@clawops/cli 1.7.8 → 2.0.0

package/dist/{chunk-FNS56UQY.js → chunk-GYV4KNW7.js}

@@ -1,28 +1,26 @@
 #!/usr/bin/env node
 import {
-  acquireSession,
-  drainPool
-} from "./chunk-DQDAWNGB.js";
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
 import {
-  OPENCLAW_CONFIG,
-  atomicWriteConfig,
-  restartGateway
-} from "./chunk-SEZMVVAS.js";
-import {
-  buildContext
-} from "./chunk-P5LKWRPL.js";
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
 import {
   chalk,
   failure
 } from "./chunk-Q7NQY5HV.js";
 import {
-  StateError
-} from "./chunk-KGXPLI7W.js";
+  GATEWAY_PORT,
+  PUBLISH_INSPECT_CMD,
+  STATE_DIR_HOST_LINUX,
+  configPathForOS,
+  publishForRestart
+} from "./chunk-6TIYVHPX.js";
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
 import process from "process";
-var GATEWAY_PORT = 18789;
 function formatUptime(startedAt) {
   if (!startedAt) return "\u2014";
   const ms = Date.now() - new Date(startedAt).getTime();
@@ -38,27 +36,29 @@ function formatUptime(startedAt) {
 async function gatherSnapshot(session, signal, tailLines = 10) {
   const DOCKER = "PATH=/usr/local/bin:/opt/homebrew/bin:$PATH docker";
   const [inspectRaw, statsRaw, healthRaw, configRaw, diskRaw, logsRaw] = await Promise.all([
-    session.exec(
+    execPrivileged(
+      session,
       `${DOCKER} inspect openclaw --format '{{.State.Status}}|{{.Config.Image}}|{{.State.StartedAt}}|{{.RestartCount}}' 2>/dev/null || echo 'not found|||0'`,
       signal
     ),
-    session.exec(
+    execPrivileged(
+      session,
       `${DOCKER} stats openclaw --no-stream --format '{{.MemUsage}}|{{.CPUPerc}}' 2>/dev/null || echo '\u2014|\u2014'`,
       signal
     ),
+    session.exec(probeCommand("live", GATEWAY_PORT), signal),
     session.exec(
-      `curl -sf --connect-timeout 2 http://localhost:${GATEWAY_PORT}/health >/dev/null 2>&1 && echo ok || echo unreachable`,
+      `cat ${configPathForOS("Linux")} 2>/dev/null || echo '{}'`,
       signal
     ),
     session.exec(
-      `cat /home/clawops/openclaw.json 2>/dev/null || echo '{}'`,
+      // The state directory, not the service user's home: 2.0 keeps the SQLite database
+      // there, so that is the filesystem that fills up.
+      `df -h ${STATE_DIR_HOST_LINUX} 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
       signal
     ),
-    session.exec(
-      `df -h /home/clawops 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
-      signal
-    ),
-    session.exec(
+    execPrivileged(
+      session,
       `${DOCKER} logs openclaw -n ${tailLines} 2>&1 || echo '(no logs)'`,
       signal
     )
@@ -82,7 +82,9 @@ async function gatherSnapshot(session, signal, tailLines = 10) {
   return {
     container: { status, image, startedAt, restartCount, memUsage, cpuPct },
     gateway: {
-      reachable: healthRaw.stdout.trim() === "ok",
+      // Judged on the payload: a status code cannot distinguish a healthy gateway from
+      // a path that fell through to the Control UI. See src/openclaw/health.ts.
+      reachable: interpretProbe("live", healthRaw.stdout).ok,
       version,
       authMode
     },
@@ -131,7 +133,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
+  const { buildContext } = await import("./context-KHKWJJMC.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -144,7 +146,7 @@ async function probeEntries() {
         deployed: false
       };
       try {
-        const ctx = buildContext2({ stack: name });
+        const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           return { ...base, deployed: !!ctx.localState };
         }
@@ -358,13 +360,13 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-5LCUG2QR.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-QGFQRMGU.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
     process.on("SIGTERM", () => ac.abort());
     if (args.stack) {
-      const ctx = buildContext2(args);
+      const ctx = buildContext(args);
       let conn;
       if (ctx.adapter.name === "local") {
         if (!ctx.localState) {
@@ -392,7 +394,7 @@ var monitor_default = defineCommand({
         });
       }
       if (!isTTY) {
-        const { session: session2, release: release2 } = await acquireSession2({ ...conn, signal: ac.signal });
+        const { session: session2, release: release2 } = await acquireSession({ ...conn, signal: ac.signal });
         try {
           const snap = await gatherSnapshot(session2, ac.signal, tailLines);
           process.stdout.write(
@@ -400,11 +402,11 @@ var monitor_default = defineCommand({
           );
         } finally {
           release2();
-          drainPool2();
+          drainPool();
         }
         return;
       }
-      const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
+      const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
       process.stdin.setRawMode(true);
       process.stdin.resume();
       process.stdin.setEncoding("utf8");
@@ -421,7 +423,7 @@ var monitor_default = defineCommand({
         process.stdin.pause();
         process.stdout.write("\x1B[?25h\n");
         release();
-        drainPool2();
+        drainPool();
       }
       return;
     }
@@ -442,7 +444,7 @@ var monitor_default = defineCommand({
           keyHandler = fn;
         }, noColor);
         if (!stackName || ac.signal.aborted) break;
-        const ctx = buildContext2({ stack: stackName });
+        const ctx = buildContext({ stack: stackName });
         let conn = null;
         if (ctx.adapter.name === "local") {
           if (!ctx.localState) continue;
@@ -468,7 +470,7 @@ var monitor_default = defineCommand({
           }
         }
         if (!conn) continue;
-        const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
+        const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
         try {
           const result = await runDashboard(session, stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
             keyHandler = fn;
@@ -476,7 +478,7 @@ var monitor_default = defineCommand({
           if (result === "quit") break;
         } finally {
           release();
-          drainPool2();
+          drainPool();
         }
       }
     } finally {
@@ -487,254 +489,319 @@ var monitor_default = defineCommand({
   }
 });
 
-// src/mcp/tools/_conn.ts
-async function resolveConn(ctx) {
-  if (ctx.adapter.name === "local") {
-    const state = ctx.localState;
-    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
-    return {
-      host: state.sshHost,
-      port: state.sshPort,
-      user: state.sshUser,
-      privateKeyPath: state.privateKeyPath,
-      knownHostsPath: state.knownHostsPath
-    };
-  }
-  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-  const stack = await ctx.getStack();
-  const outputMap = await stack.outputs();
-  const outputs = Object.fromEntries(
-    Object.entries(outputMap).map(([k, v]) => [k, v.value])
-  );
-  if (!outputs["publicIp"]) {
-    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
-  }
-  const base = extractBaseOutputs(outputs);
-  return ctx.adapter.getConnectionInfo({
-    ...base,
-    privateKeyPath: ctx.config.ssh.keyPath,
-    knownHostsPath: ctx.config.ssh.knownHostsPath
-  });
-}
-function errText(message) {
-  return { content: [{ type: "text", text: message }], isError: true };
-}
-function okText(t) {
-  return { content: [{ type: "text", text: t }] };
-}
-
-// src/mcp/tools/cli/config.ts
-var VALID_AUTH_MODES = /* @__PURE__ */ new Set(["none", "token", "password", "trusted-proxy"]);
-async function handleConfigGet(input, _server) {
-  const ac = new AbortController();
-  const ctx = buildContext({ stack: input.stackName });
-  const conn = await resolveConn(ctx);
-  const { session, release } = await acquireSession(conn);
-  try {
-    const result = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
-    let cfg;
-    try {
-      cfg = JSON.parse(result.stdout);
-    } catch {
-      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${result.stderr || result.stdout}`);
-    }
-    const value = input.key ? getPath(cfg, input.key) : cfg;
-    return okText(JSON.stringify(value, null, 2));
-  } finally {
-    release();
-    drainPool();
-  }
-}
-async function handleConfigSet(input, server) {
-  const elicit = await server.server.elicitInput({
-    message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm config change" } },
-      required: ["confirmed"]
-    }
+// src/diagnostics/index.ts
+import process2 from "process";
+import { accessSync, mkdirSync, constants } from "fs";
+import path from "path";
+async function runDiagnostics(opts = {}, deps = {}) {
+  const { getConfig, getConfigDir } = await import("./store-SDUR52Z5.js");
+  const config = getConfig();
+  const sections = [];
+  sections.push({ title: "Runtime", checks: runtimeChecks(getConfigDir()) });
+  sections.push({
+    title: "Config",
+    checks: [
+      config ? { name: "Config file", status: "pass", detail: path.join(getConfigDir(), "config.json") } : { name: "Config file", status: "warn", detail: "not found", remedy: "run `clawops init`" }
+    ]
   });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Config change cancelled.");
-  }
-  const ac = new AbortController();
-  const ctx = buildContext({ stack: input.stackName });
-  const conn = await resolveConn(ctx);
-  const { session, release } = await acquireSession(conn);
-  try {
-    const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
-    let cfg;
-    try {
-      cfg = JSON.parse(readResult.stdout);
-    } catch {
-      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr}`);
-    }
-    let parsedValue = input.value;
+  sections.push({ title: "SSH", checks: sshChecks(config) });
+  sections.push({ title: "Credentials", checks: await credentialChecks(config) });
+  sections.push({ title: "OpenClaw", checks: await versionChecks() });
+  if (opts.stack) {
+    const open = deps.openSession ?? defaultOpenSession;
+    let handle;
     try {
-      parsedValue = JSON.parse(input.value);
-    } catch {
-    }
-    setPath(cfg, input.key, parsedValue);
-    try {
-      await atomicWriteConfig(session, cfg, ac.signal);
+      handle = await open(opts.stack, opts.signal);
     } catch (err) {
-      return errText(`Failed to write config: ${err.message}`);
+      sections.push({
+        title: "Remote health",
+        checks: [{ name: "Connection", status: "fail", detail: messageOf(err) }]
+      });
     }
-    let note = "";
-    if (input.restart) {
+    if (handle) {
       try {
-        await restartGateway(session, ac.signal);
-        note = " (gateway restarted)";
-      } catch (err) {
-        return errText(`Gateway restart failed: ${err.message}`);
+        sections.push({
+          title: "Remote health",
+          checks: await remoteChecks(handle.session, opts.signal)
+        });
+        sections.push({
+          title: "Hardening",
+          checks: await hardeningChecks(handle.conn, opts.stack, opts.signal)
+        });
+      } finally {
+        handle.release();
+        const { drainPool } = await import("./pool-EX4ZTA5P.js");
+        drainPool();
       }
     }
-    return okText(`Config set: ${input.key}${note}`);
-  } finally {
-    release();
-    drainPool();
   }
+  return summarise(sections);
+}
+function summarise(sections) {
+  const counts = { pass: 0, fail: 0, warn: 0, info: 0 };
+  for (const s of sections) for (const c of s.checks) counts[c.status]++;
+  return { sections, ok: counts.fail === 0, counts };
 }
-async function handleConfigUnset(input, server) {
-  const elicit = await server.server.elicitInput({
-    message: `Remove config key "${input.key}" on stack "${input.stackName ?? "default"}"?`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm key removal" } },
-      required: ["confirmed"]
+function runtimeChecks(configDir) {
+  const checks = [];
+  const nodeMajor = parseInt(process2.version.slice(1).split(".")[0] ?? "0", 10);
+  checks.push(
+    nodeMajor >= 22 ? { name: "Node.js", status: "pass", detail: process2.version } : {
+      name: "Node.js",
+      status: "fail",
+      detail: `${process2.version} (requires >=22)`,
+      remedy: "install Node.js 22 or later"
     }
-  });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Config unset cancelled.");
+  );
+  const pulumiHome = path.join(configDir, ".pulumi");
+  try {
+    mkdirSync(pulumiHome, { recursive: true });
+    checks.push({ name: "Pulumi home", status: "pass", detail: pulumiHome });
+  } catch {
+    checks.push({ name: "Pulumi home", status: "fail", detail: `${pulumiHome} (not writable)` });
+  }
+  return checks;
+}
+function expandHome(p) {
+  return p.replace(/^~/, process2.env["HOME"] ?? "~");
+}
+function sshChecks(config) {
+  if (!config) return [{ name: "SSH", status: "info", detail: "skipped \u2014 no config" }];
+  const checks = [];
+  const keyPath = expandHome(config.ssh.keyPath);
+  try {
+    accessSync(keyPath, constants.R_OK);
+    checks.push({ name: "SSH key", status: "pass", detail: keyPath });
+  } catch {
+    checks.push({
+      name: "SSH key",
+      status: "fail",
+      detail: `${keyPath} (not found or not readable)`
+    });
   }
-  const ac = new AbortController();
-  const ctx = buildContext({ stack: input.stackName });
-  const conn = await resolveConn(ctx);
-  const { session, release } = await acquireSession(conn);
+  const knownHostsPath = expandHome(config.ssh.knownHostsPath);
   try {
-    const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
-    let cfg;
-    try {
-      cfg = JSON.parse(readResult.stdout);
-    } catch {
-      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr}`);
+    accessSync(knownHostsPath, constants.F_OK);
+    checks.push({ name: "known_hosts", status: "pass", detail: knownHostsPath });
+  } catch {
+    checks.push({
+      name: "known_hosts",
+      status: "warn",
+      detail: `${knownHostsPath} (does not exist \u2014 will be created on first connect)`
+    });
+  }
+  return checks;
+}
+async function credentialChecks(config) {
+  if (!config) return [{ name: "Credentials", status: "info", detail: "skipped \u2014 no config" }];
+  const { getProvider } = await import("./providers-2OABPW2E.js");
+  await Promise.all([
+    import("./aws-AMON7DA7.js"),
+    import("./gcp-2JBTD7ZM.js"),
+    import("./azure-T4G6OBJQ.js"),
+    import("./local-DXBEVZ5C.js")
+  ]);
+  const checks = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
+    const providerName = stackCfg.provider;
+    if (seen.has(providerName)) continue;
+    seen.add(providerName);
+    if (providerName === "local") {
+      checks.push({
+        name: providerName,
+        status: "pass",
+        detail: `stack "${stackName}" (SSH-only, no cloud credentials required)`
+      });
+      continue;
     }
-    deletePath(cfg, input.key);
     try {
-      await atomicWriteConfig(session, cfg, ac.signal);
-    } catch (err) {
-      return errText(`Failed to write config: ${err.message}`);
-    }
-    let note = "";
-    if (input.restart) {
-      try {
-        await restartGateway(session, ac.signal);
-        note = " (gateway restarted)";
-      } catch (err) {
-        return errText(`Gateway restart failed: ${err.message}`);
+      const adapter = getProvider(providerName);
+      const result = await adapter.validateConfig();
+      if (result.ok) {
+        checks.push({ name: providerName, status: "pass", detail: `stack "${stackName}"` });
+      } else {
+        for (const err of result.errors) {
+          checks.push({ name: providerName, status: "fail", detail: `stack "${stackName}" \u2014 ${err}` });
+        }
       }
+    } catch (err) {
+      checks.push({
+        name: providerName,
+        status: "fail",
+        detail: `stack "${stackName}" \u2014 ${messageOf(err)}`
+      });
     }
-    return okText(`Config key removed: ${input.key}${note}`);
-  } finally {
-    release();
-    drainPool();
   }
+  if (seen.size === 0) {
+    checks.push({ name: "Stacks", status: "warn", detail: "none configured", remedy: "run `clawops init`" });
+  }
+  return checks;
 }
-async function handleConfigValidate(input, _server) {
-  const ac = new AbortController();
-  const ctx = buildContext({ stack: input.stackName });
-  const conn = await resolveConn(ctx);
-  const { session, release } = await acquireSession(conn);
+async function versionChecks() {
   try {
-    const result = await session.exec(`cat ${OPENCLAW_CONFIG}`, ac.signal);
-    let cfg;
-    try {
-      cfg = JSON.parse(result.stdout);
-    } catch {
-      return okText(JSON.stringify({ valid: false, issues: [`Invalid JSON: ${result.stderr || result.stdout}`] }));
+    const yaml = await import("./js-yaml-PTEEG4FO.js");
+    const { loadVersionSpec, describeRange } = await import("./versions-W5LRQCAJ.js");
+    const support = loadVersionSpec(yaml).support;
+    const checks = [
+      {
+        name: "Supported range",
+        status: "pass",
+        detail: `${describeRange(support)} (recommended ${support.recommended})`
+      }
+    ];
+    if (!support.max) {
+      checks.push({
+        name: "Upper bound",
+        status: "warn",
+        detail: "none declared \u2014 this line would accept any OpenClaw release"
+      });
     }
-    const issues = validateOpenclawConfig(cfg);
-    return okText(JSON.stringify({ valid: issues.length === 0, issues }));
-  } finally {
-    release();
-    drainPool();
+    return checks;
+  } catch (e) {
+    return [{ name: "Version matrix", status: "fail", detail: messageOf(e) }];
   }
 }
-function getPath(obj, dotKey) {
-  return dotKey.split(".").reduce((cur, k) => {
-    if (cur !== null && typeof cur === "object") return cur[k];
-    return void 0;
-  }, obj);
-}
-function setPath(obj, dotKey, value) {
-  const keys = dotKey.split(".");
-  let cur = obj;
-  for (let i = 0; i < keys.length - 1; i++) {
-    const k = keys[i];
-    if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
-    cur = cur[k];
+async function remoteChecks(session, signal) {
+  const checks = [];
+  const containerResult = await execPrivileged(
+    session,
+    `docker inspect openclaw --format '{{.State.Status}}' 2>/dev/null || echo 'not found'`,
+    signal
+  );
+  const containerStatus = containerResult.stdout.trim();
+  checks.push(
+    containerStatus === "running" ? { name: "Container", status: "pass", detail: "running" } : { name: "Container", status: "fail", detail: containerStatus || "unknown" }
+  );
+  const imageResult = await execPrivileged(
+    session,
+    `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo ''`,
+    signal
+  );
+  const image = imageResult.stdout.trim();
+  const deployedVersion = image.includes(":") ? image.slice(image.lastIndexOf(":") + 1) : "";
+  if (deployedVersion) {
+    checks.push(await deployedVersionCheck(image, deployedVersion));
   }
-  cur[keys[keys.length - 1]] = value;
-}
-function deletePath(obj, dotKey) {
-  const keys = dotKey.split(".");
-  let cur = obj;
-  for (let i = 0; i < keys.length - 1; i++) {
-    const k = keys[i];
-    if (typeof cur[k] !== "object" || cur[k] === null) return;
-    cur = cur[k];
+  const probe = await session.exec(probeCommand("started", GATEWAY_PORT), signal);
+  const verdict = interpretProbe("started", probe.stdout);
+  checks.push(
+    verdict.ok ? { name: "Gateway", status: "pass", detail: `answering on 127.0.0.1:${GATEWAY_PORT}` } : { name: "Gateway", status: "fail", detail: verdict.reason ?? "not answering" }
+  );
+  const pubResult = await execPrivileged(session, PUBLISH_INSPECT_CMD, signal);
+  checks.push(
+    publishForRestart(pubResult.stdout) === "all" ? {
+      name: "Published",
+      status: "warn",
+      detail: "0.0.0.0 \u2014 the gateway port is open on every interface, serving plaintext HTTP",
+      remedy: 'front it with TLS, or set network.publishGateway to "loopback" and use `clawops tunnel`'
+    } : { name: "Published", status: "pass", detail: "127.0.0.1 only (reach it with `clawops tunnel`)" }
+  );
+  const diskResult = await session.exec(
+    // The state directory: 2.0's SQLite lives there, not in the user's home.
+    `df -h ${STATE_DIR_HOST_LINUX} 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
+    signal
+  );
+  const diskUsage = diskResult.stdout.trim();
+  if (diskUsage) {
+    const pct = parseInt(diskUsage.match(/^(\d+)%/)?.[1] ?? "0", 10);
+    checks.push({
+      name: "Disk",
+      status: pct >= 90 ? "fail" : pct >= 75 ? "warn" : "pass",
+      detail: diskUsage
+    });
+  } else {
+    checks.push({ name: "Disk", status: "warn", detail: "unable to determine disk usage" });
   }
-  delete cur[keys[keys.length - 1]];
+  const logrotateResult = await session.exec(
+    `test -f /etc/logrotate.d/openclaw && echo 'configured' || echo 'not configured'`,
+    signal
+  );
+  checks.push(
+    logrotateResult.stdout.trim() === "configured" ? { name: "Log rotation", status: "pass", detail: "configured" } : { name: "Log rotation", status: "warn", detail: "not configured \u2014 logs may grow unbounded" }
+  );
+  return checks;
 }
-function validateOpenclawConfig(cfg) {
-  const issues = [];
-  if ("version" in cfg) {
-    issues.push(
-      "Top-level 'version' is not a valid OpenClaw config key. Use 'meta.lastTouchedVersion' (string) instead."
-    );
-  }
-  if ("channels" in cfg && Array.isArray(cfg["channels"])) {
-    issues.push(
-      `'channels' must be an object keyed by provider name (e.g. {"discord":{...}}), not an array.`
-    );
-  }
-  const meta = cfg["meta"];
-  if (meta !== void 0 && (typeof meta !== "object" || Array.isArray(meta) || meta === null)) {
-    issues.push("'meta' must be an object.");
-  } else if (meta && typeof meta === "object") {
-    const ltv = meta["lastTouchedVersion"];
-    if (ltv !== void 0 && typeof ltv !== "string") {
-      issues.push("'meta.lastTouchedVersion' must be a string.");
-    }
+async function deployedVersionCheck(image, deployedVersion) {
+  const yaml = await import("./js-yaml-PTEEG4FO.js");
+  const { loadVersionSpec, checkVersion, isMovingTag } = await import("./versions-W5LRQCAJ.js");
+  const support = loadVersionSpec(yaml).support;
+  if (isMovingTag(deployedVersion)) {
+    return {
+      name: "Deployed",
+      status: "warn",
+      detail: `${image} (moving tag)`,
+      remedy: "pin an explicit version \u2014 a moving tag resolves to whatever is newest"
+    };
   }
-  const gateway = cfg["gateway"];
-  if (gateway !== void 0 && typeof gateway === "object" && !Array.isArray(gateway) && gateway !== null) {
-    const gw = gateway;
-    if ("port" in gw && typeof gw["port"] !== "number") {
-      issues.push("'gateway.port' must be a number.");
-    }
-    const auth = gw["auth"];
-    if (auth !== void 0 && typeof auth === "object" && !Array.isArray(auth) && auth !== null) {
-      const mode = auth["mode"];
-      if (mode !== void 0 && !VALID_AUTH_MODES.has(mode)) {
-        issues.push(
-          `'gateway.auth.mode' must be one of: ${[...VALID_AUTH_MODES].join(", ")}. Got: "${mode}".`
-        );
+  const check = checkVersion(deployedVersion, support);
+  if (check.ok) return { name: "Deployed", status: "pass", detail: `OpenClaw ${deployedVersion}` };
+  return {
+    name: "Deployed",
+    status: "fail",
+    detail: `OpenClaw ${deployedVersion} is not supported by this clawops line`,
+    remedy: check.error.reason === "too-old" ? "this clawops line requires OpenClaw 2.0 or later \u2014 run `clawops migrate` to move an existing 1.x deployment across, which preserves its state and device identity" : "upgrade clawops, or pin an OpenClaw version this line supports"
+  };
+}
+async function hardeningChecks(conn, stack, signal) {
+  try {
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-PCDK3UQ5.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const provider = buildContext({ stack }).adapter.name;
+    const modules = resolveModules(MODULE_CATALOG, void 0, provider);
+    const checks = [];
+    await withRemoteExec(conn, signal, async (exec) => {
+      for (const mod of modules) {
+        const result = await mod.check(exec);
+        if (result.status === "applied") {
+          checks.push({ name: mod.label, status: "pass", detail: "applied" });
+        } else if (result.status === "drifted") {
+          checks.push({ name: mod.label, status: "warn", detail: `drifted \u2014 ${result.detail}` });
+        } else if (result.status === "missing") {
+          checks.push({ name: mod.label, status: "info", detail: "not applied", remedy: "run `clawops harden`" });
+        }
       }
-    }
+    });
+    return checks;
+  } catch (err) {
+    return [{ name: "Hardening checks", status: "fail", detail: messageOf(err) }];
   }
-  return issues;
+}
+async function defaultOpenSession(stack, signal) {
+  const { getConfig } = await import("./store-SDUR52Z5.js");
+  const { buildContext } = await import("./context-KHKWJJMC.js");
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
+  const config = getConfig();
+  if (!config) throw new Error("no config \u2014 run `clawops init`");
+  const ctx = buildContext({ stack });
+  const stackObj = await ctx.getStack();
+  const outputMap = await stackObj.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  const base = extractBaseOutputs(outputs);
+  const conn = ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: config.ssh.keyPath,
+    knownHostsPath: config.ssh.knownHostsPath
+  });
+  const { session, release } = await acquireSession({
+    host: conn.host,
+    port: conn.port,
+    user: conn.user,
+    privateKeyPath: conn.privateKeyPath,
+    knownHostsPath: conn.knownHostsPath,
+    signal
+  });
+  return { session, release, conn };
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
 }
 
 export {
-  resolveConn,
-  errText,
-  okText,
-  handleConfigGet,
-  handleConfigSet,
-  handleConfigUnset,
-  handleConfigValidate,
-  validateOpenclawConfig,
+  runDiagnostics,
   formatUptime,
   gatherSnapshot,
   monitor_default