@clawops/cli 1.7.8 → 2.0.0

package/dist/{chunk-QQNKBTYZ.js → chunk-AX74VXTV.js}

@@ -1,40 +1,42 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-35WVQY3X.js";
+} from "./chunk-UFRO4H5W.js";
+import {
+  atomicWriteConfig,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-N44K3LHE.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-RAAONHW3.js";
+} from "./chunk-WHJMKDV7.js";
 import {
   validatePlan
-} from "./chunk-6X45DDGH.js";
-import {
-  errText,
-  formatUptime,
-  gatherSnapshot,
-  handleConfigGet,
-  handleConfigSet,
-  handleConfigUnset,
-  handleConfigValidate,
-  okText,
-  resolveConn
-} from "./chunk-FNS56UQY.js";
+} from "./chunk-YR3O2I3S.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-DQDAWNGB.js";
-import {
-  IMAGE_INSPECT_CMD,
-  OPENCLAW_CONFIG,
-  gatewayRunCommand,
-  imageForRestart
-} from "./chunk-SEZMVVAS.js";
+} from "./chunk-3WYA2QDM.js";
 import {
   buildContext
-} from "./chunk-P5LKWRPL.js";
+} from "./chunk-LU2V3LXA.js";
+import {
+  formatUptime,
+  gatherSnapshot,
+  runDiagnostics
+} from "./chunk-GYV4KNW7.js";
+import {
+  GATEWAY_LOGS_PROBE,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+} from "./chunk-SBLQH2TJ.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
 import {
   getConfig,
   getConfigDir
@@ -43,6 +45,12 @@ import {
   StateError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
+import {
+  IMAGE_INSPECT_CMD,
+  STATE_DIR_HOST_LINUX,
+  gatewayRunCommand,
+  imageForRestart
+} from "./chunk-6TIYVHPX.js";
 
 // src/mcp/server.ts
 import { createServer } from "http";
@@ -141,6 +149,18 @@ var clawops_statusAnnotations = {
   openWorldHint: true,
   toolsets: ["cli", "read"]
 };
+var clawops_doctorSchema = z.object({
+  stackName: z.string().optional(),
+  failuresOnly: z.boolean().optional().default(false)
+});
+var clawops_doctorAnnotations = {
+  title: "Run Diagnostics",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
 var clawops_logs_tailSchema = z.object({
   stackName: z.string().optional(),
   tailLines: z.number().int().optional().default(100),
@@ -291,18 +311,6 @@ var clawops_config_validateAnnotations = {
   openWorldHint: true,
   toolsets: ["cli", "read"]
 };
-var clawops_agents_restartSchema = z.object({
-  stackName: z.string().optional(),
-  agentId: z.string()
-});
-var clawops_agents_restartAnnotations = {
-  title: "Restart OpenClaw Agent",
-  readOnlyHint: false,
-  destructiveHint: true,
-  idempotentHint: true,
-  openWorldHint: true,
-  toolsets: ["cli"]
-};
 var clawops_gateway_restartSchema = z.object({
   stackName: z.string().optional()
 });
@@ -353,6 +361,7 @@ var clawops_task_statusAnnotations = {
 var TOOLSETS = {
   cli: [
     "clawops_status",
+    "clawops_doctor",
     "clawops_logs_tail",
     "clawops_monitor",
     "clawops_config_get",
@@ -364,7 +373,6 @@ var TOOLSETS = {
     "clawops_config_set",
     "clawops_config_unset",
     "clawops_config_validate",
-    "clawops_agents_restart",
     "clawops_gateway_restart",
     "clawops_task_status"
   ],
@@ -374,6 +382,7 @@ var TOOLSETS = {
   ],
   read: [
     "clawops_status",
+    "clawops_doctor",
     "clawops_logs_tail",
     "clawops_monitor",
     "clawops_stacks_list",
@@ -421,32 +430,102 @@ function text(t) {
   return { content: [{ type: "text", text: t }] };
 }
 
-// src/mcp/tools/cli/logs.ts
+// src/mcp/tools/_conn.ts
+async function resolveConn(ctx) {
+  if (ctx.adapter.name === "local") {
+    const state = ctx.localState;
+    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
+    return {
+      host: state.sshHost,
+      port: state.sshPort,
+      user: state.sshUser,
+      privateKeyPath: state.privateKeyPath,
+      knownHostsPath: state.knownHostsPath
+    };
+  }
+  const { extractBaseOutputs: extractBaseOutputs2 } = await import("./outputs-DJHBY7EE.js");
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
+  }
+  const base = extractBaseOutputs2(outputs);
+  return ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
+function errText(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function okText(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+
+// src/mcp/tools/_trim.ts
+import { writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import path2 from "path";
 var MAX_BYTES = 8 * 1024;
+function trimForMcp(output, stackName) {
+  try {
+    const dir = path2.join(getConfigDir(), "state");
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync(path2.join(dir, `${stackName}.last-run.json`), JSON.stringify({ output }), "utf-8");
+  } catch {
+  }
+  if (Buffer.byteLength(output) <= MAX_BYTES) {
+    return { content: output, truncated: false };
+  }
+  const trimmed = output.slice(0, MAX_BYTES);
+  return {
+    content: trimmed + `
+
+[Output truncated at 8KB. Full output available at clawops://stacks/${stackName}/last-run]`,
+    truncated: true
+  };
+}
+
+// src/mcp/tools/cli/doctor.ts
+async function handleDoctor(input, _server) {
+  const ac = new AbortController();
+  const report = await runDiagnostics({ stack: input.stackName, signal: ac.signal });
+  const payload = input.failuresOnly ? failuresOnly(report) : report;
+  const { content } = trimForMcp(JSON.stringify(payload, null, 2), input.stackName ?? "local");
+  return okText(content);
+}
+function failuresOnly(report) {
+  const sections = report.sections.map((s) => ({ ...s, checks: s.checks.filter((c) => c.status === "fail" || c.status === "warn") })).filter((s) => s.checks.length > 0);
+  return { sections, ok: report.ok, counts: report.counts };
+}
+
+// src/mcp/tools/cli/logs.ts
+var MAX_BYTES2 = 8 * 1024;
 async function handleLogsTail(input, _server) {
   const ctx = buildContext({ stack: input.stackName });
   const conn = await resolveConn(ctx);
   const { session, release } = await acquireSession(conn);
   try {
     const tailLines = input.tailLines ?? 100;
-    const sinceFlag = input.sinceMin ? `--since "${input.sinceMin} min ago"` : "";
-    const command = [
-      "journalctl -u openclaw",
-      `-n ${tailLines}`,
-      sinceFlag,
-      "2>/dev/null",
-      "|| docker logs openclaw",
-      `-n ${tailLines}`
-    ].filter(Boolean).join(" ");
-    const result = await session.exec(command);
+    const since = input.sinceMin ? `${input.sinceMin}m` : void 0;
+    const probe = since ? { stdout: "" } : await execPrivileged(session, GATEWAY_LOGS_PROBE);
+    const choice = chooseLogSource({ since, gatewayReachable: probe.stdout.trim() === "ok" });
+    const opts = { tail: tailLines, follow: false, since, json: choice.source === "gateway" };
+    const command = choice.source === "gateway" ? gatewayLogsCommand(opts) : containerLogsCommand(opts);
+    const result = await execPrivileged(session, command);
     if (result.code !== 0 && !result.stdout) {
       return errText(`Failed to fetch logs: ${result.stderr}`);
     }
-    let output = result.stdout;
-    if (Buffer.byteLength(output) > MAX_BYTES) {
-      output = output.slice(0, MAX_BYTES) + "\n\n[output truncated at 8KB]";
+    let output = `[source: ${choice.source} \u2014 ${choice.reason}]
+${result.stdout}`;
+    if (Buffer.byteLength(output) > MAX_BYTES2) {
+      output = output.slice(0, MAX_BYTES2) + "\n\n[output truncated at 8KB]";
     }
-    return okText(output || "(no log output)");
+    return okText(result.stdout ? output : `[source: ${choice.source}]
+(no log output)`);
   } finally {
     release();
     drainPool();
@@ -469,42 +548,182 @@ async function handleStacksList(_input, _server) {
   return { content: [{ type: "text", text: JSON.stringify({ stacks }, null, 2) }] };
 }
 
-// src/mcp/tools/cli/agents.ts
-async function handleAgentsList(input, _server) {
+// src/mcp/tools/cli/config.ts
+async function handleConfigGet(input, _server) {
+  const ac = new AbortController();
   const ctx = buildContext({ stack: input.stackName });
   const conn = await resolveConn(ctx);
   const { session, release } = await acquireSession(conn);
   try {
-    const result = await session.exec('docker exec openclaw openclaw agents list --json 2>&1 || echo "[]"');
-    return okText(result.stdout.trim());
+    let cfg;
+    try {
+      cfg = await readRemoteConfig(session, ac.signal);
+    } catch (err) {
+      return errText(err.message);
+    }
+    const value = input.key ? getPath(cfg, input.key) : cfg;
+    return okText(JSON.stringify(value, null, 2));
   } finally {
     release();
     drainPool();
   }
 }
-async function handleAgentsRestart(input, server) {
+async function handleConfigSet(input, server) {
   const elicit = await server.server.elicitInput({
-    message: `Restart agent "${input.agentId}" on stack "${input.stackName ?? "default"}"?`,
+    message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
     requestedSchema: {
       type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm restart" } },
+      properties: { confirmed: { type: "boolean", title: "Confirm config change" } },
       required: ["confirmed"]
     }
   });
   if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Agent restart cancelled.");
+    return okText("Config change cancelled.");
   }
+  const ac = new AbortController();
   const ctx = buildContext({ stack: input.stackName });
   const conn = await resolveConn(ctx);
   const { session, release } = await acquireSession(conn);
   try {
-    const result = await session.exec(
-      `docker exec openclaw openclaw agents restart ${input.agentId} 2>&1`
-    );
+    let cfg;
+    try {
+      cfg = await readRemoteConfig(session, ac.signal);
+    } catch (err) {
+      return errText(err.message);
+    }
+    let parsedValue = input.value;
+    try {
+      parsedValue = JSON.parse(input.value);
+    } catch {
+    }
+    setPath(cfg, input.key, parsedValue);
+    try {
+      await atomicWriteConfig(session, cfg, ac.signal);
+    } catch (err) {
+      return errText(`Failed to write config: ${err.message}`);
+    }
+    let note = "";
+    if (input.restart) {
+      try {
+        await restartGateway(session, ac.signal);
+        note = " (gateway restarted)";
+      } catch (err) {
+        return errText(`Gateway restart failed: ${err.message}`);
+      }
+    }
+    return okText(`Config set: ${input.key}${note}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigUnset(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Remove config key "${input.key}" on stack "${input.stackName ?? "default"}"?`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm key removal" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Config unset cancelled.");
+  }
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    let cfg;
+    try {
+      cfg = await readRemoteConfig(session, ac.signal);
+    } catch (err) {
+      return errText(err.message);
+    }
+    deletePath(cfg, input.key);
+    try {
+      await atomicWriteConfig(session, cfg, ac.signal);
+    } catch (err) {
+      return errText(`Failed to write config: ${err.message}`);
+    }
+    let note = "";
+    if (input.restart) {
+      try {
+        await restartGateway(session, ac.signal);
+        note = " (gateway restarted)";
+      } catch (err) {
+        return errText(`Gateway restart failed: ${err.message}`);
+      }
+    }
+    return okText(`Config key removed: ${input.key}${note}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigValidate(input, _server) {
+  const ac = new AbortController();
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    let cfg;
+    try {
+      cfg = await readRemoteConfig(session, ac.signal);
+    } catch (err) {
+      return okText(JSON.stringify({ valid: false, issues: [err.message] }));
+    }
+    const { validateConfig } = await import("./config-validate-K2N6XLDX.js");
+    const yaml = await import("./js-yaml-PTEEG4FO.js");
+    const { loadVersionSpec } = await import("./versions-W5LRQCAJ.js");
+    const spec = loadVersionSpec(yaml);
+    const { errors, warnings } = await validateConfig(cfg, {
+      schemaCapturedFrom: spec.runtime?.configSchemaCapturedFrom
+    });
+    return okText(JSON.stringify({ valid: errors.length === 0, issues: errors, warnings }));
+  } finally {
+    release();
+    drainPool();
+  }
+}
+function getPath(obj, dotKey) {
+  return dotKey.split(".").reduce((cur, k) => {
+    if (cur !== null && typeof cur === "object") return cur[k];
+    return void 0;
+  }, obj);
+}
+function setPath(obj, dotKey, value) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
+    cur = cur[k];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+function deletePath(obj, dotKey) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) return;
+    cur = cur[k];
+  }
+  delete cur[keys[keys.length - 1]];
+}
+
+// src/mcp/tools/cli/agents.ts
+async function handleAgentsList(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await execPrivileged(session, "docker exec openclaw openclaw agents list --json");
     if (result.code !== 0) {
-      return errText(`Failed to restart agent: ${result.stderr || result.stdout}`);
+      return errText(`Cannot list agents: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
     }
-    return okText(`Agent "${input.agentId}" restarted.`);
+    return okText(result.stdout.trim() || "[]");
   } finally {
     release();
     drainPool();
@@ -528,11 +747,12 @@ async function handleGatewayRestart(input, server) {
   const conn = await resolveConn(ctx);
   const { session, release } = await acquireSession(conn);
   try {
-    const imgResult = await session.exec(IMAGE_INSPECT_CMD);
+    const imgResult = await execPrivileged(session, IMAGE_INSPECT_CMD);
     const image = imageForRestart(imgResult.stdout);
     if (!image.ok) return errText(image.error);
-    const result = await session.exec(
-      gatewayRunCommand({ image: image.value, configPath: OPENCLAW_CONFIG })
+    const result = await execPrivileged(
+      session,
+      gatewayRunCommand({ image: image.value, stateDir: STATE_DIR_HOST_LINUX })
     );
     if (result.code !== 0) {
       return errText(`Gateway restart failed: ${result.stderr}`);
@@ -578,29 +798,6 @@ function makeProgressEmitter(server, progressToken) {
   };
 }
 
-// src/mcp/tools/_trim.ts
-import { writeFileSync, mkdirSync as mkdirSync2 } from "fs";
-import path2 from "path";
-var MAX_BYTES2 = 8 * 1024;
-function trimForMcp(output, stackName) {
-  try {
-    const dir = path2.join(getConfigDir(), "state");
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync(path2.join(dir, `${stackName}.last-run.json`), JSON.stringify({ output }), "utf-8");
-  } catch {
-  }
-  if (Buffer.byteLength(output) <= MAX_BYTES2) {
-    return { content: output, truncated: false };
-  }
-  const trimmed = output.slice(0, MAX_BYTES2);
-  return {
-    content: trimmed + `
-
-[Output truncated at 8KB. Full output available at clawops://stacks/${stackName}/last-run]`,
-    truncated: true
-  };
-}
-
 // src/mcp/tools/cli/up.ts
 var VALID_INSTANCE_TYPES = ["micro", "small", "medium", "large", "gpu"];
 async function handleUp(input, server) {
@@ -627,7 +824,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-HL4DNUNG.js");
+    const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -850,7 +1047,7 @@ async function handleTaskStatus(input, _server) {
 
 // src/mcp/tools/cli/monitor.ts
 async function handleMonitor(input, _server) {
-  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-QGFQRMGU.js");
+  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-EX4ZTA5P.js");
   const ctx = buildContext({ stack: input.stackName });
   const tailLines = input.tailLines ?? 5;
   let conn;
@@ -1015,6 +1212,7 @@ function makeEntry(schema, annotations, handler) {
 }
 var TOOL_REGISTRY = {
   clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus),
+  clawops_doctor: makeEntry(clawops_doctorSchema, clawops_doctorAnnotations, handleDoctor),
   clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail),
   clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor),
   clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList),
@@ -1027,12 +1225,12 @@ var TOOL_REGISTRY = {
   clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet),
   clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset),
   clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate),
-  clawops_agents_restart: makeEntry(clawops_agents_restartSchema, clawops_agents_restartAnnotations, handleAgentsRestart),
   clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart),
   clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp),
   clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover),
   clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus)
 };
+var TOOL_NAMES = Object.keys(TOOL_REGISTRY);
 function resolveEnabledTools(opts) {
   let names;
   if (opts.readOnly) {
@@ -1258,7 +1456,7 @@ clawops_gateway_restart({ stackName: "${s}" })
 ### Agents not running
 \`\`\`
 clawops_agents_list({ stackName: "${s}" })
-clawops_agents_restart({ stackName: "${s}" })
+clawops_gateway_restart({ stackName: "${s}" })
 \`\`\`
 
 ### Bootstrap failed or incomplete
@@ -1325,7 +1523,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-QYZFN3FP.js");
+  const { version } = await import("./package-3HUW57XH.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);

package/dist/{chunk-C5X375RO.js → chunk-CKSPROD5.js}

@@ -1,8 +1,21 @@
 #!/usr/bin/env node
+import {
+  CONFIG_FILENAME,
+  CONTAINER_UID,
+  GATEWAY_PORT,
+  STATE_DIR_HOST_LINUX,
+  gatewayRunCommand
+} from "./chunk-6TIYVHPX.js";
 
 // src/providers/startup.ts
 function makeStartupScript(opts) {
-  const { openclawVersion, os, bedrockEnabled = false } = opts;
+  const {
+    openclawVersion,
+    os,
+    bedrockEnabled = false,
+    publishGateway = "loopback",
+    gatewayPort = GATEWAY_PORT
+  } = opts;
   const dockerDistro = os === "ubuntu" ? "ubuntu" : "debian";
   const bedrockEnvBlock = bedrockEnabled ? makeBedrockEnvBlock() : "";
   return `#!/bin/bash
@@ -53,27 +66,58 @@ if [ ! -s "\${OPENCLAW_ENV_FILE}" ]; then
   chown clawops:clawops "\${OPENCLAW_ENV_FILE}"
 fi
 
+# \u2500\u2500 State directory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# One directory holds config, the SQLite state and any plugins installed below.
+# Owned NUMERICALLY by the uid the container runs as: useradd clawops gets 1001 on
+# Ubuntu 24.04 (the ubuntu user already holds 1000), and a 1001-owned state dir makes the
+# gateway exit 1 with EACCES on its own SQLite WAL. There is no degraded mode.
+OPENCLAW_STATE_DIR=${STATE_DIR_HOST_LINUX}
+OPENCLAW_CONFIG="\${OPENCLAW_STATE_DIR}/${CONFIG_FILENAME}"
+mkdir -p "\${OPENCLAW_STATE_DIR}"
+
+# Migrate a pre-2.0 deployment: the config used to be a bare file in the service user's
+# home. Without this an in-place upgrade comes up with no configuration at all. Guarded on
+# the target being absent, so re-running provisioning never clobbers a later edit.
+OPENCLAW_LEGACY_CONFIG=/home/clawops/openclaw.json
+if [ -f "\${OPENCLAW_LEGACY_CONFIG}" ] && [ ! -f "\${OPENCLAW_CONFIG}" ]; then
+  cp -p "\${OPENCLAW_LEGACY_CONFIG}" "\${OPENCLAW_CONFIG}"
+  mv "\${OPENCLAW_LEGACY_CONFIG}" "\${OPENCLAW_LEGACY_CONFIG}.migrated"
+  echo "clawops: migrated config from \${OPENCLAW_LEGACY_CONFIG}"
+  OPENCLAW_MIGRATED=1
+fi
+
 # \u2500\u2500 Default config (apply.ts will overwrite with plan overlay) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
 if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
   cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
+{"meta":{"lastTouchedVersion":"2026.9"},"gateway":{"mode":"local","port":${gatewayPort},"auth":{"mode":"token"}},"models":{},"channels":{}}
 OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
+fi
+
+# Numeric, and last, so it covers the config and anything migrated above.
+chown -R ${CONTAINER_UID}:${CONTAINER_UID} "\${OPENCLAW_STATE_DIR}"
+
+# A 1.x config has no gateway.mode, and clawops no longer passes --allow-unconfigured \u2014
+# so a migrated deployment would exit 78 with "existing config is missing gateway.mode".
+# Normalised with OpenClaw's own tooling rather than by editing JSON in shell: it is
+# schema-aware, writes atomically, and applies OpenClaw's internal config migrations at the
+# same time. Runs after the chown so the container can write.
+if [ "\${OPENCLAW_MIGRATED:-0}" = "1" ]; then
+  docker run --rm -v "\${OPENCLAW_STATE_DIR}":/home/node/.openclaw \\
+    ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
+    openclaw config set gateway.mode local || \\
+    echo "clawops: WARNING could not set gateway.mode; gateway may refuse to start" >&2
 fi
 
 # \u2500\u2500 Start OpenClaw container \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p 18789:18789 \\
-  -e OPENCLAW_CONFIG_PATH=/app/config.json --add-host=host.docker.internal:host-gateway \\
-  --env-file "\${OPENCLAW_ENV_FILE}" \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-${bedrockEnvBlock}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured --port 18789
+# Built by src/openclaw/runtime.ts, so this cannot drift from the restart paths.
+${gatewayRunCommand({
+    image: "ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION}",
+    stateDir: '"${OPENCLAW_STATE_DIR}"',
+    envFilePath: '"${OPENCLAW_ENV_FILE}"',
+    extraArgs: bedrockEnvBlock.trim(),
+    publish: publishGateway,
+    port: gatewayPort
+  })}
 `;
 }
 function makeBedrockEnvBlock() {

package/dist/{chunk-UKTP332Z.js → chunk-GAZPPSKU.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
+import {
+  resolveSpecDir
+} from "./chunk-JW5A7E3X.js";
 import {
   err,
   ok
 } from "./chunk-EI7CQQ7D.js";
-import {
-  resolveSpecDir
-} from "./chunk-PVUVI35Y.js";
 
 // src/openclaw/versions.ts
 import { readFileSync } from "fs";
@@ -28,7 +28,8 @@ function loadVersionSpec(yaml) {
         min: raw.support.min,
         max: raw.support.max ?? "",
         recommended: raw.support.recommended ?? raw.support.min
-      }
+      },
+      ...raw.runtime ? { runtime: raw.runtime } : {}
     };
     return _spec;
   } catch (e) {
@@ -77,9 +78,7 @@ function checkVersion(version, support) {
       reason: "too-new",
       supportedRange: describeRange(support),
       message: `OpenClaw ${version} is newer than this clawops release supports (${describeRange(support)}).
-OpenClaw 2026.8.1+ changed the container runtime contract: state moved to SQLite, config moved to a writable path, and provider plugins became install-gated.
-Use clawops 2.x for OpenClaw 2026.9.1 and later:  npm install -g @clawops/cli@latest
-To stay on this line, pin an OpenClaw version at or below ${support.max}.`
+Pin an OpenClaw version at or below ${support.max}, or upgrade clawops.`
     });
   }
   return ok(version);