@clawops/cli 1.7.9 → 2.0.1

package/dist/{remote-config-QDLN4UMG.js → remote-config-3HZLUWEA.js}

@@ -6,10 +6,12 @@ import {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
-  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
-} from "./chunk-SEZMVVAS.js";
+} from "./chunk-2I7KCMXZ.js";
+import "./chunk-NUDIHZEH.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 export {
   OPENCLAW_CONFIG,
@@ -18,7 +20,6 @@ export {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
-  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
 };

package/dist/runtime-X3KW5TCP.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import {
+  ADD_HOST_FLAG,
+  CONFIG_FILENAME,
+  CONFIG_MOUNT_PATH,
+  CONTAINER_UID,
+  ENV_FILE_PATH,
+  PUBLISH_INSPECT_CMD,
+  SECURITY_FLAGS,
+  STATE_DIR_CONTAINER,
+  STATE_DIR_HOST_LINUX,
+  STATE_DIR_HOST_MACOS,
+  SUPERVISOR_ENV,
+  configPathForOS,
+  gatewayRunArgs,
+  gatewayRunCommand,
+  publishForRestart,
+  publishedGatewayPort,
+  stateDirForOS
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+export {
+  ADD_HOST_FLAG,
+  CONFIG_FILENAME,
+  CONFIG_MOUNT_PATH,
+  CONTAINER_UID,
+  ENV_FILE_PATH,
+  GATEWAY_PORT,
+  PUBLISH_INSPECT_CMD,
+  SECURITY_FLAGS,
+  STATE_DIR_CONTAINER,
+  STATE_DIR_HOST_LINUX,
+  STATE_DIR_HOST_MACOS,
+  SUPERVISOR_ENV,
+  configPathForOS,
+  gatewayRunArgs,
+  gatewayRunCommand,
+  publishForRestart,
+  publishedGatewayPort,
+  stateDirForOS
+};

package/dist/server-GBA7BJGK.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+} from "./chunk-KC3GC3PE.js";
+import "./chunk-LBE6COC4.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-2I7KCMXZ.js";
+import "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-STLRHLLV.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-5XT5IAJK.js";
+import "./chunk-IVWP4QUJ.js";
+import "./chunk-NUL5F6YV.js";
+import "./chunk-3OLUJPCB.js";
+import "./chunk-NUDIHZEH.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-Q7NQY5HV.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+};

package/dist/spec-path-KQOOIQCA.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  _resetSpecDirCache,
+  resolveSpecDir
+} from "./chunk-JW5A7E3X.js";
+export {
+  _resetSpecDirCache,
+  resolveSpecDir
+};

package/dist/ssh-VAI5DU5M.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  connect,
+  describeConnectError
+} from "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  connect,
+  describeConnectError
+};

package/dist/ssh-key-DUO6OKOI.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import {
+  resolvePublicKey
+} from "./chunk-AEEMRFZV.js";
+export {
+  resolvePublicKey
+};

package/dist/stack-config-R4SPSUQZ.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  writeStackConfig
+} from "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  writeStackConfig
+};

package/dist/upgrade-ULD4KFYC.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+// src/openclaw/upgrade.ts
+function judgePreflight(report) {
+  const { targetVersion, foundVersion, status, reason } = report;
+  if (status === "indeterminate") {
+    return {
+      ok: false,
+      reason: reason ?? "the database schema could not be determined, so compatibility with the target release is unknown"
+    };
+  }
+  if (typeof foundVersion === "number" && typeof targetVersion === "number") {
+    if (foundVersion > targetVersion) {
+      return {
+        ok: false,
+        reason: `the state database is at schema ${foundVersion}, but the target release understands ${targetVersion}. This is a downgrade across a schema boundary: the older release would read a database written by a newer one. Restore a backup taken before the upgrade instead.`
+      };
+    }
+    if (foundVersion < targetVersion) {
+      return { ok: true, note: `state will migrate from schema ${foundVersion} to ${targetVersion}` };
+    }
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    reason: reason ?? `preflight returned no schema version (status: ${status ?? "unknown"})`
+  };
+}
+function parsePreflight(stdout) {
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    if (parsed !== null && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return void 0;
+}
+function snapshotCommand(image, stateDir, repo) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw backup sqlite create --global --repository ${repo} --json`;
+}
+function preflightCommand(targetImage, stateDir, snapshotDb) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${targetImage} openclaw database preflight ${snapshotDb} --json`;
+}
+function snapshotPathFrom(stdout) {
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    if (parsed.ok === true && typeof parsed.snapshotPath === "string") return parsed.snapshotPath;
+  } catch {
+  }
+  return void 0;
+}
+function repairCommand(image, stateDir) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw doctor --fix --non-interactive --yes`;
+}
+function describeOutcome(o, version) {
+  switch (o.kind) {
+    case "started":
+      return `Gateway updated to ${version}.`;
+    case "repaired":
+      return `Gateway updated to ${version} after a one-shot repair (doctor --fix).`;
+    case "rolled-back":
+      return `Rolled back to ${o.to}: the gateway did not start on ${version} \u2014 ${o.reason}. The previous image is running again. If it also fails, restore the snapshot taken before the upgrade.`;
+    case "failed":
+      return `Upgrade to ${version} failed and the rollback did not come up either \u2014 ${o.reason}. The state snapshot taken before the upgrade is at ${o.snapshotPath}; restore it with \`openclaw backup sqlite restore\` before retrying.`;
+  }
+}
+async function resolveUpgrade(steps, ctx) {
+  const first = await steps.gate();
+  if (first.ok) return { kind: "started" };
+  await steps.repair();
+  await steps.run(ctx.version);
+  const second = await steps.gate();
+  if (second.ok) return { kind: "repaired" };
+  const reason = second.reason ?? first.reason ?? "unknown";
+  if (!ctx.previousVersion) return { kind: "failed", reason, snapshotPath: ctx.snapshotPath };
+  await steps.run(ctx.previousVersion);
+  const back = await steps.gate();
+  return back.ok ? { kind: "rolled-back", to: ctx.previousVersion, reason } : { kind: "failed", reason, snapshotPath: ctx.snapshotPath };
+}
+export {
+  describeOutcome,
+  judgePreflight,
+  parsePreflight,
+  preflightCommand,
+  repairCommand,
+  resolveUpgrade,
+  snapshotCommand,
+  snapshotPathFrom
+};

package/dist/validate-YVI3BJ55.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  assertValidPlan,
+  validatePlan,
+  validatePlanConfig,
+  validatePlanNetwork
+} from "./chunk-BSLIYB5Q.js";
+import "./chunk-JW5A7E3X.js";
+export {
+  assertValidPlan,
+  validatePlan,
+  validatePlanConfig,
+  validatePlanNetwork
+};

package/dist/{version-guard-VUCNZXQS.js → version-guard-XVYW5WFJ.js}

@@ -2,9 +2,9 @@
 import {
   assertSupportedVersion,
   loadVersionSpec
-} from "./chunk-UKTP332Z.js";
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";

package/dist/{versions-2UVAT6PQ.js → versions-W5LRQCAJ.js}

@@ -9,9 +9,9 @@ import {
   isMovingTag,
   loadVersionSpec,
   resolveVersion
-} from "./chunk-UKTP332Z.js";
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
 export {
   MOVING_TAGS,
   _resetVersionSpecCache,

package/dist/wait-WO72TRRQ.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import {
+  connect
+} from "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import {
+  NetworkError
+} from "./chunk-KGXPLI7W.js";
+
+// src/transport/wait.ts
+var TRANSIENT = [
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ECONNRESET",
+  "EPIPE",
+  "ENOTFOUND",
+  "Timed out while waiting for handshake",
+  "Connection closed by server",
+  "Connection lost before handshake",
+  "All configured authentication methods failed"
+];
+function isTransient(message) {
+  return TRANSIENT.some((t) => message.includes(t));
+}
+async function waitForSsh(conn, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 3e5;
+  const intervalMs = opts.intervalMs ?? 5e3;
+  const connect2 = opts.connect ?? connect;
+  const sleep = opts.sleep ?? defaultSleep;
+  const deadline = Date.now() + timeoutMs;
+  let attempts = 0;
+  let lastError = "no attempt completed";
+  for (; ; ) {
+    if (opts.signal?.aborted) throw new NetworkError("Waiting for SSH was aborted");
+    attempts++;
+    try {
+      const session = await connect2({ ...conn, signal: opts.signal });
+      if (attempts > 1) opts.onProgress?.(`SSH is up after ${attempts} attempts.`);
+      return session;
+    } catch (err) {
+      lastError = err instanceof Error ? err.message : String(err);
+      if (!isTransient(lastError)) {
+        throw new NetworkError(
+          `SSH to ${conn.host}:${conn.port} failed for a reason waiting will not fix: ${lastError}`
+        );
+      }
+      if (attempts === 1) {
+        opts.onProgress?.(
+          `Waiting for ${conn.host}:${conn.port} to accept SSH \u2014 a new instance takes a minute.`
+        );
+      }
+    }
+    if (Date.now() + intervalMs >= deadline) {
+      throw new NetworkError(
+        `${conn.host}:${conn.port} did not accept SSH within ${Math.round(timeoutMs / 1e3)}s (${attempts} attempts, last error: ${lastError}). The instance may still be booting, or the firewall may not admit this machine \u2014 check \`clawops doctor --stack <name>\`.`
+      );
+    }
+    await sleep(intervalMs, opts.signal);
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new NetworkError("Waiting for SSH was aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+export {
+  isTransient,
+  waitForSsh
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.7.9",
+  "version": "2.0.1",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -32,19 +32,24 @@
     "test": "vitest run",
     "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
     "test:changed": "vitest --changed",
-    "test:mutation": "node scripts/dev/mutation-check.mjs",
     "test:integration": "vitest run --config vitest.integration.config.ts",
+    "test:cloud": "bash scripts/e2e/cloud.sh",
     "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
     "lint": "eslint --max-warnings=0 src tests scripts",
     "gen:schemas": "tsx scripts/gen-schemas.ts",
     "changeset": "changeset",
-    "release": "pnpm build && changeset publish"
+    "release": "pnpm build && changeset publish",
+    "test:mutation": "node scripts/dev/mutation-check.mjs",
+    "graph": "node scripts/dev/graph.mjs"
   },
   "dependencies": {
+    "@aws-sdk/client-bedrock": "^3.1063.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",
     "@aws-sdk/client-ec2": "^3.1063.0",
     "@aws-sdk/client-guardduty": "^3.1063.0",
     "@aws-sdk/client-iam": "^3.1063.0",
+    "@aws-sdk/client-s3": "3.1132.0",
+    "@aws-sdk/client-sts": "3.1132.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@pulumi/aws": "^6.0.0",
     "@pulumi/azure-native": "^2.0.0",
@@ -58,6 +63,7 @@
     "chalk": "^5.0.0",
     "citty": "^0.1.0",
     "conf": "^12.0.0",
+    "google-auth-library": "^11.0.2",
     "inquirer": "^9.0.0",
     "ora": "^8.0.0",
     "ssh2": "^1.0.0",
@@ -82,7 +88,8 @@
   },
   "pnpm": {
     "overrides": {
-      "@pulumi/pulumi": "^3.0.0"
+      "@pulumi/pulumi": "^3.0.0",
+      "@smithy/types": "4.14.3"
     },
     "onlyBuiltDependencies": [
       "@pulumi/command",

package/spec/deploy-plan.schema.json

@@ -4,7 +4,12 @@
   "title": "DeployPlan",
   "description": "The Maker plan artifact (borrowed from Clanker pattern). Generated by `clawops plan`, applied by `clawops apply`. Reviewable, diff-able, version-controllable.",
   "type": "object",
-  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "required": [
+    "apiVersion",
+    "kind",
+    "metadata",
+    "spec"
+  ],
   "properties": {
     "apiVersion": {
       "const": "clawops.dev/v1",
@@ -15,7 +20,10 @@
     },
     "metadata": {
       "type": "object",
-      "required": ["name", "generatedAt"],
+      "required": [
+        "name",
+        "generatedAt"
+      ],
       "properties": {
         "name": {
           "type": "string",
@@ -38,7 +46,9 @@
         },
         "labels": {
           "type": "object",
-          "additionalProperties": { "type": "string" },
+          "additionalProperties": {
+            "type": "string"
+          },
           "description": "User-supplied labels (env=prod, team=platform, etc.)"
         },
         "stackVersion": {
@@ -49,10 +59,21 @@
     },
     "spec": {
       "type": "object",
-      "required": ["provider", "stackName", "instanceType", "openclaw", "network"],
+      "required": [
+        "provider",
+        "stackName",
+        "instanceType",
+        "openclaw",
+        "network"
+      ],
       "properties": {
         "provider": {
-          "enum": ["aws", "gcp", "azure", "local"]
+          "enum": [
+            "aws",
+            "gcp",
+            "azure",
+            "local"
+          ]
         },
         "region": {
           "type": "string",
@@ -68,7 +89,9 @@
         },
         "openclaw": {
           "type": "object",
-          "required": ["version"],
+          "required": [
+            "version"
+          ],
           "properties": {
             "version": {
               "type": "string",
@@ -81,7 +104,9 @@
             "channels": {
               "type": "object",
               "description": "OpenClaw channel integrations keyed by provider name (e.g. {\"discord\":{\"botToken\":\"...\"}}). Values are provider-specific config objects. Sensitive fields must use $secret references.",
-              "additionalProperties": { "type": "object" }
+              "additionalProperties": {
+                "type": "object"
+              }
             }
           }
         },
@@ -90,11 +115,23 @@
           "description": "Secret references (R6: never inline values)",
           "items": {
             "type": "object",
-            "required": ["name", "source"],
+            "required": [
+              "name",
+              "source"
+            ],
             "properties": {
-              "name": { "type": "string" },
+              "name": {
+                "type": "string"
+              },
               "source": {
-                "enum": ["env", "aws-sm", "aws-ssm", "gcp-sm", "azure-kv", "file"]
+                "enum": [
+                  "env",
+                  "aws-sm",
+                  "aws-ssm",
+                  "gcp-sm",
+                  "azure-kv",
+                  "file"
+                ]
               },
               "ref": {
                 "type": "string",
@@ -105,26 +142,56 @@
         },
         "network": {
           "type": "object",
-          "required": ["allowedSshCidrs", "allowedGatewayCidrs"],
+          "required": [
+            "allowedSshCidrs",
+            "allowedGatewayCidrs"
+          ],
           "properties": {
             "allowedSshCidrs": {
               "type": "array",
-              "items": { "type": "string", "format": "cidr" },
+              "items": {
+                "type": "string",
+                "format": "cidr"
+              },
               "minItems": 0,
               "description": "Empty array = no SSH access (unusual but allowed). Defaults applied at plan generation, not in schema"
             },
             "allowedGatewayCidrs": {
               "type": "array",
-              "items": { "type": "string", "format": "cidr" },
-              "description": "CIDRs allowed to reach the OpenClaw gateway port (default 18789)"
+              "items": {
+                "type": "string",
+                "format": "cidr"
+              },
+              "description": "CIDRs allowed to reach the gateway port. Only meaningful with publishGateway \"all\" — under \"loopback\" nothing listens on a routable interface, so these rules would admit traffic to a closed port. clawops refuses that combination rather than creating rules that do nothing."
+            },
+            "gatewayPort": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535,
+              "default": 18789,
+              "description": "Host port the gateway is published on. Carried in the plan so the firewall rules, the container publish flag, the startup config and the gateway URL all come from one place; it used to be a constant redeclared in six files, which made a port change a six-file edit that could half-apply."
             },
             "tailscale": {
               "type": "object",
               "description": "Optional Tailscale sidecar (borrowed pattern from schmitthub)",
               "properties": {
-                "enabled": { "type": "boolean" },
-                "authKeyRef": { "type": "string", "description": "Reference to a secret containing the Tailscale auth key" }
+                "enabled": {
+                  "type": "boolean"
+                },
+                "authKeyRef": {
+                  "type": "string",
+                  "description": "Reference to a secret containing the Tailscale auth key"
+                }
               }
+            },
+            "publishGateway": {
+              "type": "string",
+              "enum": [
+                "loopback",
+                "all"
+              ],
+              "default": "loopback",
+              "description": "Which interface the gateway container publishes on. \"loopback\" (default) binds 127.0.0.1 on the host, so the gateway is reachable only via `clawops tunnel` or a reverse proxy running on that host. \"all\" binds 0.0.0.0. Deliberately separate from allowedGatewayCidrs: a firewall rule says who may connect, this says whether the port is listening at all, and exposure should be an explicit choice rather than inherited from a CIDR chosen for SSH. \"all\" serves plaintext HTTP unless you front it with TLS."
             }
           }
         },
@@ -135,12 +202,17 @@
               "type": "string",
               "description": "Public key contents (safe to inline). Private key never in plan"
             },
-            "user": { "type": "string", "default": "ubuntu" }
+            "user": {
+              "type": "string",
+              "default": "ubuntu"
+            }
           }
         },
         "tags": {
           "type": "object",
-          "additionalProperties": { "type": "string" },
+          "additionalProperties": {
+            "type": "string"
+          },
           "description": "Cloud-resource tags propagated to all created resources"
         }
       }
@@ -151,15 +223,23 @@
       "properties": {
         "create": {
           "type": "array",
-          "items": { "$ref": "#/$defs/ResourceRef" }
+          "items": {
+            "$ref": "#/$defs/ResourceRef"
+          }
         },
         "update": {
           "type": "array",
           "items": {
             "type": "object",
-            "required": ["resource", "before", "after"],
+            "required": [
+              "resource",
+              "before",
+              "after"
+            ],
             "properties": {
-              "resource": { "$ref": "#/$defs/ResourceRef" },
+              "resource": {
+                "$ref": "#/$defs/ResourceRef"
+              },
               "before": {},
               "after": {}
             }
@@ -167,16 +247,23 @@
         },
         "delete": {
           "type": "array",
-          "items": { "$ref": "#/$defs/ResourceRef" }
+          "items": {
+            "$ref": "#/$defs/ResourceRef"
+          }
         },
-        "totalChanges": { "type": "integer" }
+        "totalChanges": {
+          "type": "integer"
+        }
       }
     }
   },
   "$defs": {
     "ResourceRef": {
       "type": "object",
-      "required": ["urn", "type"],
+      "required": [
+        "urn",
+        "type"
+      ],
       "properties": {
         "urn": {
           "type": "string",
@@ -186,7 +273,9 @@
           "type": "string",
           "description": "Pulumi resource type token"
         },
-        "name": { "type": "string" }
+        "name": {
+          "type": "string"
+        }
       }
     }
   }