@clawops/cli 1.7.9 → 2.0.0

package/dist/upgrade-ULD4KFYC.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+// src/openclaw/upgrade.ts
+function judgePreflight(report) {
+  const { targetVersion, foundVersion, status, reason } = report;
+  if (status === "indeterminate") {
+    return {
+      ok: false,
+      reason: reason ?? "the database schema could not be determined, so compatibility with the target release is unknown"
+    };
+  }
+  if (typeof foundVersion === "number" && typeof targetVersion === "number") {
+    if (foundVersion > targetVersion) {
+      return {
+        ok: false,
+        reason: `the state database is at schema ${foundVersion}, but the target release understands ${targetVersion}. This is a downgrade across a schema boundary: the older release would read a database written by a newer one. Restore a backup taken before the upgrade instead.`
+      };
+    }
+    if (foundVersion < targetVersion) {
+      return { ok: true, note: `state will migrate from schema ${foundVersion} to ${targetVersion}` };
+    }
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    reason: reason ?? `preflight returned no schema version (status: ${status ?? "unknown"})`
+  };
+}
+function parsePreflight(stdout) {
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    if (parsed !== null && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return void 0;
+}
+function snapshotCommand(image, stateDir, repo) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw backup sqlite create --global --repository ${repo} --json`;
+}
+function preflightCommand(targetImage, stateDir, snapshotDb) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${targetImage} openclaw database preflight ${snapshotDb} --json`;
+}
+function snapshotPathFrom(stdout) {
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    if (parsed.ok === true && typeof parsed.snapshotPath === "string") return parsed.snapshotPath;
+  } catch {
+  }
+  return void 0;
+}
+function repairCommand(image, stateDir) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw doctor --fix --non-interactive --yes`;
+}
+function describeOutcome(o, version) {
+  switch (o.kind) {
+    case "started":
+      return `Gateway updated to ${version}.`;
+    case "repaired":
+      return `Gateway updated to ${version} after a one-shot repair (doctor --fix).`;
+    case "rolled-back":
+      return `Rolled back to ${o.to}: the gateway did not start on ${version} \u2014 ${o.reason}. The previous image is running again. If it also fails, restore the snapshot taken before the upgrade.`;
+    case "failed":
+      return `Upgrade to ${version} failed and the rollback did not come up either \u2014 ${o.reason}. The state snapshot taken before the upgrade is at ${o.snapshotPath}; restore it with \`openclaw backup sqlite restore\` before retrying.`;
+  }
+}
+async function resolveUpgrade(steps, ctx) {
+  const first = await steps.gate();
+  if (first.ok) return { kind: "started" };
+  await steps.repair();
+  await steps.run(ctx.version);
+  const second = await steps.gate();
+  if (second.ok) return { kind: "repaired" };
+  const reason = second.reason ?? first.reason ?? "unknown";
+  if (!ctx.previousVersion) return { kind: "failed", reason, snapshotPath: ctx.snapshotPath };
+  await steps.run(ctx.previousVersion);
+  const back = await steps.gate();
+  return back.ok ? { kind: "rolled-back", to: ctx.previousVersion, reason } : { kind: "failed", reason, snapshotPath: ctx.snapshotPath };
+}
+export {
+  describeOutcome,
+  judgePreflight,
+  parsePreflight,
+  preflightCommand,
+  repairCommand,
+  resolveUpgrade,
+  snapshotCommand,
+  snapshotPathFrom
+};

package/dist/validate-BOQRWX4F.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  assertValidPlan,
+  validatePlan,
+  validatePlanConfig,
+  validatePlanNetwork
+} from "./chunk-YR3O2I3S.js";
+import "./chunk-JW5A7E3X.js";
+export {
+  assertValidPlan,
+  validatePlan,
+  validatePlanConfig,
+  validatePlanNetwork
+};

package/dist/{version-guard-VUCNZXQS.js → version-guard-GPSTCPT7.js}

@@ -2,12 +2,12 @@
 import {
   assertSupportedVersion,
   loadVersionSpec
-} from "./chunk-UKTP332Z.js";
-import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
+import "./chunk-EI7CQQ7D.js";
 
 // src/cli/version-guard.ts
 async function defaultOpenclawVersion() {

package/dist/{versions-2UVAT6PQ.js → versions-W5LRQCAJ.js}

@@ -9,9 +9,9 @@ import {
   isMovingTag,
   loadVersionSpec,
   resolveVersion
-} from "./chunk-UKTP332Z.js";
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
 export {
   MOVING_TAGS,
   _resetVersionSpecCache,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.7.9",
+  "version": "2.0.0",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -32,13 +32,13 @@
     "test": "vitest run",
     "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
     "test:changed": "vitest --changed",
-    "test:mutation": "node scripts/dev/mutation-check.mjs",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
     "lint": "eslint --max-warnings=0 src tests scripts",
     "gen:schemas": "tsx scripts/gen-schemas.ts",
     "changeset": "changeset",
-    "release": "pnpm build && changeset publish"
+    "release": "pnpm build && changeset publish",
+    "test:mutation": "node scripts/dev/mutation-check.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",

package/spec/deploy-plan.schema.json

@@ -4,7 +4,12 @@
   "title": "DeployPlan",
   "description": "The Maker plan artifact (borrowed from Clanker pattern). Generated by `clawops plan`, applied by `clawops apply`. Reviewable, diff-able, version-controllable.",
   "type": "object",
-  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "required": [
+    "apiVersion",
+    "kind",
+    "metadata",
+    "spec"
+  ],
   "properties": {
     "apiVersion": {
       "const": "clawops.dev/v1",
@@ -15,7 +20,10 @@
     },
     "metadata": {
       "type": "object",
-      "required": ["name", "generatedAt"],
+      "required": [
+        "name",
+        "generatedAt"
+      ],
       "properties": {
         "name": {
           "type": "string",
@@ -38,7 +46,9 @@
         },
         "labels": {
           "type": "object",
-          "additionalProperties": { "type": "string" },
+          "additionalProperties": {
+            "type": "string"
+          },
           "description": "User-supplied labels (env=prod, team=platform, etc.)"
         },
         "stackVersion": {
@@ -49,10 +59,21 @@
     },
     "spec": {
       "type": "object",
-      "required": ["provider", "stackName", "instanceType", "openclaw", "network"],
+      "required": [
+        "provider",
+        "stackName",
+        "instanceType",
+        "openclaw",
+        "network"
+      ],
       "properties": {
         "provider": {
-          "enum": ["aws", "gcp", "azure", "local"]
+          "enum": [
+            "aws",
+            "gcp",
+            "azure",
+            "local"
+          ]
         },
         "region": {
           "type": "string",
@@ -68,7 +89,9 @@
         },
         "openclaw": {
           "type": "object",
-          "required": ["version"],
+          "required": [
+            "version"
+          ],
           "properties": {
             "version": {
               "type": "string",
@@ -81,7 +104,9 @@
             "channels": {
               "type": "object",
               "description": "OpenClaw channel integrations keyed by provider name (e.g. {\"discord\":{\"botToken\":\"...\"}}). Values are provider-specific config objects. Sensitive fields must use $secret references.",
-              "additionalProperties": { "type": "object" }
+              "additionalProperties": {
+                "type": "object"
+              }
             }
           }
         },
@@ -90,11 +115,23 @@
           "description": "Secret references (R6: never inline values)",
           "items": {
             "type": "object",
-            "required": ["name", "source"],
+            "required": [
+              "name",
+              "source"
+            ],
             "properties": {
-              "name": { "type": "string" },
+              "name": {
+                "type": "string"
+              },
               "source": {
-                "enum": ["env", "aws-sm", "aws-ssm", "gcp-sm", "azure-kv", "file"]
+                "enum": [
+                  "env",
+                  "aws-sm",
+                  "aws-ssm",
+                  "gcp-sm",
+                  "azure-kv",
+                  "file"
+                ]
               },
               "ref": {
                 "type": "string",
@@ -105,26 +142,56 @@
         },
         "network": {
           "type": "object",
-          "required": ["allowedSshCidrs", "allowedGatewayCidrs"],
+          "required": [
+            "allowedSshCidrs",
+            "allowedGatewayCidrs"
+          ],
           "properties": {
             "allowedSshCidrs": {
               "type": "array",
-              "items": { "type": "string", "format": "cidr" },
+              "items": {
+                "type": "string",
+                "format": "cidr"
+              },
               "minItems": 0,
               "description": "Empty array = no SSH access (unusual but allowed). Defaults applied at plan generation, not in schema"
             },
             "allowedGatewayCidrs": {
               "type": "array",
-              "items": { "type": "string", "format": "cidr" },
-              "description": "CIDRs allowed to reach the OpenClaw gateway port (default 18789)"
+              "items": {
+                "type": "string",
+                "format": "cidr"
+              },
+              "description": "CIDRs allowed to reach the gateway port. Only meaningful with publishGateway \"all\" — under \"loopback\" nothing listens on a routable interface, so these rules would admit traffic to a closed port. clawops refuses that combination rather than creating rules that do nothing."
+            },
+            "gatewayPort": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535,
+              "default": 18789,
+              "description": "Host port the gateway is published on. Carried in the plan so the firewall rules, the container publish flag, the startup config and the gateway URL all come from one place; it used to be a constant redeclared in six files, which made a port change a six-file edit that could half-apply."
             },
             "tailscale": {
               "type": "object",
               "description": "Optional Tailscale sidecar (borrowed pattern from schmitthub)",
               "properties": {
-                "enabled": { "type": "boolean" },
-                "authKeyRef": { "type": "string", "description": "Reference to a secret containing the Tailscale auth key" }
+                "enabled": {
+                  "type": "boolean"
+                },
+                "authKeyRef": {
+                  "type": "string",
+                  "description": "Reference to a secret containing the Tailscale auth key"
+                }
               }
+            },
+            "publishGateway": {
+              "type": "string",
+              "enum": [
+                "loopback",
+                "all"
+              ],
+              "default": "loopback",
+              "description": "Which interface the gateway container publishes on. \"loopback\" (default) binds 127.0.0.1 on the host, so the gateway is reachable only via `clawops tunnel` or a reverse proxy running on that host. \"all\" binds 0.0.0.0. Deliberately separate from allowedGatewayCidrs: a firewall rule says who may connect, this says whether the port is listening at all, and exposure should be an explicit choice rather than inherited from a CIDR chosen for SSH. \"all\" serves plaintext HTTP unless you front it with TLS."
             }
           }
         },
@@ -135,12 +202,17 @@
               "type": "string",
               "description": "Public key contents (safe to inline). Private key never in plan"
             },
-            "user": { "type": "string", "default": "ubuntu" }
+            "user": {
+              "type": "string",
+              "default": "ubuntu"
+            }
           }
         },
         "tags": {
           "type": "object",
-          "additionalProperties": { "type": "string" },
+          "additionalProperties": {
+            "type": "string"
+          },
           "description": "Cloud-resource tags propagated to all created resources"
         }
       }
@@ -151,15 +223,23 @@
       "properties": {
         "create": {
           "type": "array",
-          "items": { "$ref": "#/$defs/ResourceRef" }
+          "items": {
+            "$ref": "#/$defs/ResourceRef"
+          }
         },
         "update": {
           "type": "array",
           "items": {
             "type": "object",
-            "required": ["resource", "before", "after"],
+            "required": [
+              "resource",
+              "before",
+              "after"
+            ],
             "properties": {
-              "resource": { "$ref": "#/$defs/ResourceRef" },
+              "resource": {
+                "$ref": "#/$defs/ResourceRef"
+              },
               "before": {},
               "after": {}
             }
@@ -167,16 +247,23 @@
         },
         "delete": {
           "type": "array",
-          "items": { "$ref": "#/$defs/ResourceRef" }
+          "items": {
+            "$ref": "#/$defs/ResourceRef"
+          }
         },
-        "totalChanges": { "type": "integer" }
+        "totalChanges": {
+          "type": "integer"
+        }
       }
     }
   },
   "$defs": {
     "ResourceRef": {
       "type": "object",
-      "required": ["urn", "type"],
+      "required": [
+        "urn",
+        "type"
+      ],
       "properties": {
         "urn": {
           "type": "string",
@@ -186,7 +273,9 @@
           "type": "string",
           "description": "Pulumi resource type token"
         },
-        "name": { "type": "string" }
+        "name": {
+          "type": "string"
+        }
       }
     }
   }

package/spec/integrations.yaml

@@ -1,9 +1,44 @@
 # spec/integrations.yaml — OpenClaw channel integration catalog for the setup wizard.
 # Read at runtime by src/cli/commands/setup.ts — not compiled or code-generated.
 #
-# Each integration maps to a key in openclaw.json's `channels` object.
+# Each integration maps to a key in the `channels` object of OpenClaw's config.
 # infraRequired: true means a publicly reachable webhook URL must be registered
 # with the provider after the stack is deployed.
+#
+# ── Checked against OpenClaw 2026.9.2 (WO-60) ────────────────────────────────
+#
+# EVERY channel in 2.0 is an install-gated plugin. `openclaw channels list --all --json`
+# reports all 31 as `origin: "installable"`, and none is bundled — the same shape as model
+# providers (WO-43), which is why `plugin:` below carries the package to install.
+#
+# Configuring a channel without installing it produces a gateway that starts, reports
+# healthy, and never connects to the channel.
+#
+# `dmPolicy` and `groupPolicy` are REQUIRED by the schema on every channel here, and Slack
+# and WhatsApp require more. `defaults:` carries OpenClaw's own default for each of them, and
+# the wizard writes them — a JSON Schema default does not satisfy `required`, so a config
+# omitting them is REJECTED. Every channel the wizard wrote was invalid before this.
+#
+# Every credential field also accepts a SecretRef — `{source: env, provider, id}` — as well
+# as a plain string, so a token need not be inlined into the config.
+#
+# The catalog was wrong in four ways before this pass, all of which would have produced a
+# config OpenClaw rejects or ignores: the Teams key was `teams` (the schema has `msteams`),
+# Discord's token field was `botToken` (it is `token`), WhatsApp's `phoneNumberId` and
+# `accessToken` do not exist on that channel at all, and EVERY `envDefault` used an
+# `OPENCLAW_*` name that OpenClaw does not read.
+#
+# `envVar` below is the variable `openclaw channels add --use-env` actually reads, taken from
+# the binary's own error message. `useEnvSupported: false` means that flag is rejected for the
+# channel outright — measured, not assumed.
+#
+# `plugin.version` is pinned to the runtime floor, and it is not decoration. Measured on
+# 2026.9.2: `@openclaw/discord@2026.9.3` refuses to install with
+#
+#   plugin "discord" requires plugin API >=2026.9.3, but this OpenClaw runtime exposes 2026.9.2
+#
+# The same drift that forced version pins on model providers in WO-43. `latest` would break
+# the deploy the moment upstream publishes ahead of the runtime, which it already has.
 
 integrations:
   - id: discord
@@ -11,12 +46,21 @@ integrations:
     displayName: Discord
     description: Connect OpenClaw agents to a Discord server via bot
     infraRequired: false
+    plugin:
+      package: "@openclaw/discord"
+      source: npm
+      version: "2026.9.2"
+    useEnvSupported: true
+    requiredConfig: [dmPolicy, groupPolicy]
+    defaults:
+      dmPolicy: pairing
+      groupPolicy: allowlist
     fields:
-      - name: botToken
+      - name: token
         label: Bot token
         description: Bot token from the Discord Developer Portal (Bot → Token)
         sensitive: true
-        envDefault: OPENCLAW_DISCORD_TOKEN
+        envDefault: DISCORD_BOT_TOKEN
     setupUrl: https://discord.com/developers/applications
 
   - id: telegram
@@ -24,33 +68,69 @@ integrations:
     displayName: Telegram
     description: Connect OpenClaw agents to a Telegram bot
     infraRequired: false
+    # Bundled in the image: `channels add --channel telegram --use-env` succeeds with
+    # `--network none`, so there is nothing to download and no egress needed. It is listed
+    # as "installable" alongside the rest, which is why this looked unresolved at first.
+    plugin:
+      package: ""
+      source: bundled
+    useEnvSupported: true
+    requiredConfig: [dmPolicy, groupPolicy]
+    defaults:
+      dmPolicy: pairing
+      groupPolicy: allowlist
     fields:
       - name: botToken
         label: Bot token
         description: Token from @BotFather (/newbot)
         sensitive: true
-        envDefault: OPENCLAW_TELEGRAM_TOKEN
+        envDefault: TELEGRAM_BOT_TOKEN
     setupUrl: https://t.me/BotFather
 
   - id: slack
     channelKey: slack
     displayName: Slack
-    description: Connect OpenClaw agents to a Slack workspace via app
-    infraRequired: true
-    infraNote: >
-      After deployment, register the gateway webhook URL in your Slack app
-      configuration at api.slack.com (Event Subscriptions → Request URL).
+    description: Connect OpenClaw agents to a Slack workspace via app (Socket Mode)
+    # Socket Mode, not a webhook. `mode` defaults to "socket" in OpenClaw and it is what
+    # `channels add --use-env` drives: the gateway opens an OUTBOUND WebSocket to Slack, so
+    # there is no public URL to register and no inbound rule to open.
+    #
+    # This entry said infraRequired: true — the `http` mode setup — while declaring the
+    # socket credentials incompletely. It described one setup while the tooling installed
+    # the other, and the config it produced failed validation either way.
+    #
+    # `mode: http` is still available: it needs a public webhook at `webhookPath` and a
+    # signingSecret to verify inbound requests. That is a deliberate choice, not the default,
+    # and clawops does not configure it.
+    infraRequired: false
+    plugin:
+      package: "@openclaw/slack"
+      source: npm
+      version: "2026.9.2"
+    # Socket Mode is what --use-env drives, and it demands SLACK_APP_TOKEN:
+    #   "Slack Socket Mode requires SLACK_APP_TOKEN when using --use-env."
+    useEnvSupported: true
+    # Slack requires more than the two policies: the schema also demands postAs, mode,
+    # webhookPath and userTokenReadOnly.
+    requiredConfig: [dmPolicy, groupPolicy, postAs, mode, webhookPath, userTokenReadOnly]
+    defaults:
+      dmPolicy: pairing
+      groupPolicy: allowlist
+      postAs: bot
+      mode: socket
+      webhookPath: /slack/events
+      userTokenReadOnly: true
     fields:
       - name: botToken
         label: Bot OAuth token
         description: "Bot User OAuth Token (starts with xoxb-)"
         sensitive: true
-        envDefault: OPENCLAW_SLACK_TOKEN
-      - name: signingSecret
-        label: Signing secret
-        description: App signing secret from Basic Information → App Credentials
+        envDefault: SLACK_BOT_TOKEN
+      - name: appToken
+        label: App-level token
+        description: "App-level token for Socket Mode (starts with xapp-), from Basic Information → App-Level Tokens"
         sensitive: true
-        envDefault: OPENCLAW_SLACK_SIGNING_SECRET
+        envDefault: SLACK_APP_TOKEN
     setupUrl: https://api.slack.com/apps
 
   - id: whatsapp
@@ -62,27 +142,49 @@ integrations:
       After deployment, register the gateway webhook URL in the Meta Developer
       Console (WhatsApp → Configuration → Webhook). The gateway URL is printed
       at the end of setup.
-    fields:
-      - name: phoneNumberId
-        label: Phone number ID
-        description: Phone Number ID from Meta Developer Console → WhatsApp → API Setup
-        sensitive: false
-        envDefault: ""
-      - name: accessToken
-        label: Access token
-        description: Permanent system user access token from Meta Business Suite
-        sensitive: true
-        envDefault: OPENCLAW_WHATSAPP_TOKEN
+    plugin:
+      package: "@openclaw/whatsapp"
+      source: npm
+      version: "2026.9.2"
+    # `openclaw channels add --use-env` answers: OpenClaw does not recognize option
+    # "--use-env". There is no non-interactive path for this channel.
+    useEnvSupported: false
+    requiredConfig: [dmPolicy, groupPolicy, mediaMaxMb]
+    defaults:
+      dmPolicy: pairing
+      groupPolicy: allowlist
+      mediaMaxMb: 50
+    # WhatsApp has no top-level credential fields in 2.0 — credentials live under
+    # `accounts.<name>`, with `defaultAccount` selecting one. The wizard cannot collect a
+    # flat token for it, so it is marked unsupported rather than collecting fields that go
+    # nowhere. `phoneNumberId` and `accessToken`, which this entry used to declare, are not
+    # properties of the whatsapp channel at all.
+    wizardSupported: false
+    unsupportedNote: >
+      WhatsApp uses per-account credentials (`channels.whatsapp.accounts.<name>`) rather
+      than a single token. Configure it with `openclaw channels add --channel whatsapp`
+      on the host after deployment.
+    fields: []
     setupUrl: https://developers.facebook.com/apps
 
-  - id: teams
-    channelKey: teams
+  - id: msteams
+    channelKey: msteams
     displayName: Microsoft Teams
     description: Connect OpenClaw agents to a Microsoft Teams channel via bot
     infraRequired: true
     infraNote: >
       After deployment, update the bot's messaging endpoint in Azure Bot Service
       to the gateway webhook URL.
+    plugin:
+      package: "@openclaw/msteams"
+      source: npm
+      version: "2026.9.2"
+    # Same as WhatsApp: --use-env is rejected outright.
+    useEnvSupported: false
+    requiredConfig: [dmPolicy, groupPolicy]
+    defaults:
+      dmPolicy: pairing
+      groupPolicy: allowlist
     fields:
       - name: appId
         label: App (client) ID
@@ -93,5 +195,10 @@ integrations:
         label: App password
         description: Client secret from the Azure app registration
         sensitive: true
-        envDefault: OPENCLAW_TEAMS_APP_PASSWORD
+        envDefault: ""   # no --use-env path; collected interactively on the host
+      - name: tenantId
+        label: Directory (tenant) ID
+        description: Azure AD tenant ID for the app registration
+        sensitive: false
+        envDefault: ""
     setupUrl: https://portal.azure.com/