@clawops/cli 1.7.9 → 2.0.0

package/dist/{chunk-PVUVI35Y.js → chunk-JW5A7E3X.js}

@@ -23,7 +23,11 @@ function resolveSpecDir(startUrl = import.meta.url) {
     `Cannot locate the spec/ directory (searched upward from ${dirname(fileURLToPath(startUrl))}). If this is an installed package, spec/ may be missing from the published files.`
   );
 }
+function _resetSpecDirCache() {
+  _cached = void 0;
+}
 
 export {
-  resolveSpecDir
+  resolveSpecDir,
+  _resetSpecDirCache
 };

package/dist/chunk-LT4XMO5D.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// src/openclaw/health.ts
+var HEALTH_PATHS = {
+  /** Process is up and serving. `{"ok":true,"status":"live"}` */
+  live: "/health",
+  /** Startup completed — the gate for "is this deploy finished". `{"ok":true,"status":"started"}` */
+  started: "/startupz",
+  /** Accepting work. `{"ready":true}` */
+  ready: "/readyz"
+};
+function probeCommand(kind, port, pathPrefix = "") {
+  return `${pathPrefix}curl -fsS -m 5 http://127.0.0.1:${port}${HEALTH_PATHS[kind]} 2>/dev/null || true`;
+}
+function interpretProbe(kind, body) {
+  const text = body.trim();
+  if (text === "") return { ok: false, reason: "no response from the gateway" };
+  if (text.startsWith("<")) {
+    return {
+      ok: false,
+      reason: `${HEALTH_PATHS[kind]} returned HTML, not JSON \u2014 the gateway serves its Control UI on a catch-all route, so an unknown path answers 200 with the SPA. The endpoint is missing or renamed on this OpenClaw version.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { ok: false, reason: `${HEALTH_PATHS[kind]} returned unparseable JSON: ${text.slice(0, 80)}` };
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    return { ok: false, reason: `${HEALTH_PATHS[kind]} returned ${text.slice(0, 40)}` };
+  }
+  const obj = parsed;
+  if (kind === "ready") {
+    return obj["ready"] === true ? { ok: true } : { ok: false, reason: `gateway is not ready: ${text.slice(0, 80)}` };
+  }
+  if (obj["ok"] !== true) {
+    return { ok: false, reason: `gateway reported not ok: ${text.slice(0, 80)}` };
+  }
+  if (kind === "started" && obj["status"] !== "started") {
+    return { ok: false, reason: `gateway is still starting (status: ${String(obj["status"])})` };
+  }
+  return { ok: true };
+}
+
+export {
+  HEALTH_PATHS,
+  probeCommand,
+  interpretProbe
+};

package/dist/{chunk-P5LKWRPL.js → chunk-LU2V3LXA.js}

@@ -56,17 +56,17 @@ function makeProviderProxy(name) {
     if (resolved) return resolved;
     switch (name) {
       case "gcp": {
-        const mod = await import("./gcp-UG6AWPIZ.js");
+        const mod = await import("./gcp-2JBTD7ZM.js");
         resolved = mod.default;
         return resolved;
       }
       case "aws": {
-        const mod = await import("./aws-L4RR2LSE.js");
+        const mod = await import("./aws-AMON7DA7.js");
         resolved = mod.default;
         return resolved;
       }
       case "azure": {
-        const mod = await import("./azure-7OXQENQL.js");
+        const mod = await import("./azure-T4G6OBJQ.js");
         resolved = mod.default;
         return resolved;
       }

package/dist/chunk-N44K3LHE.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import {
+  CONTAINER_UID,
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  PUBLISH_INSPECT_CMD,
+  configPathForOS,
+  gatewayRunCommand,
+  imageForRestart,
+  publishForRestart,
+  stateDirForOS
+} from "./chunk-6TIYVHPX.js";
+
+// src/plan/remote-config.ts
+var OPENCLAW_CONFIG_LINUX = configPathForOS("Linux");
+var OPENCLAW_CONFIG_MACOS = configPathForOS("Darwin");
+var OPENCLAW_CONFIG = OPENCLAW_CONFIG_LINUX;
+var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
+async function detectOS(session, signal) {
+  const result = await session.exec("uname -s", signal);
+  return result.stdout.trim() === "Darwin" ? "Darwin" : "Linux";
+}
+async function readRemoteConfig(session, signal) {
+  const os = await detectOS(session, signal);
+  const configPath = configPathForOS(os);
+  const result = os === "Darwin" ? await session.exec(`cat ${configPath}`, signal) : await execPrivileged(session, `cat ${configPath}`, signal);
+  if (result.code !== 0) {
+    throw new Error(`Cannot read ${configPath}: ${result.stderr}`);
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error(`Cannot parse ${configPath}: invalid JSON`);
+  }
+}
+async function atomicWriteConfig(session, cfg, signal, opts = {}) {
+  const os = await detectOS(session, signal);
+  const configPath = configPathForOS(os);
+  const json = JSON.stringify(cfg, null, 2);
+  if (!opts.skipValidation) {
+    const [{ validateConfig }, yaml] = await Promise.all([
+      import("./config-validate-K2N6XLDX.js"),
+      import("./js-yaml-PTEEG4FO.js")
+    ]);
+    const { loadVersionSpec } = await import("./versions-W5LRQCAJ.js");
+    const spec = loadVersionSpec(yaml);
+    const { errors, warnings } = await validateConfig(cfg, {
+      openclawVersion: opts.openclawVersion,
+      schemaCapturedFrom: spec.runtime?.configSchemaCapturedFrom
+    });
+    for (const w of warnings) process.stderr.write(`warning: ${w}
+`);
+    if (errors.length > 0) {
+      const rejected = `${configPath}.rejected.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+      const b64r = Buffer.from(json, "utf-8").toString("base64");
+      await execPrivileged(session, `echo '${b64r}' | base64 -d > ${rejected}`, signal);
+      throw new Error(
+        `Refusing to write an invalid OpenClaw config:
+` + errors.map((e) => `  - ${e}`).join("\n") + `
+The rejected config was kept at ${rejected}. The deployment's current config is unchanged.`
+      );
+    }
+  }
+  const b64 = Buffer.from(json, "utf-8").toString("base64");
+  const chown = os === "Linux" ? ` && chown ${CONTAINER_UID}:${CONTAINER_UID} ${configPath}` : "";
+  const cmd = `echo '${b64}' | base64 -d > ${OPENCLAW_TMP} && mv ${OPENCLAW_TMP} ${configPath}` + chown;
+  const result = os === "Darwin" ? await session.exec(cmd, signal) : await execPrivileged(session, cmd, signal);
+  if (result.code !== 0) {
+    throw new Error(`Failed to write config: ${result.stderr}`);
+  }
+}
+async function restartGateway(session, signal) {
+  const os = await detectOS(session, signal);
+  const pathPrefix = os === "Darwin" ? 'export PATH="/usr/local/bin:/opt/homebrew/bin:/Applications/Docker.app/Contents/Resources/bin:$PATH" && ' : "";
+  const imgCmd = `${pathPrefix}${IMAGE_INSPECT_CMD}`;
+  const imgResult = os === "Darwin" ? await session.exec(imgCmd, signal) : await execPrivileged(session, imgCmd, signal);
+  const resolved = imageForRestart(imgResult.stdout);
+  if (!resolved.ok) throw new Error(resolved.error);
+  const image = resolved.value;
+  const pubCmd = `${pathPrefix}${PUBLISH_INSPECT_CMD}`;
+  const pubResult = os === "Darwin" ? await session.exec(pubCmd, signal) : await execPrivileged(session, pubCmd, signal);
+  const restartCmd = gatewayRunCommand({
+    image,
+    stateDir: stateDirForOS(os),
+    pathPrefix,
+    publish: publishForRestart(pubResult.stdout)
+  });
+  const result = os === "Darwin" ? await session.exec(restartCmd, signal) : await execPrivileged(session, restartCmd, signal);
+  if (result.code !== 0) {
+    throw new Error(`Gateway restart failed: ${result.stderr}`);
+  }
+  const healthy = await waitForGateway(session, pathPrefix, signal);
+  if (!healthy.ok) {
+    throw new Error(
+      `Gateway restarted but did not finish starting on port ${GATEWAY_PORT}` + (healthy.reason ? ` \u2014 ${healthy.reason}` : "") + `. The previous container has already been replaced; inspect it with \`docker logs openclaw\`. If the newly-applied config is at fault, revert it and restart \u2014 before v1.7.2 this config was never applied, so a value that has sat unused may now be taking effect.`
+    );
+  }
+}
+async function waitForGateway(session, pathPrefix, signal, attempts = 15) {
+  const { probeCommand, interpretProbe } = await import("./health-5CCOXYGG.js");
+  const probe = probeCommand("started", GATEWAY_PORT, pathPrefix);
+  let last = "no response from the gateway";
+  for (let i = 0; i < attempts; i++) {
+    if (signal?.aborted) return { ok: false, reason: "aborted" };
+    const r = await session.exec(probe, signal);
+    const verdict = interpretProbe("started", r.stdout);
+    if (verdict.ok) return { ok: true };
+    last = verdict.reason ?? last;
+    await new Promise((resolve) => setTimeout(resolve, 2e3));
+  }
+  return { ok: false, reason: last };
+}
+function deepMerge(base, overlay) {
+  const result = { ...base };
+  for (const [key, val] of Object.entries(overlay)) {
+    if (val !== null && typeof val === "object" && !Array.isArray(val) && typeof result[key] === "object" && result[key] !== null && !Array.isArray(result[key])) {
+      result[key] = deepMerge(
+        result[key],
+        val
+      );
+    } else {
+      result[key] = val;
+    }
+  }
+  return result;
+}
+
+export {
+  OPENCLAW_CONFIG_LINUX,
+  OPENCLAW_CONFIG_MACOS,
+  OPENCLAW_CONFIG,
+  OPENCLAW_TMP,
+  readRemoteConfig,
+  atomicWriteConfig,
+  restartGateway,
+  deepMerge
+};

package/dist/chunk-NUDIHZEH.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+// src/transport/privileged.ts
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function sudoWrap(cmd) {
+  return `sudo -n bash -c ${shellQuote(cmd)}`;
+}
+function looksLikePermissionDenied(result) {
+  if (result.code === 0) return false;
+  const text = `${result.stderr} ${result.stdout}`.toLowerCase();
+  return text.includes("permission denied") || text.includes("docker.sock") || text.includes("operation not permitted");
+}
+var sudoNeeded = /* @__PURE__ */ new WeakMap();
+function resetPrivilegeCache(session) {
+  sudoNeeded.delete(session);
+}
+async function execPrivileged(session, cmd, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === true) return session.exec(sudoWrap(cmd), signal);
+  const direct = await session.exec(cmd, signal);
+  if (!looksLikePermissionDenied(direct)) {
+    if (direct.code === 0) sudoNeeded.set(key, false);
+    return direct;
+  }
+  const escalated = await session.exec(sudoWrap(cmd), signal);
+  if (escalated.code === 0) sudoNeeded.set(key, true);
+  return escalated;
+}
+async function streamPrivileged(session, cmd, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === void 0) {
+    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
+    sudoNeeded.set(key, looksLikePermissionDenied(probe));
+  }
+  return session.stream(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, signal);
+}
+async function execPrivilegedWithInput(session, cmd, input, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === void 0) {
+    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
+    sudoNeeded.set(key, looksLikePermissionDenied(probe));
+  }
+  return session.execWithInput(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, input, signal);
+}
+
+export {
+  shellQuote,
+  sudoWrap,
+  resetPrivilegeCache,
+  execPrivileged,
+  streamPrivileged,
+  execPrivilegedWithInput
+};

package/dist/chunk-SBLQH2TJ.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+// src/openclaw/logs.ts
+var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null 2>&1 && echo ok || echo no";
+function gatewayLogsCommand(opts) {
+  return [
+    "docker exec openclaw openclaw logs",
+    `--limit ${opts.tail}`,
+    opts.follow ? "--follow" : "",
+    opts.json ? "--json" : ""
+  ].filter(Boolean).join(" ");
+}
+function containerLogsCommand(opts) {
+  return [
+    "docker logs openclaw",
+    `-n ${opts.tail}`,
+    opts.follow ? "-f" : "",
+    opts.since ? `--since ${shellQuote(opts.since)}` : ""
+  ].filter(Boolean).join(" ");
+}
+function chooseLogSource(opts) {
+  if (opts.since) {
+    return {
+      source: "container",
+      reason: "--since is a container-log filter; the gateway log command has no equivalent"
+    };
+  }
+  if (!opts.gatewayReachable) {
+    return {
+      source: "container",
+      reason: "the gateway is not answering, so its own logs cannot be read \u2014 showing container output"
+    };
+  }
+  return { source: "gateway", reason: "read from the gateway over RPC" };
+}
+function agentAuditCommand(opts) {
+  return [
+    "docker exec openclaw openclaw audit",
+    `--agent ${shellQuote(opts.agentId)}`,
+    "--kind agent_run",
+    "--json",
+    `--limit ${opts.limit}`,
+    opts.cursor ? `--cursor ${shellQuote(opts.cursor)}` : ""
+  ].filter(Boolean).join(" ");
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+export {
+  GATEWAY_LOGS_PROBE,
+  gatewayLogsCommand,
+  containerLogsCommand,
+  chooseLogSource,
+  agentAuditCommand
+};

package/dist/chunk-UFRO4H5W.js

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-N44K3LHE.js";
+import {
+  validatePlan
+} from "./chunk-YR3O2I3S.js";
+import {
+  saveOverlay
+} from "./chunk-6ZFIFDBJ.js";
+import {
+  resolveSecrets
+} from "./chunk-BOPSG2LI.js";
+import {
+  buildContext
+} from "./chunk-LU2V3LXA.js";
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-6TIYVHPX.js";
+
+// src/plan/apply.ts
+async function applyPlan(plan, opts) {
+  const validation = validatePlan(plan);
+  if (!validation.ok) {
+    throw new UsageError(
+      `Invalid deploy plan:
+${validation.errors.join("\n")}`
+    );
+  }
+  if (plan.spec.provider === "local") {
+    throw new UsageError(
+      "plan/apply is not supported for the local provider. Use `clawops up` directly."
+    );
+  }
+  const { guardOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+  await guardOpenclawVersion(plan.spec.openclaw.version);
+  const ctx = buildContext({
+    stack: plan.spec.stackName,
+    provider: plan.spec.provider
+  });
+  const stack = await ctx.getStack();
+  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
+  if (plan.spec.region) {
+    await stack.setConfig("region", { value: plan.spec.region });
+  }
+  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
+  await stack.setConfig("publishGateway", {
+    value: plan.spec.network?.publishGateway ?? "loopback"
+  });
+  await stack.setConfig("gatewayPort", {
+    value: String(plan.spec.network?.gatewayPort ?? GATEWAY_PORT)
+  });
+  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
+  if (modelProvider === "bedrock") {
+    await stack.setConfig("bedrockEnabled", { value: "true" });
+  }
+  if (plan.metadata.stackVersion !== void 0) {
+    const currentInfo = await stack.info();
+    if (currentInfo !== void 0 && currentInfo.version !== plan.metadata.stackVersion) {
+      process.stderr.write(
+        `
+Warning: stack "${plan.spec.stackName}" has changed since this plan was generated (plan version: ${plan.metadata.stackVersion}, current: ${currentInfo.version}).
+The diff you reviewed may no longer reflect what will be applied.
+
+`
+      );
+      if (opts?.confirmDrift) {
+        await opts.confirmDrift();
+      }
+    }
+  }
+  const start = Date.now();
+  const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
+  const outputs = Object.fromEntries(
+    Object.entries(result.outputs).map(([k, v]) => [k, v.value])
+  );
+  const changeSummary = {};
+  if (result.summary.resourceChanges) {
+    for (const [op, count] of Object.entries(result.summary.resourceChanges)) {
+      changeSummary[op] = count;
+    }
+  }
+  const hasOverlay = plan.spec.openclaw.config !== void 0 || plan.spec.openclaw.channels !== void 0;
+  if (hasOverlay) {
+    await applyConfigOverlay(plan, outputs, ctx, opts?.signal);
+  }
+  return {
+    outputs,
+    changeSummary,
+    durationMs: Date.now() - start
+  };
+}
+async function applyConfigOverlay(plan, outputs, ctx, signal) {
+  const { connect } = await import("./ssh-B3NZAU4I.js");
+  const connInfo = ctx.adapter.getConnectionInfo(outputs);
+  const session = await connect({
+    host: connInfo.host,
+    port: connInfo.port,
+    user: connInfo.user,
+    privateKeyPath: connInfo.privateKeyPath,
+    knownHostsPath: connInfo.knownHostsPath,
+    signal
+  });
+  try {
+    const remote = await readRemoteConfig(session, signal);
+    const configOverlay = plan.spec.openclaw.config ?? {};
+    const resolvedOverlay = resolveSecrets(
+      configOverlay,
+      plan.spec.secrets ?? []
+    );
+    const merged = deepMerge(remote, {
+      ...resolvedOverlay,
+      ...plan.spec.openclaw.channels !== void 0 ? { channels: plan.spec.openclaw.channels } : {}
+    });
+    await atomicWriteConfig(session, merged, signal, {
+      openclawVersion: plan.spec.openclaw.version
+    });
+    await installProviderPlugins(session, merged, plan.spec.openclaw.version, signal);
+    await installChannelPlugins(session, merged, plan.spec.openclaw.version, signal);
+    await restartGateway(session, signal);
+    await verifyProviders(session, merged, signal);
+    await verifyChannels(session, merged, signal);
+    saveOverlay(plan.spec.stackName, configOverlay, plan.spec.secrets ?? []);
+  } finally {
+    session.close();
+  }
+}
+async function installProviderPlugins(session, cfg, openclawVersion, signal) {
+  const [{ requiredPlugins, installCommand }, { STATE_DIR_HOST_LINUX }, yaml, { readFileSync }, { join }, { resolveSpecDir }] = await Promise.all([
+    import("./plugins-DTST3OER.js"),
+    import("./runtime-LZ7NA53V.js"),
+    import("./js-yaml-PTEEG4FO.js"),
+    import("fs"),
+    import("path"),
+    import("./spec-path-KQOOIQCA.js")
+  ]);
+  const catalog = yaml.load(
+    readFileSync(join(resolveSpecDir(), "models.yaml"), "utf-8")
+  );
+  const needed = requiredPlugins(cfg, catalog);
+  if (needed.length === 0) return;
+  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const image = `ghcr.io/openclaw/openclaw:${openclawVersion}`;
+  for (const plugin of needed) {
+    const result = await execPrivileged(
+      session,
+      installCommand(plugin, image, STATE_DIR_HOST_LINUX),
+      signal
+    );
+    if (result.code !== 0) {
+      process.stderr.write(
+        `[clawops] warning: could not install ${plugin.package}@${plugin.version} for provider "${plugin.providerId}": ${result.stderr || result.stdout}
+`
+      );
+    }
+  }
+}
+async function verifyProviders(session, cfg, signal) {
+  const { missingProviders } = await import("./plugins-DTST3OER.js");
+  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const result = await execPrivileged(
+    session,
+    "docker exec openclaw openclaw plugins list --json",
+    signal
+  );
+  if (result.code !== 0) return;
+  const missing = missingProviders(cfg, result.stdout);
+  if (missing.length > 0) {
+    process.stderr.write(
+      `[clawops] warning: the gateway is running, but these configured model providers did not load: ${missing.join(", ")}.
+[clawops] The deployment will look healthy and fail on first use. Check egress to ClawHub, then re-run apply.
+`
+    );
+  }
+}
+async function loadChannelCatalog() {
+  const [yaml, { readFileSync }, { join }, { resolveSpecDir }] = await Promise.all([
+    import("./js-yaml-PTEEG4FO.js"),
+    import("fs"),
+    import("path"),
+    import("./spec-path-KQOOIQCA.js")
+  ]);
+  return yaml.load(readFileSync(join(resolveSpecDir(), "integrations.yaml"), "utf-8"));
+}
+async function installChannelPlugins(session, cfg, openclawVersion, signal) {
+  const [{ requiredChannelPlugins, channelInstallCommand }, { STATE_DIR_HOST_LINUX }] = await Promise.all([import("./channels-KBUR42IU.js"), import("./runtime-LZ7NA53V.js")]);
+  const needed = requiredChannelPlugins(cfg, await loadChannelCatalog());
+  if (needed.length === 0) return;
+  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const image = `ghcr.io/openclaw/openclaw:${openclawVersion}`;
+  for (const plugin of needed) {
+    const result = await execPrivileged(
+      session,
+      channelInstallCommand(plugin, image, STATE_DIR_HOST_LINUX),
+      signal
+    );
+    if (result.code !== 0) {
+      process.stderr.write(
+        `[clawops] warning: could not install ${plugin.package}@${plugin.version} for channel "${plugin.channelKey}": ${result.stderr || result.stdout}
+`
+      );
+    }
+  }
+}
+async function verifyChannels(session, cfg, signal) {
+  const { missingChannels, CHANNELS_LIST_CMD } = await import("./channels-KBUR42IU.js");
+  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const result = await execPrivileged(session, CHANNELS_LIST_CMD, signal);
+  if (result.code !== 0) return;
+  const missing = missingChannels(cfg, result.stdout, await loadChannelCatalog());
+  if (missing.length > 0) {
+    process.stderr.write(
+      `[clawops] warning: the gateway is running, but these configured channels are not installed: ${missing.join(", ")}.
+[clawops] They will never connect. Check egress to registry.npmjs.org, then re-run apply.
+`
+    );
+  }
+}
+
+export {
+  applyPlan
+};

package/dist/{chunk-A4QR4TXW.js → chunk-WHJMKDV7.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-6X45DDGH.js";
+} from "./chunk-YR3O2I3S.js";
 import {
   buildContext
-} from "./chunk-P5LKWRPL.js";
+} from "./chunk-LU2V3LXA.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,10 +45,10 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-5AR4ZPK4.js");
+  const { version } = await import("./package-3HUW57XH.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
-  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-VUCNZXQS.js");
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
   const openclawVersion = await guardOpenclawVersion(
     intent.openclawVersion ?? await defaultOpenclawVersion()
   );
@@ -108,6 +108,26 @@ async function generatePlan(intent, _opts) {
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-BOQRWX4F.js");
+  const cfgCheck = await validatePlanConfig(plan);
+  for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
+`);
+  if (!cfgCheck.ok) {
+    throw new Error(
+      `The OpenClaw config in this plan would be rejected:
+` + cfgCheck.errors.map((e) => `  - ${e}`).join("\n") + `
+Fix spec.openclaw.config before applying \u2014 the gateway reads it verbatim.`
+    );
+  }
+  const netCheck = validatePlanNetwork(plan);
+  for (const w of netCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
+`);
+  if (!netCheck.ok) {
+    throw new Error(
+      `This plan's network settings contradict each other:
+` + netCheck.errors.map((e) => `  - ${e}`).join("\n")
+    );
+  }
   return plan;
 }
 function planId() {