@clawops/cli 1.7.9 → 2.0.1

package/dist/passphrase-MJBE45N7.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  PASSPHRASE_FILE,
+  ensurePassphrase,
+  passphraseInEnvironment,
+  passphrasePath,
+  passphraseStatus
+} from "./chunk-V25QRZRB.js";
+export {
+  PASSPHRASE_FILE,
+  ensurePassphrase,
+  passphraseInEnvironment,
+  passphrasePath,
+  passphraseStatus
+};

package/dist/plugins-DTST3OER.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+// src/openclaw/plugins.ts
+function providerIdOf(p) {
+  return p.configPath?.split(".").pop() ?? p.id;
+}
+function requiredPlugins(cfg, catalog) {
+  if (cfg === null || typeof cfg !== "object") return [];
+  const models = cfg["models"];
+  if (models === null || typeof models !== "object") return [];
+  const providers = models["providers"];
+  if (providers === null || typeof providers !== "object") return [];
+  const configured = new Set(Object.keys(providers));
+  const out = [];
+  for (const entry of catalog.providers) {
+    if (!entry.plugin) continue;
+    const id = providerIdOf(entry);
+    if (configured.has(id)) {
+      out.push({ providerId: id, package: entry.plugin.package, version: entry.plugin.version });
+    }
+  }
+  return out;
+}
+function installCommand(plugin, image, stateDir) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw plugins install 'clawhub:${plugin.package}@${plugin.version}' --accept-capabilities`;
+}
+function missingProviders(cfg, pluginsListJson) {
+  let loaded = /* @__PURE__ */ new Set();
+  try {
+    const parsed = JSON.parse(pluginsListJson);
+    const list = Array.isArray(parsed) ? parsed : parsed.plugins ?? [];
+    loaded = new Set(
+      list.filter((p) => p.enabled !== false && p.status !== "error").flatMap((p) => p.providerIds ?? [])
+    );
+  } catch {
+    return [];
+  }
+  if (cfg === null || typeof cfg !== "object") return [];
+  const models = cfg["models"];
+  if (models === null || typeof models !== "object") return [];
+  const providers = models["providers"];
+  if (providers === null || typeof providers !== "object") return [];
+  return Object.keys(providers).filter((id) => !loaded.has(id));
+}
+export {
+  installCommand,
+  missingProviders,
+  requiredPlugins
+};

package/dist/{pool-QGFQRMGU.js → pool-PIIKJ4L2.js}

@@ -2,8 +2,9 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-DQDAWNGB.js";
-import "./chunk-3XK66DKK.js";
+} from "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
 import "./chunk-KGXPLI7W.js";
 export {
   acquireSession,

package/dist/preflight-EF52S3WW.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+
+// src/providers/gcp/preflight.ts
+import process from "process";
+import path from "path";
+import { readFileSync } from "fs";
+var REQUIRED_APIS = [
+  { service: "compute.googleapis.com", why: "Instance, Network, Subnetwork, Firewall, Address" },
+  { service: "storage.googleapis.com", why: "the GCS state backend" }
+];
+async function accessToken() {
+  try {
+    const { GoogleAuth } = await import("google-auth-library");
+    const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });
+    const client = await auth.getClient();
+    const token = await client.getAccessToken();
+    return typeof token === "string" ? token : token.token ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveProjectId() {
+  return process.env["GOOGLE_PROJECT"] ?? process.env["GOOGLE_CLOUD_PROJECT"] ?? process.env["GCLOUD_PROJECT"] ?? process.env["CLOUDSDK_CORE_PROJECT"] ?? gcloudConfiguredProject() ?? void 0;
+}
+function gcloudConfiguredProject() {
+  try {
+    const home = process.env["HOME"] ?? process.env["USERPROFILE"];
+    const dir = process.env["CLOUDSDK_CONFIG"] ?? (home ? path.join(home, ".config", "gcloud") : void 0);
+    if (!dir) return void 0;
+    const active = process.env["CLOUDSDK_ACTIVE_CONFIG_NAME"] ?? readFileSync(path.join(dir, "active_config"), "utf-8").trim() ?? "default";
+    if (!active) return void 0;
+    const ini = readFileSync(path.join(dir, "configurations", `config_${active}`), "utf-8");
+    return projectFromIni(ini);
+  } catch {
+    return void 0;
+  }
+}
+function projectFromIni(ini) {
+  let section = "";
+  for (const line of ini.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    const header = /^\[(.+)\]$/.exec(trimmed);
+    if (header) {
+      section = header[1]?.trim() ?? "";
+      continue;
+    }
+    if (section !== "core") continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    if (trimmed.slice(0, eq).trim() !== "project") continue;
+    const value = trimmed.slice(eq + 1).trim();
+    return value === "" ? void 0 : value;
+  }
+  return void 0;
+}
+async function gcpPreflight(opts = {}) {
+  const checks = [];
+  const project = resolveProjectId();
+  checks.push({
+    id: "project-resolved",
+    label: "GCP project is set",
+    ok: Boolean(project),
+    detail: project ? `Deploying into ${project}` : "No project resolved. Run `gcloud config set project <id>`, or set GOOGLE_PROJECT."
+  });
+  if (!project) return checks;
+  const token = await accessToken();
+  if (!token) {
+    checks.push({
+      id: "adc-usable",
+      label: "Application Default Credentials resolve",
+      ok: false,
+      detail: "Could not obtain a token from ADC. Run `gcloud auth application-default login` \u2014 `gcloud auth login` alone authenticates the CLI and leaves ADC unset."
+    });
+    return checks;
+  }
+  const enabled = await enabledServices(project, token, opts.signal);
+  for (const api of REQUIRED_APIS) {
+    const on = enabled?.has(api.service) ?? false;
+    checks.push({
+      id: `api-${api.service.split(".")[0]}`,
+      label: `${api.service} enabled`,
+      ok: on,
+      detail: on ? void 0 : `Needed for ${api.why}. Nothing can be provisioned without it.`,
+      mutates: on ? void 0 : `Enables ${api.service} on project ${project}`,
+      fix: on ? void 0 : async () => {
+        await enableService(project, api.service, token);
+      }
+    });
+  }
+  if (opts.bucket) {
+    const exists = await bucketExists(opts.bucket, token, opts.signal);
+    checks.push({
+      id: "state-bucket",
+      label: `State bucket gs://${opts.bucket} exists`,
+      ok: exists,
+      detail: exists ? void 0 : "Pulumi needs its state backend before it can run, so clawops cannot create this as part of a deploy.",
+      mutates: exists ? void 0 : `Creates bucket gs://${opts.bucket} in project ${project}${opts.region ? ` (${opts.region})` : ""}, with versioning on`,
+      fix: exists ? void 0 : async () => {
+        await createBucket(opts.bucket, project, token, opts.region);
+      }
+    });
+  }
+  return checks;
+}
+async function enabledServices(project, token, signal) {
+  try {
+    const out = /* @__PURE__ */ new Set();
+    let pageToken;
+    do {
+      const url = `https://serviceusage.googleapis.com/v1/projects/${project}/services?filter=state:ENABLED&pageSize=200${pageToken ? `&pageToken=${pageToken}` : ""}`;
+      const res = await fetch(url, { headers: { authorization: `Bearer ${token}` }, signal });
+      if (!res.ok) return void 0;
+      const body = await res.json();
+      for (const s of body.services ?? []) if (s.config?.name) out.add(s.config.name);
+      pageToken = body.nextPageToken;
+    } while (pageToken);
+    return out;
+  } catch {
+    return void 0;
+  }
+}
+async function enableService(project, service, token) {
+  const res = await fetch(
+    `https://serviceusage.googleapis.com/v1/projects/${project}/services/${service}:enable`,
+    { method: "POST", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new Error(`Could not enable ${service}: ${res.status} ${await res.text()}`);
+  }
+}
+async function bucketExists(bucket, token, signal) {
+  const res = await fetch(`https://storage.googleapis.com/storage/v1/b/${bucket}`, {
+    headers: { authorization: `Bearer ${token}` },
+    signal
+  });
+  return res.ok;
+}
+async function createBucket(bucket, project, token, region) {
+  const res = await fetch(
+    `https://storage.googleapis.com/storage/v1/b?project=${project}`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        name: bucket,
+        location: (region ?? "US").toUpperCase(),
+        // Versioning on, because this holds Pulumi state: a corrupted or truncated write
+        // with no history is a stack that can no longer be updated or destroyed.
+        versioning: { enabled: true },
+        iamConfiguration: { uniformBucketLevelAccess: { enabled: true } }
+      })
+    }
+  );
+  if (!res.ok) throw new Error(`Could not create gs://${bucket}: ${res.status} ${await res.text()}`);
+}
+export {
+  gcloudConfiguredProject,
+  gcpPreflight,
+  projectFromIni,
+  resolveProjectId
+};

package/dist/preflight-MWWM5JT3.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_ALIAS,
+  INSTANCE_TYPE_MAP
+} from "./chunk-FEK7VJAY.js";
+import {
+  resolveSubscriptionId
+} from "./chunk-RHOWYIWT.js";
+
+// src/providers/azure/preflight.ts
+import process from "process";
+import { spawnSync } from "child_process";
+var ARM = "https://management.azure.com";
+var API_VERSION = "2021-04-01";
+var REQUIRED_PROVIDERS = [
+  { namespace: "Microsoft.Compute", why: "the virtual machine and its disk" },
+  { namespace: "Microsoft.Network", why: "the virtual network, NSG, public IP and NIC" },
+  { namespace: "Microsoft.Storage", why: "the azblob state backend" }
+];
+async function managementToken(signal) {
+  const tenantId = process.env["AZURE_TENANT_ID"];
+  const clientId = process.env["AZURE_CLIENT_ID"];
+  const clientSecret = process.env["AZURE_CLIENT_SECRET"];
+  if (tenantId && clientId && clientSecret) {
+    try {
+      const res = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "client_credentials",
+          client_id: clientId,
+          client_secret: clientSecret,
+          scope: `${ARM}/.default`
+        }),
+        signal: signal ?? AbortSignal.timeout(1e4)
+      });
+      if (!res.ok) return void 0;
+      const body = await res.json();
+      return typeof body.access_token === "string" ? body.access_token : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  const result = spawnSync(
+    "az",
+    ["account", "get-access-token", "--resource", ARM, "--query", "accessToken", "-o", "tsv"],
+    { encoding: "utf-8", timeout: 2e4 }
+  );
+  if (result.status !== 0) return void 0;
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function registrationState(subscriptionId, namespace, token, signal) {
+  try {
+    const res = await fetch(
+      `${ARM}/subscriptions/${subscriptionId}/providers/${namespace}?api-version=${API_VERSION}`,
+      { headers: { authorization: `Bearer ${token}` }, signal }
+    );
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return typeof body.registrationState === "string" ? body.registrationState : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function register(subscriptionId, namespace, token, signal) {
+  const res = await fetch(
+    `${ARM}/subscriptions/${subscriptionId}/providers/${namespace}/register?api-version=${API_VERSION}`,
+    { method: "POST", headers: { authorization: `Bearer ${token}` }, signal }
+  );
+  if (!res.ok) {
+    throw new Error(`Could not register ${namespace}: HTTP ${res.status} ${await res.text()}`);
+  }
+}
+async function availableSizes(subscriptionId, location, token, signal) {
+  try {
+    const url = `${ARM}/subscriptions/${subscriptionId}/providers/Microsoft.Compute/skus?api-version=2021-07-01&$filter=${encodeURIComponent(`location eq '${location}'`)}`;
+    const res = await fetch(url, { headers: { authorization: `Bearer ${token}` }, signal });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    if (!Array.isArray(body.value)) return void 0;
+    return new Set(
+      body.value.filter((s) => s.resourceType === "virtualMachines").filter((s) => !Array.isArray(s.restrictions) || s.restrictions.length === 0).map((s) => s.name)
+    );
+  } catch {
+    return void 0;
+  }
+}
+function sizeCheck(location, available, requested = INSTANCE_TYPE_MAP[DEFAULT_ALIAS]) {
+  if (!available) {
+    return {
+      id: "vm-size-available",
+      label: `${requested} is available in ${location}`,
+      ok: false,
+      unknown: true,
+      detail: `clawops could not list the VM sizes this subscription is offered in ${location}. This says nothing about ${requested} \u2014 the usual cause is credentials without permission to read Microsoft.Compute/skus. A deploy can still succeed.`
+    };
+  }
+  if (available.has(requested)) {
+    return {
+      id: "vm-size-available",
+      label: `${requested} is available in ${location}`,
+      ok: true
+    };
+  }
+  const alternatives = [...available].filter((n) => /^Standard_[A-Z]*[0-9]+[a-z]*(_v\d+)?$/.test(n)).filter((n) => /[^0-9]2[a-z]*(_v\d+)?$/.test(n)).sort().slice(0, 4);
+  return {
+    id: "vm-size-available",
+    label: `${requested} is available in ${location}`,
+    ok: false,
+    detail: `${requested} is not offered to this subscription in ${location}, so a deploy fails after the network, NSG, public IP and NIC have been created. ` + (alternatives.length > 0 ? `Available instead: ${alternatives.join(", ")} \u2014 pass one with \`clawops plan --instance-type <size>\`.` : "Try another region.")
+  };
+}
+async function azurePreflight(opts = {}) {
+  const checks = [];
+  const subscriptionId = resolveSubscriptionId();
+  checks.push({
+    id: "subscription-resolved",
+    label: "Azure subscription is set",
+    ok: Boolean(subscriptionId),
+    detail: subscriptionId ? `Deploying into ${subscriptionId}` : "No subscription resolved. Run `az login`, or set ARM_SUBSCRIPTION_ID."
+  });
+  if (!subscriptionId) return checks;
+  checks.push(stateBackendCheck(opts.bucket));
+  const token = await managementToken(opts.signal);
+  if (!token) {
+    checks.push({
+      id: "management-token",
+      label: "Azure management API reachable",
+      ok: false,
+      detail: "Could not get a management token, so the resource providers and VM sizes below were not checked. Run `az login`, or set AZURE_TENANT_ID + AZURE_CLIENT_ID + AZURE_CLIENT_SECRET for a service principal."
+    });
+    return checks;
+  }
+  if (opts.region) {
+    checks.push(
+      sizeCheck(
+        opts.region,
+        await availableSizes(subscriptionId, opts.region, token, opts.signal),
+        opts.instanceType
+      )
+    );
+  }
+  for (const provider of REQUIRED_PROVIDERS) {
+    const state = await registrationState(subscriptionId, provider.namespace, token, opts.signal);
+    const registered = state === "Registered";
+    checks.push({
+      id: `rp-${provider.namespace.split(".")[1]?.toLowerCase()}`,
+      label: `${provider.namespace} registered`,
+      ok: registered,
+      detail: registered ? void 0 : `${state ?? "unknown"} \u2014 needed for ${provider.why}. Nothing can be provisioned without it, and registration takes a couple of minutes.`,
+      ...registered ? {} : {
+        mutates: `Registers the ${provider.namespace} resource provider on subscription ${subscriptionId}`,
+        fix: () => register(subscriptionId, provider.namespace, token, opts.signal)
+      }
+    });
+  }
+  return checks;
+}
+function stateBackendCheck(container) {
+  const account = process.env["AZURE_STORAGE_ACCOUNT"];
+  const hasSecret = Boolean(
+    process.env["AZURE_STORAGE_KEY"] ?? process.env["AZURE_STORAGE_SAS_TOKEN"]
+  );
+  const ok = Boolean(account) && hasSecret;
+  const where = container ? `azblob://${container}` : "the azblob state backend";
+  return {
+    id: "state-backend-credentials",
+    label: "azblob state backend is configured",
+    ok,
+    detail: ok ? `${where} on storage account ${account}` : `${where} needs AZURE_STORAGE_ACCOUNT and one of AZURE_STORAGE_KEY or AZURE_STORAGE_SAS_TOKEN. Pulumi authenticates to blob storage with these and not with your \`az login\`, so every other check here can pass and the deploy still fail to open its own state.`
+  };
+}
+export {
+  REQUIRED_PROVIDERS,
+  availableSizes,
+  azurePreflight,
+  managementToken,
+  sizeCheck,
+  stateBackendCheck
+};

package/dist/preflight-TFD4N5ZU.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_ALIAS,
+  INSTANCE_TYPE_MAP
+} from "./chunk-N4WZLWJ4.js";
+
+// src/providers/aws/preflight.ts
+import process from "process";
+async function callerAccount(signal) {
+  try {
+    const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+    const client = new STSClient({});
+    const result = await client.send(new GetCallerIdentityCommand({}), { abortSignal: signal });
+    return result.Account ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function bucketExists(bucket, signal) {
+  try {
+    const { S3Client, HeadBucketCommand } = await import("@aws-sdk/client-s3");
+    const client = new S3Client({});
+    await client.send(new HeadBucketCommand({ Bucket: bucket }), { abortSignal: signal });
+    return { ok: true };
+  } catch (err) {
+    const status = err.$metadata?.httpStatusCode;
+    const detail = err instanceof Error ? err.message : String(err);
+    if (status === 404) return { ok: false, reason: "missing", detail };
+    if (status === 403) return { ok: false, reason: "denied", detail };
+    return { ok: false, reason: "unknown", detail };
+  }
+}
+async function createBucket(bucket, region, signal) {
+  const {
+    S3Client,
+    CreateBucketCommand,
+    PutBucketVersioningCommand,
+    PutPublicAccessBlockCommand
+  } = await import("@aws-sdk/client-s3");
+  const client = new S3Client({ region });
+  await client.send(
+    new CreateBucketCommand({
+      Bucket: bucket,
+      // us-east-1 is the one region that rejects an explicit LocationConstraint.
+      ...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
+    }),
+    { abortSignal: signal }
+  );
+  await client.send(
+    new PutBucketVersioningCommand({
+      Bucket: bucket,
+      VersioningConfiguration: { Status: "Enabled" }
+    }),
+    { abortSignal: signal }
+  );
+  await client.send(
+    new PutPublicAccessBlockCommand({
+      Bucket: bucket,
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        IgnorePublicAcls: true,
+        BlockPublicPolicy: true,
+        RestrictPublicBuckets: true
+      }
+    }),
+    { abortSignal: signal }
+  );
+}
+async function instanceTypeOffered(instanceType, region, signal) {
+  try {
+    const { EC2Client, DescribeInstanceTypeOfferingsCommand } = await import("@aws-sdk/client-ec2");
+    const client = new EC2Client({ region });
+    const result = await client.send(
+      new DescribeInstanceTypeOfferingsCommand({
+        LocationType: "region",
+        Filters: [
+          { Name: "instance-type", Values: [instanceType] },
+          { Name: "location", Values: [region] }
+        ]
+      }),
+      { abortSignal: signal }
+    );
+    return { offered: (result.InstanceTypeOfferings?.length ?? 0) > 0 };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function awsPreflight(opts = {}) {
+  const checks = [];
+  const region = opts.region ?? process.env["AWS_REGION"] ?? "us-east-1";
+  const account = await callerAccount(opts.signal);
+  checks.push({
+    id: "account-resolved",
+    label: "AWS credentials resolve to an account",
+    ok: Boolean(account),
+    detail: account ? `Deploying into ${account} (${region})` : "No account resolved. Set AWS_PROFILE, or run `aws sso login --profile <name>`."
+  });
+  if (!account) return checks;
+  if (opts.bucket) {
+    const bucket = opts.bucket;
+    const result = await bucketExists(bucket, opts.signal);
+    checks.push(
+      result.ok ? { id: "state-bucket", label: `State bucket s3://${bucket} exists`, ok: true } : {
+        id: "state-bucket",
+        label: `State bucket s3://${bucket} exists`,
+        ok: false,
+        detail: result.reason === "denied" ? `s3://${bucket} exists but these credentials cannot read it, or the name belongs to another account. Bucket names are global.` : "Pulumi needs its state backend before it can run, so clawops cannot create this as part of a deploy.",
+        // Only offer to create what is genuinely absent: a 403 means the name is taken or
+        // the permission is missing, and creating it would fail either way.
+        ...result.reason === "missing" ? {
+          mutates: `Creates bucket s3://${bucket} in ${region}, with versioning on and public access blocked`,
+          fix: () => createBucket(bucket, region, opts.signal)
+        } : {}
+      }
+    );
+  }
+  const instanceType = opts.instanceType ?? INSTANCE_TYPE_MAP[DEFAULT_ALIAS];
+  const offering = await instanceTypeOffered(instanceType, region, opts.signal);
+  checks.push(
+    "error" in offering ? {
+      id: "instance-type-offered",
+      label: `${instanceType} is offered in ${region}`,
+      ok: false,
+      unknown: true,
+      detail: `clawops could not ask EC2 whether ${instanceType} is offered in ${region}: ${offering.error}. This says nothing about the instance type \u2014 the usual cause is credentials without ec2:DescribeInstanceTypeOfferings, which nothing else needs. A deploy can still succeed.`
+    } : {
+      id: "instance-type-offered",
+      label: `${instanceType} is offered in ${region}`,
+      ok: offering.offered,
+      detail: offering.offered ? void 0 : `${instanceType} is not offered in ${region}, so a deploy fails after the VPC, subnet, security group and address have been created. Pick another region, or pass --instance-type with a type this region has.`
+    }
+  );
+  return checks;
+}
+export {
+  awsPreflight,
+  bucketExists,
+  callerAccount,
+  createBucket,
+  instanceTypeOffered
+};

package/dist/privileged-JFA6LLTV.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import {
+  execPrivileged,
+  execPrivilegedWithInput,
+  resetPrivilegeCache,
+  shellQuote,
+  streamPrivileged,
+  sudoWrap
+} from "./chunk-NUDIHZEH.js";
+export {
+  execPrivileged,
+  execPrivilegedWithInput,
+  resetPrivilegeCache,
+  shellQuote,
+  streamPrivileged,
+  sudoWrap
+};

package/dist/providers-FW6H6OPF.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  getProvider,
+  listProviders,
+  registerProvider
+} from "./chunk-VUFMZEIM.js";
+export {
+  getProvider,
+  listProviders,
+  registerProvider
+};

package/dist/ready-KDNRBNSU.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import {
+  containerStatus,
+  looksLikeStillBooting
+} from "./chunk-3OLUJPCB.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import {
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/ready.ts
+async function bootstrapTail(session, lines = 12, signal) {
+  const command = `(tail -n ${lines} /var/log/cloud-init-output.log 2>/dev/null || journalctl -u google-startup-scripts --no-pager 2>/dev/null | tail -n ${lines}) | tail -n ${lines}`;
+  try {
+    const result = await execPrivileged(session, command, signal);
+    const text = result.stdout.trim();
+    return text === "" ? void 0 : text;
+  } catch {
+    return void 0;
+  }
+}
+async function waitForGateway(session, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e5;
+  const intervalMs = opts.intervalMs ?? 1e4;
+  const port = opts.port ?? GATEWAY_PORT;
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const started = now();
+  const deadline = started + timeoutMs;
+  let lastContainerStatus = "unknown";
+  let lastReason = "not probed yet";
+  let announcedAt = 0;
+  for (; ; ) {
+    if (opts.signal?.aborted) throw new Error("Waiting for the gateway was aborted");
+    const container = await containerStatus(session, "openclaw", opts.signal);
+    lastContainerStatus = container.status;
+    if (container.error) {
+      if (!looksLikeStillBooting(container.error)) {
+        throw new Error(
+          `Could not ask the host about the openclaw container: ${container.error}. This is not the container being absent \u2014 clawops was unable to look.`
+        );
+      }
+      lastContainerStatus = "docker not installed yet";
+    }
+    if (lastContainerStatus === "running") {
+      const probe = await session.exec(probeCommand("started", port), opts.signal);
+      const verdict = interpretProbe("started", probe.stdout);
+      if (verdict.ok) return { waitedMs: now() - started, lastContainerStatus };
+      lastReason = verdict.reason ?? "the gateway did not report itself started";
+    } else {
+      lastReason = container.error ? `docker could not be asked yet: ${container.error}` : `the container is ${lastContainerStatus}`;
+    }
+    const elapsed = now() - started;
+    if (elapsed - announcedAt >= 3e4 || announcedAt === 0) {
+      announcedAt = elapsed;
+      opts.onProgress?.(
+        `Waiting for OpenClaw to start \u2014 ${lastReason}. A first deploy pulls a ~3GB image (${Math.round(elapsed / 1e3)}s so far).`
+      );
+    }
+    if (now() + intervalMs >= deadline) {
+      const tail = await bootstrapTail(session, 12, opts.signal);
+      throw new Error(
+        `The OpenClaw gateway did not answer within ${Math.round(timeoutMs / 1e3)}s. Container: ${lastContainerStatus}. Last check: ${lastReason}.` + (tail ? `
+
+The last of the host's bootstrap log:
+${tail}` : " The instance is up \u2014 `clawops logs --stack <name>` shows what it is doing.")
+      );
+    }
+    await sleep(intervalMs, opts.signal);
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("Waiting for the gateway was aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+export {
+  bootstrapTail,
+  waitForGateway
+};