the model backend it was configured for. clawops defaults
+        # to deny-all egress, so this is the default outcome, not an edge case.
+        silentlyAbsentWithoutEgress: true
+      ollama:    { bundled: true }
+      anthropic: { bundled: true }
+      openai:    { bundled: true }
 
-# Provider-specific quirks discovered through testing
 quirks:
-  - id: aws-bedrock-aws-profile
+  - id: openclaw-2-provider-plugin-install
     description: |
-      OpenClaw 2026.4.5+ ignores `auth: "aws-sdk"` in openclaw.json's Bedrock
-      provider config. Instead, AWS_PROFILE must be set in the systemd
-      EnvironmentFile so the AWS SDK resolves credentials via IMDS.
+      OpenClaw 2.0 does not bundle every model provider. A provider named in
+      models.providers whose plugin is missing is installed from ClawHub during
+      startup convergence; the gateway then exits 1 and requires one restart. With no
+      network egress the gateway starts successfully but without the provider.
     affected:
-      versions: ">=2026.4.5"
+      versions: ">=2026.8.1"
       providers: [aws]
       configs: [openclaw.models.providers.amazon-bedrock]
     workaround: |
-      AWS adapter MUST emit BOTH:
-      1. openclaw.json with `auth: "aws-sdk"` (for older versions, ignored by newer)
-      2. systemd EnvironmentFile with `AWS_PROFILE=default` (or the profile name)
-      Adapter should test the rendered systemd unit includes the EnvironmentFile.
-    discoveredFrom: aws-samples/sample-OpenClaw-on-AWS-with-Bedrock troubleshooting docs
+      Install the plugin at provisioning time, before the first gateway start:
+        openclaw plugins install clawhub:@openclaw/amazon-bedrock-provider
+      and/or persist /app/npm/projects so a container replacement does not refetch it.
+      Verify after deploy rather than trusting a healthy gateway: a missing provider
+      does not fail the health check.
+    discoveredFrom: docs/spikes/SP-10-openclaw-2.0-startup-contract.md
 
   - id: pnpm-pulumi-hoisting
     description: |
@@ -43,25 +123,34 @@ quirks:
       providers: ["*"]
     workaround: See docs/decisions/0003-pulumi-pnpm.md
 
-# Tested combinations — populated by CI matrix
+# Retired: `aws-bedrock-aws-profile` (AWS_PROFILE in the systemd EnvironmentFile).
+# It described a native/systemd install; clawops is Docker-only per ADR 0013, and on
+# 2.0 the Bedrock question is plugin installation, not credential resolution.
+
 tested:
   - openclawVersion: "2026.4.5"
     providers: [aws, gcp, local]
     nodeVersions: ["20.x", "22.x"]
     lastTestedAt: "2026-04-15"
+  - openclawVersion: "2026.9.1"
+    providers: []          # runtime contract characterised only; no deploy path yet
+    nodeVersions: ["24.x"]
+    lastTestedAt: "2026-09-06"
+    notes: "SP-10 — startup contract, plugin install behaviour, config schema capture."
 
-# Known incompatible combinations
 incompatible:
   - openclawVersionRange: "<2026.4.5"
     reason: "Below clawops's declared minimum support. Earlier OpenClaw versions used different config paths and channel registration semantics."
   - openclawVersionRange: ">=2026.8.1"
     reason: |
-      OpenClaw 2.0 changed the container runtime contract. Verified against 2026.8.1:
-        - No gateway token on first boot => "Refusing to bind gateway to auto without
-          auth", exit 78, crash-loop under --restart unless-stopped.
+      OpenClaw 2.0 changed the container runtime contract. Verified on 2026.8.1 and
+      re-verified on 2026.9.1:
+        - Without gateway.mode the gateway exits 78 unless --allow-unconfigured is
+          passed; clawops writes no mode.
         - Sessions, transcripts and credentials moved into SQLite under the state
           directory, which this line does not mount => total state loss on restart.
-        - Provider plugins (Bedrock included) are install-gated; a configured but
-          uninstalled provider prevents startup entirely.
+        - Provider plugins are not all bundled. A configured provider whose plugin is
+          missing is fetched at startup, costing a convergence restart — or is silently
+          absent when egress is denied, which is clawops's default.
       Use clawops 2.x, which targets OpenClaw >= 2026.9.1.
     useInstead: "@clawops/cli@2"

package/dist/chunk-35WVQY3X.js

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-import {
-  saveOverlay
-} from "./chunk-6ZFIFDBJ.js";
-import {
-  resolveSecrets
-} from "./chunk-BOPSG2LI.js";
-import {
-  validatePlan
-} from "./chunk-6X45DDGH.js";
-import {
-  atomicWriteConfig,
-  deepMerge,
-  readRemoteConfig,
-  restartGateway
-} from "./chunk-SEZMVVAS.js";
-import {
-  buildContext
-} from "./chunk-P5LKWRPL.js";
-import {
-  UsageError
-} from "./chunk-KGXPLI7W.js";
-
-// src/plan/apply.ts
-async function applyPlan(plan, opts) {
-  const validation = validatePlan(plan);
-  if (!validation.ok) {
-    throw new UsageError(
-      `Invalid deploy plan:
-${validation.errors.join("\n")}`
-    );
-  }
-  if (plan.spec.provider === "local") {
-    throw new UsageError(
-      "plan/apply is not supported for the local provider. Use `clawops up` directly."
-    );
-  }
-  const { guardOpenclawVersion } = await import("./version-guard-VUCNZXQS.js");
-  await guardOpenclawVersion(plan.spec.openclaw.version);
-  const ctx = buildContext({
-    stack: plan.spec.stackName,
-    provider: plan.spec.provider
-  });
-  const stack = await ctx.getStack();
-  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
-  if (plan.spec.region) {
-    await stack.setConfig("region", { value: plan.spec.region });
-  }
-  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
-  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
-  if (modelProvider === "bedrock") {
-    await stack.setConfig("bedrockEnabled", { value: "true" });
-  }
-  if (plan.metadata.stackVersion !== void 0) {
-    const currentInfo = await stack.info();
-    if (currentInfo !== void 0 && currentInfo.version !== plan.metadata.stackVersion) {
-      process.stderr.write(
-        `
-Warning: stack "${plan.spec.stackName}" has changed since this plan was generated (plan version: ${plan.metadata.stackVersion}, current: ${currentInfo.version}).
-The diff you reviewed may no longer reflect what will be applied.
-
-`
-      );
-      if (opts?.confirmDrift) {
-        await opts.confirmDrift();
-      }
-    }
-  }
-  const start = Date.now();
-  const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
-  const outputs = Object.fromEntries(
-    Object.entries(result.outputs).map(([k, v]) => [k, v.value])
-  );
-  const changeSummary = {};
-  if (result.summary.resourceChanges) {
-    for (const [op, count] of Object.entries(result.summary.resourceChanges)) {
-      changeSummary[op] = count;
-    }
-  }
-  const hasOverlay = plan.spec.openclaw.config !== void 0 || plan.spec.openclaw.channels !== void 0;
-  if (hasOverlay) {
-    await applyConfigOverlay(plan, outputs, ctx, opts?.signal);
-  }
-  return {
-    outputs,
-    changeSummary,
-    durationMs: Date.now() - start
-  };
-}
-async function applyConfigOverlay(plan, outputs, ctx, signal) {
-  const { connect } = await import("./ssh-CNJNLM3E.js");
-  const connInfo = ctx.adapter.getConnectionInfo(outputs);
-  const session = await connect({
-    host: connInfo.host,
-    port: connInfo.port,
-    user: connInfo.user,
-    privateKeyPath: connInfo.privateKeyPath,
-    knownHostsPath: connInfo.knownHostsPath,
-    signal
-  });
-  try {
-    const remote = await readRemoteConfig(session, signal);
-    const configOverlay = plan.spec.openclaw.config ?? {};
-    const resolvedOverlay = resolveSecrets(
-      configOverlay,
-      plan.spec.secrets ?? []
-    );
-    const merged = deepMerge(remote, {
-      ...resolvedOverlay,
-      ...plan.spec.openclaw.channels !== void 0 ? { channels: plan.spec.openclaw.channels } : {}
-    });
-    await atomicWriteConfig(session, merged, signal);
-    await restartGateway(session, signal);
-    saveOverlay(plan.spec.stackName, configOverlay, plan.spec.secrets ?? []);
-  } finally {
-    session.close();
-  }
-}
-
-export {
-  applyPlan
-};

package/dist/chunk-6X45DDGH.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-import {
-  resolveSpecDir
-} from "./chunk-PVUVI35Y.js";
-
-// src/plan/validate.ts
-import Ajv from "ajv/dist/2020";
-import addFormats from "ajv-formats";
-import { readFileSync } from "fs";
-import { join } from "path";
-var _validate;
-function getValidator() {
-  if (_validate) return _validate;
-  const ajv = new Ajv({ strict: false });
-  addFormats(ajv);
-  const schema = JSON.parse(
-    readFileSync(join(resolveSpecDir(), "deploy-plan.schema.json"), "utf-8")
-  );
-  _validate = ajv.compile(schema);
-  return _validate;
-}
-function validatePlan(plan) {
-  const validate = getValidator();
-  const ok = validate(plan);
-  if (ok) return { ok: true, errors: [] };
-  const errors = (validate.errors ?? []).map(
-    (e) => `${e.instancePath} ${e.message ?? ""}`.trim()
-  );
-  return { ok: false, errors };
-}
-function assertValidPlan(plan) {
-  const result = validatePlan(plan);
-  if (!result.ok) {
-    throw new Error(`Invalid deploy plan:
-${result.errors.join("\n")}`);
-  }
-}
-
-export {
-  validatePlan,
-  assertValidPlan
-};

package/dist/chunk-SEZMVVAS.js

@@ -1,156 +0,0 @@
-#!/usr/bin/env node
-import {
-  err,
-  ok
-} from "./chunk-EI7CQQ7D.js";
-
-// src/openclaw/run-flags.ts
-var CONFIG_MOUNT_PATH = "/app/config.json";
-var GATEWAY_PORT = 18789;
-var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
-var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
-var PORT_PIN = `--port ${GATEWAY_PORT}`;
-var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
-var ENV_FILE_PATH = "/home/clawops/openclaw.env";
-var IMAGE_INSPECT_CMD = `docker inspect openclaw --format '{{.Config.Image}}'`;
-function imageForRestart(inspectStdout) {
-  const image = inspectStdout.trim();
-  if (!image || image.includes("Error") || !image.includes(":")) {
-    return err(
-      "No running OpenClaw container found, so there is no image version to reuse. Deploy one with `clawops up --openclaw-version <version>`. clawops does not fall back to `latest` or `stable` here: both now point at OpenClaw 2.0, which this release line does not support."
-    );
-  }
-  return ok(image);
-}
-function versionOf(image) {
-  return image.split(":")[1] ?? "unknown";
-}
-function gatewayRunCommand(opts) {
-  const { image, configPath, envFilePath = ENV_FILE_PATH, pathPrefix = "" } = opts;
-  const envFileArg = `$([ -s ${envFilePath} ] && echo --env-file ${envFilePath})`;
-  return pathPrefix + [
-    "docker stop openclaw 2>/dev/null || true",
-    "docker rm   openclaw 2>/dev/null || true",
-    `docker run -d --name openclaw --restart unless-stopped -p ${GATEWAY_PORT}:${GATEWAY_PORT} ${COMMON_RUN_FLAGS} ${envFileArg} -v ${configPath}:${CONFIG_MOUNT_PATH}:ro ${image} node openclaw.mjs gateway run --allow-unconfigured ${PORT_PIN}`
-  ].join(" && ");
-}
-
-// src/plan/remote-config.ts
-var OPENCLAW_CONFIG_LINUX = "/home/clawops/openclaw.json";
-var OPENCLAW_CONFIG_MACOS = "~/.config/openclaw/config.json";
-var OPENCLAW_CONFIG = OPENCLAW_CONFIG_LINUX;
-var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
-async function detectOS(session, signal) {
-  const result = await session.exec("uname -s", signal);
-  return result.stdout.trim() === "Darwin" ? "Darwin" : "Linux";
-}
-function configPathForOS(os) {
-  return os === "Darwin" ? OPENCLAW_CONFIG_MACOS : OPENCLAW_CONFIG_LINUX;
-}
-async function execWithFallbackSudo(session, cmd, signal) {
-  const result = await session.exec(cmd, signal);
-  if (result.code === 0) return result;
-  return session.exec(`sudo -n bash -c "${cmd}"`, signal);
-}
-async function readRemoteConfig(session, signal) {
-  const os = await detectOS(session, signal);
-  const configPath = configPathForOS(os);
-  const result = os === "Darwin" ? await session.exec(`cat ${configPath}`, signal) : await execWithFallbackSudo(session, `cat ${configPath}`, signal);
-  if (result.code !== 0) {
-    throw new Error(`Cannot read ${configPath}: ${result.stderr}`);
-  }
-  try {
-    return JSON.parse(result.stdout);
-  } catch {
-    throw new Error(`Cannot parse ${configPath}: invalid JSON`);
-  }
-}
-function normaliseGatewayPort(cfg) {
-  const gateway = cfg["gateway"];
-  if (!gateway || typeof gateway !== "object" || Array.isArray(gateway)) return void 0;
-  const g = gateway;
-  const current = g["port"];
-  if (typeof current === "number" && current !== GATEWAY_PORT) {
-    g["port"] = GATEWAY_PORT;
-    return current;
-  }
-  if (current === void 0) g["port"] = GATEWAY_PORT;
-  return void 0;
-}
-async function atomicWriteConfig(session, cfg, signal) {
-  const os = await detectOS(session, signal);
-  const configPath = configPathForOS(os);
-  const json = JSON.stringify(cfg, null, 2);
-  const b64 = Buffer.from(json, "utf-8").toString("base64");
-  const chown = os === "Linux" ? ` && chown clawops:clawops ${configPath}` : "";
-  const cmd = `echo '${b64}' | base64 -d > ${OPENCLAW_TMP} && mv ${OPENCLAW_TMP} ${configPath}` + chown;
-  const result = os === "Darwin" ? await session.exec(cmd, signal) : await execWithFallbackSudo(session, cmd, signal);
-  if (result.code !== 0) {
-    throw new Error(`Failed to write config: ${result.stderr}`);
-  }
-}
-async function restartGateway(session, signal) {
-  const os = await detectOS(session, signal);
-  const configPath = configPathForOS(os);
-  const pathPrefix = os === "Darwin" ? 'export PATH="/usr/local/bin:/opt/homebrew/bin:/Applications/Docker.app/Contents/Resources/bin:$PATH" && ' : "";
-  const imgCmd = `${pathPrefix}${IMAGE_INSPECT_CMD}`;
-  const imgResult = os === "Darwin" ? await session.exec(imgCmd, signal) : await execWithFallbackSudo(session, imgCmd, signal);
-  const resolved = imageForRestart(imgResult.stdout);
-  if (!resolved.ok) throw new Error(resolved.error);
-  const image = resolved.value;
-  const restartCmd = gatewayRunCommand({
-    image,
-    configPath,
-    pathPrefix
-  });
-  const result = os === "Darwin" ? await session.exec(restartCmd, signal) : await execWithFallbackSudo(session, restartCmd, signal);
-  if (result.code !== 0) {
-    throw new Error(`Gateway restart failed: ${result.stderr}`);
-  }
-  const healthy = await waitForGateway(session, pathPrefix, signal);
-  if (!healthy) {
-    throw new Error(
-      `Gateway restarted but did not become healthy on port ${GATEWAY_PORT}. The previous container has already been replaced; inspect it with \`docker logs openclaw\`. If the newly-applied config is at fault, revert it and restart \u2014 before v1.7.2 this config was never applied, so a value that has sat unused may now be taking effect.`
-    );
-  }
-}
-async function waitForGateway(session, pathPrefix, signal, attempts = 15) {
-  const probe = `${pathPrefix}curl -fsS -m 3 http://127.0.0.1:${GATEWAY_PORT}/healthz >/dev/null 2>&1 && echo ok || echo waiting`;
-  for (let i = 0; i < attempts; i++) {
-    if (signal?.aborted) return false;
-    const r = await session.exec(probe, signal);
-    if (r.stdout.trim().endsWith("ok")) return true;
-    await new Promise((resolve) => setTimeout(resolve, 2e3));
-  }
-  return false;
-}
-function deepMerge(base, overlay) {
-  const result = { ...base };
-  for (const [key, val] of Object.entries(overlay)) {
-    if (val !== null && typeof val === "object" && !Array.isArray(val) && typeof result[key] === "object" && result[key] !== null && !Array.isArray(result[key])) {
-      result[key] = deepMerge(
-        result[key],
-        val
-      );
-    } else {
-      result[key] = val;
-    }
-  }
-  return result;
-}
-
-export {
-  IMAGE_INSPECT_CMD,
-  imageForRestart,
-  versionOf,
-  gatewayRunCommand,
-  OPENCLAW_CONFIG_LINUX,
-  OPENCLAW_CONFIG_MACOS,
-  OPENCLAW_CONFIG,
-  OPENCLAW_TMP,
-  readRemoteConfig,
-  normaliseGatewayPort,
-  atomicWriteConfig,
-  restartGateway,
-  deepMerge
-};

package/dist/validate-CFQ4FH2T.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-import {
-  assertValidPlan,
-  validatePlan
-} from "./chunk-6X45DDGH.js";
-import "./chunk-PVUVI35Y.js";
-export {
-  assertValidPlan,
-  validatePlan
-};